From 781d0f14cc295cee0973337f81fa7d2598ff8359 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Sat, 25 Feb 2012 20:02:26 -0500 Subject: Use gp_add_krb5_creds until cred store extensions are available. --- proxy/src/gp_rpc_accept_sec_context.c | 12 ++++ proxy/src/gp_rpc_acquire_cred.c | 111 +++++++++++++++++++++++----------- 2 files changed, 88 insertions(+), 35 deletions(-) diff --git a/proxy/src/gp_rpc_accept_sec_context.c b/proxy/src/gp_rpc_accept_sec_context.c index ec5835a..07030e8 100644 --- a/proxy/src/gp_rpc_accept_sec_context.c +++ b/proxy/src/gp_rpc_accept_sec_context.c @@ -59,6 +59,18 @@ int gp_accept_sec_context(struct gssproxy_ctx *gpctx, } } + if (ach == GSS_C_NO_CREDENTIAL) { + ret_maj = gp_add_krb5_creds(&ret_min, gpsvc, + NULL, NULL, + GSS_C_ACCEPT, + 0, 0, + &ach, + NULL, NULL, NULL); + if (ret_maj) { + goto done; + } + } + gp_conv_gssx_to_buffer(&asca->input_token, &ibuf); if (asca->input_cb) { diff --git a/proxy/src/gp_rpc_acquire_cred.c b/proxy/src/gp_rpc_acquire_cred.c index 611bfe6..4940ad7 100644 --- a/proxy/src/gp_rpc_acquire_cred.c +++ b/proxy/src/gp_rpc_acquire_cred.c @@ -24,6 +24,7 @@ */ #include "gp_rpc_process.h" +#include int gp_acquire_cred(struct gssproxy_ctx *gpctx, struct gp_service *gpsvc, @@ -37,11 +38,13 @@ int gp_acquire_cred(struct gssproxy_ctx *gpctx, gss_cred_id_t in_cred = GSS_C_NO_CREDENTIAL; gss_name_t desired_name = GSS_C_NO_NAME; gss_OID_set desired_mechs = GSS_C_NO_OID_SET; + gss_OID_set use_mechs = GSS_C_NO_OID_SET; gss_OID desired_mech = GSS_C_NO_OID; gss_cred_usage_t cred_usage; gss_cred_id_t out_cred = GSS_C_NO_CREDENTIAL; gss_cred_id_t *add_out_cred = NULL; int ret; + int i; aca = &arg->acquire_cred; acr = &res->acquire_cred; @@ -56,6 +59,8 @@ int gp_acquire_cred(struct gssproxy_ctx *gpctx, } if (aca->add_cred_to_input_handle) { + add_out_cred = &in_cred; + } else { add_out_cred = &out_cred; } @@ -74,57 +79,92 @@ int gp_acquire_cred(struct gssproxy_ctx *gpctx, goto done; } + /* if a mech list is specified check if it includes the mechs + * allowed by this service configuration */ + if (desired_mechs != GSS_C_NO_OID_SET) { + ret_maj = gss_create_empty_oid_set(&ret_min, &use_mechs); + if (ret_maj) { + goto done; + } + + for (i = 0; i < desired_mechs->count; i++) { + desired_mech = &desired_mechs->elements[i]; + + if (!gp_creds_allowed_mech(gpsvc, desired_mech)) { + continue; + } + + ret_maj = gss_add_oid_set_member(&ret_min, + desired_mech, &use_mechs); + if (ret_maj) { + goto done; + } + } + + if (use_mechs->count == 0) { + /* no allowed mech, return nothing */ + desired_mech = GSS_C_NO_OID; + ret_maj = GSS_S_NO_CRED; + ret_min = 0; + goto done; + } + } else { + ret_maj = gp_get_supported_mechs(&ret_min, gpsvc, &use_mechs); + if (ret_maj) { + goto done; + } + } + cred_usage = gp_conv_gssx_to_cred_usage(aca->cred_usage); - if (in_cred == GSS_C_NO_CREDENTIAL) { - ret_maj = gss_acquire_cred(&ret_min, + for (i = 0; i < use_mechs->count; i++) { + desired_mech = &use_mechs->elements[i]; + /* this should really be folded into an extended + * gss_add_cred in gssapi that can accept a set of URIs + * that define keytabs and ccaches and principals */ + if (gss_oid_equal(desired_mech, gss_mech_krb5)) { + ret_maj = gp_add_krb5_creds(&ret_min, + gpsvc, + in_cred, + desired_name, + cred_usage, + aca->initiator_time_req, + aca->acceptor_time_req, + add_out_cred, + NULL, + NULL, + NULL); + if (ret_maj) { + goto done; + } + } else { + ret_maj = gss_add_cred(&ret_min, + in_cred, desired_name, - aca->time_req, - desired_mechs, + desired_mech, cred_usage, - &out_cred, + aca->initiator_time_req, + aca->acceptor_time_req, + add_out_cred, + NULL, NULL, NULL); - } else { - if (desired_mechs != GSS_C_NO_OID_SET) { - switch (desired_mechs->count) { - case 0: - desired_mech = GSS_C_NO_OID; - break; - case 1: - desired_mech = &desired_mechs->elements[0]; - break; - default: - ret_maj = GSS_S_FAILURE; - ret_min = EINVAL; + if (ret_maj) { goto done; } } - ret_maj = gss_add_cred(&ret_min, - in_cred, - desired_name, - desired_mech, - cred_usage, - aca->initiator_time_req, - aca->acceptor_time_req, - add_out_cred, - NULL, - NULL, - NULL); - } - if (ret_maj) { - goto done; } - if (!out_cred) { - if (in_cred) { + if (out_cred == GSS_C_NO_CREDENTIAL) { + if (in_cred != GSS_C_NO_CREDENTIAL) { out_cred = in_cred; } else { - ret_maj = GSS_S_FAILURE; - ret_min = EINVAL; + ret_maj = GSS_S_NO_CRED; + ret_min = 0; goto done; } } + acr->output_cred_handle = calloc(1, sizeof(gssx_cred)); if (!acr->output_cred_handle) { ret_maj = GSS_S_FAILURE; @@ -142,5 +182,6 @@ done: &acr->status); gss_release_cred(&ret_min, &out_cred); + gss_release_oid_set(&ret_min, &use_mechs); return ret; } -- cgit ] >/G[@"$Lsؾh( ɸ Trve*5? Eê of#PTHVPLP=4:iԞڰ KX(:{+ { ƙU+Z9&S;| Q)(njdx ~$>]&YP> +~HkPo-&%;~RGΎКE݈*ߧ# >їxAMr3P'ۏi۹HyW':Mż+#NvHH5㬑@'1n#=mKƀA@T/\T;:yW0G [%op5sҞB)ٹoǘbuXq,틛Wn\i7,*F }ѡ-@Xc5 jpwTeMi^< )C~U01%dc,w^-FeTs0 e6ʸQuƏ_B0/pAp1Y2%0w^@L < e/y^LuL*R2|pNT& r|h)Ц2 Yb9yx/tlg9 xU IL枆{1F?H?n!