wpa_supplicant-gui-2.9-150000.4.36.1 < > , ĉ b~p9|q)z' ZC:JZ z KT1${ N! m:Hm z~sf}qoՂҰw;GCKPA3,)E#_\BI2cX; ÇVYI+rԬX8jTBNXw4 ܘ* lD
OvwO o%U!)4Tʖ]eYE3FB?A{ YH0o'*WStgn/g*a4 > > ? d ' J
, B N k q x
& 0 \ d ( 8 ( 9 \ ( : ( F : G P H X I ` X d Y l \ ] ^ b c v d e f l u v w @ x H y P z C wpa_supplicant-gui 2.9 150000.4.36.1 WPA supplicant graphical front-end This package contains a graphical front-end to wpa_supplicant, an
implementation of the WPA Supplicant component. b~s390zl31
\SUSE Linux Enterprise 15 SUSE LLC BSD-3-Clause AND GPL-2.0-or-later https://www.suse.com/ Unspecified https://w1.fi/wpa_supplicant linux s390x
` 큤 b{bwd9b6e468a60b2bdbb385749fe3f603679558a98d7debde1d14a752fe66ba7e40 b88d2e4686481dd240f44e052421fe8e627beb64bf43df1bcf595ea8d4664b37 root root root root wpa_supplicant-2.9-150000.4.36.1.src.rpm wpa_supplicant-gui wpa_supplicant-gui(s390-64) @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
libQt5Core.so.5()(64bit) libQt5Core.so.5(Qt_5)(64bit) libQt5Gui.so.5()(64bit) libQt5Gui.so.5(Qt_5)(64bit) libQt5Widgets.so.5()(64bit) libQt5Widgets.so.5(Qt_5)(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.15)(64bit) libc.so.6(GLIBC_2.17)(64bit) libc.so.6(GLIBC_2.2)(64bit) libc.so.6(GLIBC_2.4)(64bit) libgcc_s.so.1()(64bit) libgcc_s.so.1(GCC_3.0)(64bit) libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2)(64bit) libstdc++.so.6()(64bit) libstdc++.so.6(CXXABI_1.3)(64bit) libstdc++.so.6(CXXABI_1.3.9)(64bit) libstdc++.so.6(GLIBCXX_3.4)(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) wpa_supplicant 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.1 b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y ]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U /@TBV@cfamullaconrad@suse.com cfamullaconrad@suse.com cfamullaconrad@suse.com cfamullaconrad@suse.com cfamullaconrad@suse.com cfamullaconrad@suse.com sp1ritCS@protonmail.com cfamullaconrad@suse.com songchuan.kang@suse.com cfamullaconrad@suse.com bwiedemann@suse.com cfamullaconrad@suse.com ilya@ilya.pp.ua tchvatal@suse.com tchvatal@suse.com ilya@ilya.pp.ua ilya@ilya.pp.ua kbabioch@suse.com ro@suse.de kbabioch@suse.com kbabioch@suse.com kbabioch@suse.com ro@suse.de meissner@suse.com obs@botter.cc dwaas@suse.com meissner@suse.com tchvatal@suse.com lnussel@suse.de crrodriguez@opensuse.org crrodriguez@opensuse.org crrodriguez@opensuse.org lnussel@suse.de michael@stroeder.com ro@suse.de zaitor@opensuse.org crrodriguez@opensuse.org stefan.bruens@rwth-aachen.de stefan.bruens@rwth-aachen.de stefan.bruens@rwth-aachen.de - Enable WPA3-Enterprise (SuiteB-192) support. - Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
SAE/EAP-pwd side-channel attack update 2
(CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733) - Add CVE-2021-30004.patch -- forging attacks may occur because
AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
(bsc#1184348) - Fix systemd device ready dependencies in wpa_supplicant@.service file.
(see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844) - Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
(bsc#1182805) - Add CVE-2021-0326.patch -- P2P group information processing vulnerability
(bsc#1181777) - Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
(https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/) - Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build - Enable SAE support(jsc#SLE-14992). - Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
(bsc#1150934) - Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Change wpa_supplicant.service to ensure wpa_supplicant gets started before
network. Fix WLAN config on boot with wicked. (boo#1166933) - Adjust the service to start after network.target wrt bsc#1165266 - Update to 2.9 release:
* SAE changes
- disable use of groups using Brainpool curves
- improved protection against side channel attacks
[https://w1.fi/security/2019-6/]
* EAP-pwd changes
- disable use of groups using Brainpool curves
- allow the set of groups to be configured (eap_pwd_groups)
- improved protection against side channel attacks
[https://w1.fi/security/2019-6/]
* fixed FT-EAP initial mobility domain association using PMKSA caching
(disabled by default for backwards compatibility; can be enabled
with ft_eap_pmksa_caching=1)
* fixed a regression in OpenSSL 1.1+ engine loading
* added validation of RSNE in (Re)Association Response frames
* fixed DPP bootstrapping URI parser of channel list
* extended EAP-SIM/AKA fast re-authentication to allow use with FILS
* extended ca_cert_blob to support PEM format
* improved robustness of P2P Action frame scheduling
* added support for EAP-SIM/AKA using anonymous@realm identity
* fixed Hotspot 2.0 credential selection based on roaming consortium
to ignore credentials without a specific EAP method
* added experimental support for EAP-TEAP peer (RFC 7170)
* added experimental support for EAP-TLS peer with TLS v1.3
* fixed a regression in WMM parameter configuration for a TDLS peer
* fixed a regression in operation with drivers that offload 802.1X
4-way handshake
* fixed an ECDH operation corner case with OpenSSL
* SAE changes
- added support for SAE Password Identifier
- changed default configuration to enable only groups 19, 20, 21
(i.e., disable groups 25 and 26) and disable all unsuitable groups
completely based on REVmd changes
- do not regenerate PWE unnecessarily when the AP uses the
anti-clogging token mechanisms
- fixed some association cases where both SAE and FT-SAE were enabled
on both the station and the selected AP
- started to prefer FT-SAE over SAE AKM if both are enabled
- started to prefer FT-SAE over FT-PSK if both are enabled
- fixed FT-SAE when SAE PMKSA caching is used
- reject use of unsuitable groups based on new implementation guidance
in REVmd (allow only FFC groups with prime >= 3072 bits and ECC
groups with prime >= 256)
- minimize timing and memory use differences in PWE derivation
[https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
* EAP-pwd changes
- minimize timing and memory use differences in PWE derivation
[https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
- verify server scalar/element
[https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
- fix message reassembly issue with unexpected fragment
[https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
- enforce rand,mask generation rules more strictly
- fix a memory leak in PWE derivation
- disallow ECC groups with a prime under 256 bits (groups 25, 26, and
27)
- SAE/EAP-pwd side-channel attack update
[https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
* fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
* Hotspot 2.0 changes
- do not indicate release number that is higher than the one
AP supports
- added support for release number 3
- enable PMF automatically for network profiles created from
credentials
* fixed OWE network profile saving
* fixed DPP network profile saving
* added support for RSN operating channel validation
(CONFIG_OCV=y and network profile parameter ocv=1)
* added Multi-AP backhaul STA support
* fixed build with LibreSSL
* number of MKA/MACsec fixes and extensions
* extended domain_match and domain_suffix_match to allow list of values
* fixed dNSName matching in domain_match and domain_suffix_match when
using wolfSSL
* started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
are enabled
* extended nl80211 Connect and external authentication to support
SAE, FT-SAE, FT-EAP-SHA384
* fixed KEK2 derivation for FILS+FT
* extended client_cert file to allow loading of a chain of PEM
encoded certificates
* extended beacon reporting functionality
* extended D-Bus interface with number of new properties
* fixed a regression in FT-over-DS with mac80211-based drivers
* OpenSSL: allow systemwide policies to be overridden
* extended driver flags indication for separate 802.1X and PSK
4-way handshake offload capability
* added support for random P2P Device/Interface Address use
* extended PEAP to derive EMSK to enable use with ERP/FILS
* extended WPS to allow SAE configuration to be added automatically
for PSK (wps_cred_add_sae=1)
* removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
* extended domain_match and domain_suffix_match to allow list of values
* added a RSN workaround for misbehaving PMF APs that advertise
IGTK/BIP KeyID using incorrect byte order
* fixed PTK rekeying with FILS and FT
* fixed WPA packet number reuse with replayed messages and key
reinstallation
[https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
* fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
[https://w1.fi/security/2018-1/] (CVE-2018-14526)
* added support for FILS (IEEE 802.11ai) shared key authentication
* added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
and transition mode defined by WFA)
* added support for DPP (Wi-Fi Device Provisioning Protocol)
* added support for RSA 3k key case with Suite B 192-bit level
* fixed Suite B PMKSA caching not to update PMKID during each 4-way
handshake
* fixed EAP-pwd pre-processing with PasswordHashHash
* added EAP-pwd client support for salted passwords
* fixed a regression in TDLS prohibited bit validation
* started to use estimated throughput to avoid undesired signal
strength based roaming decision
* MACsec/MKA:
- new macsec_linux driver interface support for the Linux
kernel macsec module
- number of fixes and extensions
* added support for external persistent storage of PMKSA cache
(PMKSA_GET/PMKSA_ADD control interface commands; and
MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
* fixed mesh channel configuration pri/sec switch case
* added support for beacon report
* large number of other fixes, cleanup, and extensions
* added support for randomizing local address for GAS queries
(gas_rand_mac_addr parameter)
* fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
* added option for using random WPS UUID (auto_uuid=1)
* added SHA256-hash support for OCSP certificate matching
* fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
* fixed a regression in RSN pre-authentication candidate selection
* added option to configure allowed group management cipher suites
(group_mgmt network profile parameter)
* removed all PeerKey functionality
* fixed nl80211 AP and mesh mode configuration regression with
Linux 4.15 and newer
* added ap_isolate configuration option for AP mode
* added support for nl80211 to offload 4-way handshake into the driver
* added support for using wolfSSL cryptographic library
* SAE
- added support for configuring SAE password separately of the
WPA2 PSK/passphrase
- fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
for SAE;
note: this is not backwards compatible, i.e., both the AP and
station side implementations will need to be update at the same
time to maintain interoperability
- added support for Password Identifier
- fixed FT-SAE PMKID matching
* Hotspot 2.0
- added support for fetching of Operator Icon Metadata ANQP-element
- added support for Roaming Consortium Selection element
- added support for Terms and Conditions
- added support for OSEN connection in a shared RSN BSS
- added support for fetching Venue URL information
* added support for using OpenSSL 1.1.1
* FT
- disabled PMKSA caching with FT since it is not fully functional
- added support for SHA384 based AKM
- added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
- fixed additional IE inclusion in Reassociation Request frame when
using FT protocol
- Drop merged patches:
* rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
* rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
* rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
* rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
* rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
* rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
* rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
* rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
* rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
* wpa_supplicant-bnc-1099835-fix-private-key-password.patch
* wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
* wpa_supplicant-log-file-permission.patch
* wpa_supplicant-log-file-cloexec.patch
* wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
* wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
* wpa_supplicant-getrandom.patch - Refresh spec-file via spec-cleaner and manual optimizations.
