Implementation of SASLprep for SCRAM-SHA-256
Hi all,
Here is another thread for an issue related to SCRAM
(/messages/by-id/243d8c11-6149-a4bb-0909-136992f74b23@iki.fi),
that can be discussed independently: SASLprep.
RFC5802 (https://tools.ietf.org/html/rfc5802) regarding the
implementation of SCRAM, needs to have passwords normalized as per
RFC4013 (https://tools.ietf.org/html/rfc4013) using SASLprep, which is
actually NFKC. I have previously described what happens in this case
here:
/messages/by-id/CAB7nPqScgwh6Eu4=c-0L7-cufZrU5rULTSdpMOOWiz1YFvGE6w@mail.gmail.com
This way, we can be sure that two UTf-8 strings are considered as
equivalent in a SASL exchange, in our case we care about the password
string (we should care about the username as well). Without SASLprep,
our implementation of SCRAM may fail with other third-part tools if
passwords are not made only of ASCII characters. And that sucks.
To put in short words, NFKC is made of two steps: a canonical
decomposition of the UTF-8 string (decomposition of the string
following by a reordering using the class of each character), followed
by its recomposition.
Postgres does not have any logic on the frontend-side related to
encoding, still it is possible with some of the APIs of wchar.c to
check if a string provided is valid UTF-8 or not. If the string is not
valid UTF-8, we should just use the string as-is in the exchange,
which leads to undefined behaviors anyway as SASL needs to do things
with UTF-8.
I have also implementation a Postgres extension able to do this
operation, which has been useful for testing.
https://github.com/michaelpq/pg_plugins/tree/master/pg_sasl_prepare
Attached is a patch implementing that, the conversion tables are built
from UnicodeData.txt to be minimal in size. I have added an Open Item
on the wiki for this problem as well.
Thanks,
--
Michael
Attachments:
On Tue, Mar 7, 2017 at 10:01 PM, Michael Paquier
<michael.paquier@gmail.com> wrote:
RFC5802 (https://tools.ietf.org/html/rfc5802) regarding the
implementation of SCRAM, needs to have passwords normalized as per
RFC4013 (https://tools.ietf.org/html/rfc4013) using SASLprep, which is
actually NFKC. I have previously described what happens in this case
here:
/messages/by-id/CAB7nPqScgwh6Eu4=c-0L7-cufZrU5rULTSdpMOOWiz1YFvGE6w@mail.gmail.com
This way, we can be sure that two UTf-8 strings are considered as
equivalent in a SASL exchange, in our case we care about the password
string (we should care about the username as well). Without SASLprep,
our implementation of SCRAM may fail with other third-part tools if
passwords are not made only of ASCII characters. And that sucks.
Agreed. I am not sure this quite rises to the level of a stop-ship
issue; we could document the restriction. However, that's pretty
ugly; it would be a whole lot better to get this fixed.
I kinda hope Heikki is going to step up to the plate here, because I
think he understands most of it already.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
On Wed, Mar 8, 2017 at 10:39 PM, Robert Haas <robertmhaas@gmail.com> wrote:
On Tue, Mar 7, 2017 at 10:01 PM, Michael Paquier
<michael.paquier@gmail.com> wrote:This way, we can be sure that two UTf-8 strings are considered as
equivalent in a SASL exchange, in our case we care about the password
string (we should care about the username as well). Without SASLprep,
our implementation of SCRAM may fail with other third-part tools if
passwords are not made only of ASCII characters. And that sucks.Agreed. I am not sure this quite rises to the level of a stop-ship
issue; we could document the restriction.
I am not sure about that, what we have now on HEAD is still useful and
better than MD5.
However, that's pretty ugly; it would be a whole lot better to get this fixed.
Agreed.
I kinda hope Heikki is going to step up to the plate here, because I
think he understands most of it already.
The second person who knows a good deal about NFKC is Ishii-san.
Attached is a rebased patch.
