From 6d1611afa26fe5e9230ee7bf1446a8473d9d66ff Mon Sep 17 00:00:00 2001 From: Dana Keeler Date: Wed, 5 Jun 2024 23:58:03 +0000 Subject: [PATCH] Bug 1900132 - attempt to redirect www.example.com to example.com to avoid certificate domain name mismatch errors r=jschanck,smaug Differential Revision: https://phabricator.services.mozilla.com/D212329 --- build/pgo/certs/badCertDomain2.certspec | 3 + build/pgo/certs/cert9.db | Bin 294912 -> 294912 bytes build/pgo/certs/key4.db | Bin 360448 -> 360448 bytes build/pgo/certs/mochitest.client | Bin 2448 -> 2614 bytes build/pgo/server-locations.txt | 4 +- docshell/base/nsDocShell.cpp | 52 +++++++---- .../browser/browser_badCertDomainFixup.js | 84 ++++++++++-------- security/certverifier/CertVerifier.cpp | 22 ----- security/certverifier/CertVerifier.h | 25 ++++++ 9 files changed, 110 insertions(+), 80 deletions(-) create mode 100644 build/pgo/certs/badCertDomain2.certspec diff --git a/build/pgo/certs/badCertDomain2.certspec b/build/pgo/certs/badCertDomain2.certspec new file mode 100644 index 000000000000..d70891a215e4 --- /dev/null +++ b/build/pgo/certs/badCertDomain2.certspec @@ -0,0 +1,3 @@ +subject:badcertdomain2.example.com +issuer:printableString/CN=Temporary Certificate Authority/O=Mozilla Testing/OU=Profile Guided Optimization +extension:subjectAlternativeName:badcertdomain2.example.com diff --git a/build/pgo/certs/cert9.db b/build/pgo/certs/cert9.db index 92235bfa3102213ecdee16b3284b003eef0d5f1c..9005540772bb43ae0219fc467913c5c23c71d255 100644 GIT binary patch delta 4171 zcmaJ^d011&7H2Y-01*TN2qFl`zJ(+#ic4*))!J9JZfI#MjY)(ENgyOZmV0kdKbN}H z4aa_Ht5u{{TCESfZgtnH^-=wv_7k z&YU^p^(wty<%$8|xs@@ae4q1Cxhg*~H1_(ZD|~!>^0}l2KTyhW*<8}!L%q9L-XAhR z9uPSrp8(%`Z?DP|!R@B2xgxj``h}K)c8v(G{g|buATvhjTscYmo9?O$4^T0=ZV+P$G?&)vQ9?7lS09|WDy+x*_lK^U7`r~x3>+Vpfy1R zyPIm`DX57P!6)7$11UHhD}t87RWTH-93XUeWKH!f;vADSoSI96omSUz?3?XpbQ+6#|#3p$jdM4j82n6Sc1xw(A-WJBY}ool^86Sdj%^2Ppdon1)n54lx0a z0Vv@fjFtNlu^cVqWg3Mq!OU>z0cihYI0Tn9JeFm^;sABBCQ+Rrhtn7s7(Gj8&>L-b zgVn4vS+pu+oz7fYVN~g@X7Ql1#Xj7(Y&U<0o5?wG9z^gi{sq2-%jKi^9sE1o8vZ;7 z`5bO6yMjB(p5=D1F1CgLjz7&e^DB89&Ylr`Dj&i_(quClvZ*{P9A<%PyUuRXzhbfsx0o!Y&+81CRGJYAQvhD3 zQFxg~i_4TwC20Y$AE+#~>UF7$A!Za|;QK~5@$XDkNCVLV`MFXFT2CEA++5#eadQ@VF$ZXY@ne4`Ddo~db@Po19 zF^VRR9F}s6wboLi*Y&5?qEIIZF_I4Zk=f}g>_(eKhyScrdjyq)i}QAr=4o;Z)rG`# z7?miA! zCJT0KHX2MgfIjpqML(zp2B$@57Waf~$ylq^5J1KL#MQs&?MJ!t{;&X;%w`k5P3#rU z5`(FlW{EG=V8~8etWzASS#ykf`*Ric2|BY8QmHHyrUm?Ir?uiC@SJM!gPNgi7XK31vk{}mKq6{dM^p~~Tqh*G0~HLe^*I}eDcr=NmJQGi5>VQ^B#`~>t-{uK z;bI8lsTJJSNuecg#@^zPZ8I^oyQxOFw;84|DCd1L#+{y|6|@a&#iHVE68Essu?@yE z_{Qk@h&aUkAFBNr)_?)%&d0=IOW{hPVh5bb;ESZMo53o$Aw)~u%pf#!4_*td6|Y5q zB(xG`+#w42ZSZA?ZyITixK)(=_C1J|m+ZyLk?8nd;(SxmL1ENB7|GzPNLo1DMM?|T z=MWAu0?jx?j5f}{E_`_iu7>!Ul8oZsQZia{9P5RlmgB@;!_6ci^8}pC;46$fO(ugo zPW0$BzIj8DkqWF?<`wVP?AcUI2EvRH_Q3sB%@e3SZFuL#svG>-hR$amIe2`lD*Rpae(Rfae%&P)_tOE*%vBw-iOaJDDGD>#?7##`d%+q&3uGa zAu>FYL=%LrM=%zv_CS`w&2f>aI$o1F?T&By`SeZg_w~C&z6QryvW9^6DWfLQ-xN%z z_$>ak<$7LYap|S1gn6$%T7}ytoOYQ;MEC`zYFc+YRtuW-jBxq72 zjOSHM+lvtg2EMe@mh)Pw{Ji~3eZj8i@zJW_5q{C*+8>)6%w_)e?q=KYuC_gfqghd0F?yK&&S5ht?KJ)isy^phe*8Vm&YGm6Fb0!V5DodWQTk6|7=U$25 zKD@o)XwmWsmMd%b-jaF!?l;HWUG50`<5Jm|&Mv;yFgsIr{8I1I{DtRBzfU}o_rdh3 zRfiYs-9Dz`_375#yb;UYw>ZJ8Ey0@o{ z@IJeF{E6uU*IxWo_U3P>YCW{&{MDlVpB@aYyaN-~FicFK;iM0D(B*b=4u^fQwa2n& z&Uw>~GWBe?;UvCMwi@6(ZT?y_<6_8jSvXzJ;6sonGRU)8;LL=PD>3l%S;(~#hL%vOg({{D;#OPAc>Khc()gGQE03wc$~lOyVQ_|D z`!Q2^Qo{r@Kt(O%*Eg|j0oka>P3&Dh8Ya|vm_-oQyRv8r!Vhv%f_RXLD(cDMyV!75 axK$62Ly$q8;upH)blehrcJ?fQ1^)scL{s+w delta 3597 zcmZ`+3vg7`8Q!z!W|Q5#-!Jmo&HK5V4Uw0{3Kd}hQOZ<74Vz?1mcZT3W;Y~v@4Y9f ztxAOg3LM9XMIu-#1r_WqGayD{MWt0nv_;gCLE;k#Dn$n;po)RYQ-7@#U{?hLB?BLn z3vi;0fx?F6r7?(xFKqCYFjdZ{n~DY4=wKjy%N)A^vx^u=TH+}bU}*sZu_ev<0(kNm zh&ucI1Odi#88E#xkR!ko*%a6>2g6x05HS?WWUB8PFJuTXmd?P~XnL9eX{ii+xno0$ z0PB+(81;=N32-Knfsv|j5(M}MvILA1nln{%~qy5rd)^-U@V$} zqf_6p2=I0k1ONE(pd`Qn$iUF>AI#BEvf77+SF_#q=bQZHeuqE5yQzCdz#EwDpY5;d zIoPwMyC8fyWa}DPwPsaQ@SWgbV0WN@8d`_)^yl=++UwdP^|aclxO<0s@96ocr)t&y z?z7#I@ak}8XnV-r#afl8XxFg6CcUUEH~pixO@w=EA|1b}owW)vrN0DCDAm zDe*JkUT2uVy>ju?i@*VLxX9+gv$)9QE*V^;^B`$lq;h2n7s+`4I4A%~TqH6jo`30j ztT^r!i-#_OGr-1#5x4?2!sTvdp$Q#A4R`;m7xHXYT*|k~D+*RRv;^%N?I>ENJgHWxr?omIpe|DPsSjw2QG@bYq)|^tYn4md8Z;ak zi7eM=D=o?rWg*#*Grf7yFa>NkEp`i8FQkj^juTH;%%zq(ifeI)Vs_YSD6X!BO97tV zD^=R6=(zGG7zB8IL~`3I=(wEO@B1yRw3N{?-yBN`#l`sfhXL9x9U&ILFT!$M0D z9rLZR6;PaC1s4N+;b~ZA$)n>5_yN^iVaugBrv%OiIQ}oN$dXORe0waJ6ldTcRdb0Y zonpQ*Dl&Uly)!g44W?h1KZ z>x8y86;^_-c8{ycE4PyWkT29*BW%@~u>Qsq9=X-q6YvGStyRKanFgytSI86cwJh+- zNcPEXw|ZJDgta^wmV#za>kMx&G}FJ*8s7x(hX+4E=lkfc});r#F++tyGWEj%vHLp!RF6QN4x&>L{t<9u*%^ zVHR-X5h9}MvtR?jL+w%;c53i8d`5+7;@tVkV&Ufwd*J$+Lm#&BGv|gMKX;fPF4W;x z&c;uR8(!kXpbR((iI~OwJfL2W&3WorR(#yfO&$MvHet`^Pj0?5>Rl^+^4}iM{8IJC4m?H>YEEWaiEpZPOS1;_k^qlTgDx z_mSE!YsM>nQ=abd+iUVm@~X48WiCw_PyQk9xC;LbNps-psxoZthY_ki zVLaRqYbA1Ob4Sv7F-PqYn1)|@5KaOm_|k(=m1rks^gaX!Byy_r8IYEY&md_7aXztz zI6H94T1uSr=|*G2TKG8xc0o+KHAWnGlw1Qv_~4_|Eq%*uW7=cTCXw4<7KXj?4${K? zYvGKAz(lSo489?;z8ioUIQnryUVv|T9FoN(Em>;3{5V_obC2|X`36Wi(ts-8!8_FOPzrCBd5JkwCw+GIJNao6o7antdKdr4fP95a^egP9V!w^%mqq@SeOL?9Ih_EV;@(KO@Se)t$9*BNIb z4JKha43hEi%ar8H9qWx5hu~cjx#TtS3-mxv!6ro5xR zGlujU+z#>ScPR^LN!k3izDss-?;FH39)I-)w|s4Mya{`(AWqDHG^@;4KS6xY9w)xB zyp-%G#|Dkq9AG3k&QVa<6$2(faWD-Rf#&cjYZk<91VIJQCZjhNpBc47ABFuDIH9J2}g0JFv4|(j@xPWX$qPjR4eR zeHncL$=8!{Wf|4Dgob=Z885U`jg!}sgM3fXTC(GnGI^s1mXkNS4j*4mAD^=MlyO&w z)DB5&#;cipYO!fP@0aF+8hq6+k!qeOA2-y1lqi8}!AZWqIA>Lu_*LPaFr{;r1&r^) H(!=n7M^a_1 diff --git a/build/pgo/certs/key4.db b/build/pgo/certs/key4.db index 87004562385063d167016b79bbc18e1e6a732c27..59d870a9b4b330def3cfbf3d8ab5d5d8b8f9f408 100644 GIT binary patch literal 360448 zcmeF)2|Seh|2O`zZ&|WOq{$wc!Hkh5OUk})DKW!fEMptHXd;Ogr4((JELjpEl_jYp zLP&dQlZr(9qW;4<=i51*$M2eX-2eN&|Bv7Q_jbN#sL%#sTMFpD;eM{q6X_Iy6MBNQ@9n{fy#G zG(;u6N$pHJkwi>dl6WuCFtPH#ItgwE0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X0D=Fm0--!S zQgU)^^yM@nDU=*WrV&>YX~e%i@|rtan7UdhxSE>TS}6Q=tAZ-UU%}DY%Ffhzoq~J7C!&E&tL2NVE;PeGvnr#l3L2Pe*O-AAw-HlH9FcciV{ntk$L_sXJxBoU8Eb4hpJ7EJj<+glm2ckNGu1i6nC9ue)&nV~zRnUu)>7t>NUBl3mK?^GEF% zQZU(%_G=BUf2Fnk^XBH0#!snl|Ukm&?V*higKc2Qqj<~}9Ne>!