* Change URL and Source0 to actual project homepage.
* Remove macro %{?systemd_requires} and rm (not needed).
* Add %autopatch macro.
* Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd). - Refresh spec-file: add %license tag. - Renamed patches:
- wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch
- wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798) - compile eapol_test binary to allow testing via radius proxy and server
(note: this does not match CONFIG_EAPOL_TEST which sets -Werror
and activates an assert call inside the code of wpa_supplicant)
(bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Added wpa-supplicant-log-file-permission.patch: Fixes the default file
permissions of the debug log file to more sane values, i.e. it is no longer
world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
O_CLOEXEC, which will prevent file descriptor leaking to child processes
(bsc#1098854). - Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205). - Enabled PWD as EAP method. This allows for password-based authentication,
which is easier to setup than most of the other methods, and is used by the
Eduroam network (bsc#1109209). - add two patches from upstream to fix reading private key
passwords from the configuration file (bsc#1099835)
- add patch for git 89971d8b1e328a2f79699c953625d1671fd40384
wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
- add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f
wpa_supplicant-bnc-1099835-fix-private-key-password.patch - Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088):
- rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
- rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
- rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
- rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
- rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
- rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
- rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
- rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch - fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match
eloop_signal_handler type (needed to build eapol_test via config) - Added .service files that accept interfaces as %i arguments so it's possible
to call the daemon with:
"systemctl start wpa_supplicant@$INTERFACE_NAME.service"
(like openvpn for example) - updated to 2.6 / 2016-10-02
* fixed WNM Sleep Mode processing when PMF is not enabled
[http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254)
* fixed EAP-pwd last fragment validation
[http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115)
* fixed EAP-pwd unexpected Confirm message processing
[http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115)
* fixed WPS configuration update vulnerability with malformed passphrase
[http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172)
* fixed configuration update vulnerability with malformed parameters set
over the local control interface
[http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175)
* fixed TK configuration to the driver in EAPOL-Key 3/4 retry case
* extended channel switch support for P2P GO
* started to throttle control interface event message bursts to avoid
issues with monitor sockets running out of buffer space
* mesh mode fixes/improvements
- generate proper AID for peer
- enable WMM by default
- add VHT support
- fix PMKID derivation
- improve robustness on various exchanges
- fix peer link counting in reconnect case
- improve mesh joining behavior
- allow DTIM period to be configured
- allow HT to be disabled (disable_ht=1)
- add MESH_PEER_ADD and MESH_PEER_REMOVE commands
- add support for PMKSA caching
- add minimal support for SAE group negotiation
- allow pairwise/group cipher to be configured in the network profile
- use ieee80211w profile parameter to enable/disable PMF and derive
a separate TX IGTK if PMF is enabled instead of using MGTK
incorrectly
- fix AEK and MTK derivation
- remove GTKdata and IGTKdata from Mesh Peering Confirm/Close
- note: these changes are not fully backwards compatible for secure
(RSN) mesh network
* fixed PMKID derivation with SAE
* added support for requesting and fetching arbitrary ANQP-elements
without internal support in wpa_supplicant for the specific element
(anqp[265]= in "BSS " command output)
* P2P
- filter control characters in group client device names to be
consistent with other P2P peer cases
- support VHT 80+80 MHz and 160 MHz
- indicate group completion in P2P Client role after data association
instead of already after the WPS provisioning step
- improve group-join operation to use SSID, if known, to filter BSS
entries
- added optional ssid= argument to P2P_CONNECT for join case
- added P2P_GROUP_MEMBER command to fetch client interface address
* P2PS
- fix follow-on PD Response behavior
- fix PD Response generation for unknown peer
- fix persistent group reporting
- add channel policy to PD Request
- add group SSID to the P2PS-PROV-DONE event
- allow "P2P_CONNECT p2ps" to be used without specifying the
default PIN
* BoringSSL
- support for OCSP stapling
- support building of h20-osu-client
* D-Bus
- add ExpectDisconnect()
- add global config parameters as properties
- add SaveConfig()
- add VendorElemAdd(), VendorElemGet(), VendorElemRem()
* fixed Suite B 192-bit AKM to use proper PMK length
(note: this makes old releases incompatible with the fixed behavior)
* improved PMF behavior for cases where the AP and STA has different
configuration by not trying to connect in some corner cases where the
connection cannot succeed
* added option to reopen debug log (e.g., to rotate the file) upon
receipt of SIGHUP signal
* EAP-pwd: added support for Brainpool Elliptic Curves
(with OpenSSL 1.0.2 and newer)
* fixed EAPOL reauthentication after FT protocol run
* fixed FTIE generation for 4-way handshake after FT protocol run
* extended INTERFACE_ADD command to allow certain type (sta/ap)
interface to be created
* fixed and improved various FST operations
* added 80+80 MHz and 160 MHz VHT support for IBSS/mesh
* fixed SIGNAL_POLL in IBSS and mesh cases
* added an option to abort an ongoing scan (used to speed up connection
and can also be done with the new ABORT_SCAN command)
* TLS client
- do not verify CA certificates when ca_cert is not specified
- support validating server certificate hash
- support SHA384 and SHA512 hashes
- add signature_algorithms extension into ClientHello
- support TLS v1.2 signature algorithm with SHA384 and SHA512
- support server certificate probing
- allow specific TLS versions to be disabled with phase2 parameter
- support extKeyUsage
- support PKCS #5 v2.0 PBES2
- support PKCS #5 with PKCS #12 style key decryption
- minimal support for PKCS #12
- support OCSP stapling (including ocsp_multi)
* OpenSSL
- support OpenSSL 1.1 API changes
- drop support for OpenSSL 0.9.8
- drop support for OpenSSL 1.0.0
* added support for multiple schedule scan plans (sched_scan_plans)
* added support for external server certificate chain validation
(tls_ext_cert_check=1 in the network profile phase1 parameter)
* made phase2 parser more strict about correct use of auth= and
autheap= values
* improved GAS offchannel operations with comeback request
* added SIGNAL_MONITOR command to request signal strength monitoring
events
* added command for retrieving HS 2.0 icons with in-memory storage
(REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and
RX-HS20-ICON event)
* enabled ACS support for AP mode operations with wpa_supplicant
* EAP-PEAP: fixed interoperability issue with Windows 2012r2 server
("Invalid Compound_MAC in cryptobinding TLV")
* EAP-TTLS: fixed success after fragmented final Phase 2 message
* VHT: added interoperability workaround for 80+80 and 160 MHz channels
* WNM: workaround for broken AP operating class behavior
* added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE)
* nl80211:
- add support for full station state operations
- do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled
- add NL80211_ATTR_PREV_BSSID with Connect command
- fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use
unencrypted EAPOL frames
* added initial MBO support; number of extensions to WNM BSS Transition
Management
* added support for PBSS/PCP and P2P on 60 GHz
* Interworking: add credential realm to EAP-TLS identity
* fixed EAPOL-Key Request Secure bit to be 1 if PTK is set
* HS 2.0: add support for configuring frame filters
* added POLL_STA command to check connectivity in AP mode
* added initial functionality for location related operations
* started to ignore pmf=1/2 parameter for non-RSN networks
* added wps_disabled=1 network profile parameter to allow AP mode to
be started without enabling WPS
* wpa_cli: added action script support for AP-ENABLED and AP-DISABLED
events
* improved Public Action frame addressing
- add gas_address3 configuration parameter to control Address 3
behavior
* number of small fixes
- wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509
certificates from remote radius server in debug mode in WPA-EAP. - Remove support for <12.3 as we are unresolvable there anyway
- Use qt5 on 13.2 if someone pulls this package in
- Convert to pkgconfig dependencies over the devel pkgs
- Use the %qmake5 macro to build the qt5 gui - add After=dbus.service to prevent too early shutdown (bnc#963652) - Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination
with CONFIG_DBUS=yes. - spec: Compile the GUI against QT5 in 13.2 and later. - Previous update did not include version 2.5 tarball
or changed the version number in spec, only the changelog
and removed patches.
- config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable·
random number generator by using /dev/urandom, no need to
keep an internal random number pool which draws entropy from
/dev/random.