Ϧ"91ܓ6 \Q4Ş |] ק2,kE)YJ݈.Bl oMŗ#&ȯ!wcDpH.gb!1񻋌2.DQOVT-kyAR\eZ16hwc<5uI B(zy]cWC'V}.7KfF`LZdu+"Q3Q 04PwX`kN*Q9\9oqpfKܗcD˙8~\>[܊ e˷j#(hj;T_91;)q,=rk[]bT%Pą\)*(\?3:&S: uև 7ּP-@.yvi]Fh@" /_t0O+EcBHV;au\ S#Ɓ oԩ amRBFBsJAu´Eͳ&B5ދ9KWb,gLqJ'zosL ĺXT/@dLq:{ӳxeoehg`E4)O(p-<ݺQ"VyF;Os47~ntz!͕"'֨kM!V ~dg(.9FWZA_MY!z^ٚcF,kWJe&{h O;ȇ~ٚǛ>[/T`;iM"ZW4fĿB_)Bq^^T9ϼ\n׼{F = #-5 w6(^w4!4&ha "(!`89}]ʌP'p)Wqjh7W" v-h"12ǁe1$4I X_]|R>}E,y1Boy.Ur.jW&D3}DǣtLt{P3[2:`GkJ c/A30F&SY1 ,o팦G㍦.䝸,S V5KYP nR 24Z;6}U%#&Mϵ?.~eE433%XB/]ֆ&i w>{amNAx}d?2 B(dg&(󱅖Z`HQ|p✿ YpM;o ݤϮӵh@ s (^7n$!a d9$%SN> 9M) #JFHDK^kM"B &ܡ*z=WR$)ii_.|8jP JNó XJv䍖<'{2\4z =Rb\n=?2M̻=$EѕS|w֌ fJ4@Z \x) SIAj 2{(%$Z@[$rP)-~Inv*m-9SN$"} 6`ukHJ&mhzl@x”>D~ulاp&4LMYa-E8._D%\#ӟ(}^ U s|vJOjf GRbAtxN 6G.ACFNIg"[AXmV(WmB V@=Y4IDjl%jB38c-Z8N]J4$πBdMop39Q$TF1cRiNz{{uwC9>aW`D4@wq*>lLuڔmg)w95ݮ Ĥ`DB}L7pMt}}^iڱMb>~p_] V _ óG:~wyD No?UvM4Uh@B!A@R{CwF|Zff2=iqg?q YFh},;`rPȈ$tҗIBqyV̫ڏz46d#.9øcgR^ N$clxј . RSesIń ױWW v랋oDR(eo$޲]/擠’ȳN[_sNjl3a53`@'e7HLx!O+qAbI5%D Yn|\gX@al61I7ص ފ-~lFus0xR8;.*wj5|c̘ LC.vy9:ќYZFU0Ġe9eII",$`-nLFg62?t?{Fa;JiI4O%mTC/YCǸz(⚠/!i~=c[䑦529T7!8$ᘆE):JöJӤG1"~46{c lC 9Q Ip.AvN)*!p'Dae=@aG.&غk_:^&4@w[v4ES1pbH ĽP6V嶽1SE絮=JKpSN͡^OQjaexͳ蝲zONQ%82B6-3I|o K4HKq7Q5(rN^raI18xacӹHQڑSgSR^W(d(%DzoTw/ܤ-Lo2ÅmƷ_זPPGu;驨Rw$7hMqRk"Jgm:hMRAbeTԏ< El=)ln3Ɯ{agH]VO̖pfB.CdKHRȯ3V{d=ǶfAs1SN|8W_ZӕDG_ÆO6A5B߱잇ɥQP6B{Ye[,XҫK}ױK-AȂm_K.h }uYWBCy6Qa엸=|޺ $O?{&^歭3nnZS8D( 21Yӟ g}D4/ D"2V7rfWVfҘKΨb pZLcnF2^u3ga.|D/͒>dQl`#xŒS,#Yb~=[ʍ@\"/{HLHaz)Ih.xHݎУh6t:F,cT4{ Ii8rF5QW3Ʀ]ijbrҚ!2 pwo0<8: J&xO  7}݇_v\Ż&wGfZU3\/*ѣ4JW(e3Do1CB>_f9#ŭ]aA1 *}TnM4 pr Ѱ ;:qq((ODCRܦ -{vH]IQzp)?? qC3\4LHd av%&20΃|"jb[V))uZ$m8F s7)S=7ʖZ QbGv ɪqWPyF(_KIy6]e%#Y-$Z*R><}!m/v'O˔Yqʁ:Qd/9\d/ ^Fg&ޫA=Y63(8mF '.a0ŕ u7E44/Vh.QdC(B(뒋WXlX )Zb!_H&)`~FxzDů'Vi7CR{}Tm^0xsдt`+X7҂CsV*{$U o c pe =\eZb S{̈́ld̨*.2:j'<;!S4?ywY1#lC?CFeu9C=NF)+8aT_u#_E#>PB`Z"7žfk+v1߲|O:6G:+iaO#χ?w<dDvnt9h95؟AB6.B(I`TV '*yJwVq?g$.2+QR񵛿b+26֮}/ȂwWxBZ~O% Y]'dG[NGwoCB:#@i/Q8U}vb*Ar$նv^ RF9נvq{ e/f W>ϖpؠw+r1ts!y ;/T!_/ Uįk`fc.JV03+r+<%ûϘͅs+jNi_׳$AL}iIꪉj$_dQ]W j3N%3]sNjᏈ᜔ ׃D #L--LQm`ap .sx nO9~VE`|HFQXF06 =7Ok](/[v?Mnz.<RYIS۽;]a t۹>_[_/t A'Oe|j?>aj8eˤ>_طTwT XP) V."i50I En^0?3G㏂oQ|@ "o6 Z~Aqiz6h ];q@J%MϿYdaNwF~o}I2ªpmV"{]:jcZ).7d+M՞h,CblƸj_}MJ+FMW!?W2[뾭X1zDckΞ)Z$X-b4п>}A[hdt0VU@_:.