&;g6`Zq+}u0-+&jIwcZ9ij`g8AybMHuuclz^7Vg7hOzanOC4J_u5 z$C+CNi&)M-Gk?48{4Kikx9I+P%iN>rV&)!2 zcV0$!UPgC*eck!>b?2W4-2Az?`Ezme=i=s78EaxN+Ss`V|MPIJJz?%v%>14G$T%Hc z9o*a<{ydz!!=Hz9kN)T3T!lXm=XU$&;oO%0Je(8#^Kg#!kHdMNKM#MMHZS$(t-nsg z|LwH7r{s@2=>6)T_g4q}ufB}Kzxpx`|GF>Z@Nf71>wy`!{?(Up_}2q74*z;!#^GNN z%s8C;tv1(zaX9z;?a#xx-*kT-`u{p4|2ho#&*A)Unm_JK`c;QCSH~Ym#Q2ji7&RSs zZmG3P|Et0H>rb!`_SZ27<7*D@+}9n!*bo$lX9dc$A~c_5^WXI=5%dND5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009vAUlGVvV575hiVF#8{C>80l&%np@sE%Y3MC{en!W%fnjw=e z{ntN#-JOxo-R=LyTlxa7iPC$F1vuE)qG?1L#m|vKrBbMYW<>wFWieQ+7Dkhs!;O<; zfii{a7aHSF)@1xhcmMD(B83{gBI1vGuOP=0!y-b-EBwO4@PWr#FOGA3|3F{F_GVX> z(tWz1FWcN3subnL_+LlN73ToHV{yFdfqSN#V>?qfJSUtAwZ4w7>lqF&^SZ14!1U@x ztE@{Ur#n81Z+kCG*>2jpxpc9iDEsQm>Blcw>To?5+rh@&&)Zgzq2haPta$ug__E7) z(!|a_s?|%gxZCG6JaT`qtjDm6`}K89#KghgXZ)pmZmD^tMqX|UpvW!P{BhN4^*Vve zC9kYzbL(!onD|IV$L8PQ#FpeP z7v1qB_!y3l-OcPA~~ zL)-e+!;CREEjjr`a*<1ehR(C0*f3kz(lBA%eCipN8J`5%xCAl27}H;$F2Lw=Ds=j) z8gPbbxEb=l#)wBQGhGlU(tM@&!OqDGRqu+gX_~OJv9Yr$VEDOt|5$~c4X36$@VdSe@z8PKC?YZSS{c@=r?&punv6DMpBiirx@kvtaWRLYeK4d=9 zzq|NWSo~yZ>8T$zUr($&!9KZ+M}G1&weO)oc%y|+QfE)1#G9#^GsZ=`CuPoXuC)j= zOx2*D_Ipe9zTNO;iFxUWV(WG>vpym(vE^~(i0|Ely5+H?zQVR=R%`Bhg!RUCCG%}u zleYYz6Wa}$+TNqC9VWX%L#9UDFFdfrL_D2+-+r}A++J0gxLTL9wesEBnG8o_zz@pN zCQ+rBHS4&zMFY=%HjPi)I{L}LVcpbo6OE(eUm7u&QP9lu z)i&t4Ks6*Ree90L)G;*JwnSNMzmH^5(8>@DgBkt*A5=|@*z(DxspKJ1@V2H`acc! zoFBff6|$-%B%JTyCQ-!$rEJ_0?^?CQz1(jqYwJW8E-a~EvXDNp)^IX_@sIV=JZ#*E)^&PM>qCQA#^#MBBko2wBi}vR1@t z?bpIDPg03jRPP7qZBZv!B}Zg5Va46Jw4O*ECgMJX>3| z*EA!d$>&8yL5SX=d@Dz1uAA%P>YZ!yr@Vd~Zc(=qS3l{nQTWz`=89{M%gJAb(zs0? zDx*qwoku%+zdtR$r%+pa_T=&%Hy<>9sjrh(x1%M5xXbkW$+Dv0_EhOIef3VeJum#e z-)XjT2qTd4Rs85^IY1{up(e%s==0}Zx80|BZn_2F8oPw z?YJPgGc7kv9;d>uHQ{h0xn^IRO7#FoY1YR_Mh`UO90Ly83cvmtk~yAYy<|y3@7+t~ zO-na7M)q}eFDrU~FjaUvzLwL+v43L{#_i_vQHH_-6>aR`;G%lXxw~K9*oCkT%(a=DO4IcDvaz;VZ7qcTptYmK2`w3H+PA~EynKV^4BN4V(jLo zSV@fdT*4zJXcrzsr7^DA6x=D~IP5aa(z)CD#boTl6DgsgLR2h#F z6%$R13y-1&C8#l$(V{Y5KFNq2t2wu5bBR-d`uC zGw*t|`-=tb)_4}B@lzy+&_QGGUa7v;s8uz1a@GAIzkV+@@i?~D+tRm)>%ZVaZVp}5 z39j717m3f}?!3O5c-Gj-%wB5s`4yGJ!BvF5ML|pRmTZf(mh_{n;)`AU$S$Nv=~Z7> zn~ES|cl@!?NAV}It0z@2ZA?%j_>~u{TOQ=c9~X+cnb3V!>Cxw|T)ft7(1G%f7~72p zx&u33J&-w>RovUBo5etsoiz| zTxaA);pI(kB5T6J5O>|{EwUYmV0$*QF~mN^t`_$oYiHCaS#E?%D!DRRnwm(Y!A z-7jBT$9p=qgt`bd`h1AsqFxzvo1E-CX8-C(#_i-pdCPR)=zVhA2m&re2f7Rh+1XXg zaVsubb$z}1NX_3&OuHuFgkHr2zASzDqOUVDYoAqhzshf1|5+jM+z~l{UH8)?Htk}; z`NpSo#!W}>E@sPBu+Me;@eaSVt+?lt_uEjr;<*Z&NbDdI7>fPcm`L%H<$^LG1^)A=ES#1=C3O!AI4r@uiWz_{>qNH)~J!LC8g=M5ox0bUg)HpV)`^>woK-T z4p?}W4F;ZAw3hKzV@Z4Xr{EBcGFb<=t3j^k4!_t?azUi_0cEM^)l;{R+}#>6?xW+b z_xXC${m${^sc8ef#rB3qJOjmp`|309eXMw-8_iyO2)~`qR&CfE@-1fJ!S38;SDu@< z)kKI5X%)6)d{Wow4LtbOCThwcMmDx^@h0}=W{Wo%M>%bMGv?DoofLIHxo!I6w&Pi` z)4Dq<2O?Qfs4Koo5?WxrYw|$UvYvG>OSN2-w9_@8pYd%o9F1T2C6cMa_1ls;?!h*A z5ux23yg>{F7g3=}Gb7_$fiHeU^F6raczyMo$)3d3XWk6?%G$`kj)>p)oznP?{xR(R zZJ$bY#Q~v}$>M`otpze~z0CS{vWrdDa7yU?5ajU}W^ZSz3B-`4ZgE|Y` z#}srdCPlYX8ba13DV4wDPLjzQ_&OoC$|fHrbF@J>B7af7T=1k{X-vd~<~IKsHw)Qv zRut5;t)69LmaoML=46hbo zDA=C(*w-Xb+juz@w_meDI9z?gI{eY#`FEk2+L$#zEaR`n+wYNLZ_8Xu=Jt6|rb^+L z?0WS!NG7* zV|zftJ~_YGdehbuPIrnm1Fj9f`lxd5?O0ycs7(98w!uc;{uOKYmxuQ~kS$aUAJSAXzDd^nR*ITA)l$K(~ zPC5+bt=}K<*?yX9;mI!PR{i7EEe1c@2%E~fi%{c>_qF?0ybLm7MWH$Ob~in^+CF38 ziqpntfiLWBMY4I#?n(ELY%_m!=i_;%3fW6VlB%8a>;qCqj}EJR*?O4fSv7k-zxp3cXnoXeZpVx~^vDb5vzdsr!k9*050TFO)sg+;J;h zgZScX2H(3CmMpRuSofTdV^vlidQ;=~rusL>rk9sF@^6+fd=$%vTL1Yf+FoM8F7)`* z1KS+pI`yb^mn!|82K{i2+T#0*9K;h#VyAFloUt!o&tFacPyb?_>%jiU)uiO#uO#P= z#p(Y4*RCeHrg!gQJS5|4G9obCk2v@6m|(0bM){Acxh1aTu!!&|VpM{HIXQ|(3845f zE;SWQV`xF)bJu`aX^iCDJ^96i|GIYk^WqPyh(Z5x!6@q(6&^qdB`d6rq4<;i6&xaH zlrTyn*U zPq}XXU7j*PP*BUQQs}gLcJHk1#gI^;Nr^4O(z{ByYQ&3Gk{+Vb9T8nIy8ATd{X>=z*F% z;`%dB@3f+QVy) z?^&$KsnIT(t@V6*cfJ(1`ScH~WnZJ5E@5wSRNs~6$4%~J@rthFh)Pl4mFc)?i|I7H z+swxp33;q>>~kJ@stTIzX8L-jBV&=rMH|;)5%Ynu(v`B-b60dy6$|24OX#E3`}k@X zJKi+Nn!2y~o%@2q+09PpZjZkD;y^6rwDD^{(|s&w-DS7oa92mG(Qvk7@5qFdlwAYy zuKPMy_1FEhOE+!k-j=&q@@6sSD_&oVuQ~q1vyN!$_1&_jvP&`cSj?ePVcN zu>DSr+5J%`gOe96U*KCq%Vw3vO0YTK?b}dHm*}AANg#JR=3P9K0ISmRL`|Og7yVE&Jf6*yQ$0;^z|u zgViD`8%GYZGPxD3uc)|W7g-uxp4zyyP=UB@ho4QOd6_9^?67rPmEaMkPs5q9luaRllXdg(Dwl>PN$yU70wKIRWKD_udJDb_?ntrAV6QWX2CckVv)K|6KJ-mUT zFtYiq?^+_E)aBD+ea<8193D!VYl)>J8lUe-CkP!_Xg$oQmHT;MRo*2VWrHiq@0t$9 z$K2d!^gyUR?pzf6a9$zEk z6JovLxbO5+|1I*DhYnchbJJv{YOfTBy%VqU#{0$ceXMq}c{DB}Q(fC*K{@BpT12BUlNRQJ5+W=sxMn8MnLKh(|B0s$wW4+%m1t zyZ>X-xOBjw;?62VDL!c{A4>;HuK%LmhjrUkvK5?$Pn{1Cy%=^7bC0NDMIpVeTchxJ=DPWRD7@kU=b(r4{E@yi9f1{OqD zjP8HuhreVkg6}%$5uBFe;49U&n>|M`{IM%~w9Vp-!LkD2aeiCcKl%G#YL_q;SIn!lp^pZ>)fh2q;kcL4=&AOHd& z00JNY0w4ea{~rqQGaj2GbqtmIIdzKh0p36W1V8`;KmY_l00ck)1V8`;KmY_l00ck) z1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`; zKmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l z00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck) z1V8`;K;Zw!0=yiYY}|ZO9vpKAT+_Svu=8+m@^MX+-s5NNnj>`vmHIvP6XOHCfdB}A z00@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p z2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?x zfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=9 z00@8p2!H?xfB*=900@8p2!H?xfB*=900@A<{}2IA4ip>5+&gv-4iq1M>M)8U#R8RL zkxEKQ{vSdB+XMj+009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X0D=Eg0(g!nJ`5JCh0)~Z zaO31ypiH6qg~s@kHKSul{^4On3N?B~1cgeaPy<(x9g)ESJdqL_ zN>tEPuy9xKCzE0V6=>vWngZiwIgISwodm?hUC4ehQ50H&f(12@LM4-<7*()%jP6{_ zA*RVV)0J@!<3O}oRu!ZC$D=KAC5J_XM-ihE6wJv{G)e%) zk4Pgcn8wh8!sj|-r7@Co_v9B7{%dc4mcuGy(0^=5)-ftPfD%epSQ|s}C;KZnM9?T< zltdzp5>91jJk1)cKGpoGQz(wqHdN|h>T|{icmn|t009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sHf&YdAVjLQL(KI5B;^#=AQYq9xGorsJhbkL6mO`bGqr%Ak6e5kx!N(!V z77-ZkM`UO0ap6Dq$Z(5Mtmo$=e zCfPYzJUKF1C+S1tY~sVDgd~HcgGpXVixU+Sxe^N#Nr~-=^hEOnn*@!7u7vFgV+j=r z!SPY?F7a>TPbCP(_s8#v%a2Qpmx#L+uN(I)nrrliXrt)c(FM_;qR&PrMWsdg zNBxZIh?b8UjVg|;jLeQwjvSA&h~kOtj<^v~A88jU92pw9BI0fMO!#0#RD^cK-U#Oi z(Qr}fO!(e#=kWUQsBmqnHdT~bPmQ7uQuk7w!<@sk!v@3lhRuZ4hed@(g*u1Mgw}_N zh7N}A4cQwK6)GAs7^)pI6H*^sAG|k2J9s96a&iQK&wFYz{`PUf!hLuf;a-7{cm}yVG$4j0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0TB3K7Ffbz${tM#^zkD{ z(R?s?j6PNmNASVSylgA@}`*N|d8RQEq!Z~<6CfWG#xjbBB~F{rM8EdR&p*k7k#LW(h{PNW!