--
Michael
Attachments:
On 03/31/2017 10:10 AM, Michael Paquier wrote:
On Wed, Mar 8, 2017 at 10:39 PM, Robert Haas <robertmhaas@gmail.com> wrote:
On Tue, Mar 7, 2017 at 10:01 PM, Michael Paquier
<michael.paquier@gmail.com> wrote:
I kinda hope Heikki is going to step up to the plate here, because I
think he understands most of it already.The second person who knows a good deal about NFKC is Ishii-san.
Attached is a rebased patch.
Thanks, I'm looking at this now.
- Heikki
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
On 04/04/2017 01:52 PM, Heikki Linnakangas wrote:
On 03/31/2017 10:10 AM, Michael Paquier wrote:
On Wed, Mar 8, 2017 at 10:39 PM, Robert Haas <robertmhaas@gmail.com> wrote:
On Tue, Mar 7, 2017 at 10:01 PM, Michael Paquier
<michael.paquier@gmail.com> wrote:
I kinda hope Heikki is going to step up to the plate here, because I
think he understands most of it already.The second person who knows a good deal about NFKC is Ishii-san.
Attached is a rebased patch.
Thanks, I'm looking at this now.
I will continue tomorrow, but I wanted to report on what I've done so
far. Attached is a new patch version, quite heavily modified. Notable
changes so far:
* Use Unicode codepoints, rather than UTF-8 bytes packed in a 32-bit
ints. IMHO this makes the tables easier to read (to a human), and they
are also packed slightly more tightly (see next two points), as you can
fit more codepoints in a 16-bit integer.
* Reorganize the decomposition table. Instead of a separate
binary-searched table for each "size", have one table that's ordered by
codepoint, which contains a length and offset into another array, where
all the decomposed sequences are. This makes the recomposition step
somewhat slower, as it now has to grovel through an array that contains
all decompositions, rather than just the array that contains
decompositions of two characters. But this isn't performance-critical,
readability and tight packing of the tables matter more.
* In the lookup table, store singleton decompositions that decompose to
a single character, and the character fits in a uint16, directly in the
main lookup table, instead of storing an index into the other table.
This makes the tables somewhat smaller, as there are a lot of such
decompositions.
* Use uint32 instead of pg_wchar to represent unicode codepoints.
pg_wchar suggests something that holds multi-byte characters in the OS
locale, used by functions like wcscmp, so avoid that. I added a "typedef
uint32 Codepoint" alias, though, to make it more clear which variables
hold Unicode codepoints rather than e.g. indexes into arrays.
* Unicode consortium publishes a comprehensive normalization test suite,
as a text file, NormalizationTest.txt. I wrote a small perl and C
program to run all the tests from that test suite, with the
normalization function. That uncovered a number of bugs in the
recomposition algorithm, which I then fixed:
* decompositions that map to ascii characters cannot be excluded.
* non-canonical and non-starter decompositions need to be excluded.
They are now flagged in the lookup table, so that we only use them
during the decomposition phase, not when recomposing.
TODOs / Discussion points:
* I'm not sure I like the way the code is organized, I feel that we're
littering src/common with these. Perhaps we should add a
src/common/unicode_normalization directory for all this.
* The list of characters excluded from recomposition is currently
hard-coded in utf_norm_generate.pl. However, that list is available in
machine-readable format, in file CompositionExclusions.txt. Since we're
reading most of the data from UnicodeData.txt, would be good to read the
exclusion table from a file, too.
* SASLPrep specifies normalization form KC, but it also specifies that
some characters are mapped to space or nothing. Should do those
mappings, too.