&&WP_f_]g_Zk"9_I-.Z3&dkriU1,`CA Hۊ5MYYF3wAѥ\ ofDykFQNȿ8cn@̞͋Q)[ԀJJ]NX0M] Cp8%X`w9L{lD Z:LI_|>%_NVg} >NFTB @%|![I<x%`ߧf x'P֢mYt(Wos[6zorLLȶ"r  e䕏a@A ʔG'QN;Rר{s@)*%bUܴ#hԿjã-;`t=$8{F.SK~VuCPF)+= F8=6j=<*',kJ *Ba{TđFN;" zT46N-"еe5vj׍G7/Ml +kq{պ<jBcʈ ĀƵTedݴ7a"q9(Wt iyo^kY)HZu еLeU՗T^t :NʑN ?;ck.VϤQb&֐%Mߝt:VdFAŽ#D5=wI+"²@}>^H>3"ZC#" b_#㖊la~/%Q|~~\ޙdP%\ɞjջG$^dDx"͞2Q~ W,DY-ϓ,}/Q˙R\˪֛‰jCܡNkRS /I‚$`U[@o~apFA:ajEFvx]Wq/*&ӔDH[)|;*KNnPt>M~|;V+)P+tY<)_2ʟfy)lSc-5ezN^<+%]z㺲|Za Ytp$r62Ei'LMnr,tuMļL0;32QBg,|_+HT]/8cI %T]vy)ހ6f'd-Mץ{@5,/܆~<MNkW'׹l09Z,g/ogNscm$Ō |:X/B%%ևD'` 42w'Ј8 Ditaq uY $^UxwKy)=0hOoݻ CEw DkUYURV{ IVVD6Mp޳OH NO}Sq]59Fgm]*MV q ,'a/nxI _t;ק\<9Z'MqRngak4-joP]gBb<Ot(dUƸ_0w __+hqMV|2 lMXޛAPą 3LzB!g)67Γ_]\fqAc)ŞNxCPʧ|BO4\;GjoK&9.TJF,RIE* HKgHV-őŴDں.5O`‹R}uS-uixCf $Wў6<38& /^3)oft-եpۓc=V?;APC16\F`UT]%Oc7ɏd_G A^FxKQåҊY89oNǏ {`c3("CM2FY1L MrZ\Va% 4x _zQ&'YYcPs.]cTq@JK_o/ӡ^ְ MKЫd)-P#Ah +"ωU/\&h_)\tGG;Pї2 ڼ4-ù!HRmJHceQzO8 6]Q J3V^Ԥ\ C\5v{T宲ۓOB!`馣܂H~\71W66; wg7t]kt .bY¿rCvԞoeݞN-ux3qI\N(8H]A*_O8MR5^YAt# t!)ZWp!|gB_R>MWYwgC͞B9֯BlI{R$CVUAF3s#* A"V;߇m L{[>@1j3 aR:I(w]\UQ4 .rf(pp+m+h"݈SP("N>eʨR5~H ؎}=qLbOco9p,CMPa=B" ϱkTܵJ bN,2!P\WBbRVMlDĶr5,;V7'FAS:2O~[/'53+{*?{L4)gω ,ߛ!-0h jSS;Z>2l qdQT4爦Ƭv6A "Jn:לdXx=fF绞؍<SD;nvU0Sf½6/e C}OL"~^q3dyL$3RI7tďOظnx;dX XT& Xc8M PI(ȢX 3kzkj?Ď:am4E_5/pb$E0y=e.]Z6!w\F(R0'R<+9(~sj'DÀqc(-a^1SL2TT~=t$8nϐu?:,<\0ɧGyj|5Y<~C5Nڰ`̀xR6wTOqmbP-TLJ%]vHDAq4ohx.ei {":x-gAG@9G'rH1z-U,CR0v=Rͳ$nPC;CCq0${|>J0-+8m?YN nMIx ӎu7(h(aڹ6s 4fBAo9Hz 3\$%eL0)ILO`|+dX_M3LLuV7$D͋H}dQK!1JA!~2VEo#Te*nD5:= u_<'~m6,(N{e< !Ŕ`ժ~_L}qLHK_#{!s  ~ʰ78 EIM<(xǨOfn54R掜&xbʐЂzWYuqOT^Rv,x.[k~#w.]A7٩uR_8l[:||hT#M:5|pO!7y Irm^d.eC<D x@*U@ *Kyz6^#2}P3tDBv qmoyymxm1^*S.Yߝ5gfmƝoG zr4@&}MA(*3~o!PǪ LB 3`°:ނ I㸐o!fz ]N^ !s١N{䕁3Q=PH{yG% 6lF  T2wN6 ٬I,D4,E U~vxm ?xgm!qƬ& t1xABOR/-{:vu!0\_č׳phbϰfyJj@ `#2jK qz]pl: f_LjhM6ɬ!}*p91ĥ#shcTiYk]=Vwb \9S8[?dxӛK+nN3=j{QEBm8dNUeϘ*h۬{x@H('>]YE\i|7v rSlGDvgQCZc.!)uvz\eL7yQ"TE/ ňRTW_x-l$>'hJ)g?D&=+-W}$6ˋ\xcî12'`½8L q\7B!E'/?Eh^ٿ]^jԦj6N2~hE^h2u/'4_ˣYVD $>wM"^kϹ.=J- gj%~$?d; _@Fg==3g/XۺA7 ,g2DIw`i UiO3qG:tF_dyaV JqoW L3Pf͚օ>EΛ:|WsN<..Krv]ER4C*balx\\2z!?&odw;0ҐE{E8Q,%sBs *u+]WR\0Q-L4#G̢W4z~;.o`2tE Ev դ5$2W* ߇tl8}Rgi B )ws]D@͖pFm͆9 ҳΝ$},&O4S)ɖk%FQrD{\=:rmqb=[5xǾo?@:D8^diC)xvQ o!(dŊf?dm=y+4"Fnބn?6 ].h?hobLq.{Q/5Th?B^m {i m)_AWDUI6}I=(&R=<_x$!"d &WӅ}ucu"z@O 4]΄\!VAʴWJw=f'Q bI _OYCKH/>QPz~a7Z~̭e>S[mUANp{Z OBq'-MCE񟶨k[+b@nz U0N껼6u<7]7x'~xMIXgY'|%p4zk[;2 Z/@! ?