* zx`-6xP#s9IF6shOtb=MtiV3JTq*xEt`kM>ckBIa4`?c{F#2kY<|Ig*;Pbd94y%{OS zpw1x0cvKToj6*dd#k!~lq*w=a8Yw2A>XBkSRNe0`I4ssLfbpjmr-RqQ>7z~|<^)tN zQcl95P9o(v5~>C%C+VW9k#ZanRfUw}F{sMla{mCbzqa46{hdI}38)IBoUy-hq@1z8 zGNhcbzfz=}vA^R;Ib(k%zvo0hZLIFE{S_nT1XK}H&e&feQqI`lF{GTazoSSwV}D1G za>o7+|DNOYasK|l_IC&|C!h+Da>oAhk#ffV4kG1@{T)Ec8T-pa${G9H|9g(X2M{s8 z_O}l)C!lhXa>oAlBIS(z?Lo>J`^!Pf8T;Fflr#3X>$lvGr0b8v{@UM8#GHWIfs`}$ zmyMJ&_Lqf}GxoO~DQE026DeoxZ`yL;F;TzAcp^?u?>`%hM2ra$ zNHGZ)juhiaRHT@s8-^6)h@nU^9ux9=j3r?FevOh~#F#)qib=R2q!>pEM2bne0Z1{9 zNJfhB82{g5qMwdFj3fCX#Ux!Hq!>rsh!o>7-oM9qKP*<~ zKO5VC7!%eb#Uz{;Qj8<5LyAedo=7o{=z$dDG48*|SZ!U>ud8M^#F*fU6q9f+NHLD& zj1-e}oseQ2(Ge-eV;p{q^+^O>@~>yi9x*1^A;lz|EmDjl*&xLvU2CKmN3=qU@fgeB zV;q^F{cGH>MT`k+kYWIo<@fg$JV+@Yy|LY6131UoGg%p!; z#z--aWP}uxbPbVW9MJ$N#$#6g788j2+JE~3t&bQJ2uLvrr-u~dNO+`}q>Dp}aYS9D z7?08UJ=P5f_}f&}MvMtqq?m-mAjLS67E(;oU4azih?+<-9;5MFtQVk%^Zzv!mm|gm zb)=YtQ$vbzBvquCq^p7y3$M_P&$lXMl3 zVjOV^QjEvQ{~qh=2K?>nUJfxPEJlh+I9a3^N0LE`NxF-WVjNK#DaK=@ev9#B5)u3B zl1dUWCP*N~B%C->j3bF5#Ux!(q!>qBh!o>7BEQG_+IqUb{)`DD#sndxn1mBVigBa` zNHIxQ04c^1`H^BghVS=SM^7Jz|If7|FJesKL5fK@ZloAT;zEi^x|~Qcj>v%&<1y?4 z9CCaS#OUa_@F;&l#(z%GsYF^lMm~CizD0_%^aC5L2g&Ncyq!^eQa5n%)&hdZk zzs9eK^qu5EtS1Wk2KjXQ$Zt&W9`@GSkhT8#dK0fh>pre?@~rmc@gTXkx=Xu7yY{)N zxuiQka$f1Q-|?-ZjYF9OoBam6Gj^i3VK!H7mRYA*-LcZO+`abIT8lM>7T+w~SJ$mx zU><08(M--X-ekyR#j5Sb&x}_Y6&QXnbTp_k;9g18Z_$?`MCo1EQ^lv@9^&+M_vuXO zSZkMRqp<5SO_+sRp)0yppf!^+Xv(%rd8><~uol&(_DN{iydnq+22`L6GySQvI zI(F&6Qgwy&B@dSn=1|OmDqD zx4l7DZ}5WGHD)EFX95GXHvh~UF1Z-yNgR=d zk}E&os(4`TmHY94NL#Smo-m()w=^N+?$8%4)zXhg`xKd#T)nqMxu+|s%k6eOTFU=0 zk*&w_sJEl;;+GffHoyDclt4%OBbLNtSSY!yRVmNvE%qti7$5vSaz$Txf!>N#wlF}hdlrP*_wn@n`#&RGjzlU>fH}+aXN3l9sGHl%4cyP_ZT~R# z{q2-uexK~QgEw>9qsN4I^w811h$V5Xj3BG2@#9G^b!O`=#oKRx6dg1znAwuE;fC>4 z@oQ1<)}(l5B?;XtYqzR6zrprZOKkl9Jzc6)TV;2Tjr-3sv8(2xk1gqFAH=Uf+zI<=0D-iTO|r4htG%+K4&|MvTJ+s-c26K5YgIKIQI-BIRa=5=&> zf8sjEBu5_RANC(BoGuxweSkXtRDf?0k70J(Sj?SW$2zk!9*b9TZ>FQY5lgZ(f|Ldb zyT$50^@P7{|z5J?@*+FI{zmN2sc(mqPOQY*my$!1!x(8e= zg}*h_u%E@{*xwmkkVi*v_*cn){uDnJ{@^S)aiBfvwrGt-7bS^OH)fssVf?!pp3B=I zB>cF}b%j05N^WgTK@B}y&U2Smp~RlCyZy!1-o1xZ*6fMMwsBr4m^VO2uSYJ)$_T1& zOH5Rj?Rf8Wjffpji5IyidKte6kv9c&6Wz7Vd?;_Lu#~Rv_pU1ogqqON>kvz_G=hxinR`E5 zOtsa@#wNXZ{Pxh#j0IyQ-d~6ELxQ?EBVjz(sC>et^jd3F?)7?m zW+m_32)=xU|4Brw`JyeHc_R)VdfZz?A5M3ZQ=DelOW$zP(H@8;SsFp%57}SUOi8@l z%#+>OZggVICgRk(vzf&2YRTHK1*>0IF)L|9yP?wlD&S58szlt!JYoGhTlYL)Kapde zr&A(Ri>9B^(e8*PSsFpJj4gQ zS$Z@%m-qR3I@%SvBr7B6$BLITUtKP?2M!*KWRqXTRrOiuBIeo-;j#O@H=Zs#$Ih%| zwBGX_Be+kG#Jp!?wL9Ye1xv{Gkmu21|98!Sdyg?`?O#8FoE#;=m)dq6d2Zs2F)1 z9qou%lBE&!(PhGEXjKTV$H_t8VDi?&-TrBBBayKkNO293sx-|NpZFd%m}$gM>`;vWN8F(B{j8vbf#5hMS2f;Eef@`|6KUM zovKF%PrGo5@O<%LdKDD=R+S{xI=e@rz*}ag@ZHiqEnlkSFX%nnC*7lcK6t!juuEw!_@zQGNM8v>h!^KfPDQdpTA! ztBeq55|_ZNB>CWAdQrsQ&nvr{|X zNVc^;H-xF$4gyb~zZ`y2w4fmF;}Xpxshf1PC1OdIMv%)0$@8st zn%xsMLvh-FL3!kr#!geRq(QA-PvND2pmUiIJ zE9i0=ER?CAtUML*dC93b-{hYhkJ->Xvzu0#Gb<_U)UG^otkLjA;}hA7d5gO4?DtWp z-y>JVUe&OBbbCz&9c_VFlBE%3wHCME(t)%yeQmYWM9Qk!G2SJj?m+{4l~a^%x14<# z&8#H<8x{T~CkPKZicH6IYLZ?>?Br8&{~Ucy*&e(8?asq{>FCvnC0QClKkBaBk&L=~ zgtLF8)qRUcR8^5Kj)e_fpNM$a}V_`S?Z zYA4*#u6l)z&KFg8zqE=+m1agA#}7EVo8=pP+q~UGb{QyIv(zI zQtWHVJyqq1_zZg?F4&jTB4EmeH_ry4$wJGD~7{9ar3ERS`PcLcvkfzp~Jfx*=c;%s!yJjr7kNIypx9`Vf_uM*VIFe*1l%lW`J(teLBkKbmv zf{r#qEXmRc5}cs+s&v_Se}7t&a`YO`z0Y&f%$V`0N@ck-1I zs)~;X?AdTJt9MnbQmB9NzU+YIMpmggb#$~LVo8=pkh#SZ;plq1{)g6eU(|LvIWBt| zJW`-~K-#e2`{yq`9=6O%^7MY&a?|D>J3HoW>#bc8-L^TW&hL&K?kPl_3CY&TWQ-sK z#F8wHAiumD$0%FeM>wuN>wV@hP0Y3A7K`Te+{nAic(I84YzMQFn%uiFHdc}6s&myX zJD;qn8Q6kXEVw3N<*PA4_~3P?la5}ASdyg?l>X*QUy<`v(`3V04lb<*S>?%X*JjdV z*_OB;O%TpCImE2wYnnilLE#v&N|3xg!$y-Yv9q7LNwx;1+I#arV89GN9j*U+$=_ZV zf`t(@crwH*;^O7l@j=%Co~pQaTk~rw0*ahGd*yO#A5IibF)KN!)Z4i8Wa7S1PW5LO z6bn~uQ6#UqpLKm@bw+;I$#s=W=x73RNmfSCBbT@*6%V4KVl~LY1}CFZCzM`h?!Wq7 zxBQuLW9!PWS!N|iGyJt}*uHygjeVd^aCbO{P4ahfWk02G_VK2Rlp9orq#j~PmPXLW zMMct&j6yt|RyqW&n(o{Z+b8ie^h2sdY}MP|>wY!A8p@QG%fq&^12;1 z)SSS4b6UbtQ_2qNkUJfXM=Z(G2$BhCPcOP4PxX}GyLg*BOSj3lb&6yE_p1*T_$9l< zpPDg~RMF;7YgcaXb{X15%UUxNx^mYFSw{^HY?~gNUfWN}uXHpHu_Q|)=$v_<$R)P# z2imw!UgL50vNyc;;jqaV+VZ`K>dbQigB{FDUK1XDtoq#W@sa0*%rhD{)EzGFi)X(k z{xfr!y*MDe6i-L%B9>%n1QoF3x~jPzNUpg!qSPi&t(#bJz`t#P^F;LiC-`sskMJ-n zsrs=us;uQ%SKt@RrG(DQV#A@{>$0}m497d1XufDZnMgPM2~3{SQ|kC=E191Th3+e2wU2zq-}W*7>jM_KBr7B6p`e?;R8h&* zQMRg^YvTqog;afpw+f@UX&Jjzl|LHZU{+Fbf7Im0`Vqw=ttCAY-EHY_sN{ju+a-?f zZTN0{&Z)nOj>aICWN8GY+vvEOnzhR9{MgYZ^#0T!=j%Sv3lGjNO(@)%w^31b3)7O5 zW@Y^}+q{GMmVDA8>?(WD=nn5y)O_aBqZEAgZMq{Jt%X>Ur4gi5UY(H=bBK!K%Xmqw z8L-~k;#=27+T#DQN8|v{OfFN&iLdb^J{Z6JU3{dZlPh@*T(V_uq;)4Iw@bZU5PO1P zMn|teEXmRclDHnq+y8Xn#PV$SWnA_#mQu0z_}}P1xZCPl&-QsHi|JJmMyDaVoDwbZ zHseOBw(9?)+*R+Xq|k(=D9RWjE>esEXmRcO7<#CuU`KkNiW0x^N4qM_R=u_ z2j^SeGKmvU?=AbWrH9$mt$#wIpo0$+JZ!J`AAqoNR_0aSa}5xjj~=J?Ll+ z#F8wHAlxE16sAEl$0|6cO9*IHs>1ie?TI3&qQy(+AKaKC9oF3+Kg z_kNk}&r+Ousy7h>-wrS<+3k(BaS&-sP&XDF)?23^p}pc z527UO)tnocNhZBLIWA|^AFrak`#3ty`;A;depLIrcl|GePpb(ZVB1MYDePtphD5EeFJ}FimGo;#IYZ4dx>QhqCv{gv72!aU zuQLBy_d_RfgWXQTzEgCx5@Jb~MvxA{vr4ArGkTv9&m=cjeP){M$wQkSIcYmx78Lc0 zb=t|Sq~$8pH~EW>T|y5lWS(6tJu34ea(`g>1!Ez(`h(wzc|YiA#ebFj=c}TzFoK#L zWAshq^F_m|bu+vb9?yDgk9QmJbT0Xn{fsBvy_U+Xq;$@#;*UZ$T76?xzvK46-ly(Y zZegc42&puC=_@sBFs>(;A(v!j1Z^hQ^!Z z#Rr*{e7?%?oO|ZF!y38T3MvbiM9-!Vry0FGZ_?<0wkG26a{?WWMl8wF2&%MK9;&~s zu34SAH_7@Go|>k(w{hZ{(Q9k@#`67(cyP>0-g!n?{bVGG{{E zn+PO^HuG>BiPF(a5lgZ(f@G#B8s?JzuWYc(*c;mJA6;%bePj^Zn|>odGIw!~TQ#$i zwQ{#BO4bDq74)ngvG^*X!l(K;RX?{&E5sytFeOtspN>{QEXmRcx^?J2N9fw&Pgfrs zZt+Yip6Crh)x91(J*c#4a(R{5Y!0)Mhi8iJHI4}%G)@#VNXo_^56ilBns!Ai#v;lz zr}toDV%1EA;dZi_OeRo^?8U z&UVJrYGr`l&9Q-)$L7RqY?HVnlP7(RvGNWXjK60tk64nW5%k5krK()fY|$W(UZXi` z->#e9HZ9jwFJE1_y?gv^jK?KrC9AOV1^z!*W{MZ7R;{14s64^8Y9qa=e68jCu&gZE z%wjrP?q4PU`TB({jG#)*ZLTP>r`DgY2lDYYM}M@?Z;9o%xXjK+vru|lai5D>N%kSm z$R!yaib0po-q`=7^s&j$%_netv+O_jeXwN97IC1X7bBNsWdv!YppV=tI?FS#oUEzM zrM`d<=hpl+wb^&-YzOXK_4^gfN^WJNHpH8}t{b1$Ro=SCccOGeKPXpvWO*F8bOC!3N}b6{&>F>eHE+qWBi;=iJofX{(!eVFR6k1Wpv2QO4@IuoW4Gi z=Q2H$=_FShLL4+mYPxLLbD4ER z?z7<(1XO6P>=xAxgk}QoNdAoad`7YO@jm4%iG*@rmka6N>|AQlr z5A60`E`0Juk?D8U4*!