- config: prefer using epoll(7) instead of select(2)
by setting CONFIG_ELOOP_EPOLL=y
- wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2)
system call to collect entropy. if it is not present disable
buffering when reading /dev/urandom, otherwise each os_get_random()
call will request BUFSIZ of entropy instead of the few needed bytes. - add aliases for both provided dbus names to avoid systemd stopping the
service when switching runlevels (boo#966535) - removed obsolete security patches:
* 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
* 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch
* 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
* 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
* wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch
* 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
* 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
* 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
* 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
- Update to upstream release 2.5
* fixed P2P validation of SSID element length before copying it
[http://w1.fi/security/2015-1/] (CVE-2015-1863)
* fixed WPS UPnP vulnerability with HTTP chunked transfer encoding
[http://w1.fi/security/2015-2/] (CVE-2015-4141)
* fixed WMM Action frame parser (AP mode)
[http://w1.fi/security/2015-3/] (CVE-2015-4142)
* fixed EAP-pwd peer missing payload length validation
[http://w1.fi/security/2015-4/]
(CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)
* fixed validation of WPS and P2P NFC NDEF record payload length
[http://w1.fi/security/2015-5/] (CVE-2015-8041)
* nl80211:
- added VHT configuration for IBSS
- fixed vendor command handling to check OUI properly
- allow driver-based roaming to change ESS
* added AVG_BEACON_RSSI to SIGNAL_POLL output
* wpa_cli: added tab completion for number of commands
* removed unmaintained and not yet completed SChannel/CryptoAPI support
* modified Extended Capabilities element use in Probe Request frames to
include all cases if any of the values are non-zero
* added support for dynamically creating/removing a virtual interface
with interface_add/interface_remove
* added support for hashed password (NtHash) in EAP-pwd peer
* added support for memory-only PSK/passphrase (mem_only_psk=1 and
CTRL-REQ/RSP-PSK_PASSPHRASE)
* P2P
- optimize scan frequencies list when re-joining a persistent group
- fixed number of sequences with nl80211 P2P Device interface
- added operating class 125 for P2P use cases (this allows 5 GHz
channels 161 and 169 to be used if they are enabled in the current
regulatory domain)
- number of fixes to P2PS functionality
- do not allow 40 MHz co-ex PRI/SEC switch to force MCC
- extended support for preferred channel listing
* D-Bus:
- fixed WPS property of fi.w1.wpa_supplicant1.BSS interface
- fixed PresenceRequest to use group interface
- added new signals: FindStopped, WPS pbc-overlap,
GroupFormationFailure, WPS timeout, InvitationReceived
- added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient
- added manufacturer info
* added EAP-EKE peer support for deriving Session-Id
* added wps_priority configuration parameter to set the default priority
for all network profiles added by WPS
* added support to request a scan with specific SSIDs with the SCAN
command (optional "ssid " arguments)
* removed support for WEP40/WEP104 as a group cipher with WPA/WPA2
* fixed SAE group selection in an error case
* modified SAE routines to be more robust and PWE generation to be
stronger against timing attacks
* added support for Brainpool Elliptic Curves with SAE
* added support for CCMP-256 and GCMP-256 as group ciphers with FT
* fixed BSS selection based on estimated throughput
* added option to disable TLSv1.0 with OpenSSL
(phase1="tls_disable_tlsv1_0=1")
* added Fast Session Transfer (FST) module
* fixed OpenSSL PKCS#12 extra certificate handling
* fixed key derivation for Suite B 192-bit AKM (this breaks
compatibility with the earlier version)
* added RSN IE to Mesh Peering Open/Confirm frames
* number of small fixes - added patch for bnc#930077 CVE-2015-4141
0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
- added patch for bnc#930078 CVE-2015-4142
0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch
- added patches for bnc#930079 CVE-2015-4143
0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch
Fix Segmentation fault in wpa_supplicant. Patch taken from
upstream master git (arch#44740). - 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
Fix CVE-2015-1863, memcpy overflow.
- wpa_supplicant-alloc_size.patch: annotate two wrappers
with attribute alloc_size, which may help warning us of
bugs such as the above. - Delete wpa_priv and eapol_test man pages, these are disabled in config
- Move wpa_gui man page to gui package - Update to 2.4
* allow OpenSSL cipher configuration to be set for internal EAP server
(openssl_ciphers parameter)
* fixed number of small issues based on hwsim test case failures and
static analyzer reports
* P2P:
- add new=<0/1> flag to P2P-DEVICE-FOUND events
- add passive channels in invitation response from P2P Client
- enable nl80211 P2P_DEVICE support by default
- fix regresssion in disallow_freq preventing search on social
channels
- fix regressions in P2P SD query processing
- try to re-invite with social operating channel if no common channels
in invitation
- allow cross connection on parent interface (this fixes number of
use cases with nl80211)
- add support for P2P services (P2PS)
- add p2p_go_ctwindow configuration parameter to allow GO CTWindow to
be configured
* increase postponing of EAPOL-Start by one second with AP/GO that
supports WPS 2.0 (this makes it less likely to trigger extra roundtrip
of identity frames)
* add support for PMKSA caching with SAE
* add support for control mesh BSS (IEEE 802.11s) operations
* fixed number of issues with D-Bus P2P commands
* fixed regression in ap_scan=2 special case for WPS
* fixed macsec_validate configuration
* add a workaround for incorrectly behaving APs that try to use
EAPOL-Key descriptor version 3 when the station supports PMF even if
PMF is not enabled on the AP
* allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior
of disabling these can be configured to work around issues with broken
servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1"
* add support for Suite B (128-bit and 192-bit level) key management and
cipher suites
* add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS)
* improved BSS Transition Management processing
* add support for neighbor report
* add support for link measurement
* fixed expiration of BSS entry with all-zeros BSSID
* add optional LAST_ID=x argument to LIST_NETWORK to allow all
configured networks to be listed even with huge number of network
profiles
* add support for EAP Re-Authentication Protocol (ERP)
* fixed EAP-IKEv2 fragmentation reassembly
* improved PKCS#11 configuration for OpenSSL
* set stdout to be line-buffered
* add TDLS channel switch configuration
* add support for MAC address randomization in scans with nl80211
* enable HT for IBSS if supported by the driver
* add BSSID black and white lists (bssid_blacklist, bssid_whitelist)
* add support for domain_suffix_match with GnuTLS
* add OCSP stapling client support with GnuTLS
* include peer certificate in EAP events even without a separate probe
operation; old behavior can be restored with cert_in_cb=0
* add peer ceritficate alt subject name to EAP events
(CTRL-EVENT-EAP-PEER-ALT)
* add domain_match network profile parameter (similar to
domain_suffix_match, but full match is required)
* enable AP/GO mode HT Tx STBC automatically based on driver support
* add ANQP-QUERY-DONE event to provide information on ANQP parsing
status
* allow passive scanning to be forced with passive_scan=1
* add a workaround for Linux packet socket behavior when interface is in
bridge
* increase 5 GHz band preference in BSS selection (estimate SNR, if info
not available from driver; estimate maximum throughput based on common
HT/VHT/specific TX rate support)
* add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to
implement Interworking network selection behavior in upper layers
software components
* add optional reassoc_same_bss_optim=1 (disabled by default)
optimization to avoid unnecessary Authentication frame exchange
* extend TDLS frame padding workaround to cover all packets
* allow wpa_supplicant to recover nl80211 functionality if the cfg80211
module gets removed and reloaded without restarting wpa_supplicant
* allow hostapd DFS implementation to be used in wpa_supplicant AP mode - Update to 2.3
* fixed number of minor issues identified in static analyzer warnings
* fixed wfd_dev_info to be more careful and not read beyond the buffer
when parsing invalid information for P2P-DEVICE-FOUND
* extended P2P and GAS query operations to support drivers that have
maximum remain-on-channel time below 1000 ms (500 ms is the current
minimum supported value)
* added p2p_search_delay parameter to make the default p2p_find delay
configurable
* improved P2P operating channel selection for various multi-channel
concurrency cases
* fixed some TDLS failure cases to clean up driver state
* fixed dynamic interface addition cases with nl80211 to avoid adding
ifindex values to incorrect interface to skip foreign interface events
properly
* added TDLS workaround for some APs that may add extra data to the
end of a short frame
* fixed EAP-AKA' message parser with multiple AT_KDF attributes
* added configuration option (p2p_passphrase_len) to allow longer
passphrases to be generated for P2P groups
* fixed IBSS channel configuration in some corner cases
* improved HT/VHT/QoS parameter setup for TDLS
* modified D-Bus interface for P2P peers/groups
* started to use constant time comparison for various password and hash
values to reduce possibility of any externally measurable timing
differences
* extended explicit clearing of freed memory and expired keys to avoid
keeping private data in memory longer than necessary
* added optional scan_id parameter to the SCAN command to allow manual
scan requests for active scans for specific configured SSIDs
* fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value
* added option to set Hotspot 2.0 Rel 2 update_identifier in network
configuration to support external configuration
* modified Android PNO functionality to send Probe Request frames only
for hidden SSIDs (based on scan_ssid=1)
* added generic mechanism for adding vendor elements into frames at
runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE)
* added fields to show unrecognized vendor elements in P2P_PEER
* removed EAP-TTLS/MSCHAPv2 interoperability workaround so that
MS-CHAP2-Success is required to be present regardless of
eap_workaround configuration
* modified EAP fast session resumption to allow results to be used only
with the same network block that generated them
* extended freq_list configuration to apply for sched_scan as well as
normal scan
* modified WPS to merge mixed-WPA/WPA2 credentials from a single session
* fixed nl80211/RTM_DELLINK processing when a P2P GO interface is
removed from a bridge
* fixed number of small P2P issues to make negotiations more robust in
corner cases
* added experimental support for using temporary, random local MAC
address (mac_addr and preassoc_mac_addr parameters); this is disabled
by default (i.e., previous behavior of using permanent address is
maintained if configuration is not changed)
* added D-Bus interface for setting/clearing WFD IEs
* fixed TDLS AID configuration for VHT
* modified -m configuration file to be used only for the P2P
non-netdev management device and do not load this for the default
station interface or load the station interface configuration for
the P2P management interface
* fixed external MAC address changes while wpa_supplicant is running
* started to enable HT (if supported by the driver) for IBSS
* fixed wpa_cli action script execution to use more robust mechanism
(CVE-2014-3686) s390zl31 1654850942 2.9-150000.4.36.1 2.9-150000.4.36.1 wpa_gui wpa_gui.8.gz /usr/sbin/ /usr/share/man/man8/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:24619/SUSE_SLE-15_Update/115db8ea68d41b7b073ab75c067eea19-wpa_supplicant.SUSE_SLE-15_Update drpm xz 5 s390x-suse-linux ELF 64-bit MSB shared object, IBM S/390, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=c063de03da0b9b96698a66ed22330dd3274dd7bd, for GNU/Linux 3.2.0, stripped troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) R R R R R R R R R R
R R R R R R
R R R 頢h 累
^ utf-8 da95d52a97ce04e21ac1511f28559af32e496802c4341be0b9b1b15b5288680f ? 7zXZ
! t/{] "k%{m{#rD~d tGJf͚tvC n9AdF
/htrl+
d^
n-I}
i\v5t%yuT^:1`]31 oSib*PbſO§j
pl>C }J WV5ztMO*2~ {='E,CO_Ǵʙ
d7uwW+z Q~ϳet EdΣpy;Zh)S, [g,
& 4?|EaM@l>}@$ZҦ~GG쾏!bMtTɨ 6ΐ {` U!)ћ?gZڽЩH!rV d*,'fvgQ iJS1PnH16% <",M2/,C 28(&^Lrտn[^ KU"!Җ*}$ s8kr3f PlM*?.1k6}qF2I4@rOش~pT}|[ *p7h55a/1g?}|Dt͍<y 'n{ + kT(t^cՏfkP.T$x0::*+9-):ШV.R 8)XBt='-ض9<īj⏳#tIxo߄|4:ҷ >/lh.L||? ;'&t qSpd^!mzI]gCp @FA` 2P20 6D͗>\ 1T*(^9
sW-8jM'fZYKDP,K2|{%qgQ|Ia7-pkƮmt[ |Lovzr@~[ib`-u1Lɧ /YMUx?Ɉ4a\PP*3(> *Tva`w$.s| 0cHWyLobƳ4a"5(9Qikzi[Q&4`_ Nhė~`qJUX8V z3 L;Y0]m[&7OJX~jZ(պp( 3 n2\''@=8 #r7!/f学ޭ( wIə ]c!z_LUla5bO/N} ֗|D{ {ME3S9vg\ExJtc۳< 1x Ԩ(@LO#7J:n@ҌkbwஜBǏ]jBwpʠoTXn?2*U1m ϖm-
ԮF 7z}_:|L|d5ՒqSɑ346 ]\0 r}AZMӦU
[X@XG e[%cث|tu@qim+˕k!S\
m@9B@_V.kϢPqx9p dKPSNY&Ɂ* kf` ASyWI
wG)|dOHg:ˌT z+#_^inuVZxI$Gx~uZ 6xtAWg퉃T&.*.%PtW=uFF G(kۢMjn` +51Rp5~p )w%L|<[Cy
ӽes xx<S
:s*y]
ĭa3~+/GOR6 R: A`;,>9ڤi\3.j *VAͅeU
GuR:&)ù41+؛0*U
~LvK4_>nEn@f:rzfi6<60˹\u*X,ܰv%5M E
i\57J&]Nqۮw{jmf}<[OsA* 4'>۾LhZyhB`G]N7 9?)zƥG(;!]Bҥ&5B E)Stv|
I}ZU#che5⦝L]NR>mx)Jm4*j'w\Lyyfo
~GtO5OgKKUD{,Y g p}c*ڔ
DO 3EkUW$)m.9S 3QIͽJu$?QMM$ô]
HZ1jYP*>k|.f_;UtlchVu?