*G'XmxmB V&C4XnO{S 4߀#VѢ\t)qACʷ_!9#;¤nw})66.!>,bc+l>doS`~?zք7ɘ8L왑2͙Kc`Ҋb/Y!H e!?''cY">.uyYz6Eo+i ˪d"Jپ -BV+2ܭE)Ϝf݇>>Mљ{A!|/f$(gѴju]z)k:<]ީnvU)#P#'U~x5D`Y5+pi< 7&lHFwz-#Y߹)n҄P\i R=Ƹ>2iUXW.s.Tj"c)ۙ>eGG?y9*G%Fp]*Jy,37 -/_%): x U}Iҫ#$iWC_T@GkǪ>ii~4o,dy=ijQy'@S[!W $:ȷ95[qǝג5&*ڀTع}6O%X>t{-Xdrڵ6}2f`0PES$eœ ,bj[r!q?>z zqwK_%' .VhȓA?pNR7G.oY pk)xwYMg'O1T_/G|> *TJ>!,:E9fE֮z ٔ!:ya'Mk8.vfZ;p?׿S 2˘xE ?>}I¸f7=R^QHR HD?Fd)zUn(x˼"POv.VWu<;/z%mH拏ݏ<݀]VM=)l)$_ˌ24]3U=|b&&Ϗq ۪(-ItRkSovxn! s 1f\"91j pXcXs?fTY A ᳹HR9řڙ[mJ*bG]MV^PEW6bd_ݘy%[/SH5{3>Bߨ8LȆ}8!sP :UfX& D= qK\DSH:][!To'DߞԊ,g۔/5DDB AڅʼnDH!?ݧXD>I[a`!0呠:װS 2!yCe:3\H3="kVe۹8KWF2jB~Fzlk*,_4j洯Rgzn+7mH Yơnʱd.fՉˆqdPIct }^czѨ٢6¯O jLxS&(RG6V:*~7GJE˦?3S?_pdUNKzQ˰ iXWk#rf/$W7r+dR$An8!w:%r$xeRYjq᭨1-pnUSŝwQ# K)^uW-Ԯ40}8')lJsKqǍ!+DJm/AQT.GS]T7ߕB+̜%t4 0c"AP\*ڣnFa fR8lc( >8K"+%!l peV'7X^{[EXy﵎Ovׇ58jV_ؾsI'%⻜7Zq?/\pr 1bD O[(w1Wn »ge ~uOwF|aS$ GN QߡK7[+[=&y|׾6sA4 jKd RIN"HQr$p)t9ƶձ/,]ZL1^c~ *L<{zu VrHSi hX"7*B/kۖ꾘zU/q((6VY8Z Ƒr_QB6O;SCxR;Foy3/01xx}oR~}0NWC u~"1_CVn 'E# '(VoOFVt1%z?#gʷ" I}}Gy uK{[&$5V9xN}FqP 2J?zA  Ղ -0Z{ Նz<9P1UdB/ ^3ルkZ*=QlIbJ:+ D4i5P[=ݱSW>Ip.%iM)P!mQ.ٿiuLQ^=@QV>P4Eqm؅^yБo{ \}z^՝MJD.֛ KQNRvcΗUd蓬=ꐻH7+˲C>OY$7pko^@bd$GapϜBOIw^W딹M]2tDx14퀢hr˺dH=~^xɈk㝓1$<;͜"8$F6 Ol?={RziGeXī)δI.Vx 6 PNPh [Nb8,|ͭkS~)uI7uF?.( UJg׬âg6a;貔O9M!vwZIK y;)r'sT: tZe2XH{^RNwEgwc`%XrqRblXޣ`D 1nR٭: N9Wփ^.-Dbm2|綩8Ubli/UniX 'v$ޱ OڛL9+k Y`wκJ'U5 ~ givɷs"*CQ|>B9 u{T f1SGʏ%N|t>(] |KlhnOS5u&vb-chgau 2-bdɐ:m3JX!H5Ք)튁*H`xIwJG L:"0ث0-=C :oba5sWYr}2j vv1<@,-4=7$Z"| BXZbȝݽ@AMdL };\܃JvBۃf&Tqb#pg˕enyͪY0Zb Ṩ<7vyIX` y2p;ywN)0ʾQ)M).iLltBGKQ4߼GtB`.)!%G.Rx '`pٶP%MiUQ k/ec;#-=N\`&7jjlou+h7Ǡ:F:)[#8e: pB(SQ5Նgބxʒц98z֭*'ㆄ`e8W ܅Vf6Ѕ\+br@h4X&V=0 b+}; ƥnzՙApUxWU;K.o㼆3ww_&j6 7)-#!Y;]P vU".r;,rjxzǶ 4):-3MXE Q{yty(mDA&9]L4h\[zunʕ3z>Ld(<ϵ-{Nu۝0}Ͽ;>ZD\8TVߞ5c5JP=},gnP ڡrK7 ^wC<|AZ3.w k},V / Cl q].a@JTVyP^ѝRMʍ?}jW߰+UT~nXm^@b=3Jii '̏ZÖ!knA *v.057S{W!߆fh+.u|i,2F7Ol>>.z1/1f[&h-GlF2Bx=fs 8#Y*uKYdȳ-/Q AlsB;lu@!][G^ji!W&i:g&bäa3N `'zw$L k/ f+cb!o KZRZ2\Dnٳ\珦#N)%:~Lέ3Kv =kSA{< j[.$1_G[!%7i!24n`?d/w캃1R132GO2ϺK]8h;Z .E-_zM؝MDۺQ# c`=&Q 5_fM 2D'>[gk䛎y 1saߜ=BcMs (:2Bqf}&SlaiH{ EIfFot1`c] w2IgaM1XpësRV8ssQA%gb(Feɟ#:81Pאs>lP߯1OP!LluP)WY] d7֭b΀8@T5*'siP!d۠,M+h!Ld_U= &,_"(?|Ցqn ~ }OWYqVڇqcѩ'+3?R'rx=P~ПDL\!L~{ ߸dƙ>"y (gBWq۔&:\g.B .nԒ#' ͭ3,9{pADݬcia gi, i H{ 7 rط-d( iU8"adTf5*` $o\N,o G'~YXv@V 6C$5@e&]>^t_2ra=>[Xø*$K[ ~M49VkOQ}CԲ:AG0n+n^ 2݈]A2w~~E0:97O3(LW(Z5o,5K|@^*⃼{& mLS뼏fU-FiXy`P$ ƻ'S9Ir?