(jux;Z<8;PfNM-Ad*`NB;^#Osmi+X-I?zoFYm%mj7w~6)1 zU?qi;D&GegHcbC-1*2D;DalJK0z^e#p0mO@Jyn<4-V$yrQK7u>+y$ARdW^q0Ac0(x zl@WA~+UCh4onoF49XtB1P1WPxhWz$LO5QO?CVxt9Ilq_bxBe#c$%!A^*SiZ|#>Bi@ zJ!NCrHME^A_u-qx?t7$9_87;}(c*|DSsFopVe*R}nm*+a8eF_xa1XI*!#cY=eveco zJqk}A?TBQ1!0hR^>>eo`|2ig+!=b(Z$Ay&9SFciw_PoO8Ue0>vc=O#k#@|F0LoCVC z2s$o5{M^XwQ;8JUvdp&T%>`pME}5aOfpoMeVo8=pQ1*}1W?5&az@ZmbpNw+0E~2hwAHQ+vtgFWv znSEy_cAsTdazZ9Y|E{lMOj(G&rsLNmPUbN?eI~xFmrdJ4zFKL1gYmBq3lU4QG=dJN zh?J%ir=Cl8y>&A+IEVWfN$sGvzc@lfXS_5U7iIcaZpsGITsdsdSXF6^`ka5mpJh6@ z>-`?fs|}gCAC9>t3^4v)kO*Q)mPSyiYQI+yQ7}@PN7=iT@Yv+tzMNghnz)bFuAiMe zuT}G$nWO>jT=C-gZz#bfpHg_tvbEUz#(jtb_gBg_q@Gcx>H5&o!v8Ay&({QIVFV2o zKXo_Pn`tt?ADV|JZs1!lL!3D9IDC12v$yo1)!_e}sLE(b%D3?mOWh&ml== z+h)_stR$P4L3x@>x@KBT-Gud(J55CGx>E}{hU(j$eR5N8kcH`JLBx_QjiA%Ejt+;6 zJ9+dCR&yp!l$k~k8?~+yW7lwTTtYY)sNcw}a_mzsS|^qlaDf8(jUbflRSa# zznQ2ADw*rygQ-|vgA}w6W_2@amy0a3k_8>s z!e4SrE>8Sh+HpkXsGOay&k^P2h173hQM$c)YD7Ak2e~9GBdEJ=ee}Lr>DsF|mn-$& z!}aOvDw$XLFKQNFI<}mv3Cs zv5b!9Ml8wF2$IQAt=3QJ2`^3^8WV{#t?hMMQ=_tZ^p&QG3`g~Q@nB{pZP7!>XtTVvcK51Fq<36?7j4wwC-Kfa+pnzn?6&y?<6D0mh$UGXL0=6MSMG{B-tEWlH>%ajN%%k`J%8Bi z)mS8zh$jTUVtRpbL?C_HcAn6!1($86!XB+#*%?){(_k zp%AE7VJS2*OtZJJn^jn#d!XV%&#-WiutN-d6d>dO%BDt73H#rkIxjFVa(m6b^AGg14_t19LR>CI3df!^js@U?< z(%7QT0@vKZtkaCb)YoL#gza9W@w~C{-BhD(BL&0f2B!vk`W5=TBv!YFVm3RW(#fRFIX;m70}qD!MCtRA7=1lbepq>cmnVQ;0eGJfF}S?0GNCHte07^;L>^s?s_ zu@~k08)d4~55!vLHoC6nB0o>#5uX|UKrpU88}NGYs$K%U@?cZ1Ffk z3r>2{Fczhlry}~mh0f_{hpZ7}5kd!%N0o{oMDTWUuyC;pwBQl^PbBaEAo)O??ZG&G z(;##8owk*mxu7dw*@$j4a=D$+EN3ByeAth%=4v41G|d}N6#cVu4H3!g(-j=W+MZJZ ztVfu;)ib+OiS-0CP^8?oNHEviEnz<3GJ#BKK7LJKZj7xYO%m669T~|_Uj2OKZ2Z?d zAmmfcB`Qjnz%r!UMIYpogFTaw_88f_zG>y@>nv%S4%tDGvezPoKqR>vI*O7!xzs?& zGVW15oERHgA2UdF*7IxPS(|oZ3_d>)vJkBS3Bzscu<B==va(-G)*)T9;WYrH;F9rf!XnAcSI8`j{kC;=g}&$kHj zElRRB!&MLe1cvDjgq@MyX#1q->cnAazsBVbMM__b6aazjT=hcLeYH8G5Z3wqm$7Yy z3t?Ber)LbIz_`L#MM2LV5R#kd>yqNZs~#ueqFzOB`|ND39roU_4UJlaTgP0CDQi%q z)U`-{5XckKjg5%iASz50l=(0@)rj{&SPgBH{F$p_PW2PDvAICV4*boecU-vN-w|cM z+&`{)if&8&Og6HGfHm?5*Q3!hNhnhCS|pf5aTJ&08m;`on23KwGVk2>e&O8KFu5C1 zvoa&~o;ZNC0dSaTFH|lxlCVxfn-hCIkHq9`xc61#w^*#N44um?f&KN-#}HDPFEPi5Nn|>PCyxUn4GGbw?^UHMa@FV9TLIc9zfq=%+F} zCA}(sp9zDur+#Uj_GjQtFRowsjxP2ZeBW%XnTjo-7hL3D7yLhw)_)V_xjDJbvaVJ` zyTUWR+b_BhqIYq=3`^!y&1GQMsd8HM0U-r3)#+B4D(EthVxkeB#tD!5oiVCLEo3v; zX$cLdU1UL#!q+0fB#GO2T<;$u(l&da?#;MXV1dR<4u|BjrqjryQM|z=0l=L(>Gv}N zp4<2hj#ac@4;xto=}1lcWp1W-iU&Y?yIk>*p-7=?kznpQ0_sT~KSb$@wyTFkUM;0y zJct!YM5rt3itz|7o+maU1WJog~6z_33Eqb|hKuXv)mvN~grJX08o z6ucG*=AI*Q|D1}t<91a*--)*Zqq`U5GR5Q%EezJjPl&A=e+6CwA$9z6r?4(?eUEBc z2)pyM{q>%E6%STyq9&-=`?l{9ghP=6*CN5(a|my~y-C(ogYL+@-!4$hf%%EmvXkJG zhXtlHc{f?ZDd3iNOJP*+g0xIXkwu@gCG)g7qEo;U-_~+!J-KJ%tXsYb6v=-r63jh^ zeRnB(L7wMK)!T4aM?2x5iD2NK>6{(4_gBM5othgyKuNBa{>rOV_merL+3OoVq8n|` z{IGUd=_eO&^{kPGrQj5b z+^fQj&((s^qdy@q14?#+yu3E{7B+T*{6hSKq9E>!8lvntyqEhnC6-cT2s7L$N>1he zoDidFB^q?!2C`{9Af>%A0rgCg=;LkqM=z1b>e*cn?<+ld?D3|>r_il!uYwV(gjrC! zsswYvyI*0woKZK)#QBQWwCedJ)c23ZhM$1hE~-*FdHOmk;KwypiX zN>FF-rD%x0_nI$_@MQJ6BRTQ}za+XFu}Gc54ol9Qj*y=-9_Wh4-V;xXdT}E@v84JO zVIeYi%g10;(cyloTuu8eV3Md^wX z)aiST@uT^rYMt@Fq}(UgaYwvZcOidezPF3Y&HWp^JIu!*=&$p?F^-v|uj*_jtoh_fu z-!xGnmd-%AauHdU`FVELxecD%eSFDeQDp9}ll_wR2Z1l-jeA2G8!RuMu)6ai9(t1tPAU%VzLj%CK8u)!G$ zV2Bbz-T&!;s#-J{OZOeRwE}^eQo5o9)kLrOq71|Aqu%+sAFBQC3*z;}Hv37QUSVd; zAu3P#@lY8^X%ax89NCq9rlur@n?AW?LC70IN=E&BC&+^!Ao6$qKmU4Qwv?_YK{e4W zedS-1O-IxEENyvq69!%HZeS!#WEjeQRd<~zs-$HAQpQW7*rg@OY*ITa++|#BUkr^$ z_FX>`cayV8Mt+jXTnkmgj454Ff@-1~b_W@^yYG7|rzvxm&-sE&otQV`G0MM14XON0 zudE0LQfgV^E}dI)*MzuCEze2dN@DktxwRi#F5Gcg(qgn{`v_IStSMblf@-4uM3YLL zNs%LjdK0`YOyV)=y)OKMMBUm0#FPgdDViZbN~UzLI7_F&QbQ?Bw43rMhIgoPszW|7 zS)QZt5d84ffgY&}J)TzPzn@py*m?OtA6VL2+3@iS{7n<3iJUz&rt@tcItj63a(sx2 zVP^mISkc{*s`us1_#_m-!4;yUXeQc@%I12ub!~*?TIA8r0G9h|9dtgd%oBDa8h%hE z%%0L!C732+5M>X?QS-GBFT$m6`$S?!2w^(If7F!y*+9}&L#hn$Gtq3C5ViI2Xt>_m zQYVrFA^EZqYh4TCH=&Gn<_C(gpDCeAm_em0N>EKyP0N8fL@mxC#kS@2c;Um1`zY!n zWgG|;&MzDAJg6E0r>SH|4xDu;7B;`d2jb84ck0`k;#q4+ONoe5=NZ=$6+>6)Aux+d zSCpWd=yIpUk|Sb<#x4SnIm*xW`__=8GcC4ACFQx_C8D`@rI;LLSFD303 zv|Y4Sr3g{1hkdexy)P_`OrwvEp-PxZr7KEMO++Ap){4-C>%nywmjeNz?A{Zfs9akq zjQkrRBrg84k@P^y;sWU(zZAtMxm*kQ?^V_(;K;S8eZlX(nZo_-DD9Rb9aIUksdPmN zs)^9wP?9ScV4)Z8@kZ-B^jD7$zw6%g$;f|gt|Y_%Rmvog@Vdo#WQ+OfSPgZ|c_Ie*~1JQ(iFweqPz>xfzq` zJZ%9{ZkUf`oHc(BSA5!y<$2YAKDoinDqU5AX(A-o-)!@&gJa(NzkU(zP$1$kE`;T) zciK8=mA&iC3pfW-F0EBKD2&QJNwz*wL$(+(-tjsuyVI1b301=EDqT^6 zY9fc-(mp%|{s0scMWUp>bG>3@IZ3);r46;_TfDSrN>e~e--i!_(xW+sUPJ~}tLDy4 z*cZy)`Eo~M9o4by+bBzYFH{LLtaL>Qs)_Koii$n@Hal=2_2DAt;*$L>A)7xK`ONh$ z`$h>}hU$Qn+pUx}>9wR(N*+5u?-T!-sa}s6LV6uO&pFUr;wqs?4OPM{D_v27YNFdl zga&8l0%g++e%lIpqdEvw#cqr z${Av}nq7A!${?oT?#H3;Bw=~nJ;FcoDI=GGloawoHb)}*M)45_5tU3;nW7)VJ`}X2 zhUl{In(su^CP9@j<4U$XLiScXf73+L&SSZ!i~f>GGqPu7Syp?W4xX8F%LmLEjC^ux zTCK7KQl@;Nzde6nDR0S@i1fvsCBC`SB{xnxJ^IGlPx_5g~F(ssz(SW2N4m zhwPi63wN3-*vJhM@e6*+2hbfRbm%r z0ya_3Vxj z%6k+aIJR;?l`sQKSCpWdD7Hz|Z_hgeQ;y(eFo*UeWRM_8S-FU~R(4G}=usvn;6wFQ zkFfP&$t()d+KT&@;vdpUadyzKT{KkUmpHY3r=nM(N|=SED@ssJ6v&~8t=LBq(=O)u zc5Q5I)@>Bo%i&Rfv0d?0j+=5OU|%vNy=Xr12rw4Sx5)Y3Y=L3S6G zf!iyS8q*jE!ZUPHY&fK$S2XOE%U5wt~EW(?o+VuNd%;st8{w zx6?nQxa3iYK-96DsHYVBibsMHYAi z?eCYS(9sq#M`9T+YeDiVh>SKO)pezd- z>3bIll)Y}Nn$E2*jdygZ)~ZyCl!zuW>}|R+bo}!_&M+%WSCpWdXs%}SiNb>?L%bhe zp(73(a9MDSa8pzW#ckh`7nlkqAq7&pWxr<6^HIZ{QfEx%vRIuqRiI}r{v;w*E%mlH zL;vdxR0%V)bVUiOiKK=H&#LrdRJ-mk*V{%SkQi4sPu#Xi=N6RYuV@uc1Z;ImjxU** z0=3EJ<`?Z_d_N)ef4ET0Yk3@Hd=W7;UwPO-G%XV+>!Yhe;m6evs4sSW4)du(*O_ZtJ@%n~-T4C%Q3K3N9<>R12 zl`um~SCpWdXqfhqo@<($LS~OMzZcTB^0QWr4V<^D#9yb83uvq90RN3&zM+lbs}LnY zil@1>th;a5j4;QZls)Siux}pTtMDeo4*f(CFoKr;0?rcyWKBQ8V zKUATY`u)ke3o+w`paD>pjdkybd}5L!wZDAGA7{ys^j*5tWS)Cgy|>uwBY|~t52}Qj zTCx%1wGtKmn;>b4#6#Vn@KISq+D;^oh)# z^@r4wHLo^(VVMzE-{XAV>5JM+S@l!orzKPgv$b?p38sm9Esgyy0tt>N)mSWEsH4hK zyC6B_q!5r!j1k(kNelpvIhwqkqVx)|WW^+8RUvvo_fpnwn83$N=BcKZnJE{sj4xCP zGq!X^395-^5sGi~`A4>4z zHHcuGP!hi%Hzd^sRBE#nBJ^tOdPk*`aHV!B=VpL5$6FB_?nn-9!eE{_cZ{an(NrLHw z9g*Vi7nI)MSNQ#=zElE29|nWuvF8*1t0Ee$yU+SbyWL()>sF!s8|oq1WE9W()Xu2H zJ}o-hP0$eH^i~lpgfM%{4yp!UC@vv zD3U-?(C|U)R@`~e`MB2iQzvuD5h=h8;SwUF5S^q{UXU!`1-cD$=^*s; zZ{W2^P!;sU+G!EV=A&3`bH0-GI~8x&RL0yV4HSOf0pGc)JTB~kkYlSsd%E&-hEF6q z1Qs@S`3jPUZGUAw{yE}~@)IST0vAFb@NcBGwT+#%;NN@}N=N(?hw$fx`LEc@ve*4c zwO$+^vbmWg=e*k3Y;R^0b%2mj0STmZN=!eKT}aYn^LL%=~j8teMHP8=`?zio>qcu_y!UIH-z5zS|q3n z8ou+V?