>S4@$w#? 6!kެSOC2BZ^r5Xgl7 %W'+!qww8qjVa^Nb/ԎyjL_}@CD<ǣz&DO%P^}w m ZHRV].m>uZ b6<81#\:dBC(]z] ^\a!1Nb-Qo(۱+ _fs
7v> lHD68 KCې($-LPB5>CioD6'W3G3̡ lw(uo*1#,b5n8X]
OO,e_Smh;!>E9
)S?L (qP7'ZE_h+sv5[I&9 x:\qSETGNv%
ITݮ?EDϪb)=ѣuf 専VqA_ Ry~ YGcŝ%.a հ,žW0nkޏn [kr)4X^ 4fO.j|I7h.e-0(uF84w0qם\ Je` , cW=+U&Vx5Ӹ=;
JŸ ;шt^k<j fZ7t M>!QqhXhۛw?xgEZSS
I (_ߥo⚫ $C~! fe9C0uQ?kٞSGÍ-}#s!ye
{!e Y]4Ju(o$l1}TӮ6rZt5 XۊlN1L1Jcws3C =ʲ~=JCK m7
-k-;)´ſ
ݙ9O,i3 Y)>01^H8FHiEx0 H*8p hu`aˢKu8V`)cɃ5QK;s'37QOU ,u ?cP
Xbg6gHkDF wwZ<lІ L5~Yh;loƩ5=ƶFA
GZS-M@%ݍf h?qxR0ߥF7Pkq-=jؘ%k Z {g}3c9"6\tIӵ]s7B{ Mw˕2 $d,0ap Yic'Q 6BՎj ˎli( "X(=| Et^5jiq=\I^1P!iy6 ]r1H{ԫILCc]7A}`2:YޓG0ZC8 n7[q#) Q؎fi!( 5ИpOYm@% J+B| ٔdS2;bALr 6+I2~'=XLN؆9#I5 eQ&5FVd얷NLap\:Տ R2W LhZ nYŨͬ
? >q -N Nv*nbo}fTi ;3= 7^
3
m L.==pӥmqh j*[lL&) Ti ۅ֗0m8)Qd(|O*'i9Q{Ѻ ![:۽$?{JD4,y,{MrjqJQh^D,ekEr02K ]5(TS ӌK%c 1t.݈i\XGVv|oʢy T @g SW-: QxrQV)4.o1τ_̩X*|__y+"8uG@dYpajvK;.kwZ
3pvߵmA`gCrN50ƃ=-+*'L(ha Ig۫.si7:T iaIR3-O S(0z ݗ*;.k:@:D'ξŊ|xMC;畕* /3 Jkf'"ݽB\=9ضBWm@ at N+6IpH:m^#8|uBŇ'W:sQvfN=,s4XJ&ژR] .4gwc7O6T n d(=Z(C]MzSUsˊ&y{ӆ]U&e)e AW bB̬́lq_I^F"CE99`wb@iYd $5ۛf9Gp>" 튙is$\!@CqW
hurwH-<
bSqzQN sI+@#ﾆ-e2b1d( uy?'Y ;*44n.|̜U>}nTq)}P# 'kD^ùa_]YC sf\%s=% %.[K}B
~MH eN p L
/qax9vhTڔxYwp7NQI{ :K#9eきE9zF ~a6#$CњOJER)-.Zodl`Tae8l^K»VNւo|^} :ȯZ2J &8ovMi k]KX-S"vYxM9S< űSQ K(3,Zף Bb4UiKZ 2erclhl~KR2t.\
='$ Py;9 7haTseξv>Ljfp-W2^S~DM끘
î(UEd˘75܂c\B&aq ]WhuVO&R@ch=lG )[B|BxIu"sAqB(jJ _w0O^~@r>Lʊj?
-F Ve[P*.V+ݒYKaL&لU`qt+/rhS>+2ǃ wղF=qEH1! WZ(~}i,s,,l?Ѵ'ح06 Tܤ3Q~(=ѕ¸yir~#DtImwlQ7 +#`琍1NAo!*cf2b|sE9 Jʒ(jB$>ٮvH"r B ~T T Ø)Փj`v0Q" l ,aZpz#dBdנn9ؽV9 s,\ C :*3kWoTq:=4k QcT
̞ͩڑm5S Ru='z& 1jBsI9AYVI#vyQx~)pH, :FĮT~\Qَ_ 1>#F+2P_)<9Ǔl8$2.w2WCZ? .-|=<ʼ
IyǡI3٥ͤT:* h} 7Jb.]h߬$.V+7nfL8:Ks$Î #J| o 3><&rd䱥)݃٘@U~t rTt笞4
/,Y Z˗ߝvoI BVuק´,؎#H+hro6Yncq 䂶~\Fl6 aS sc
GXvJ2?ym _
WL;4N$ݱ- .b*U1Kh4 `BwO>`ʂ g9 +-V+%TO dMcOs?;Y pF$N p=>4K\EH*k䪛$p+ЂV zPg?D;]=
ṁ ~?Hϔ:N/( < oDV)6BiWX#}j[HM!n:uqJN=xV`7^E
:=)$ݧ1M f&) FRP70E fɸfM(Zw֓~MT\{"0$*0POO
wg2N)?v Fn X1Ffz`:qNN/J,#-dŢ|VHϹM+1`%tNŎi{*HIlC! xcO@P@ȊXR2-|Wrt{XZaHMjHs}3ڰ5ƶ rM K 'I!Ja5It l6l~vB:ѽy"`ϓN[sݰ<3Ώu]u AHCZH *kd. ?iMapTlA-QOVBS7cv ̓/Kofp+-S0QN$wlӛj#2Eq''0*h=L┤9ηA(hjkN ukNWթ̲" hY.6]2%y8IY3۲/{"U;z)5ڜ :O8%.~ xE\1 gfTͺQW|l){;D*xyNۨ7pӽ #[t|a@b/
Ǐ Ȃ\xmAywgB^
F8@:Ti
{N9x%%&vJZZI࿉OxRBYt"MaYt#+!&XUy
TST4 3kj5KOdJ ?"Nkdn*7RL1L?雜b7o_i 3 䲹 Y+7q&Xkqc<#w]i<hr_G7-J::OP@ &'>?'{0Z#txd}2Agx.gw%LB_OkZ_J=dߎ'Y'ihܵc䘿y橸tGd /ďq]\XJك6YVeY[ᰜK4eT.1H;?6utE77821b5_}0[oq,C6m7ҋ
w52zmO)2H NHO$HWDK&+(vWl@RPM"&A1?*>h[]IH pVIxўmP^4qfA W@7jRR O 3Ň9xl{m 5 SpfQ1K&2mbH R=(=B2N
ƈ[On)M#~kk%Q' 4_gan:1- nLDZFREv? ~yQ(pJ -T P U_|}~Hdqkw Ͽ$5Y#@2ډ!lnp2k-:lᢶ5 GdԫkKQ z eژrRl+L }/(:Q|L]`z_AMj"o8/J^"Eȧ^[\uRN/FO"D~GU;+DQ6/#cXP+`ِ|S,<sZxǬEkKS,CJNH2fFTJgҞrou)
?Wjtow(~2,^+l ԛ] 4QCm2G T
ܷn95,{YUc/: K%ybA"SMN&Wk'&RB oY*ʛ2ly1q#'Y[
1_3 ` S?+zB!(ILJKVrY;ahíeH KΒ\~@N|ܩ~ewli^9!,تfYO `Z1U>^bjI6DW^S?wڛ}3ކ)y"'X^7 y*o־/ LGO@EC8^ŵIFg`Cfb&I"#zܾZbt`$g*N5]nֺwIuȰ`zͷ<
5g=
]ޑ',طr<^ֲ/n=H;rPmt3W9 2y銊'KXjض)ʆ6OȨjZi@"V"P3cq_-XiyEN` Z`yf_ ,NS6c#~/ m^6z9
KK~%*f̬/6B{?ɵ"SW3lkJ 14[=IQPj#笎}"] yY~wHBS
vʝoeӉ%$
ž!ܴr6[w?x uIiwff[]!