_b9-j#π`yXgGVw3PPY$#of=; 8ɢCl xT}l2$Q'%ttg2Dt"S6(מ^{b Nvp{&({U]~r ;) %ISGGoO']4ެn+UyK5O 1e)W GSOؿ. Iv>ޜ)I Ux,vv3T9Y@ΔP _]WXt]E *|m++ E'epoƞ9}߱ދnYe \1rڣ[duwL4!JR%LKW:_D)rBbO^zx#nFryGN)`MӁ`=.|j޹Z&|_⢀uաB+/NĀG'#o ` ~6(_s t+Έ/&2Q z9=؀19?/QFLJqM%>t_[:axo5AtUsZ޺B qUdޅ99-\Y(ƤzLVOIXuT\,MRA$Z{xak knieՉ*"s@-Œoy,Xs#_F,>enstzT~A۶ T#5S6Oۀ :T/6)tYaVreM \a%k@p$ K)џ6_wi%L;Z&3F@8w,aB7`-ڨۑ..yyNojNxbOW0'/jmPN&2Sr<58)*`#ҥ*D70,xւ% n uEZ\@ kp(& {FNN 9 6SV2C{5/i:"R\OiAހ'vMXD IU?C͊ \#?NY\jV{}k"T. v휢}/ҟD{'1oYTM~P<96dA06&j|sK{0Za|EAt VaN>LI]Zv-wal<(ِ~fJV ӓ+!ޖO/|k #1H~;MĔp{@i `^JgD7sVhD3Lcktat)02t)r7\߇,gpIKL]aps$Q9==/ 8T`g ڸy]^WD5:h:|\an;Q d"nmQN}H֑8,[y*y͡d櫈_SdHӒD|*q}@+V{׏k6]!rTLx$p}Ts7םx8Z>Sm <5\ N\LoesHmO6 WqS?!TF }f@uބ#ަ V+}İ-rGz ¸1.5 J.?(7toONbdRȝ.n篘Oj{=ؓ(W2߳L286޲S #U]؃G9߸LZ1~RL&~B \}NU5O oz`j0tNtjE.3[;,JqS^=,r<~ϣYwU >S>_a1gwa]eSbh%-v\Ŋ ՗3u#|G 4RSܥ0;Z؁#ybr|뜜w4b&Hvurxϋh`xE|2)gw`{a,5?Gfp6{LdTDNkSkOa>Nxry;@`ND2ss_/ _;v& ?6TC=40kJ t;wwl GjqoYi {>f^7},* N}z51K+5?^!y+xoȰ7br(C fbC"oc,~vuv̲þ0#gՓm`[/ndr}#5$d"=4n*`2>+i[}O"^ך"Ȩ5ǽ1 i{E v|Yt2kE_Lfm`n}մ\yЃapy x)o\MD[+l hoo4N$0 g.ґ"[uq9qz-| 6uB4,B"gbҎ,s@Msn Fiw%ԯvV}uႽ [g+[MtC݋JsOd#2F?s ;4咎nVObb:x2Bx6cud)u♐7ͧ`pCxRnc TLe4ht3I0H ~&؉V\v07#}5^:-eRKֽҿ/dxMD /(L9~|T"ϵL>[h;P2ƭ6Q|o(ې Uo2|5bәGZVOгgEI+1/,{` c2ߕ".^:wB=o$ېT:nkB~Pw.G(CAX&|h<(؋(YB̩CniV&RT|mpeܽ8@o9?{vY.ómuJ^5۶f'ɭ8Mt=!ʍ1F̾1LM{sE +b;O=)jijlIێ鐞vdcĻș*p>V ~]}[hmKuE}ue>*2|VI77 OxH%u^-wD%-^fFx )ph[Jx6FYynv;iVK.T^s#Tl*KzZ[IMuK]% 4X= gW@ERBo{¥ev^*`A=Hm*FKg1]3P0)3>M.8zm)͆t>' 3W?zfYZ7+Ȏ~ (N5Q# 2zC5Hr6g|Wrg&t ,ث!.pA~ =6R0nq\p7A)5FV`CMKUt3RhU } B'AlVdX,*L^xC2B~-/_[0\+hĆ *_)D*ܦ~Fi}%[lgGƆ(n"hV)nc [VcrME2b.(+4HOQ]̈u=?sJ#APHJ tu@ y'N -9@]j:虮o!>l!m]|mYfL5&ONO]s4Tǽ>'zӑ2jb+!GrO BIW0%1We616fI/)>},oE4_wlh_z0?B.4,uM/FbxOct1&TM#V-ʳM"wB0*-,ۿJ <蒼4@I>{Iwv)0:-{~QSVUg"U|D CȻ{>ܫƤh ںU =llZʳx@8lʫIoH/*LX`> EdE$EǺj\PJNіD>ՀfC.[g' @JPHא f0DSޚ{6w&Amx|Y1J6.M x~Ϙή>U`!.NA1q&jBq gZ&ٯ, ]jl;]soǪShůhEeg8* *Yg248ټ3yCI{@ :*TmJshpDVG^9ُ!K16.+R[x&:yJ7p-?7@FRÆ'T 8Th{pfѹɣCAUݛК9/<| ~ -Ah}a:@c^MM-yo7J [ԓ hl^㙁ENDSl7:ژrxj'r%pYc*n&IE$݀ H^agI2tÈ׶|6O/` G^bL៤XdXA#eI=[[C>- *l/ }I{^cc4Jl/8(x၎,,ְ*HvH 4Qh6dXFLyTx4=Mk.7X0Sz]顜ӵ :e|Q\+/h[ߴֺ2$4,Ĥi'䓭{RK` !}Ih?[SI e @卟yӧ#faȣd!&Ms6 b˨ ֧|;a\Q&$x`C=nOpX/p7QX9Gl 9e/wR"$ZYJscP0Vkd!;!Ɲ"(c\"߸g!a+f/|x[K\o$~ YX<܌2JEm_3מ[_l+ƪ,:8C <0uk21߀up #ĀD|mY[_oiL)m*`+si=gs\l|툈UP`L(ΕbrbA+h22Pkx-)pu#Ɇ3[D`vV粬ȾK ?e{nCKjQI1ߩ% c&L sE}dkDx_t  D衎^`ZVjz@'|t# W:q(}y.xFȝδtQDPg-c->EojN8]JtQ\4uBw2uï ˽ Ov9ٍ 7|PEpX^\JGaIQnIV|Zq^U{g(9OoR'jnD쿴7Q[ma+ΙXMbEН nP,~Pm>Nf  Mi!co0`qi\4t~l*%+t@sAG9Muܐ!h6󔈔k̼'᫐WͣyүG7{ȅ3a9YEjމ]WeMM?