#ac?6T<~$Db1V7y2Gqw5(ZXtqaXgD*d4SOodO}7SscZ!xpZ!82p0G5E~YC) zcO!**kKH23b!0FSYWe~#bDwLGpeiWRFjUxNvxqi4vr9Yo$IUMn@ec}_-bCOEIX`1) z*?3zIgj^D*q?>(f(8IBNo0cMt2>DPn`J*dSEcqPHn{SP2jfN0y4v+RbP;uYG)!@;E47Y)#kPNOCRd*T?zT8H8*v8}(u{BtSMK;Qcgxq3z+a0CK=^{s@sKpSFGvLR>!Qe)SeOs9ukD!{aPfb3Nq)woe+85HI?xLlBW|b zf1{5f@7|!viu0gEdH6vxNfZ#0P0FiGK0-;ONP2wi`F>QptJ}%kcrMjaf^PX^HRM!R z2>tzQk)SF_+RZZtOXqhJ%@JnQy1uA*2cH|zSO)&u=csN1zjP!)6>Z1v4miEh-VN-%oCHjdh~($MRB z&KEKY6$Y-Xx3pV8NwU6Uwcr;M%3MH%a7^8)KykO(s2oC%#o_2evsTi64}DnadMy%E z1$}%&VmnYk{bpnwrg6@_<|Jp(+rvm=RNE|LNUqCZ;esuN+pc z7LH`}U;GZ+UE-S)+$plq@2$FAiv(3c)}1ZgJuUvc-%C6{CCiVPh*^79a<|09FTO3w z*_Rmye1yI+m$()5nkoi`RouCn(R6r+Dux2%xD{(9%5==`o)j5`-WdkTE5c**SI?%6 z?!5@Lt>SAq~A#Hi!=kP?EZJFI7s}l0;e_%N1>%GO?<0 z$wpxY5mr5~djGOWo&@?oJ5JXl!Bo)iJ<^?dM;Ud(A_;5xrOk%WxB`wwzbc)t`Rjfa zCkqNd$QlKmsg(#SWqN95@zy`;r@S9$^Nvyl7pf2aA!#?QbfCX@>;FsnuNQE^yfxa6 zA-vSThPYWuyd~PX_5?Rd}<+qV>W)HQ#(Kn1Q?0f9fOCoje(+g|huE z%&YnSy7H+R6Ht^#5`*JniY=O4T0_26y~~sxJK3CnPMINzrpe5HQY2zfq~^6qFfT)` zI3_f@yv-m|{JfcUnWeJ2J8lzYh1+V@n=TaJW^#`o2&u8nf9EhEdcpa(WU>n8pHLUc z_Q~O2gibuJvSe&YLqbrb#H) z{(&M@u0?`*8Hyiw)S2L`nc=hMj){Sfgr$i+?#jZ&0(li^xhMigLV&NfnpwDg!>|_b z;}??EAhNJrciK1^QcR1-h^6`LV^q9H1HI=c|GUnw9;X22p2IF#nib<#E(gmwi8FLN>ZL_B~9aDKGl#(KfzJ315;l F{|B(2h{FH? literal 360448 zcmeF)2|Seh|3Cb(?@RXG7%g^VnX!Z{*=46tm|-w>W8a&UB4w+DL@A^qsVtEeMH`ir zc3Da*TC|~iIOlvjr*r?Vna6$q|Nr~(yMJ%z#ARM{edcvNNAI~T88;UPavTXA6h(<3 z#G!Ri8&OP5C{r{Vg+i^Q{o$eg`Rj$9w!!+>JG8et|-ObD$EYW{midG^AqMcoB*O<9_q3tcb&>oJq zE*_R>Cr7k}lcSY`t%W<<)zaC)%)(L)O?zhQ2(3TfXe(=SvWr{DGNH(kfuy9^m~dL? zM~IJ$T72K{ul4=3{@UU)XJ;1|S77p4yh1=2fgBha8|zFVClKOD9DkOxbzE(^4!syI zRQPoTv=TuJtF3Ixwz$UH#WlhSL{j*#tFZrLjm7X^Yv?Fjv9gOxD=_)}Q9GU(N(zYk zwFcWi)`7ItyTzmA3+8yioe{91n^;)Exf`nywY2ErN8jXVBr;E;T4hg%3yIR>>sZeSHv!?p@se9b{1CA z!Y(YMgy|}XW;>y~KD{C*Vth2bU&f>m0i~H&+3Gw54gpBaf|!n7Wc(1s?yfPVzspvZv4;9h4%Ujmtq&M96-Y9=<47W zuJGsP!WI79T)6c=Hy0}Wxw&w(e{L=u@}HXvqJM5Ku>P^R==101uiX}<{=D?pZur0L zws4pHaRt3!9rXU{fdAE(w)t0I+U8%^rEUK0x_{j;?b5&c(l-CPVcOxOBY z3m<9=9cY^iA8&tdE_~4axf%Ftlk{sd=s%l_A2felm-wp=aiLBij(`m$VzJ6P%yKP=f=Y_MncT1FK<57ZKK0BE}X~2-p_fiEPI82`-_7UAEOj6Kgbep zd)BCzW%;nrymfoWX^4zOU%*ay}1_iV|g#OQlDVX)a<*H6)!AbtSXc@ zlKnk>nGCzios225>8&>h9kWz%t;GUy?FIGQdkDcxRhs4^h$4Iv-RE1cWbP)yiOOj+0nb}p4{o9r)qOl*8uf2`TBcX_e8tmxqKYxZ1K z^|@by)^Gl4f0(=U`_GObUt8I_TUT=(B*#RVnV6WF&{%GE&OcUR=E6#|bNOf6Fp*eT znN(Q$!^aL`1SYFp#Ddx@pO&+3ViFv1#$^(|ZMTkU-S9D2TsXk8M=tiHkHDyw)4P1F z7NaLB+a{hHDTvPt)BjzA~zQ$~B>TI2km5k6Btm6T8Idbs4M zT-4z*^$7Fsm;1!EJ~oeJDm_SL^<2&|pm8Ma@!ff1zG9&LK0Tx7FqyZr^LRC(^|nWoZxbvaKkF{5{Mup!aA*5|BxBkU78s7$*XnCaaO8aH=o zt4leK4es~fG4!ea>yn*1=Z4&0jlbVP`c(axe}eAau*xXAcX@Wd>h41+TRgV2QVVkT z=MiFYtR8EnTs$AE-?UBAx?fV2S-;#$P;NHCOIy_P@?M#7+gZ*6*?T$2s@xys*E=!hk z^q-6g>dVn)&rE2a-IB1gjf$I84b>`cFqG&!KPETU*5$J2^nCQ5e$HXbFUigCDod)X zhn2EEjIt2foelDgqn$0AZ?P|5A+yiVeYM>~;TKselWam zdi6tAhh-=BR;9UJ*i`j1YvxVPoz z*X>KHJ7k=ySdxx8#4{V*DBn0jSK+_~YNnS|FTrz%c?i~mrXZ9Pefzy=t3X1#pxat) z*ARogRHu@d^Lsa}U71ruv=eY<%3UVAOJ-n6Ub4CRV3X4-orAcKd6e5^Z}`jN%md{d-kc8E)TnRMCDxuvL?FI`?bgWUF>qm632%_Gxf2&Zkz zkI7yC%qg%}IL>wUs8aLeb>931=Ptb7m>VBy|Ar9-Eq>ARDf^}s335*eME#bhJgF?w zQByg$&K}D@fA>|90bPZC*96vzg>yR>SFU{O{gb9(rrJHs_dUMtxzh{xB+MC%wzk;= z8MFI&D>n(+rtHgAyD%uR{e#b2ztK4ViT zN#5J~H8Z{Z_w9sux+45y$n}XR#(Wy`BFN?JL*Lt zxpA8-^N2rP1;smqhnI!wR#$be;Q9W5rqCBuXTC}}bGj}i%Hnj@(3;Nq7-hn_#=fmN zTZgD>anqKkqXjBAR~8emED5ae84;5StyXn4?_$>cF`^}2AfPmhm9l9azWep)QhoJ0 zLpL0I{Q(Wia<8ehW`E{l4bXQ?i|fq=N;{~ zY3FF91af2?i4s8yB-5VpXQ2<4`dEtx%e8Qd#xBh4;r7=%oWjf&W?Euck%fdqm~Tx~ zd}JK$oDJ^4=142(UzX*KoT)N7#&B7jYHFRmZhCh(5}QI zEaFBAh^LU_lF^ot!Q@C1i9$O=)WTzR7h)D+b=scpw0&q7qLpa3LWz%!ON^q#g(NG} zmeGu)J$;ffDM5WSnI)^0g6MVkm!UhL=bwca&xMJ|R?3Zq? zCbXHjm^+HEKC4lGH}t4}pJa%_9{H^?c47hKRa^-&&(?$;SoXTF=iCZD{rsfL@MlR4 zTC3kFb^9hO>j%^xRI%C1jX%Us8BD&~w(Qy0o?^V_Tu4dng?Ia&UO$m)$US(Y zPdAr|+{&+X@IJ599^NP&KlQ5e^1xNzUG26L^+%|${72Ha+VDK_c(P0UyM%M)Sr3PP z>LG)S?R7%Ax}6`ANEdR(W1UVavoUx!X|d(A?|^B^)q!E1`}-73>~kXo@W#r;W=S2_ zuEkIG-KRUQGGtQJKF%@~+}eF_Fx!6NY;s;+T4l%Qw9EcesC)j_RUA?i@fgRlva%au znA6J!BU_$1Ym$sCHoT44uyoX>w*39r$>}6i)ce*DvYp=2;MBW?oAlJg?pOvM;`| zA>skQ6`Miv<|{a_gO*ldYs*)o1kOF*wpDZ1tG=#%$FqHMM{=(1>6b3)R4PwV22x^J-=paV2qyo5ZEE&u5rt z%AL=?RKtwA%1jFdxLw=daPp+om>sGEJ4knqVycc}X7Q}!y_qegPd zdD)PzicZq{>Pty}d>x7-*SVHeXPYH@v&3s}zb1De`E*-H&&cMeFu|)#XsH)6wuz0L zCRYpVwREkXC$HaSIqWdGrZ4|hn@QBBFaDFk)H#`;+oW~R+p725HKo5?!C@0EVEtY> zmC{)mUu9@|oJ~_IbaG^rC|TPw;LNmk`8``u!~*mwcB(VBg+}xjU{RT-;;dHZ9@Dt(Bmq>Y*UrfTz;S(DQo|DKWA>k3u#2I?}pI)dk*H3ZLjKII!aJu>)skxJpy2PkW7qRc56GcEsOH zw>oYbMD8=4aS$As*_iS}TV`E)+dYZP1D~#)p)}m;CJ!8CMB&1CdN9Y03L6YRlH*UHBZj3M@r86IUkx+-Zn|h>cSVl)&c6fW~{!Rl*)dO6* zpy7R)iU+>^PI@J$k|b^UR0m52Cr|F5FpU(riMA4M`*s<#svz0%xcBXqVdk#lyLsim zHd#J26?V_eiPlc3~;_#}rCycPuNTJnw_9JQC~ON* z_azRNhX6tCf9v&a7OfH@Ji_OO;PL}W4vTyKcla%h;)#q6Ep${1}@q|*R zty8zRKWz2yaeOeIQ?@Qai~Xs;_33JMMid%+-xlqeFEiqFiF*1aes#=!gZDK_B6l3c zzBMT66g)SktI(*i?P|>%e*Emt%10aQX$l(aZ)Td2{2OOCPkM(w8h`G0urZN|L-^q+ z`pXvnp1P3OD_34AqQ>HOqO!VAUywnO!c1L6Fy~Jsz1Wi2;kM%9^xWH1 zdlgl=aymzU^v)%0S}WjHYN8~5{Dh%nr-O`%Sxdo4cF-34hsrngQL9SiCO!!@QZN_3 zb{2{=dj_W9yr1To+%j++(Oo>7{Ga|{UF^jC$JwOV-_Il$wneCc|L4voS8JT1-6ZX7 zGCDXafUt1$*ibDc?D9X(=H%T;5z$c;0wo!3L88QwgUA82Q%$s4d|XJ>!a1Op1eW#* z=fb(8z+dN%f1dnlEyZH~IAN4_rbGpi!%1lCcyb^q5bYElM~)z;(7wJH6`7XWVX}G8 zvZ;>ROm(Y}=OMVGCshA_M%TX0rEc|3v3q87k!QBC;{}b4gde;f!`YpB`#EH7_|nu1 zJN~U2D1Zi_GBCeasm*EoSA&xAf7<#YfSX zY{wq8Ia~}2=YJ=ob@OG!0V)H?l9iAroG5d=J5=Wn_=g`FO2r-ohuR zu6>z3F1u`iYqCw8zc%D~bE+mLiadHMcQ--y{qlRuDvlO%I^wU(EM-;e65FmhKAm4G zuGQK+Z>#v7;?k`($a3tV1UK&84hGNYKJ7o1tK1{~c0|RK`qNC-e=b35Jntsi;?N$W z>G6<&c)BCQOzfSaC@*jOhaD&$!>WZdI@5&o0M}I;IJTI|aa*TNHh1V&20lCZL%_d( zpJsw>R*2V)&r7#_=SyL+?}{4ZNICCpayKOQq&nN^s8P847F$sP4#RT>U*a4pIok3Y zoDCW|Y(F+uyFVkv6N@Y4CqLghdT~_qk=)=%>J!^@dtJwa0}ll)_ia7mb38GkoVV5Q zS-i(&FUMYEjtxOKuNJ6&-X-cDqIsxf3-e|CBNmq&UTpXawN)9cF?j-$2l~B;$HFh{ z%6@S!<$IpyDvzNj()VBbO_hn|DUQf#%#6jTdYoXo?(+#_dd-A1S6u5qcng1TJnZSGTye{>%Qx>d_zKd#8j$4j+A+`ugIM`%a8ZZgYG0 z?tOkrA*%CsH(!_6UDLf}zl3mcqt@uX7n7BHt)l4O4aQDee8$7K6eo(uWbR(G@c6~8 z++uS-=isJE&7*G&^*)@4&2zkCHh&E}UiZO3)s0`@PSvem{l|Bo4C=L6{?