<ͮP^Z3րBXAr؈@; ~qtR$Rjb {%%
ܒۚV-/BBEq'Fc ^#Uq#"bFI (۟тogb%v]p4/[oE2@'W;0O]ڄ?Ο\$ 0|G)]QkBRY Ent e|a oɁ:0YT_ٗNaH`2 =9UQOƴ8tuuSxB; ċm7c\wxV>@* u3±\?S-b11-fs'it!$V4
J1Lt y u 7d z \zbʹkn&hZ>?
8rnv[0QF=5IV73ӧ ՉF=ËZT[1Kau|&;{[ u:uyw']>AqV~F?) ^
]o?H84.5]P_ gyEVx5&mCltť))apjSϡoNLSIR1t|#QB& 76[J-P DZF[asB8.dtB]u~HL瘥,ZyP:Bjq5V"i58숿VZ̚ RZ`k3(]~L9ԝ"ZfN0:0`@atI?l43& = :C(ߜ'+ & '\i9`m }e[(sϚ 7MCݚ*X5AwxZQNyoȡP˾}?́;cn]wps&;7Q%
Y=l
+Umn/LXCX u \?|įXK# h
D G]5N`d ۀe:=\-_0& 8nTUzJ1:؍n?h. Yrtuqg;&W ɿ?OF!1 dg*˦dhU%GllPfE 67"٥չ^p68 L2/㠉r:%K^;VbCFB > 2 ےd(1Uy ͍uSVބi{k^uutRܚBc,^)&hQ8h Ut,fO(
z(Z]pLi`npTϓǻ 8,ca e%T Vᕕzy3[_q(I[a/Ձ# s/!
ɓLer ?X !sgWe8;s}a"[S
Sn~-& \9md9_G
M«i 2hL 4A}DG3j}$~hmi @ ]S;J:lWW_c29]J )_q:1TiEd5_QAX E h1PlQjp.joE>f Rږ'ݽtΣI"*wټ^t$-gܲ<Mk()Ϻ_>u8@Q|8aK{M(xTgP(0{LKb;PRϟ՛ʵh^dG)V3OךkRPVX moCRn*Z'Vh2IK=-G}vsJc@3k&Ł{]
9tTѫ 6e&2YB)`SD9s}|T9F{G(m̏)=Vd` DJh {y]Q)b-33:ipƣ.0BC{;4 S)ss]beJ?
|]:}|`J >^9IxLR~
աкVEX'RN\wvn3F#?2W*`aeUi
/` ޤ<
l>1TJwW0+
Ed0.5 zOK +ȟ7n; _zf".(w o[ H.u3R , 8 +
[_6.zpgLZvTV-Cnq'Pqcyީ6ErVmhga)ޫvd 4
{Ct|iz ;ů
f@]+hߨa]U_(#,uV ̰ L-9Uou*YLڋoɮLgWyf
($$DAO#nFRN'^iE]!9 >92+Id0;[ w=z]'0*+5ߛw.#Y )g 8# >Hi ̹a~qd4V`OA{j iD%Èj.4 g@1^`bHOgK<ܘ2SQŹS{ckif~7VM&i~cQX YJ=$ BsEǝס.tRUfm¾
ꖠxBR& .j
V ߅gt``l
v=Ec ךy]vIջċ<ڄWHs=i^2Q?%P"0Ck?~" )7[b [0Df a#AcĖǴ.7d2'2[ȐMS&VյǟAwär)Goqqۻ-a1Vݨ7M_j0Glo/
hHn@o9bdܚ`@
F̒ܯbυt2]l48sz
,Du:\ w%#Mzs_y[q{QOHT >24 2;@Qz>2p)*WPvvJ\Ȑ{1*<:6=$]D2+5KzMqFwn)m`X}nG!e #E9 .u h
0=rxJ`_v~ M&7fEbF y!g?&3\ UcJw H;b+6Y40=IpSŦڌEQizђ+QW8IRHq'4p.{2<| Clk5*ª{#w:hz"d0m'S@G1)a;CB-pZߒ\ecpb_!ڥA mn8֖Lq>ɶׅbl25 AoDUFlsǐI< "[ ʋ79^OG$L!e Paaj_S$;ۋ1n#eN}m59 }T*8 $_RfBM۞xjj'B-xJⓚCdo_
wfNmbxwWᨠA7x܁7`]=R},eI Z3BAܖ<]v,hŞH4}
H9ۜ~RV͏NHPsfAY
樂]7.ku@8 ۀش-Hg 2=],p:9kDtEUa>'_rUrQ`Z|. "Xdಈ]x_kBNosF-r bG57x#j{ԔҘ3x?96v 7 驘yHG ]{]KˏG=/K]c4w/(VJlupkuZSɚd0IńYDcÀ^zL.? 졉l}TƝ=_4#,Ѻ Gu ns^ AEJEGwO |h;{t% Se|@ԾV^Dh!(PZ 4c{->?up'y3MH7R4X(}yP&5u du7-cuq|fCQ!4's혚:GZwSydGfC) * ne~ ZIk#X
ώԽ{ާ+ӁXK]+C،#VZbwsH|, Cy挭Qzw#Ŷ7 Vr ᎅ ,._41q%:{X$ |9}d ]qdm~$I?Ylj1oL lsj I;'
BJUg\4!O[. tmI N$ ߖM
+< $j#H yp 72N;9RZ@/|&+f4qʬ0߇ 69< vWb?h7 ? 6JڏY .#yis
:mjCH/p9~ڈ&.Z:IbPTh /|Kd v zvC?U/˦QtY!Zy>>bF,x-.;ayȆ%?(z177n?!^Md?> ͠гٞI"J\KmVbfH&dֈۄtPѼn{Bڿɷ) MG09Z0 v".qn7z%ڤo 5 wqkX$C>9E=qe
ϕ mS,\ #ũ8.6y_yx 3Qjz4Ќj{ )
HH ˢ SuP[s(?Z/wMiM$*bjszlhxeZW[ҭ<ԫh^^Ш%1=$וȷAYg1qȬJ= A{2Ƈ_
O`*KnA%lzS:!Z.iĽ h_U wW7R@C]hLC]ųBDG6e?QdVJ jݛ̈":/ߒߺRlv~Tӹ_nYo"HnoTW@#D" Ow>E][DF=uP(El%Mp/Pצ+uYG -vvTB[T}ʸW^ЎdAƛt8+C60FCuBՐ;k 15 *]l*@r6>`o @
q
G$Jl
=p$65סN̵4D+
lFԓ-h,)Q%e}?X9b >v k!O{wO,XJ
k"$3$ݛ( o џK Um'.RyrV9w
9YR,-t|i pUqL({s*ipd% R(LEyE}H%EܩNH
m%J8 ,Sx0mS!oYsV =$+S*Đ3HQ}|p5K$BCslq
^DG\< E
Ж!Z %.,Mi鮅BVC!LpO()רUk̥?bBC2Sni&=R43"o3 p&6 4Vbl'0՟ї>Wzy QJV
\7i/تt|c۩ j~K2[ /zW8:5+# &4 ]QbipW"3'O)^5z8zH][M?I0uiY 3 ݗlHWd@@^ܫw>5%脓\Ӌ)fg^#4 [ ] kC@'I g孞TTO `P+(ԡ ) ѽh bQ4i$;;'6И-Ю4O>SuHU
#9}S5u`|jEZ{xCEH3:ҥկxm+ek52z0nWsuQŠ{oYOa:#4i'0 ;9THY݂%Cao w%ߋѻ7WR
o{ӿ"< `س%Paҏ#1v:Db!orơ] ⌇1!GSc< mdcR8djme DV%Sp_G9)1am~M^#\pm=M
L\R|P) hk [(
ԭdQRl0= 9+Ov_.HtfQ$L@|n ^$(.I4$4Et'@z4̈́vΛ($+)#J
JUkI41H-$4\"[N$ 'd"52dM@rfY@&dY l^c{{ g!Ob 4_UlKʓsv? 1r]c/]m"OC, /#V(Ew9E&z:3
& +9( F}s*w)Tar < A4IګDϙ|8h rh0Ct5@Q. p>ED|]h2爔B4v{5+$/ae,Ȥ0 <ڟ㉾y ,f<>3s06þӀv' 43mG}Qo*1o!0O;͓nn C+y Ӡveiq106^& C?o fS)vEQ\Y9JYU#&Z쟱xuL),Rr:8s#,h)X-Jl$˥hnq'@hɳ5YQ3F==L-˔!l _
˦G&fF+r'VFe\40F%/ldB/́(w&VCljp76
.Z0 pFc+ SIK_31fa 0h" f$h')N
@&
*2u#WY{{Є0!crw{eC!6@Ϝ+\1\hGcZK G۱&D~ of}C^uz81oh? kOl( v`
Hqf>=LVަ6 !
N=mB5HΞ%TCj/J#; I49bFs9`*7PƗw{y(Fp%Q s܊3iwMEsU9em$b{ OVQf.I^jj~Y \F *ch*4OhmtV #0sƪc)[h,=@HBl;
Z7Ń&PS 91pܔ Քaj }oV/}p|0
a)n5uǹ eHVA.s/ K22;,?$jdlbM/Xx_E?' dڣ[86f{E㲔
Lb/Jp.Ѯe8(1~5L<64V=tS{J\?!4GF$ |=GWdٖ*ml¾ E 7ږs/$etb/ikdU!u٠ .EY!I0:j`+
Bbfo
t7'. 7apC L˃r.TDmnu 1950pqV}O9^d~ePj C0w]w~$)+nk rFxe&F;К5 ARL3 s)y<͒uo80SHmJ5 Ћ˭ݕ!&. qpBىX.,:%wCiʞ宭*FD;rކnZ-GXƢx]ژuIS09(Y Pu)^-RWv^wd#dFbugPPa67-S*ɤ+w0IOߓ A(.д^Z}[)aiPa2)^Jܷ6ׁX
mfonY 2JW~51=[$om幦_ 8>b1;Vx@n-<T~{M t-T([v>ވ|DLCzNUFBDuc`PͺК9LH?xjH<2z2
ql5 +B8XoIuryU,w 듊ssks5=(_שQF%C߾\fii=ҦVs~(54S -HBB2.E3Lhi| ZNnŔFp0geɏQ d:u KK@ 2
YZ/#D\~9 B punOF'LU=J*] Q"36\ =U9)i5'o SU0 Q-&[n~b5E3!rU0+עGw|NYEh6sO Y# [ +7fbw_oyQq)qŘ`i⾔aFƣA8xU?MPK ,s֜'".twqoW7 ulg6 )ې !4>NʖO` HW3mMXupJpo>-Whu$#@Q˿u˼}>m1)OUn]
ҳ_b܅=TAg7C8$WEQx-#%l n Qn 髪2Cyo=reD, =5s>:N$(7maE+GYZsƧN4B$@
N/o#`zyĆ։2h.O|p.