ᔥM$EݖyIzDSȸ7c|7Yħ9>ۏPARHy6E0?Pɾf"dlRU_ߡPݽ zq} 4*# ø젍JzrRSukK{ jAڴb>8%M3̢Y /SOQu.&FDvJt\ouxėk+!&oҿ߆8R[ %L{.NG^ᨲ PO5*qLYdqzFa%|7K bTF2FA <2vE۞o'9qlFv`uuy<6O-8A7Df|)=lŔ!Z4/aLzÀM0:R }4I+֫=3'cl[ R 0ӫ "%~bE?C)8]*!ٍ=SK5o粈W(;$ ){B AdWC@ghHNdBxt*wBI k}ݞV^CoKÅi(^At(}e׸3j?ųt@(3RSu_oaPSlS^(GlȄQ%:,@8Nj|M'‘g!Zy 9P=A%۪V#\JtyYȅ"[҉macd9dp`z@uGmj}gJ zV pOU+:ZfQc$ߟ?ˎV!CY0'^bP}&Sd OPn]<pI'6)v; o~:ڳ#]4֘2@ٗPp5hڶ1.T*o\L5O~$-#ȶ~uYĊohm:dvoz'eZf?WXM_lgkȊf.7{Fи$ φϭGmj;as Ƚv1sC 6%P_r_G'+و鹞-I,}"&AsAR=uBx-y}}ҖPφ݈V&ѳ.k x]oc{g0KlA>nn'A^I p4wps7w_:+k,*|EV7ܫ2V1s48AyQ=WjtZ  0%`/Obvu<S9ۼ]# }v6$A60Cpcy轹QϨY[[MZnD}S7a*{Uhmj>8 k1vG7['mB=n>G5օN@Ξl-Qm]U6PYnd|t7CB:~jJla2b/O)nL,,քhhF˓&6jذ $/hMX@bZ!mLRc'sT:yߞbDJ̠b5<5"FeI91ԔʎAQCg#k]ܐ+1>#:yUd(_Gl^R"bH6m8Ϭ*{Y|l C `%j'7Mˁ'Q&%E6oClYfJfG2~r^=-ՎUNI!Mԩ:>9dA +'ǀ២A%^JAj<ObNj4C ^+Тsa=<<,Dp"<W4#DF;%2gluSE8:Z`2.}? 5Kc'"?͛Ml!@GEӚuN,BsnrؽA#^cdL4y%:ODb9#6 cghW)/S 7+B%7^ʚX.&To56폤r@L-S`m~|JZZM$[wr͍*:}D b' 6u;Vqͯ(v^8\"zv(\AzA6w!Lu`/XmJQoQ&x)䰡05gL|wd<{^1YR8nͳ|Q_"Ic6Ճj ,j.{Rg'׵w,(s*x4՛l%FIpQQ6.͑.+a{ f|u~E GEʪg΃9V0z^r&3^}+J8zJgF"]|dLWM)hfry o4j 3ViՈjŎ(.K,ayGZt#AF6?8t{<˔v ˳zm\*7|lմU</$EeIDnXwT^s0J,ThEIhsytPYSŸ.2j^̞>b" [ä[9ù #j*6xH(bC>Vr|m1' 63I٠@EzTv%.Zj-9D=WLf/5hV{ZM[Qu;o~]<;)و@21lCZ]Oc-]ȿ0AyE-|,[xSO?v+.3q矉ip,lbVA0/^@Zg78PŅSsIq<C4*9*uRρ-.+-+(e+?LWA3+#6=Brӕv7+ 1Yʜt"MdpR菢ҙOu|@RX_>AWS}Ce$by\鏞'X+P]=\w9 ;z]KTTΗěY6AMN'2\KJ1.F{> !(PlZ&exj9h'WNHcHtQ$!&%pR[/+9u3p&uP➫[l %O3X-ғ",X|jr1 4IE7cWLKǵ?`j[fVM=PzRsSܦ3 +zNlb #}DwNz|[(-!'+E-DޮU&}d|aheCf5݉g&KM^kk.u oʁ,c >;X=E{@Ko@8oė|e>UZnoOX_nSI5fy;%w߿9>kGΧAӞ貢; h:F.! ,L8VSq {] {lJ~7JFf{^&>Krz_5Inb,A#kR6 41e{-‹ZHM}M,u؝kC&(&ӡVc(p30Y3nt] ~s}eߗ0yK73 'Hdɂvnʿ@D]T&`]"QHU'r wKWdjg!^;P(1 䬧͗~)uhUGW+A>;I>R>V%9)rQ\v` :~?ƈ/w72"ezT`[pb@ڃif7kunSf?uަlP-$_S>LN^!8a_`wR-Z,a wu I|ܬ72XM=His̓~|٨ʝCؙR|D s]{+\} ִU.o s#w M_3I|jSK{3C$C8ˡ,CfXx1O?Aœ芟 j@^nD`.L 8&EOqj }_ha9{:V?( &tP(Ɗ}^.F)C7,$r1}p% .Jl9[m]\yըK&2$>}s4{#a#v"͆9a_cO%Y!<ٝNl9}DJ op"U:2_ח{f'cnnk Gd$$|w+5u{@(a(O,QbP9ȈpQq5N N * h]ZH5p | !ƔZ&p遒N;k =?xX׋Uqq#J1}'=FK vgz@Ї2^B`8Qև9Rz=<$Drڀ P#]nxE=i9E|&4p]$rDƤ'AbRҢ4Lm!$(>JOtЍj1c `$D@KTqFyI~R|!#3Fy7h4#|M(rՙ~4+[W) ~s?5bv:sjl tx%UHTch!x/K4#?nQxvt\٭.'[yqO6\!)vY;R|O UJ!