@&-mMDR^ zt%>FARn5lSD>F=_9rpS}ML&4>?9d3)h-a*!`AAwhuRA+WkcEe3eA73L&D&$$4-ECO z-%*}<_|mVrqlYKr!mbY-QJSbzpKes&=&EF5UcNd*M^N@|UUT`E-ESFDsG6>xHI&oV zlO7s=;&I&^Bc-Rko2-|f9XzsrTGE?$ zjYI9Aqv6zegPQjpha^Lu%iWb~y$_Uc$9)`ra9(sq@*#F zQgl4m}@RhN&? zFald=^5T5qt<)UJFOo@XmyL?ae~3Ie7+>@)fy#)2m446#gNk#`ia)#~Z+^c`2#=x? zk6V=c>|h;Q7bv`SD_w=#{vKi%gBmAi44;1~o1-ZVMtnuTt9LxVD`vO4U3$d$^i+QL z^{%LCqQaHaPSoYk&oTv!X!cpNJ@8v4k$1j!w?}tHhhO^Lpo3H6tioLU0oPm=Q76Lp zB-Y74(*5i&{f@~z&|xNjzmBBl-To_?l;z{;YtB??#qNmuoWHGl@cJfe>~WG2@5VwC ztE|?ld*c4n<;L~0dkQ~{bGUGvxRF=Mh{DLOQ{&3sk2en&UAtyL#B2+a&@#krRu&oE zG%Ym8p1hx~Ldw1VRtM>8y)lEAC$=t}-Je-?q(;9r;>pdmSJo<>4cIYq`MceX;~QcQ z2EAEd&oAM_WV%n{#08h=d;0B)-}P1v)r)CGzRU?>o0-R?**a-$A&srivi3T%$@F7O zxZPfk!H{!5j$T%MBd2!Qpu}BjU!ACl$cegVho;!Bnpu98vM!8F%gEEN80QldmFP*= ziYwm9)h*xX{Ymhx)Mnh>fHB_1GrIrj57sCY*Y1TAD0l$@5C8!X009sH0TB5AP=K3u z+bo$cP?=vdCuwis1q46<1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck) z1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`; zKmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l z00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;{(mgM$->H{ z=&kdPWpQJ*#u;V~7FI6BRhO)|X-CbH`2m$VoB4(I23|k_1V8`;KmY_l00ck)1V8`; zKmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l z00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck) z1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`;KmY_l00ck)1V8`; zKmY_l00ck)1V8`;K;VCf04ocMiDlsxGYbofi#zi!iY3Dmm0_7l%t-qmLI8&e0w4ea zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd& z00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea zAOHd&00JNY0w4eaAOHd&00JNY0w4ea|GNb6EEF!RmX;<~ot?#lm4$aXIWizTK9Hmy z8&3?3iXf09V>P15k&)!cU=30dAtE}Qq!ADmK@DWhvSY$hA8YYoxfb?h7iRWw`|BM} zVP*?6EitUfLc$@;wE=|Ry}~ArG`~u=TgbG$^OE}#Kj~g8xTUEgcITj zk){jR`0XHBVpyqxOxRE@CG7G)ZcW~u6cHUoAyAUh79>g>IfxuUh$ErR;^RW17CLH4 zV8s@$$t^7K*RlOsPHQO^^Tz>6J5!>9$l)Zkbv!wc6o__;jw45qQwVY7s7Pko-K@sw zUCo_2iDJn-hswN@IZk^6FCYK{AOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd& z00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&@ZV5C zm_>~%HjWTS4sa$%Mv^0g%?W`*EJ{qI1af2?i4s8yBopFDEL<#NOwqwn0R(2+F)sPX zadOk%W63;&%ACmTr@es}5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009vAZzLeW zqRUilxBs>TAMcUfVMDe2jeEw7UDyU#7J{_Y4wKD$mQ8ikW~y6-JP*MgJ)z1h&Z5hO z53cOIIKeXenJUTjerN8o$5cLlHri1$W&T(=cAh`p{5N8NsvrOYAOHd&00JNY0w4ea zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd& z00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea zAOHd&00JNY0w4eaAOHd&@V`WWJCK{UPEYVPROY8l!%XSSGnq-5gPA3nUKxZ8^Nc4M zl^L@c=Q1{?Z%ZdfNx z%G1>3)Rn1wQ@vAVQkJH$rBtO5Q@T>9DHh50$!f_x$vMd{lIxN~lPF1UN$-RvnEC$COk$XdMfHe)SYNbw03k+v}?3blu+b{sG=y>sFP8Y zDD6n?NTJA+k(9_gkwuZN5v~#15qBbrB0fZ%jG%;5!d=5ZgrAHM3cnLx6jl^Q2^R{x z6RsWhA?#$Rcc>v5LuL+s9egdcG&ChlG;}8PerRi$TbM4HKsF~oA)g~xk~fA*lV?Me zL%2f@hh&EYhuDOShIIcgxpQF=5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH z0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI z5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X009sH0T2KI5C8!X z009sH0T2KI5C8!X00D*sV_Q4 zs>S`oNXdWg9{6kbt4J{x)r%D4Q9Vd84s``7)l*(y7-%muC6wT zsQ2r@FCgYv)cJodzqmX8*Y2H2F&5Q<6ys56kzyRG9VymDwIRhis8*y{AJu{s>!Hs4 z=Asi6priXYx6_C@7Io^M%P;Q!H@7CF7>hcA6ys5iNHGr8fE4SZjw8i7sAEX6KI$k^ ztcR-q-GyL)Cu!0C*5Y*VIyeK=5yV^{Rfm)laj06P97jaeAmv0|)M2C?M?f7y%JEoK z_3t?jPYT5SI=+L5xjyOuQcgR*Dx{ote3eK!?fCX1<+S6gK+0*yx9|5HtF5Q^xBIUg zG1o_xA?38=D@Dp_$F~>&k19sWX~$QD zl+%u{5Gkh}Ujb51JHC9RoOXOWf6s9S#6ZHY!b3Ja@z52N6Kl(my49sjxPr( zrybumq?~qqTYt~7I=cA39bYzLu8-P+l+%uHGg3}FzAU7ic6^(Va@z4xk#gGcZIoj% zWBS{9juwHWXYgyjWFp4;8Ave^myQ(Uh-pYMQ8yJS#t~AGVmvna_ZVjosQc@VOG1qG z6Om#fE&(aV5#y0!qHY{gj3dM%#ds{`_ZW*K;(txd7{pjV8Yw2?qL5-7F%l^z>P8^N zI6^p5jK_xk7GsIpIK1|MMoB1QtWQRYiMSA?7)K07iix^GNHLB;LW=R&z~5sWDKJR? zKL-|o80!;}Vj_-!6yu2gNHI~@4=KhGe34>2cEj&6mPi}_|2eSrh_Sv8QcT2oBgHtP z7g9{rU56Co2y2mIJl6A{v33wqPh0QTRP;cM_1%$TBF+sd#t~hSVxq1KQj8-wBgJ^E z)9*1}2OsoncsL@)`fHG4BF+IR#u4q2Vxq1cQj85q4NWdHXy2nfrWBpY~F%f5i6yu1-NHI~@2r0%9 zRwBiCtl{r59&bRx|7Um@AjbOoNHGzohZNHuFOg!RE)FTi5pXd(geBmFN*80#w{#Y7wiDaH{MkYb`P8Y#vR&qa;M4U8Ij3Y`R#YA06q!>q#K#K8L@!#Tr03Bi=_CFtrVu-Q6C{j$s zi6F%|qA*fS)D=RCafBsEF&-=UdyEev5r2KXKmak;=SPZ(I6kBpN909{iMl*UF^<5E z6yvd6zsFhuy86F9ALB%f^*NAYB90v?#u3?&Vxlf9Qj8<8AjNnrGY^X_S2Q6uHZh74 z$VdC$Lg1<#ROY&j<_!LHa$0wqd}>O{USy1;n0ks4zJ)i2TVQrL_5B3ap ziDtM)j|N6PP3@iDq6{WM;g*65db9jf zd40Je*|)M*GF8&wrQM|(q&Ovs5*-p^;?ZK)#FmO?hzyBn3+D;F5Hee`Pw@cX3Q|*s&jCn`iT4J;f@(63Tp;8O_i)df-YR00JNY z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0{=S&sF*-DvrR&%zx`^vfBZf% zJQhpch+WUlrIKxv{e_Q-jUVfTHT(50FIJZoz0yr#T6=l%>D>jCnrYR|%Kfoc86CGz z3RIqW_r))EB957fiJ1wFA}WT6TvDHbl2^IzrrJxV zde^mtV#{v%rSq@n+~55(i`SE5e*B}FY7D)SPqsC$SzCm+U%K(k$--e>tx>g*dP2;b zwXcPSkH!haP#FDgMoJ0TauKl$B>^mN}6^BAdIk%s7*m9x6USuOuNq=JtWJtL|2vzIT_+{Mf^_`^!U2 zH}aj0&w8V+JUW+5#rPqXB)vHP0txx4GN9yA=F>-a+y?oOvU&jmc$VlD5)WUuG?1xv+jKrG472;$A#o^tvkvBsDw)^MqoPKUkGif#g51he!u5f}Eu+!ORl zUMpql!kSyvcbzZXDu&k8SG&WXKxsjGH#nR>sSKi=~Q6_$sRCUtV@~`2~4*jc@cy zcJR*E9V#!@bo#LSvXs@9>lqKGTx?gr)UQ5k*?a!@mtHEy8?huqBPim&N5Qup0iz>_ zw;wK5mV6}WCDLsDu5er4q)2R;#jrWOl9$7ty-zE7x1zCkvb|RFsl&|jKvPxjL23E+ zp%!8S`ZE>dg;V2pU))stSy3+pd1ANq`oAMd-GpI8&x#nJZZ@V%NB1Kx7d8W?Y% zhg8g3#F7k+AYSzQE5oaHO-lAuU(%iMI(&`Hvchuu!yBEq878ySG;h(jV zG8?aE)lv}LCQ}pnc2XTR!eH<0*tBh&D*SB zImTSL_2h2b(Z2W7Y6)Q(u?lVH->L*sF|LRu85%)_gD3E-%E>S8o{DU5u8~iaKVxjc zeKuB!&4yq4GdgmLUdhylm)Cb69l5Q_H9XyQuuX1uwDDpU3uZ(8ITn0p%@H3e#s#q? zLnBCTEK#r~MR3b^isr<9<&~pd?K@;!J?+wO@ih#OCI()nS28f$%WMgz`<`WoReq4v z-G_WZx>Zky^UdGZGHVVBwJ=jL&WI%$8bLO~9~$;eeHqZb9e*LnSouVzam%utj{E~d zUxriHuxixND;dkRA~vz)m4OL+Kv_5CYrtIe%dbneUXwnYVPI9_`yz~raY8J~&CY|NPCk42+<|`X&aeA0J3g!__vPF?%VqW$6L?=9u%J zuZ}%mrB=X{Pp_n8e%GFj=_39HFK3lYUvbzJj1A>qH#8QH;QIM}A8}PZ6|)ApBqJjz z>UFj0*fLVnL{i}A{EmD9Hr?A^MXEbX*R)VqjS{^s(JOhRRV>a`GO!ZH$b~d$f`n~@-{c?lYejS>B^ znJZR!%9e`QtP4vM z&bu%9(%ae}9W~!f#n>U1WM~9!{l3l1m3`}n6)SEQ?eNR}D*kww{oliS@R$H%ky4eGPxYK|>kcc~a##F7k+py+!QK@odO z3a=>0;9u?QI~;q#3+He<`}KxxS0#mR@)UGITbbU`0lx{kW9{%trx7F{9lLj9UFQtEI^@G zGF^l1P->xTfRyx2tD(rb>!Y~Kwxf=&64@?ADIs4vUQsdD|0?;<-(k(b2->CWHb{)` z_nykJl3V4Nw3{Pjs5V?s%(Q%q#kOW?6p3ERCe8F)zTNR7H;LH#0~)kY!QTj4x-$un)B9>%m1nv6i**d)PIN_9v zK!eTm(xBpgrcHg0>&_OreR9{q-3X^wQbv1^2dhIkPB(r-)!2UHRDYQ-=kPK^T_Ym7 zDkpN9Ur;ft5lb>Of~wc6EN7qEk9+93ZsU!