zϼC֏G^S$2* u MI"O>V?xnXU0Ay!]O-ƋWR/Yw rw@ֿU'~ xa`Do؈5S{`0c #߮+W 2c~bV9jO Y/+~\\E ̼@e0 8J4yՌU a34R#vt CAfіfe
!) wf
C3;:F/ߔ&M:KMkiml9_X& ?1לEq¬Q;W` ^ ۂ刍`ѺxeM|k%)k5=&J/6#M5`x)2XotjyNCq'
ǥ@9!0ِz2kH&VUsqސQZ-=:vڵ r$~o_;U~SlY&o^>(
x1v]l?f]%3|Ļ_ż~RU9ZMOJw"l) "Ym}E]y"TIsXW YK_~ bbNDd'd<N$m鼐7pLAdg6a)lQXtzDL>[tx `' g)/D3*Iu@
vwMs?lHz \ZI̕ Xf'U GV&XVJFK 9 ?Y#JWQPgŞhәy?^e06ѓ OX.0*@Ϙ;C u?@yH_q+&w3
Pj'WDǣd=DG?&/-:V%H#f0*<#,B #x?ެ-ܤڧM
^Ik K5!K-wmN>0Fn{YϽ)](J$䦚CmtD.^.FkC"Z4 }gcD]BI6$Ͻ8˖#W8$?~>Cx QTU_7'|e\zq \Vm2Y͞=kB܉ oϒ'S^JQe7
CO>` [(
'/N5${.`ﹳ f:"^
,Z1J3wD,cmdFcoےK& `iK$p|7h@i=5[Em6m
Dc2.r{*`2asv7Đ (GAA;/.9=p/0:{ ) +aTƗ!
צMr4վa.~*l}wZBӄlubV
@mcsi mVܱ9vQM{.R?dM#hcw4Wqʴ-V,dʽgBS jrPp*;`j6Eo=4C*ec??>ȓ s4g?nxY.)J( Ɨ~ܚZ[ܾ-LKf:4Q.0
ib"9{ܴb~FFj` 4cy"7 V;;p%_ Bw?^\m7g;:0q-4{Q6BMXsvnF0jjԳުI4-% VF
n +q.w{P j/@
B?M@}mE4>,V(kV 4/cgϹy7heLFS a诣?>JoFG -F
ޜ@71cRW ,)`ff%8 GHQ.[1 msc*Jk[w<^Z"C}ސlh8& /}c@]w}pV~yfOi,
A՛㔭,L bv TJ[D k1!y(1] u>w<{5^ă[hL OGI:"<%B$ q21œf_JeG/{USܤFWz"3
g']X J
ݡTə vUC2/c%wجu
b+lFs*}8٤< `ɮ\G-$D9Þ5Y+%_ d\l)xgJ`벽HIv. Bg;)f/!R*NqD'j?lv,HDmQiaKG8;4/Y |UR3QAOKKĵ<_RvJ +)^oܛPZ 4^j|3ΜUw0)j`_wB~6* F8s
tZ QL%xkr/ ϭ=>OE3Ƃƣ "ÜfZ4r cg VBgm.*yex5bJ:iأzw>9E/viÀJׇF bK.
InM9Xq=,)) 9f;mzJ]Lz)`- ik0ilA%P$DM] -ha)mb2oKvk^$Ef]Κ
K!cTj IEpF$E34E4P5Hī奃0QՌaH 5 #%@C>4ϨV ک7ax7u
5Lm8eON^
P8(k(V) _ ?7/>L97 5 \Vԋ&V{%`ȽӉ/6(Ǣ֢}W!ocA` kIa-;c7UFLXF6 ܢ]J$`MJՓE2@t$\['տ1_݂;N-HfZHR
gNc/>xO?wGW͜ΆCEm TY(ng[م^)' >u3ecw[0]u, ]05euyi3s7h'Mr ] X,@N +F]=@&=wlKAx|bO ,I >}v ID=,YkzT <ևe80Ș4]D`3~bge#Ӗ-c7FX-DϤ0Az<l9>+s_`gFO vVA/ļIs\*տbӓ IK L ; 8AĈQ"a BfohqG Ut-YH_< GI.zu"uRava K \PH9sKTyU_n?9} dkt ȱ:K|G=( oa *պ^ @9\+@w*~u7d2 EγL|ayME/&^ΕA|B8 $ sȼP8lY+;yQo6# G"Q^Ch.jH|%\V 8u(zOڿg0 2rc:8}T`sk?Kq&"i!%L2 Xx3Sی]
i*P`&YX߯<@#~}A
%ʓ̾ us4 7,@~1I#T&,0Pk# +Iz%PpB'*HDK + ")\^p1z%L51
"7ADgpY&0߅ R]܂m麪$E*F@#@
}#2}A \Q !u$}Ȏ~{HBeZMU1 # S7
9O {y(8]k_fѱ_T Վ x9 9eSQZ$UCfEgL`sW/U R^x2p,kC}lkbm7;!JZRO- %n&ǧyi
(0t+P^'J[ٮ`>GO1Ye݆b@$!2Dģ:d7Q PC0JR
ܵG/>t=up \4\`#pV .20
۩ZjgOKEqbw
~q+;pu\:s dyk(QĨ zp;7-K(_?@o(m.5(N 3)Z*ྒ
hl=*rC O3ĩtÛUOuhRqJ=EĽD֠vs"`N#%Gm)T,m\ُcps PwEa,3; ^Dqy?l*WgZL5 E~P'I uPF3$zR\)U6C: T4]-7oD hn5`Ua%aF: N<OcDl
Cd+ գ^t0`ۈ+LRY` X~ܵmA$7\]C`cdX/)2@ @h C Άԑ+D#
jPԋlЖ@AՕݛ" ?ءf IOFr3Xf\/Rԯ85OA6 x
o-Q zPH 7C׆bI=+~Br h e\, !!ޘiD{.+{#.⭯5SdQx?j;c 3o`+jD١ftL6PIȈ^\T"l]6h02hUOV!lev`
g<5ׇ[tr>6'-~4,/4Ka%L;JY:JmvЧl}cDpr
eE*Yn( | Hjt ;{v ʯ✷㘴QQxRJOZ<=ff+ԝ!f9%
G2++rz{
vDj fգZ79% t8F=Q[iHOc_l,%e?o
jf>DXN 0:э(HO*(|qp-U50H:H$o,p? 2LR*1Ot
I}yM[jo&$ڍ-Ny>PJ?GS)p{d
d6i9o^IMg50+2
;s5ˠLbx"8Y"_H 6uѨ5m.
=Bgy5r߹$PEK:he7CZd ^('i U([C[x\Lti"_UPvC;x~>Z #%}>zqGdDi0 /#a|D$ObZa.9tGN l -lE8%*Dۉ5JS/b3amZHSFόūW+eR-NnYճWjwl"kjׅ,|q~oփE!q$%Bz UJ_ E# 0n*;H|V iII|!DN!ި; Z ?1=" /S,'5:(yi&~ ~~.Lt'` (JkrCM-SO Gzt`kNp Q(^Ca.˧1x(9,k#^ڰ% }|/6cd.ߌ7q{MA϶ NvPF%5! Ukf> [9eS nasSѐubT&UE3Inn;*%֯LdsNQc2Qe#m U]> EJ!w"k٬_E7= Zg
B_3P rn2ձkp}\ 搻d1h\&NF&9|XʼnbL^WTV%❔<(BU.@O(i{~P^J*G%mKkؓ k107%pE`Ńp߉]8giI4(+v,/ ^k
'Lpa/V&%w A:@*6
)N%-`
n|zYg [m 9anR& IW'~9}Ab-ZǠG Yɸ<-
馦G !7f(> ߔPA
{5ڡnCz@9yҖ~
\h~|kގmXիU8"Z*g#${kj'ḗځ ~)'Q.W&[.wɢ*K=,$E {sNt={-^v^:,s*-ǦWKS- L[>43\3y(˴VwgѬG&*[)e8QV 9znY=ؽ90V[\
B G\V黫%klg7Lb0F߮"NjJhnf
-Zr
b gG xW@i*\.Y,㶿~r2Us2CPq @Me_n!%ՈD 4WzNl3Jy7[,i
i
eS'PmYf> sdqOiL
nR51jbjH B͗(20-E>ˆ΄F-Hh||ȜX 92 ȴ \U`vZauZ>p9h@d.j
YCN
ga_&xŦo`d\= l&ڛi2RҘ]mrvɼǢ]\nwlTZXʩ`MLŃH@]E@ =bfa۫X1|!n()uP%3vd{8L^{: 3u!6?TNgv_6P+(PoxZx31Td? d>am{z'LZߞ 6O+s32v۟NJA洲 ~]d %X( G=}g<ްivm#Sw#,]\a1spp9 IY{T4Q
ɡ+\""cۄJG9OߎhP>m:|n
@;|_St[+HlTP֜q͞yrqcNQa=~@bznbov(Rđ$ZxoFE*Y# ,as^ %oЗg M>yYîL>q<_ye5ೇ~ "QH \֍tj(A5 s|A5sPy#
SoWs=?)1w:CeF
4R k)_sHx9 p~o Bk@Q/t ~e$I2 Kn\@AvɿbautW;|)A(+;20eE G|0e LIFr 94猁jacQB0v0L
\p!g758b7TS{*Fv4~CqY"(Go|y}Ay5U*q, &E[%OEegTZ
~lAk6w啘xP7P[;y2'C
Mr" o[d l _]-\YpI N ?$Bf0 9%C8 9P˹mz]gЫW⬙שcvUx+>a 1/of:}P}K
y<W 贐BUQH,WYFrO$¯ &aq7ٵ qܻ<: @7Ip xߚh >cL6ͮCǻ͉&JѵMX`} &ȫ\VK!5F)4(hs({$\;^Hfcv \ۥ̋ Xe~|@2?Tl)&nY,xɮ+Eb`рٔAݵ q.i0QVs1|0m5sbA8E27w}LT ԋ/ 8 뿙WR/4SvwSy)ɧ l т] Z60.