œZ 2wה|mvO+X }11b*KbSxm*؝4`N?S8m6l*{?Q7!O>zXS3>[]> Ɂa>,K'p=gƸ8Ԁ\G,gF4ZXEŽ*,tqK/_8&X;ERZ[\ 7 I?Lwl Csp0ϼ4{1eS2y5Q&EEV},.p_W#%ixB5-x86ȕc_/RsZ0R;fݗr< HGSY*P7Wa{wS]6B3* s|ђhY0zvդrfoq-\Շ0 d_6/WGh5xi< 8Cn=I2%</I=J:Od$*/'6Z#[ߨ,HBVk~o|2Ŝ<԰A,_ĕP"tOF"O޹~Qcm 5<>h6_2֝?PmT3(`&I> c\aΕ)rEƔMxmި':kCu=4IMz.a_NEGxF4c܏7q}bk몓KO7A4끈zg#'i˃,r:0-Ly0! O8h]^Y~^?OzO[[<?RXJ&5x+-2Fy+ֆEf`#OYͽV׊O `'S0m8(䜓^zhp k BݷG8 m})'X=IYE}MU_`WiJI()Hl6ϼܯu8JjAӒVf&##d)%Վ6ڙlQ /ao/QMmj)+Ӳּ;fD #Ŭe֢Zp 9!\rߨxsP9wF)nj>mǙ8cbcdFH4,v"zh|׿Ηmv ; Bf9M9TLGN>USCAXg2qb6l}&Qx3Vb7-$Mߌ6b ԅEa P>~~fȮ B #qg(KѫaӒx(eMd-= BSNnխG.xܺ M =Ea|ys7r$,H*d"iwg; |//ǢC\`C1{IqgL9OKp14P yi6Ê.dI3ub"_o9 F?Q{U%YF8f1@L)}6z* V=4tTDžohH5٫kS8zykܗtFǃP2x+I `"){8ժ8r1V;'ˤx$Sk׵nb cVl;^\2zꟉprR|^]NL"_ϝ bnk 5P+-Ja|19[+f(og.B)\ۚUE !Rya偓4+Ica$A Lʔ"{lbrTƈt;xzl`Յ=SzjTk%H-w}m?%Q3z iRP S"Xc|#zV9]mzQɭbso%{2#Qف!1M^hKфl׍YdIזd 2qc?lkDjN a03|af}koIűFA;ؑClnƋ'xӀ =҂uT)N7>q>e ~ ||23)Sf0?M샎ĻRKbnMwl"?*Zo$uݵ vF?ڼڡ6%d D9P~jjL񹎑:DôRr3y6x`8[b V[?r>L^RWkQ+VhYmg},b"j:M^:zzoJT,%iLPhtvѤF |lKOyZ7e|\T]FڿVW9i C؈N"e8?[E1338゙ޫT>rӬkӢ4g\:Ó1-B?Z!/iS7vW"J`cZ/]ʤ/li2A5`]<d1 Fu2*k@WAtm)κ (M﹙KDf#[§ʶc[h1D))aѻ^셤ҽ\塝fJA(YD<e#|N 2DvsE>zQ8^Lc@#\r!l NwUV>m=+ xC.W"b摌? YU`yfd+B<~ɡ|/-V82_'U+LeQ PV$fDՠ|G~aU[ѣͬ7l@ʏf&s3cXx9]8S0>r[QIyrΘQn4 ~!F7'箖9W.C7DjSAh9,۴ĝHRyF,<[b6'qpJfGh6L3\é3R$x5!v=QE OL_'z">QSi02BH*ݟC1wTF3.|IeaMuhB| >(> -60Q}ug4zq6]Awo1%>Ssl$h&,^yWYkI.Ԧ@Ľj3&{ϥWZNa_2g[@W4;++B}8ߜ&Z ,Govhz6'|:(R's*ֽ!66 .j`K/`gZ uduk_h׮RCe]HH&\,i ; u8||=) {oAlo 1D#h ~KjfqC2'h!C*!,R kaVYof 3/Sxӧ 8R`sFC G#͑E;ѕ#A8ʙ:%<0"_nY=B݀7QD/*}p:zcĮ7K.h2S:dU @/TkPꄢVbB-PAi |؆=ڴ$:J<_@^fuN&9t0Tjxjy_mf^KXM=CK?w<"+ Ł`t^-KOp\\ fC1PڶRJ@{'FՓ\Ui^lS4V9UPo]tgOk'DBYxPuHH3yu }xp'U_ ,s$[P0gz虲G1jzjRPúJ1|?alg.{yG\]+ӽU}֏?T*74@ 2M(l&g-7Md `$k4B@u, ')dCq,L5pd/?empBo<v3B@Y"57P;`K>խ2DgOk?|70ԬH!a}G-o Nͺ?vnw~'ҹե"u;ڍ6ϕ^wJ ` 2Miwg<̃|v|X-S@ݟl|B+#˒2)3S5nmq& 팱?ɊXXh ץ/x`,T96q:jQFoS t,P嚍OH9ĂXb̜D%ݝ{7bku,i\c-|[5~YcV0t\P3dc_Z "%cgߑ@5ݳ ׳*"*y@,=I{WN kbbc~]%gJZz.rii/v<#gsOi{ejVޯV6a6.׻pn&T(N Lצ(K|l qwQ#NSiK[j G5wNơ3Έ@J,i%.rE1EfbpR$K~|4ʸtra3 &73aAr8=ي&l}S[YJze5M 'OI9 9&ɑ%f3B, ^-;I' V碲O7p4ڛ@Dý)6ga[d"rYk$y s ~ޡ}5j!_^! z65I V.bz▞rT/m.=|1I~GhFR|X,YnsBY"jX5XC>wȼ0 E!̴ 69uCq,I3h_M5?k+e?mVr>%%f-ZxV[.BJT(,1#ۥaNɂ)8@+/wt/QJ.YO' {i`i4(EUi`ZXe d Jrff&3i-Bq| ?Y P=V La&9W$A=]+qu2 «&O19yC) ^ѻf6'A{ o:MhfupUf@hI9x6O0`ʔldNDriHeLʔHc Szr7!P\i1먫rހҧ"qξÉW(7ESA~)S 4⭖}%]&eT$Ai":’v)wDF⢽͞^ PQϐN~y'n+ _1FvЈ)Q"^tER3 .^*XoQٺ5 IC _%tlK:#"!$Hz+[hiuhh/h>l "I OZuCi~ߤͺ=1ӐA*qWٝqFPuXu 2ږ8@Uj,{eMAT 8_V(AQDJcwz}h k //-pmo H~̗Kܝ NʘPkn,>Mvc̣[3\ .af1b$i,Vt؆Gy[ˉצ(c]:s>eQ ΃7^#V8QPY.U^BPhE^.GJYȩ~tXA}\ۣ]k2! Ib9ހ qljtsh8AѦꡍ͒WLÇ8NJLeqκu :iAH?ϣU N}d#&Y&UуR9^a3S&!2Z