%ve(n)EH7TR>|8bS)pGT+hSzrVO1d0> zNfnX0ewsP!=*Te7E#hcjF`#V}V$bp%Ik#_6^GxDG^?;y{;_@ z1qZ!0rx+bupIH@qR^nN`itzYYipIToT>J@ZmFv@q%Smr4C z_D2jAV~$vop%K);mMLZaCXsE_o9C4HJm2&sF<*f-LNCZK-BeX>ND~gyE7`*3sIxmG z-Erhjk>RA&lImRo^2{rbSw6?_fAX9~SU;PJF+(iL&Zce(M`dZtX!-%qrxPjEo?XT6b;w)WK3~)}l4z`YGAC z!*}Fzf4bh~5fm*G#;&^^(V)6YWP zuFjRTng!HQPDWqyo%axRlyh(S9)5s|F-9!O&BE<;m)4kg=xV>WSE#(9s?|+loo%Z;uF$vR$sUJjy$aeVVn&E1 z85%)yKhA!cI9Vy-^IR;tcLp05y<64x_CeD4ofbuI{+s?(dXh$QKhvi6*acKonS)~qIq8R9-t!?- z?B)hvFYh#^SCShSQ}n6isI$n=y7$TNrXapV8 zdmOVjIr6GrTT0dL6~oGYKR%Xny>F|=J8cS^N#0aLucThb&)XaaSh!toG_@=V?6hnb zF+b<1Z1pf{hiekc8m&qy#^7Hi|M|QS42+=o!qv<6nRdL^vpF&w>}?TqN`GR3o6Q=$TS6R|JPzCAG(05%kKB=c`r^h(kr>=y%1-4W*F)%-=-HcKSqPsDr^et z3G@&pJ8?Ji<=misvk8Y-lA#gQU0ao;Lvr72w3i39Wcfk%q;0w1?ox4FXHruQmZe+s z(<_O;qEq_wrCQQ-$mF_GF0;1y2s?&`g4@@1x;UP)(bg)Mn;9F-AP*jqQLLCZp2@zbBK{EW@H zbon#7TbFhgq=Q(Jp%GN~5P#lJdzVJ%Ixq7(Tmzyzn|@xKGm2LUJvpZkEkU_JujHxT zuNt=-w}^}hjYzmZ`66+kw~4u}w4#VS-}&fW9t-Wu(c1qi`Ojx?VPFL96FKto`qo>Q zQYNppucNrNMVw~-HmjBPSV^M)M{?hzW_l&x@04c}*eo&JuA>T$mB^R=Vy177NyO7uzw zS!A@CgyvnpD=YjkJK1|pQ|*}`$s^+{{2psWKd&93J$7ReOENTqo*aAqxzAnmR+HRN ze?`PDE)^~l-!mqS{Y`1D(`zN~Nzp60=G>%uMRH2sgmcN@)x8a;KS;KBycw?AlHfFW z>tNwST`EQsu_Qwyh?m;%yrEPssZ6IdR`pzgtL(KCIZeTjnBEMT+ep<4InyiItgvHy z>#&vU_vm4nP1h~j)wh{-Yj56wj`IkRF~6tGLB(hwmSkuIO|Sg)eRk<>)o+q-+~nBq zw6RIa+}BCpEWh79I0~KY^nhMT`TpK3_vV!!?R>skAk+8A&8!2FCGK~hz1Cd2S?ANs zl{cvvb;Obkji4)IGm_)!?kqfk+t+#9#ocSAiWxXuj1`pmd9Nk$fnWi>k{VlYmkW?q zT;gs$z9wdj_gLqb_<;6c(>12{*&Q#pGt(s15KA&Nf)uwiv8~N@U!AGD^Jzo(X9Ld@ z`b##6Ntm*JzDWWfDdpBNrT5aFZQAK3JQkIsLG~SCUwa>h=Ux$iO z{k`OG&$YzB2vU~Dc=+^9?K_F}UL961K*_diez#OY)6AQa_4xgPm2^MH*{l@)a;L5p zdxT;{31Nc$qVmwzm5nne&fCpP1vp-@VW(nLkV`T$g4)`S9ly!$YFzX4UTo23N$*ob zA;CR{V+F=SFMQ&Cy5;HJ-CY`1@tHNd&&C{?y%CD0iUs%F)V8d>WHq=uY(-e)GEFK* z8L=coBj}mw50yC4QNxReZUiws=KGf2u6&sC%`I19(kMOHTbJ%vFv@D>Qo_z%$&Q*T zb~q7KGcoimwU2jaTTE6-t@+eC^N&=F5@Jb)M$poq*RW|~T-n2z>3it4=BS?{!Aoy+ zzHABk-ZtF&et_OJZ_ExFe9vY%CVyeYg?F2$;=N-^e-P+?i)6GXl{N4NZmX0`qjzOe zCUJslu2bwu-kx+=kI<=W%TL8DM=Z(E2$BrBuXt5O?JQSUu6F4&+g(0W0lh}KR&V$@ z+y=T?D82MPCheMi3wC zsRo-%vt28bK5$g5b=uV*HnHPbNltF>wR1AnIqNIvmE4(i`Q6yO^2aG5e)C;ChqdC3 z-)lQ49e(qrv}s3O@m(t_X6e65{_|PU7#Kk(_k8$hmiQq)`QivVbsxXKu7im;yM6cR zh;3JWS03A~Nw1_vrYm>hx`Pi@=g0Br+#6jduPgf8?Zw@ayO8O)ucWJsicv%^$;b$z zM9rpLoVo6M=8|5{_!%irRjD^U$@LQh@7_Ohx6vzE+h!Rnu6fq;y&BJ)hIR#Ki$siq*t<6aZ{!;)C7Y}EP%#RKB^eq)jb*EK zm**SoGQMnQpwz#euLi+flQz1nP)f3ANQ6(f&WlA#f#EYK=m?$`X1 zc!M`@q(twP(tCcX{#t==nwy*7ov|aVp;vOPd%d8ku@oOx_6k?>{miNuSE`-fKMNY*!mob6kUQjAp*CGiuVe$0 zja|)Pqd>Oyr;A?;mF@k>8*7(8S0A`OwZ=QS@f+>C53>I%`OoJsWMBl@%irH|*J6x& zaOL^SBCJ*y(^2VO!u6Yr%HD3}8@-oGcTQ$FRJ9x;YXy)@k}BpVciTtAo7xdydCGid z|Fqfco5m3;Mh3YgBO@rotly6RUiRY*Q}XSzo9-Of_zS;wsr};$v=NkIq%*(=P(QM zxA%slpNG}2rQgN{WYGRi0quW;e^$_V_z=s3o%{5B?%%#~BQ1}adiI$mu5Y?x`5k&C>t4?P zuypb@yF~1Gv)TVt?$cy}!yD{gDQS(H!|@~cUkaQhoO2Ac zlBazURqXeYzdh3^10$$M-03dW7@t7SDM(hb%}kIiAj>S_Q?Wm zz1>ud2x3WwM$pXsPSaCzv!WF3UfGhn@he(Czgj9EQ~N@$&|JVzwwLaYfd!tyTkjz| zhd7TL5AG@@XA}uHMJiA+!iXgq8bO_exq{FKrX8F*c#>niuGKWF zvGvjBJ+jA~>ZCSM#_9gWA-*}7mL1uA(D;WIl+_6L>@_&ZT06 z5KA&Nf_5rs&s)eF?z}?S@;x3W#~Pwg*>R!w<#Csp3Rj<}ZW{FN?hRx5R@%3cmmrp8XauQLp;Km9G8*^Ws833{xsHr=TB|Gj z-aHgrJN)L2q+%Aml3HlH<&VzBYlxn`Yo{`0@TAL+Wu?cM#KrKa;mJF7ojp{HAYw^| zMv!3noxZrh8qLr9`|=-VSC^Iqk>rTRS~a--nZpXftw?Qd$%x$GaB z5?_0|d4q(;W5;l&ySB<|pNy#(fq#|!=W_xxFoHrt_7@BJa!Y-cGLQCspEDgFATM^r zVD$@8Nxb-S+f^ufCC7{|5Up<()wsVBc=nA*St)!fzj%WEC)rJ8s6qu3IYY(pBbQ`k z1ff0GmfSp=cH|k?2hqZq;&i8pzV&C@3eYR7f28p!t77Pt%u4eNvn6JQFjojy-{}6q zyM|=0{;963algD;a2C&3nj{}$Nrpy{^wr51yO(xZOTWvWOiB!MXBX2hXMG-Ip!6uh zJ@j?3FujtEseUTEFLf8Jm8>-u`aCSbab9p^`RkXD_F^A)?7eXNE)~OzSdyU;>{Gq*hA*s1KjCvn52 z%okFs*R&rL;YKXU&_@bTDTp*|M)rE!6xUd zA1PH+PIr`_D@9Q;T!oS&E#UOQpFgUj{{=dm?(zeQrb>qSXUwe8ulKv#01vWOM9@_jl_w)N7hn}-Dt=khtq*v0h z!R^Scmb&44pK5OIT4B=p$k%=T-t@$WE~yuB=S9v|P%*5CB^eq)ojZAQ1Ve?+`q#1Y zeHYvKt$XG5rX_Wkosz$weBhLD^9sF^>??=?&pu_zZRok!l)Irv+vUNwU4vOk%RWc= zem%6umG(2eEQlo;8bPX}A8igc8Ar}Y_*$Ty*LLX(oKT!J@J^q+U84Rzt2d2a$-!xv zCrMT@!o`ZGf6nknhs)TXJ22>xdfBvklb0%bIqhST8L=coBWQJzwQ1mhPRaU~S01Jz zBg;l_eSE|^ok6*&x=d4L`so0@lH=kRAK@#El(rtbKsx+D>*Xyq)Yo<0nBWHkGtQPj z9+**=F|o<&ZW4(m#KtB@Q3Bsj36($dx|pqUp6h@w`o*T|{6aLAO2tO}`WO6sSpR?h zgZ>JWEw%D#v(09$BFW>AI9ui-u1mGwu?{7m`#yXV;s3w;t0T?M<)3ZCL}FoOQeox) zXj&6g_?TNUs?pg|&!dbYOCml*tO>6RXAWB*dL~qm z92(LcA{U$#bSFrSlpQ!6Xc(}I_?~D(IOsp?@9B5KkJ~qJ!?_I->nT1re3pA}^m^!} zyKd*&iM8gQ`#femoZai)S>1eHTU~`*!kv4ZF;3}@LykIYb~?OrSZ%-m|7!2P->Hrt z{(;*gqwKQc2pMrWMmEVz_NMF|va{kKqmZnWP1z(Nn?z)!?7e69jI8hZ+~4c|UYB!! zuk(KQ!~NUo59oSa&(nFnPG`KH%7@BYN+n8!ik1qE3bgVbazEub?}o@u$%@`dklB*C zC!G^u^t4hM!{7dY^MVHS-;GWHod7xkbOPuE&od7xkbOPuE&t7rnPCvr(-tm!zWBcAmvda1wkOOlC7TasQ15$T~6tgzy6iClJ?I+ z1ZT&!%`XC*lkXEOfRI1z@SR4UUfrysbQ0?MCROqoqsT3i&`M~RHQIaBSk4K7ltYOW z0D7Z6X!Ma0#r{G}7%|o2L@|@-e>=BLp zRJTLWFc1>!TZrK6@6=2~ms8Yr!cQW-tn_>93pzRrsK`$<2_QKLq%2A#nEQL?wCAyx zt!11Q-jL0jD^%22@JjWmW~T2>$OicaOvs7=A=ASb$_9m?JJv65CB!a15fT)B>g??! z%>V2QKg-6_ggyd!2PIM%M3S?|aQua#$9uuLwsw|**scx!l_#Pa97KXQ*EZtgimm}6 z9i}*yXrmcO$r!WyYu6kHEFx07DXoimwZ8kk#7?qcMRXAI*c?nifZxho_`jdt{2-Ll zv$PX`mKP+O&d=8wY zu{6Y@YzNhLsy__Ng&rc5$ZK;*N-#~yR9=v$shb~uOQq*gv{s#Paq4&R$x$iUX}=MZ zlcl~2ASIc__8wtr@b~g63CQ1sNX=X48uNyfA6`CA`hf5DhX@bxfJ-1f;Qtk+(7#0a zM-)H(FHsm4MH;WCfv0#lh95f>i($;@Fi%*`pG(ySK*&~UCMd=Ow$a2tW$#-8c)Lhj zsoi|^x>j>vM`0M=f0&9uilan=Ns=z(_4i^`-JCi8d>>1n@Py*B&5C~a)WXA&cjq9~D|&YTENMJRi$O(maBGL7@ry<0M~k<#kFI~#juMzFcV41thXJ7Kl8 zrJn){%6;ypBscH45i+kvF`9lpc%Pl_6lU-YffPZB1as!xyhd?uCPi_5X}IaKyim&m zw@HBh23?2Af)oa$aBMl4jM`NO3oHWrxz9ZN3X<-s*gntFL5VN`eY)I zw^1U&oH^_+GFoKy(h41#Vup$xoWFj(@1xg>WBWcSL|&LM7Ow+@+;^Rzx>NDM*HfW}G!B2YbsA{)J zX)52U@SS`)76=KYKig@d(!i9T4P6x1`Eulfo%udi!cFk>p5$+l>ELAqQV1my%$ZYT zw+z+hk&&vLz9x7i;o$OqgR3jAc=B8iZ~3D`bK49MlJA3b#b`AB-m}3F zi8?iT-3lY@BqzMR5JPToYz#du1;d6zHqobBN>W3CHft2PDbwF)VPLEXjMzka8`BYXb*@Xy8<3HQa9j#Q2Plt9X5bDq_JCHn!k1z#hLC^xIE zxRct@6pW*OS;cSgXzD=31I~x^fd5yN|8(XY!bhe$ZawwAY%y+uGnzp9Q3Qu#emJ!E z(F;GeiZ>MLKuDa*{9gn01wVD$IA;RJXMd)hZbdhq*a-$77dF6mPlpjmC`u%lBx%2# zk#pG5%-kWWFO>VDg17tf8OGh@EeAJz-rmvC48ZlD_Y=+H)zsKK-q|ad9*;KaR6`{? zCRszTNvbM1ayUo-=gi?ni3D@zxX{noQC78;DN!C~{IIlpN{-3ey++@3Biy2%sobWj z7AQ$`-e{E&%SSGbA^N*iETZhLL+dFH(QOgS(w+UxZ*GVnkUS`nV9uP>q2%%{qHM0u zv+3RB%=ID~L)sK!N;f&81SPvaJxl@IK!pD4Cs{jlR4#&Ub97dITv?