A `%i*Amʋjޑ/-ꚔyVÔ I,9DPנZwhzRƅ'g7?+֢Ϥ,w5m_v,G H\rD_*cI2m_"# q
:2 Bd;vx,Js/ZUFLTrj--0 ɝ|Dg*,4= W`߈uR:HǿV$^c'SB̳lHhrաDih ^|=1Zl#xLw]Iby>ۏԛAw~Sg^JU4쿑"_FNo:";V|_(AU4; :Ԩ{D4W.r4*z",Ci6FM}o'ޜK ^" 45&C?rB6oRh@jBOGY{Ka^ZySXIx:LNHN% Q;9O VTEw˭SA 9ukJjc<a|F̒ _M|
K 'ld aG}rb̹[ʘt!,Ji#
RX!΄ 0Y: pV^ѐZ95Vxxbb"ʴ1}wKiv<Ӗ\}a| 7#A ] 4
Z} )QHs@Ҭr: Y>+ܪ h'D#
Ȓ1hk/ xJCz6; # jNuLWn~93gfΫU+N-[6@QԧNCf")`=ׁwK&5P~jiJ~nb/%@/Uq0e8>8N_Y8QTQX@N Ԁ[Lۑ
) @+nopNJ(ɭ]3k p+APr}Ƶc<߾ޱE"s/26vRc]폿?{^(Y#975@晟^ i2M`BDF; ]es) Kr
a3uy`$v - =ڑIxi`$D[xECxwl 5G=}w G2x-B͵qYKHS;?|Ƥy !ҝf{ʛ! /dxda55|O7ǥ">*HR
v Y>"vȝ{ll_F7VS55e Vj O臋 [4C3ib fJ褖BXZ^
O)e(*2xm q {%Yhg o+5Ư,JYu .t-p?"=/c]WeSt=ƚ ""Op}ח!uAؔCj]!Q±Q7ɵ8Ɇ%A
H}+$PX״X~B, nWDN5q3k~7z-wQ@9EwTSIK>g1M&ZI&CۣbGݍ SG^5|o|SsUiU?N#,X>ӥЎ 93fD C%Ur(+S=Ky wWEv1TتPǞ۱A1o",aK_=Mń}tWLi¹5 k C6?aИ"{ ޖ'qn#&Ýć39u_^GEOnHbqe'?.g[a] ʋ4fta -l1S4gaw4rշ?\Tiy3:/F2L$hym &;8qvqT-ehnР , jfvJXRc *L@!!j,
M0mo+я,
S|ڬ^W);xbw
3nXΨ:5@dKUHz T$ҭ
'ȾɈ۷ k oD`] FAb 供@< ()2fXk& _ v $4*k51ʬ_^+y]d<\[qE^i>j.qd# }tF=W_D?[Jڽ*:,H%f
8
Ak4%;$ -pW\Z,ܘ`97NUsNYk`_+~ٽs :h$HuW=w35ykky~>14qj}=0
?GEXR^j_UhmtR-p8 Fe2SA,Z}&B۔g<
)8oGkl_Q`0&Ί݂d .NɇM'eL,Ar%rq*3"
QR t ^+s} eMTåhX~ ҤAmmVP<
a\$b #{Ӯ]K{|f WvWfVjܴ>V+%)O`V :wYbxw.Ɲ_уh`1; yGGz!B[H
nᐏM|#Uޣ#YIe-5>/SU )\Go9yBiuy69,oHSn p>#cEiX f\~ bc2V?O\J9 9"AԾT.rS/ߤ Nii+&ME_7 C6ݘ&w8T=a GmY|ˊ'%4)a߯|@SnIdv^HE6^Hmѳ wȊ൬Ҏ/5) u HuoėN 1_:|S.<_>4+/eq]ew> hqtMyvGԮF!RQ:!Ҷ b lrYk=?CdJ_gIp#K*D /͵iaK
X u [_w4ljeE?
"a| d{ZQOj Gdw9X6>lF(yH !0h2Ar;e02'% )t*ŷq7q rpkV7l:Qf| 4
E3a}Tr 8B3Pd; ;Tubrf^+H }9kۦI
n[ED[ qdNW~Rä<3sҨgR*`]Cx;`{]qel/ֻ[ WϟkVFGbm؇`Ryμ,C_P*jK@مs
A4@ v$#52~(?s96U<< :KANXFknBu DB\* r}6 MöjGbQnebi.y$!;xB] Y&M
~dX\hnϷz^?燲 KtP"ąf_-qEpjY1zH~ C/hȽHIS9*;#p09X! wF#sЅYGF*:ĮWw&>KV<@vQv}&vd:a, :
Ϛ_!Pp{(|MDj0y.hSϦ l^n^/H9yj"Zї?K|ЪZa-[%qV pST,(; /@LRS>J=aF2uJɽJ3ћqɕ:~߹
bDhB19a}[j|uadSoH5tܐo_P\IO/NAn> ܍RB,.jU\ v>h0PF7PʛP8y{t"9094JėfS?Ƭ_TC[PBX`p"+)BiF B "b^
Hm H\{K3iljuTt-[3J,gfzG@ q
u}JT|JG; 8Ľ4\֡t۲gX/qN K^*v_lȂkwD
.C <7Ζ tzH\ͣm?3õAvӨ =אi7 Q"ovcfc
}]s.5 HQ!_mtpb(
]b4/IR>` D8r@Ϣ.vFT:naE_Q7n+"T ItHV̶ zK]w$y8 3i\h{)Yf nFL",> G3"G&֦q;M5|sNL ]!s8j uA_[i'g|z7 tS|-P`}XuUו^}i㬶N8@C ̯/TnwI4!{,Rv?OiOou_#bC,D+e6J)!M7.7¸VZq+9Z- & P(ZhU#~ȴ2ym_/]Y^sL?{S
DjtQ +dE Q fLoOS4TȖ{D̖:>xHS/\H _lըs _
)oϯ8E X6ܲhwFIhky}H^D .W\mrhlQ}7+Y}* CQOڞA*||DZ#hZ`pvW
GX$jشrQ"bW%aE
"Ǘ~D V4s&Ak} DB(9P*I @RQ
?-:qU0Q02H?18Xit^k(1bMxGnL;
NݧT,Q|JaUiN]=!`7=51yU:e]Rb}qi҅Cr٦Ie\a|OvEl9 EƕX5p'궅PnUM(@@)^y
&1dIg'?gج;
RT0 hGs{(w̄&
>MgТ8_Pu,2:oŮcSn^.'6B=xB8b
}!Kt,!t1mKG'*/F}i@xaI
i0EtJ-ã;vbƕ-C$AUFVH-)>
ef }Νn NUvKj!գAXCYnw(M W u1}ڔ4~01Vq1 zdaq$,)~pҰG>*"=ަ
,L
$\Ip`w>'u wjPkfឃL8iݍv
*P闉Γ۶ʰB0u]l2߫11n<©üIyTϖe**]:j@FB n fbVK E-]Սxz4Nw4vǹ
]_:iZ YW*{G.ӈ{4'jE_<( Xnۭ|Ru ~.aZջa/7`WwK=j1raZBu
v , 2wq0 3~G+; 6GF^m{ d r4; /ABWڤtj
vVc+rmoX@VE%jXE_B^2/cːvtBJph- Ćo9 F#y^gŇ 3Cj*hcѪ/Z_mI*3)={n·W+ )0GM&. i}=.T#zɶi{л[>ZO*D>+Nlrt#7@$iQޮ #a),1ȀP"f
ɟ#)]bf
jhY{7_1'w7=+alハ{"Np &^#wcAO=),\ #H
S /W4|@Fzա) Pv /Xs`OT5&YcTQ2Xp^,BXlZBB&DN>wU49fZU+
=_؝Ĥ85z.
vK ?ly7,x8
B%Jވ_ijq0u#
pVMhRugGt}4=ߝy \ Uy;c!g_eY ) %gв@l]Juy=(Xvq:?` |ZUU$HT+X8CBgVf_
cx) 6VHz_rЄ !vCy9 jUb:Uu"?Rِr,c Jꁜɳ0x7XNl)Uͥy5h6âZ~S/̤3dmS>VY FB
Zq(6ftZN^Q:D,(3&}͵0;ަl̺,v0\vHkgQ
s
`SM)z wWi..