- Heikki
Attachments:
implement-SASLprep-2.patch.gzapplication/gzip; name=implement-SASLprep-2.patch.gzDownload
���X implement-SASLprep-2.patch �;�w���?�_�M�����8������9vnp����p������j��������]i% �{{�OK�vvvv�gv9O�%����}����{����=��
8�����]���,�co���y��CfYC��u-����!{���[�]�a��:����������w><��W�3'�C�#��l��� �B�����C��z�U����n:d������0�c��.�q��<L��t|'@ gW��3b�(a������Y���]'���Z}����
%������r��l��p�|X��Z��_�N��`�d��o4���'�[�>���L���KN�S���Y4cNU�0�aq$|���E� Zs�M }����s��J7��`+�����T����
!�h2'��w �8pQ�i���v�z�KD�����������!��Fl����}7������;��^]F l2a����u��$�y�<Lk?] =��� 7��4c�����^��"vRw�&���L$ng���<�:�?����Z��Y�]&����)pv�s��<DK
�Q ����l K�n�5�����|���v���Jg��"���X���:a����lB�:b��OR.R��Y]����"=�?��JB�X����#��/���q����-��x>Y�Q�Ko
��`f������<^���d�FQ :Kq�v������x�xY��K�v�!&�����}����'h�������\���V�������2�3���Z�d�p_
ij���hm���R�v��������W�z�l�Z-� s:�8��# ��<~���;��������~8����
=��+UA�_���X���`7�y��������Z��S�,9�a�G'_�b��KD�F)�����8�Sab�� � \8��8}P��9����J��i�w���4�8����v�8%��t�X��#�)���P8�*����O��6��X/'R�X5d�p����L�"Y�s��V����������b��}5�k�hS��X�_��-{z�u{�!�����N�
C���Q�V���l����*�L9��>�Iv�����*��m����s�n���#��`��7��<{��l��wQ�#H$�2z������1k�������������g??{^�o���=��*�����������+v�����v�b�����"��&Q�&��������>~���-@��������o��$���<C���"}Ng�5��B��$�4�
a=��R��~����N`�Q����'M��X ����_Y�y
-g�e(DPo>pQ/�
�*NW��d�~��G(�?}u������f`���,�R��1XdC��M�����f��,�~��N���������C��k����O�T_�
q���6
/���Q����!���'�m-��-Z���I��<?��Z�&���ov�����4�'���1#O�$ ��}�b�@ �� ��\��M)��]��0
�i���/'�)�T_�d�WED�fN��R��X)�>#�B���6�����>E�\�y�Z��9��F-@�2`�V�����2�F�'����4�:[�i<�tV�%����4����������
�ZP*���m���^������x �3����@"�������(��O/����%k��e������nw[2"M�pssY�pe
�_J�P1��il��d�2�p��w��R�6�=�b&��g���`����w����;f�plD��8z�n�iC!����(��Z){�$�� ���2=�l��30�2D�0S�����r����hr�������_���#����6 �������}E��t
"�P��;�)���2�����;f��\H���0~xj�p7
d�H�n�5�Fa�8���$G�N1�.��a�*tg��!}���$a�]*w/�_:��*Ru�B8w2�PB��4��N@�LcS)�H����h��c m�M��7v2V)`�
v��M�(�IR�,qO�DtAy�b4v<�Yb;(�]����"��);�i��4�3�_��X����aKIx��B�C-��C�Y��<�F���a�V'z:��`('���j,�����;A
So0�P5��lOr��,`��\���9�p�1ZuE�:�V� +Z�tV��J���c�P�P�#;��0Z� ��t��^:���������%���S���3Vs�K������4�|���N��������Kv����(-��X��w/��X�VKh*�K��K�4��m��&=����FQ�2}�=.b<��h�������x��x��<��/�X��G��(�??+j;����K�N��/^0I���S����N��.�J
��
G�DU. �Y{���r��������? ���������:;��] ���
�1�+�{���n��iXn��������cL����������������<0&�o_�kX��=�� ��35��% �;�
��wo�dY��>��������oh�<Y�!�{�����8@n���`�]E��+��N�����\Z�;��e���6V�"�<$�������<��"����p�yx���"�IMpz���� ��n��cH�T��#4��� �2��O'�g�ms"1|.�)}�
g��X�D�_p!�������7[/��S���X�xA6q]��9}U��*����C|��S��g���+l�$�.��@'%��&��r#� �I^��- ���>'j�0���Eko�f������� �f<��� {>��V��Y\8b�f�����
Z`���i�����������|}�ov�K���`rZ���d�`n�-��E��z�d�[����o U���-E�?�c+x?`{ ��U�+��DU-������A�PmUt.�s���y
�'�>l�g���h��oj���nS"�� /���|l�f�MabyL�5��&�^��<��#@�;���\�r��c�Di�FA���9.T
3�;_�)Aif�!�eB�Ld�T�e���9~@�����p��1!Cg��D�&�W�7$k�I�TpJ�3L�<��y�������V�)4R�mG��B3E!zg���F������`0�!�v%�"�~�%QVP�����Y�P����=��3Lh��i�j�h��-������!����U(k]\]
��J�e���Z���3���_.�g��`�K�l����d��z��aq�u��?����[I��XW�Ky��r�!�E�*r7��c8��?wvA�3����_z�1���u�����Cw~���o:��k�]�����RC� ����v�+$B�]7:�Q�c�TT�/]5���{#g�9"��:?��r*l/;~(;� D�V �4���]������+��"�����u���������Tt����4�k#2A3.��n�m�d����4E�C��)�Az��w�0(�y����d?�� �n$��J���8Ctq������btzsq}Eld;N����U :����3� 5�c����m3�qo�Nf\������Q��|�8���#]�{��G��X�,�y<~S�ALr){!���{���U`���Y��:~]�@I?�,�4�� s�al[��������0v�&�9=�0����F��n*�����um�~7��]�wm���U ��Jd�y�4����"S��a��0*{u���$q�F���#h��J����J����#����q�>�AP-)�/����� ��� 1���W*N2���ln�&��"S�=�����|�N$�w�,���f�#�������,��9�N�?<s������h��u�p�"F^
yB�����Yb{�"D��O0+���+nl�M����}37h4(zS������rk������_r���<�L'��8_�&��>�����/�A�����`���g�*wA���}+|�>�J�iT���)�i�d7������W��d�{!i��P53}��V��76%�oe���<
�#�W��f
3V����jCa�n�,���e��������%��BGE��c5 �5���(i+x1()����q<E�R�f�C������.�si���������������f�V����\'9����7~�
�<�4��<���K���u'�I��PQBN�{$cBP� ��K�o�9�����O�/�����&�A`Cus��������������{��b���^��� ��'El@��6�����%�+�d�V6�Z�P_��j���aJ�j��M����I.��
�|��N��:}!!��h_�:a�A��e��s�<NL���:��:��:�[(g���%����,S�e�'S�����8�*���������������yi����^i��|��o,��G�S"C�a�o���J�M!�x�r6�F�H��qE��8��#:�/�zB]=����:K��}�L�{*����Z�+^�����V�a�:��v���+s>���C1���L$A\u���^l��z���qYV� ��+ygc
���Pd�w]�6jX�b�y���z�U� � �+X����l6d���zc���[S@?p�L���Nc�K�x.�,��)>��u� �}5mv��+���qA�<�$Q"d�?<���9�wo������� �lz|���{>M��D�s�ZG������p2� -�����5h����vBT�D�����������6�'����T�q��&��.KX��-��M=G'Y���fH
��r5v������f`�^Sv0���ZEE�j�J%9�8���H�)S�JM�@=�IG�j�!�]�hV������ `�38�"��lW��<�.���D�;WUz��p���ZB!��O��^�����_`�lr1�\\]^\�������kz|��MX�I�{�����i��
���.Ad��#g������X�{|'4�i��29���Lo���+��;<HuVG���l0��GF���������I��Nv�5?I���������=��_�+�R0�'FQTB� ��hI������I����!��"��������|a8CD�(E]<��?��]���o�{[�E�G���2�����3�"�<�:~��h"6R�4w"Y�y
u9���*6�sC53Q�4%�j��S��c���^��il�G�7��hd�
�������g�|7/e�,� ������Y2c�O�.�`�0R7�
��:��J���:t��������1N���%�p�;�\ ���������g]�e�`vqw�����%�����i�K}6��MV�xa�O7�Sj�]��)5;;��w&��B)�t��_d^�xK��_�XT��RQ��kp���\��>�YL|T^��r&�V������(]�����)}�@�JMSI.��bl(Q�&�9�r�fI��=�]%m�H��k���$��O����rDD�:$k������Tl��I���G����9����8��d-W|B���R����z�P�0�r���c�;}T���i/kp��J-�;�������G=p�r�U����jV�����Z�i�MTj�rQ� �ygpz�7���nb5k�����n��� #���/�'��,���*s�V2�V"2H!�4@^w����ad�����$�:��n�0��X�.���{��=�m\��S��7���G%�����|J<������X>\�f��c��a7-y��|����Dld�vu���u����Y �@ ���2R#�����z?}����Q���V d��~e����OV���b�������/�����G9���\���q_��J��X�����AZw<�z���l�}��_~v�':�W��H/i��{�����G0���5����Zy�-v��(5�B(>Z���f}�f��?/G����P~�
����(���/�X�;�g/>|��I��I��Hi����2=6�$�(����������g��������;n�rod���zE�|��sY�p?{��aI8��~�y�$����xh����-��q����=�� �y����Or����r�����4���+Dv_�7����=`.{��Q^������}/�@����f���Sk<���}���f�1����kl����m:�����7"G]o>\-��;�u~������������k]����@��?�9�=�j;�r3s���w4g��y��E�H����WG�����pWU������#� ���F�/���}������(9�?[f���S
�#�y<+�����}`%�te^�n�a��Jd�y��a3�gCL���JgM��X���j?wV�P�p_�1
��>[�^��H�|�b��o���>��:n�o����
�c���?���w���4���������J�������������Z���g�������U?����dg}��|��c�
������^~�����]bB��;�����{�X�[���q�'���gnP����w`�Q�+��X��6�y����lwVc����YQ��C�t[�!xzF{��1�.��d�������gk ��-x��O"��lC��]���doV�~��tq��S%�{p��?m�Mv�JXr;�|O��_|���0��C���/���I���'?C��[������Wyo�I`w������������D;�#t�@��`���[��D��(E�R}[,k�e �+�O�'6k;5)�GOG���^�)<����B?��iO�'St��C=�������s���\��n�0'��M������!{���������n|�����+��5�����v�|;;,r��W/^���g��m��+p���>��d�������^��?���H��2[����x��q0��XE��z/gG�{�n��m7��6�F���b������V����g���b_�^�\x|&��.ga������o6}
uaB��ws���c����d=�~o�����r�V��O_������U����}@�����z�n�?�����?(������w�^����8�y$?����/=cH�����P��������?EO$=��}�7/6Wi��7,�1��������(�7��P�_x�����]���~t��Gx���3
�����j�����\MR��4_���E����!dl��0u�������u2��/��)R���#U�&����*�h�xO�C���.������@��r���t��>y�^P{���T�*�o�'-��S�_����;Om��_���?O��_<�f�=���y�����;*@|�T�m���>/K.��?�4������������ZL���em���>��]�f3��i/���a���ES ���O��-}8������W�e����`H ��A���N9H%� ��}/K�*����������z|�<�j��
����M��B��V����I�9�E?�6��F}Z����=�Wz/0��l��-�ew�����1C��)�Th��.U]�s!�)��X���������77���oy?�����6�d�������)�f:^o�~��|���o>J�����u*��t����7^�g��Y�H^�����w��}���5l ��0�����K�Ovl�n��V�w//�9�X��-DwIu��Zt�Qy:}p�����`=:�$f���|����]�y-XR#��o�����&����|���_�S�?�����_���?�l��g��/��������j����'��|h�>��<��E �]���_���Q_i�� 6��x���6�]�����{��Y@l��$�Z�_WU�q��-�3�K���9����r|�8�6�d?<7��^}��>����� �������������������������O?�?y��~���q��O����x~"<�5���s��8�i�?3]c�$���X��c�������L[c��?�&�|���:}o��T�����^�?��'?����43��g;C�3�j����������������m��u�&�a�_~��?�G
�X�����m���a����4n�OUzV���:C��*}������BWe��_�jc��d������gO���'�_�4���'g{��g�� �_�z�?~��/�I ��np��zs�5s��Y|�x�7� ���.�eh�N�t>��)O�_NO����?}����|����.%��?�?��'��?<M��������������OL_��_���_\~������n��
��y��S��95���t�������ws���g�r���p������=q������?n�M�5
16|c55��|��44��1O�
�_v5��������_��Z��Pc�o�?�c�1�5�O�m��r�UM]>�E�������Ue��VU�g���ZC�j������UU����UU�W� ��
wU!.�����_��*gu�?�U?}\a�5��eE�����Y�V��h 6��Z|ZSbWU���?�e����y�/��X5UY����4� l|���������3����6���=-����?��O��fj�n���~��_}����_����_�������5���s-5��u��Y-�1�j���?�ij,�55�_}�~:��8����i����?��<�2Ysd��~��?X~��O?�j�������_�b�$��O�)5��?�]���?�����Y��,O�����w������o���������s����[~���7��_?]a�~m��y���� 8EH�\�����s��L[��k<O��|y�����v
�!���^��������W\���[�q}����x����}o=�9of�3�b����X ����������, {E���M?��
_������L;���|�f�L���9�������/6 c���������?� G��Z8����t*�M�=�w�Qx���U���&���?L#}n�9���e;!�����'�o!�K�����Q.�[`6u��^~
!��g�]��~������>G��b�i��M����@�9����;n�~���^�n�!�{n�{O?>_E�E��Gv���,e<�����%����_����RX������������_�^������J� ������?���|��I���l�e�4���\���Y���y�P���/�X���o�Y�����s�5K���0���
4k�E9�����?�6#�F���9�4|����Y1�_?���op�o����t��D� �%����e����!_m���H�M�������e6?��8��� }�|���/�������"��k?���.��?��W��D���0{�/�|�zs~6f���o���s?����z�3�chk�o�<m����W���O��s�y~��|k�.���������g��vJ�Zu��%-�������3%��3D�kr�et�r��o�|���������Z���/���?��|MU����������o��_����������~�������i���~����O����.
������:������7�y#�y��I��?q�o�����K���xz;|������Z�A���u�m��/�����i�zw�����|��eJn��.�[�#����b����^��%��k��1w���]�5k�;�
l���{z7��r�,�-�����
��������������o�s��S���d���^��w���WT�- ������~��?wk����v����P���^5�W>8cH>{������1�u�9{7+�W���C�h%~���<���+������|��z����-Z=���i��\��f�{�-����;�>�g �������=8����hvcJK�%8�����Q,���}���������y��_�J�~�n(_|�@<��Y�����
\�R��iC|�e����i�_t#���g����^����������{q�d ��
�~�,���k�K=+���}�3Vo��/�X�?O��o?��o~�Q�y���;�����/��������|�����Q�hx��7utS��v�w~���z"���9�J�������~��1�������������;���c���{�����T��G�Y���|��^����w_>�����m����K��%��^�������i]T�];���������S�O�om�W�����b|�������(g�}���9��Z�����X����>=q�l�����J�>�p
���������9j��O�����|��[�}?�zo��9���^\��KU7�R�T��w+�L�i��+��m�����=.y��K�<9�������D\������//?��?~����5W������l}$�iK�p~��0�o] ��[�M��,��V�n��}(F//��4����h�]��ww�o����I�S� ���*�}q,�����3x#���]��Z[/f�JKU��d���g?�������qP�?���]��=}�����4�`��{~���
���g�LG����?����&�������K���G�����K����^u���D������E�/%��+��trS\H?��>G ~��h��� �W����;��>��n�R�
�K�����K��x�9l�^�^������_���������+����%n6nc~���|����;����V������a��������
�f{a�������o�����"���QP�PP�;��h��J�d��o���%lr��y��%z!\���m�������������uJ�p�z�'���������i��_�-��2v5�*��- \���>��8f}8; �K"�S��������m���o�|i[v�c���j�/o|o�6~�����*�W_~��W�!�~~�������������m�g+^2�-��I������������/�8"��������!�:��/�_����<}��_l;��v�0����g��2���G�gx�J]S=�/������gM������#����9����cK��>|�����,~��|y������7��?%h}s�L|��U����/�$�il��e��rh.��>B���500���pR���n�3�?�=��_����B�Z��p���D_g�u����s�t��];(��������v��T�5�����n�7^�>�������������>z��?��~�����/�x�F����k�k�WW����!��Ni�����}��=p�y�p{�n}�f�����������&��^��W�{~�����������{WN87��|�������������ve�j�Q��%��/�/���-�����~b�M������y����=�8xW<��m]ac�����7�o���* �]�y���_����W���e��/�
��l��[o� ��p�w1�����<Y�-^-�C�����������z������g��~������9Y�y>�+���C�gq~ ����3��l�^����_������_��������?�q/?yom�����2�������{I��[�D�U���tM���96����������/��<z)��^������G����]�~|q�������.~]j�t�|���u�9#�a���'1��>����^��.?�v���+����#�n���w�l)�����&M���z7;�=�����5��7�����|��o7O��}8���?}�"�s�Wm�W��.���}������*���Du�:}���C�[ �r�h������o�*��7�/��pzqz�����^�������o��~{
��=��>�_}���yh���O���J�iG��i��k�����b������R�����������n\����tK���������T�4�}��z��+y��V���~���[�{/�������V����k�����pc^t�o��[�sM��m���r=�_������� W>����o3*��j������=���=x�����,�\�,�/�7�����,CV��&�d�����J�z��Ss<4|����9������9���'n��g��8�{�1��`X59-�����m���=��#p�-� w�7 ������3����i/l�G�\
}/�����P���J�^j�wG�Ka@F�K=��\���\���{)�f�r)���R�m��X��K��i/uX��K��%�BmS�����,3�MYfj���<�6e�y�-�R�-K�cmY:8��,���e��-K'@ms�� ��Yj��"�6g9D�m�r�X[�C�����X[��k��i��,�k��i��,�k������;��u����,�j[���T�X)��'�P���kR�Uf5h;�^���A���Q���I���,��J�hH��b�L`X���
,K��wP,��X���b�"*�UF)�*[)�*E���:�R��J��*E���
�x�R�
f�iD�`g�pK1T����$-��`j�F$�J�`�*E�� �R$�J�`�*E�� F�R$�J� ������IJ-�P�y��I�.�P�ywX����*E�V)��J�`�Uf �V9J1V9I1V9K1V�H1Ti�
X�����M�Ri.��9t��'�,�)�.dU7h���8h�l'�Xe/�X��Z3+#������5�2"h���=Z=w��s������ut"z��ND������:�<GZG�����N�����@+�d,��:�hE������b������z�ZQ/�C+�EvhE����mF+�E���z�f��^$�V����z� ZQ/D+D�hE�H�h0RU�U��A��V4dy[��A67hE��n�����
��A+d��V4LR�U�R�U.RU��C�1K����F���h���N��J� Z��5����Q��J�7Z��I�R��V*���JE�7Z�(�F+E�h��E�W��8�z�g���^��� ?�vj�;�b�����{>�.�����>�a�{>��w�v,�������]�#�|��������s��:�=��H���z0�J�z a����U,�X��Hd��z �����V,���\&1-�H(��z ����c��q�L���`����q�H���z ����Dj�s�b�2���z a����e��q�Hd��z �����f�3��J� ��H��=jsG���=�s������m��uH�E�! 9\]9\]$\�pu�p���E�EW
9\
$\���/2rh�%���*�"9��F�H���(��h$�����"��U�#V)3%b�2SZ�R��b�"��y�X����*E�V)���J�w�U�����F�
V/���bV�H����3s�`����� ���� �� y�UF)�*[)�*%��`��c�Y��`��c��C�F�
V�i7X=#�V�H����3����v[�r�b�2��wX���a��K�>F"=����'`}�=�c�� X����N�Z�l� 8
��8��e4��X�h$���p��f���0(���5Nh�t��a}0��.��u�Lw���c��v�=�Kf�����~������At3�y����)��IuW���<����<,0v]�w3q���^l���^����^���^����zq_/��c�x�����Z������������������mT�*o��c���w���^�*��c����#S�x�/����V��������m�G\������^=�Z�m��.��������M]��.oS����{�8j��^\��zD��B_+��X+lk�u)���m]��.e[�"�nEl�����\S������ o��8�\|�v#D���D��6���S�����
W7]�n�\}�]}�p�����
W�J�>�|}M��5���������(_�Q�n�|}
�m����`}}���`�Y�V�g�S�s�x��H8U�CS/6�������������u�'�}�PW�P�w�+r�[�P�V�n�"�F�8��[�|&��l�l{� ��P�m%�m->vK����V��%� �@�J����I@���I����I� �Z�;I1T�K�����6 �e{i �9z m@P������
�T��Z����j����j����j������ A-+-W��D��� '���N�)�=�L�bB��N����`�8Y���0���8i�G�B�?�Lf\l2]8���0��e����(���(�D����R��X�B�N��`����tZ
�t��J��Q:��Q:/���4K���IpX�t�a��Q:�#Q:�#Q���F���F���F���F���F;����9����99�
#sr ���06@����X�����JU�*�nF�R�f�*e,#V �u�R�2b�b�a�rr2`�rr2`�rb�|9A�X�������tX����*E&V)2���,�x�*g)�*)�*�d4����a�rh��|9�GX���P���{
V�J1V��I�����"cr1j[�Uw@���Wg{rH���P�S��U�<�/�����_�]5~���G���G���G���G�WpS�����}5J����������;N����W�����������8}_���.�~�Z�����.��Ymti���P�f�F�J�e�M�_��������X�q-��1�c����S�a-��Q1���f��O`i_-]��{��X��,bUz��t]_��������>���&��6��P���z�>������x}h��)4U?$4U���TJ�Q�J��y,���� 7'"x�AnND�J������9}����s�����cSs��.�6������:�������=a
���P��q��q���B=��1���0���
��[���u��'���|�\ ��f{��!��d��] �n$k�mM��{'�� ��c��� W�#l���"l��8��Ia����<S]y���Lu����3U��0U�0���\7�s���U$���7�e2�e2W}�0�;?�;?W���x��JmU$�~rmU$�V-R�U�,��JmU����d�V�Wb�-��R��Z�����Z����X?C���P\U���>ptuy���]]���DWU�X?���:�c�8+��8��8�uy�� �uy/uy/uy/uy/Uy�u����FmS��mS�`�TE�6UQ�MUTmSU�TE����ZSUk���5uQ����.AS�����T��5u ��M]��S��~����=i����Nu�����������/�m}qm��k[_\��.���l����/�m})n�kn[_s��.��j���
��W�v�+�\l���u����v�.0�\uy���;�f���;�f���;�f�+�n�{�{�{�{�{�{����.��.����K]���w��p^� �9�yA'��#�t��q�n�hG��c3:_]���>���;c_Q{*h��������~��Q��� ��P�+?G�~ht�O�����k?���� �����~�9��S�#��tr����k�|R}�ip����U_� �����@������O��SooD������S_3"������g)���R8V��p�������P�� i&"��
Nf��
�>"� �P��AG��c������V����]Z8.�(�p\8�Qh��p�Iy��p�8�D4������fw���q%����( �Z8�GhZ�b��L� 8�k����CN~�C��"�SMD��8U8Au��B�|���b���������Bht>��O�0��uj���������]W/���C�xx�w|�6M�����-]��[����5A�������3�C�����B�y�Fu��r��R�����,�z�����9R�N&��j�B�|q�^�/�<����c�+?����E����r6Z�U,k��F�R�5�L��1K�9G�5��"�
n�Q�r���� ct�$��t`������6e�u�t�8>w_�lJ����P/��S��=��o�v�#����FA�:pY���u��RG�-�c� viK��}���?f�`�����'��-�c� 6o���}���2�"]�I������'�
;��P�7�����=)kuIm��9m�X���c�f��r,�����|��
W��.���=���A����U\����Z���g2���`4�zU���>����6}Sq��Xt��Z�>W���Z�3����'n�V�j!�T\�s��f�Rq-���kZ*�N�~��m��>dC�'L��Pq*�Kp�Kp�N��3�C�l%���e�%A�T,�. L�b�_Id�$�J�A���;�A���C2���c�����p�������� ��*&`�^�J��C�T\�
C��W*���!Vu{�U�bU��X������aw����I��R1��z�r,k+�8U{6N���S�g��o4����������������������0�TU�q�N�q�����1�����T��E���Hg}I<�K��P_O���x*�w�z8������T������I"