Fg$pHa2ob,G`6xdozl<֖ k{> Vל?^É˴z cRÏ鞦(jk\WEԂAx/#
./x7&8kl]Pg˰l@jIG
yeS%EJimnS<]*莐, TC3ߚpA4ٷÌX1;r Yu*@qgTMU`5r][dod(cw \^` >6R
A3$1{KLX+ iG{H2oF'"f{ "Ίy`*S=vlfH{ b `G Y)}Qd/#% ڷUD)U',t\~+# /4%|!h{5rMk g}|^-lؼih6[!B;wXSϡЊV|s
S2YIȽ
^IאU|B%0ȍB,8qagYO RZ3ejb!s}ơ{ުD T. hGs
bxu#:u-cĘ_qYNؿOs mS?Dv>Hrq2K^h!7xa+P>шzY
+,YZ }lgDcS*{e)^`&`
,'e,#WA 0m9U
hKD.T:{X5%L }
D!!zf6R𪴇=5FJ{-!NQI1N& g43q~6w`;0ʎni^>LbbS@j !]@AXy-8H
;ӌFukCexR%p<K@nVP6
/Q>⍿!֧DsdͲ E(9 JsYz/KCyIwT 1"7&VQw.q%"U|uɄ0E P\ɹ{ cŊ}M(,J 5[{vEEPΙ+'ݴd=,MKK㵆!,Ağ7N QVt"*7*#W w~
,SaW\mJ:S Lđ@h.*K!Ȋ3;nţegOػA$C(]8՟ n.l*ᑽr=/4Sg[#= =D.ʥ Y{ @:Ƥn^t+{
H(ܖSYUۋ&<5M3LߒjMAuG=E8<==3C4h8
>~i Yлh.{{Tf"WXV+ uvp z\c3+kKR4 SRE&6gH6(EEtj(Mn%ŞH&Ƅ:ó`R҇>ȠGCTnԸls7oKAUa {/(
i8KBcp㯶G6aƧa 1t. >'*xbi!on ~mR Ll0=%S .kj.`f^Sa\Ks|~ݮci:CB@eWx;!C28B$~0l\ GmrVU+`W^9{8xä;K#^ ۮ |PF'e /b5@*x Ont"=? uW ^g&. jŽ5:` I]@ hFŅXڊMxu2h l]lVH
"
)? \$J;=U; RmlBIVi̷E0g ҿ
:
FL@|R*ddwoya)# \< ^':C^cL˴RP9sJ^bK>Fj{]1#mu99+豰*h<@f .{hrwT8lVk%I$#Fɨ :8!v ]4/ei" #.Go[j= ObJ,&VB3d gfX8*&$p6rZ}ZiBi ғBE/i4KIEALu<(qC$3Pŏ*/e-M֫ت$Zk=lJ>bD (SJ#GQin%KwǤ 2r(GK9vB[/lQh'H8\G#M{-y 8س^ߟnyLɉF\v96[ *ZCly) |MZ% !1+W/8^~})%>|wLic 66bp-O# -vOgcUP q ;\ !]֘ElRE L6D
bHpfўЂu PFzze뫶 XDl7rVed]m2Drste<ı[Jp)KHq嶶MRF_ |QOCx tTXgX Z^MY.'Z_cyv8#si:2fA
SQ'lfK/Oq%=GwZv刨-Wul Fo]xXljH<_$0@ eNҫXv3|3v: I8$Z̩yWh@RvFa Ʀ ń@ͽ=%>L1HD52UP|lA(+Y[EXe3wA(q L$rC[AHP._pX Acp¼ )NG4 l'+cK\7Lï
f;:J?ȴr
L rZk`O>!P.=(E B,ϥAKքjɩ
z2
:eKS^@f{! tTM@K, vU(t@S&MM ʢnHi}>t <z̻5X[|Ye$ MXʱxw DP7k6e guVk(NAe-:nd{oCTtG"ջj,Q kr~W"}e)1XG6#=c`ήd OOe@p>ppHʓSH C&˲Wk$z}]~CK7'Β| aQpWY.T5&jC>Y3To ]7 2D+cuK Lu`\cRmEɝ_㨝|QW?; ^xb`0`M
݉. QOsuܳivG?+C>
; ;-W%/S+,ϩ?bŻ1쏴=0Ւ A'5D]Մ!yF*.L@8
@`o$YyGyxur3%'Hʗ#ʜV$^ SJN d .H..\ F8|M80(ҭ0Sj47kئSF֎,2SQ&c1ŰKsǶ\0DJx98.K@w$I"R0GmzK7?8hn5W~2]cZN }8tT| ekp5 }
VގH(y&MXXo PUҿ S? 73õ,t]ĵV A U<,?$2)6[Q!ԄWp_6]j/d[B 0$#n6v/(XmAH0^u ;D| .5h2o(͓mKcRRPڷ2Qk Γ,ttĝ-f/.X}z :rHe% V٤~r:Pz5+PngIUǵj{DD6y3 ]Pzx?ߑ!h^[ w-) Uf|%.`G)_ {ڕo
N {߫ޓ
"{[vlM_Zǚ<
waO..h95/縝%;_CBś!X3kLGѴ+p:FFvg
CF7Z0z*'
ۄh/>M> 8+\p~
A~, ^ѲhW ݸE>ާ \p#l`u dй mՆbu uLU1qY% \s9ӆt;'jR:lz"༠U[1ay33)'8|||;n$En8t.vuHms
ki, t5Ui~ b^~k?YE&*{K*<"niVŨ\)C@%fLZ ە J@/w^9z[
C&4Gh(G`Hcp, Hmlc3$ㅬZ$h+`-@Xޮi7.ѝ @.h| WLk|Qb 2X:ɞ39 &{n
uMOaڄA=ӚDBccmw*hG4S}]ĦDL'xpC#[Lyd5rM94s
!GWk2q.9~05/ض㹆n.o a u
vuʪ`wIldά6G, I͒(Hs{xPq)䫴dU #̿ˬPSmnt\ QqTRz7i,_)E$=ڙfDH"+WA2L1 * lj.J tL&YS@$d `rHA
lmeibcZi9cm˺>ev 5 M (x( ]S^x@jOajbb)nEmEɖ+5Usi߇UhʄY$3pJ ܳK1O#̝O1Z0V@O}Jg<]/Z?JE5wPA+jJ , *{$z6xdbxձ
)t W:>A] sҁi cZ l>?.jL|˘=.Et|ZЯ,uҭT 7ԭG="X&
!5j˼L2,
5-lP 60?nY7E$lYb:4}
,qgU
fz_㣘L`JDN~+#g>l5Ng*&+g!cтJ_bi2ƼSh ϡÿ^9'mm<`7q>E%a(2-C1Nm70>!D7S%dO4Nydn C=T X#]=bfTVngc,⍆ K'k˯ ̎)ܼwE KLڱ&68LfZ o.hv`I" 'Jr232gr_'N F^-SbzC>"|cgq#Stց9'IW} _Zv^B79!)Z8X0.}yv+Fzt:n7#1=' 褖dRRTZ r>6!7x]% aC b[?
E>'dNdu]='bը}Ǧ̢E[wJaD'<5'8 a8 AYA&{i̋Z51}b8$&
:gk11;WGE ChkOsab^L3
-*n71=3 c)"+*!6x~Ri %9Tgo5G,fx=x<{
j>Lnm)iOJ7FV;{dVXl/zYsuɝvsx&^!d*ᨄoz0,"Pr9]!#al3r:TQ* y&;58C?x.1,b.4'rMQ9| 4d__ 8"J:>$u~r$'u&Z%H~4{uE zt?^fApPRI:L-8"ҜWȮ9^u^M&sY
lm*oa^B ¯OۡZl枪3իdܲ Nj *E(-\,B
C2v-ބHLJ3dž+V; v=`שּׁڪ3݃z`-+
8O~dm{\sV6SE0 `pE~T춶["xTR}N1o$IK$:4-T^)EV{|3 XVF;vn \=H$ߘ4%)K҉j6!)qF~md^Й
bjS5 HntdƻC $˾vRV8ݸx'>'Y'BY?l>UygDb4A3[4ť;N4$ܴ
5OTU^G^̺l$w `
E˄59m ZFX+R* /tgpt~́Q(yh e w=i-Mt |\+DRL%Qgwћi}m-Ow§1 ka'} (K ^ {{bԟ&FkeE0jD_sa2Ie*
Бԁņ"bPF
/<]`=JU3?jȳh65Ype c~D6 [ \xN{,R5*3jb 3.׳NXkPO FGNU36/OU}A1l!Uu[g; U8f]
1CӗvY|5 PpH
-& a n
~ͰBЌބl4i}5NO,/ ờ/Ov|0QۙD '%THW@ N_M=~
HaSW?$ob3X5cʍcUÊ?Ho{V lk+O cfkAWz}|9 h"{ |jĺ {krFĝY&,}!>e=nU˻Vq&NN8l˕»w,곳Э$Bv
VU3J@YIih _29^LI }@r -G Ӻ GzC^g+;AAu.6^j$Wb|*h oNkn]vJ[܍Oڃ._}=#I
.m`},o".yO|w+制D;Z q;1"b f=[-c깐 t nn}%@gCem'8aڻ3k D g'!4 rp#a5W 0 `|!g +_L u^ʂb}KJ?SE-[` 3yD :Bǂy6[zR=Xxٱ1T5&4vdQг$& L%b4
8O$Q;Ņ=~lv.dۇ6B,nVPV?h:Z;KaAgIkp0\w%h6|$@RtPge+$+>\AmbӪtp#(Z ۫?Q]Dub5<3m;fЮJo8 ÈR ~HB -Vy^A֑Dg3QR_!_ Ѫj4xpucx3Z#=;Ǯ(S"ǽy ͘\eФoh$*W; D] dq[L$6RDV q'rm \ͪ'>?p{n:2d)3F.
}ir ^x
|]d) Z&e 4O֓-cr;) pȾɃh G/G%sArZeQit76:orM ]ʵc/2C( bP{h#LxtՃ'0[,_I4@E J ۆ
q O>> ؍jK{x3Iq YBSgoOO: EgS 222$c<)+/*џsWp~w MqǹzglHFOO
aG`Ͷc-[csY k^Wh s^NwʕQ)+PɌ"4b8l*KB[m"p )bN'Bu avmr˧p;Þ( -/Wcnb snq +Cf m"'1aMҜ'V6>PPZzjZ:"x]&%OhL=7z˱]_%Τ$> Y$
:];S. x!pps= -\qÎR#.[ѓ"` (8ȍE9u7%RA^?|F(8H0; uzϻ&eyugGo5|_ @[;zJmiXyr s%S05 ߉w4eB3EsgK(jFP{p1J T$VfhM(\kA3j)9
Bx4O15b5sq쨎^ͩ2gxnWdjo Y 2?g9;Ǒ3]7x6Cf +[ ~2$<I_[C-ݞJFdP68&)XO-틔8M"O?OG8 MީTpg ߟD
{|vhF[ kp&@0:
B9]xa0SQlrUō^w^.*@_^r35+~{YbC{W*ZGUCYEBA2l1<W'=OEi$i @Y ,ʭYٻj+ %e>bԳ#XҵKP 0 Xh_T]FQ8kBASilVBvH>w &=:WEria{QAǴ&lX^ ëO n`J=`<'/N %O6&A<V6ӽOwv
hZb=YQ$pΒn/2P!8W ،NH&c~aJgf0}Yl `Ym L1q2=e}gMV eU0HN֔w[/#DHZ}xbx4R<$B 1u
.&(, /S&
dI:6/A٫) <5{]3 _6YJnը@S
Pgh/c>$@1UjA E "(&Ҟ! sU.g^y߈p{N6j4
kF<_Tc{v/p1X1y0 }hs{]/k8жlȉ B1E,1+cKq~&;K:}3v} MpVj%h(Fm,;v( C<blVӅkq3o) ^wO_bT@IP'6`|нݪU: u9NʜzGc_(^*II]֙ z۱~a HuN n:x~61s(:kvzqTvKR9_#c}#zG ) AX;C:C(ay#G\k L{C#s:xk(ĵ&
sYEfdYibd,t"V&rt ڿwHÛ)\6{o dV jVַf F!% ~ѦҴDKOlηJ٪Q; Z9+Rq JuTwOr%]`[uztyeħol|1̡a~ \ z]qZǰb'~
ĕ
YZ