&M!QfTS_vw}7 z-T}TPVKoAI3ndcFnUfK}fRkNCtX1ivG)I_}mN|D4`LO^a{X3I*d)~ozmLpJ-$|bv{ z3)Xgj`i5VoVY#+q2Qx75hc>s)tBKWaMUkgsA&}fCkzmf8ywHQ^(>=y-QlBq!R}m8X z;OX~3+C77*Jt{XX^1k!k210(PWFh<#&PK92AW>fN`p0l$K5x~G+)F6ixxV(?ne{6K zk_#mg%$XA>Q#G)>AH7?wd2ibIbqKvurR?y)p8oN>thh*t*rMn&n-+Ds|ZGDnZ>$D?HrQLXIyPBynof|Cwf+!!K3W-L!1haZGz%R^Qs4H{TTepx?<5EWj$gp+sKzx~K$oIj!WZY516Vq)Rj9yV=FT zKG=NRlxFT(mZ>hDT;vc%5JeUNy#kCqP-YlacVUerTA`m~61){?r#@nA2hnOE8thO8HG` zhD(mPjTnwR@`a=X(?t38n@sTA-@M_MVP$ zwnFjf5>e!YWgtK1GHGs^b9f_QtJjPjI9+OG&ip!0W8U2rGDpX7l1e&kkVLxGV(t;U zR*g_1&wO1}f@-1xG0)DPoRR)3BT4RD{rp}F=4LAoPJM}m*YEi}|ek-A}8=pI;|`CNOC67j{GpEv+Jy$U9#bm7tnPSwOSOIcY7Jd+v)mebet zZ*zKic8v3YI(T z9LPT3`je=1y(N};(#$jd9{Z%!oreSv_0fH=SY z?|OZ8{I0wD&(tCjO5~|87!1lUEc{QeiD0t!a#&=<--ss`9bXboCg1PeX3Fc{s7ShW zGb8C1G2qk}bp{>wtCik|TDSx({`@Z6tBX~pL#H*EPGQH?Tzfxa5lZB(FC-MF>`^E_CF7vup9#p4yvZI1-(j)`%tFkZn<>5nkd8d$ej{b zp^StPm*6FDq8~zuJoj}`395;P@l&+)J#U7QK+rd`iDVylUrF~9UN)|my zAjqB5KNoc=KV*Y$w!m__dLlgG?H+)O<&EMjLWXKTUK}46)7c*4bF1;z%b4V*(>pS) z?|P(#U?7ypgI^bwpqi*IMNH*7AAh!T)+KqIY0KaG4)3qxwAWi0#w6;VkSs?7Wl3!X zjqDk8tczuzek-j(&(JnQA99(g_uJ|FQ}xHTgrzlHNY&hlsgnhD0t)ATkwn|%$sW`DJ4R@MA}( z^=~}BR}vQU@6&5wRC*<#ylsxP5+ecxvX*Px*7d^0l4@ z`*ve;gc5o5>!K1=6J?hQZs*>=fs^(6s%(zsBRlL9N*QgeE!Z8y@;4z-H0wahgCz+Q z9A5HBA_Yd;(5AWuJ6oO}@m9T0sr7j|GV{Sr2qp6B*F`0$Ci0T5T1#XtHDaP?=Ng|T zVoVd;tKL%ns4}imr5E^yeGNz{q=c2%Y8iVAx<6j=`9aD;c!N`!%kti1(tO_iFRb%V z5K83PuZv1hO;jY?G{G-VOym!{^r15S2H%UnIsy&jpRFaZXku?jPy;^4{m5C1?*JjW>~c2%$vY{ko_G)kMyQ|dJ5e1oXyK)mg)tDWYh-FNqx>%T2DoM;pBvd*?*ue-&Z13ltfWA}|s zXQNpCWpVXe7C^b}%l zdju8Jwlc9WQN>|~2+ps1lyBh9`g*qZ6d)yGCvyuHwNvW6pS-{=%(B~Wv@$q3M5~2u=E5a5)L~HwCGz;! zMJ1>v3h3FYSc;qc^=WUuBSKT`j4R}?G27AA`{f^ec!dit&jBf0x03KSW3Kq}K)mYu zi6E~P3OZLwH@3=>hIlR!%0^Ekl*sE}7nPuz$j0@uFoRL9`<#^ZrX7D;m+D-gR89m& ztgN`>11(B>4j`rXxPNU;xAX>IA<10q-HN@Ck*jwM_p#O^`tu*%3f2opD3RyCE-FDa z5uK#fY~rhu>sM-&?y%@5a&E+j%M8`)@cM+Dg{udMnev_OK*}OJs9Msb^#>Ek>ojq^28ep0 zUR{9}7k03aMjOEyHx!{nUI4qO1l2^MxYYHha|(K69_w1U{FUt9*IzA%zu&1%hC-jq z$(8>CQquE2943EPm>^yG!LqhgZc^B}DQaNfiK6II@1WG%0bGO?UB5>ykh3=A*A zAjx0*%=q59R%1FN-a?pvyIbD1IL#JteVd94NEyf|pWh;&tTyD3v$MO%GJd}g%R!~% z9tUSZ=o1z@-2c3rg}ecFQ3eR0Zl@c7tI=JfT4 z5g_G4-9lbZjB4^*^2$R9f9dY;skrZTY)8_Y%%4_t&-niH4h$yJQrSf%s3tnnJH)yz zv&VJ)^O1)NcEvR&UPi_`F1k3OPJbug&3VAH=QZuNo;dB%q5arV74M!#Fr<96#xuxq zp`5v_pW#RDf8KM$K&b@PL^0CV28P?Z=db=QDjvI>P2t4G?OIH9=TD}5v35QAtOk_j zUC-Lh9GlnPCPoYO)zs78)e`KLUYRehvXy=;rF}?Z0*3@3Bl*m%ghl@84Qrl3qOZy= zlN(n^p8q}`uQJnpKa(84UOjLkOT{dm>|F(f6yN)^22E9|F$vy;v~^?L>2A};|Ab5V zz$>iHCi{4_mLmXmi2ReB!>?>n(vH?2})++k0&G69_5Q z9oJQQqgx|;Jk=K(PzmLmoua$pkN@}6;E?@|&8iP@h(Agss2ZA}8w&NAbi-kfeB#0M zr1~SN-5mBc1A6k;X(ka5e%(9-LN-zQS;u}zikGc+xH4{%T~6`zO3vJpvXRLj-Um^+ z!ohHeA4(*s78)H+62?oz_kgWzug?!9Cn}oS2S(G5Z??8u?c_sM0l%g^JLVQpw5>9s z>*GCd5vh%PJ#6>-5#}M*W5c+D4q4eaIK&qv5>yEpU@f*y+T$36uK!+?eL}Y*cS+7c zY%!CQo2?Qtpm|FQqoK5vr~6;cKKL1_^b-ZdxJF#jvzotnSs~=r+2Pp*YQ{Pc*y=* zV)nBHhTs1WxIP8i#YQw;=v z96a%51VVZw>EDVIHVD|O~Qt_}IES!bUbq_lMySFVsjd74*AaF5|~We37D4_oIL#P9Db@ZS^Ylm36_O(UFB6 zoLL~`@lw&4S@~bqyQC>=tuA*WM;6_EghKZmZNKY=`H($Ad`Rkv5(%n;v@@R1ZQd4A z-scJNzdY7>DeGBnX;N1oHEX>5)zEFeK_DdaY5|pN^`%DpmsJ6@ERpdJCOX~fs+_9T z8i_gT`Xf?shzCj}s0zYol&tvPo2OEV3)Sj~_7lClU{%^!xxe;AB@ABvTmx{QH|a#R zJkr2CAVLJgH8{^^#hPj)LGY&9C+evw#}DK2LU4#XN+hTXiY~)#T_sY)ZZ7k?Qy^b> z zA#NyvehN4!T=Ak0=sE%oD*B00CLT!X1Pd$S%OI1of zjOhvcec!rKB_O2TL1gtEV<$4-@Ehv0GWRf^ z&_8`xwxOC@neuJpl5ELv)6@*{uL0&@DmB#b}IZF4pOuW7~IcVV!XOu`#6?A5^ zRC)X<-Tw0O;^t?;S4?LrhH=Clj_dB_%3k!i>R*76ZqC;zt#4|!#hBivBi;YPwrq2c z>}?a#omZOBZ^leoq;QB6N+hTX;>s|%f4TewOO)x!5<6E$OG-ZSLrqx93IH>$E!f|K*k_kfTDO?^9* zR*#Q;@~oeY-&-88ePBkeBu5p&sqr(|x^tfZ4sk$<1XV%QZw0IthFir(zmg;-@EC}` z?q$1fEMV6Dqu0lBI^tFd5OVaD^;wukxtgm;Ci5dYJehKCya~#?erE&*in1NE4~gLr zdt@ZkoL^9g|6ksl_MdhX@$XXc8fD+IvyJ|CG&p}(Wc$~Ua!zwPzxUnSi$KVF&Xq!i zXO66u)u~r{9Ju)lNk3EkrO7j+v{x2Wt4o=IL+nr^!BmiaL~-J-VBPJ+huzwRQ!QCF z8I;=1*KC8PTN+k-%ESS`?0xY3iutVUr0MQ$-Qcc{y4P7-)mQhn@*j3OP1H2Jrig$; zY*8XXRnX;X3@Jm#5bIR8@0qO<)PXlAL>@pV@dmZ}Ni*BdGi-s9e0wfb=z$?OfX(LQ z*pGEp{m^!Bs|t%n8k>aL9;X@u4-TGL>RW`K}!E>bhU?BU687kNUka9F2zG1;3JO7T8e=Mr*T4Xh*nOQE` zxE8onxwn3OO+UCZf(G$E%Y9_!#a~*3`ITevEzY^hwZ6W-cMtL$*>1iOKWBL7spjJK zeUsw`4%xLPAZ3TK`S0~T-Ac`R(}d%bL1wzb;NRKXu`2i<^#>d(jPl?RD`e!wr?(l1 zuPC4FmbzrL>m77XeD0)D#5j*>fQRDnJ*+v<^E!*b4uAn6b-pZ5xvQ>3C$+@bY1yza z7;1`;G1wCtZ(zI$KHXFQiGldKw-VCVz5gr9|Mz=vFj3+g;htTR#wk|1_Etx-;F3ms zyjanM)$+YRABO3yP!Bc_R^p;*!KWgoUh diff --git a/build/pgo/certs/mochitest.client b/build/pgo/certs/mochitest.client index d19a92306dc12b649a37c9b34b881e4697d30ddb..c8a0c8a478e0366c074e0b1e76a77c0bdd8e5682 100644 GIT binary patch literal 2614 zcmai$S5(u962_AdAfZSR>AeIg3;%#f6L`5FZgQ>v; z9DE##gO6Uw!vGG-`P-r*;Gnb@5;X)2x=5hk4j8cgRZ!9cCIIqxNe2i+84vAgmK2bU zUUdpH9zo>kX$S-c0_dn<|CC29Sy`0Pvz`Zuaf&@2EL-M3>FhMupBQ zM5lt1Z~}eq%uCN_i^OfYt`!F=)9aS5IRs3Mrb24`zE3#14iN_tPGxr(v9T}W4Cw+K zo%M-Hrn-ntiDLRdN=u}#QV(R%eV&WK6_c%<78z&uz17@U)JxYWK#l4WmbPHqHg6dd z^g<%lO_ab)k{s|5B-wn? zeMDXsZ&>hIVmw>2GJF^((L4K;1xcma&1yRRX(jrSYfVb|SX|>(u4HbjX>Pw9+szzw zQ&}IzuiQ|5m}!qOn``}6NJX!yP%~(hHaCHMxQx@k-k@HIl8~#{zth~#1YFs0?B|(P za%*^+_3&xNPtGVTlgX_KfMb%dXF=_$Jip&J*YAj5KBdIn3CYeh^8%w(vp70tLaz z>HBk39ay9*s`)by8Mab+H3vN-YoDvcb0$SMiC{ZEwwG`R!2*89mpA)`^jR58MVJEe zawTe4F!{DkHbEw(iwp)Y zrgyYG=Tbfxo5y$T*`LHjAYW4%bRPPgc)$`ds8Q5hu#n*fg6CLt$NcACBsmeM0sg7WyAvC-ntoI@Wf`?5IHt_SsZV2qkL144#7;L# z%|$O6uDy5uMaYV6qj~FPm^XvyQrmC{(!B<|In?+C{kZ|aQC9rg^MAlWNr2)gvoGZIi+Dyw z`+ug;(SRWrrs9Pt_ivzZKgNd#2_+yr)%&rlmjC(mub|L@Jc$5k?@=ZRwY~;%%Pv82 z(4lQ-yPgk`GE1qOMj4CJV_mzmH9c<510P0+j5)F3aJ;m=vJ<92Zo@O^L0F|E^TvyT z4!GDs(g0nhDdT|!EnNs}-goOOzRlM-t@>K~g6U$WZ7X>yU%1Cq>!N*RJWANP$>GZ* zwd|WS3N<7I z2G^>_2gc`2?+#T@$|FC({}Q^VaSo~aymp!_6I7=+_~%c}LNUq%rvwNsx^;2oR-Nx{ zX^dJXZS$BLd)&$Hbsd#lO1xEN33U_eKVP^cloG|WyETm z2?1lec8$=V&xsKn(G=5f z0V#!<%j?ws@3>m<)|RC&p&auO7Pz@~hUBKC1e9dan=z8x>B9}?6VzyfU7}qoPpfOW z&7*{dxwe8wr|v=cyf*yq)%k-5$rBBmkJB(ZqzX1hktN%!%W< zE92l|L75i)idoy?WmnNqZtnTWy(RkN2R@6_f&r-FWBy}K8;u?BGv3vm1PkZ=OcAPf*9^0epD<=) zg>A){lweEr=$Qd~FL)d!Wno_JL=?8`w5(6vBW_PNn3zC&+CyG`k6PiVBRZI7Os9|w zF^ZGDehal@kK>z5mi^v;u{{1fhIkL{ZXOBbcTnRYd`w@)3pK6Nc+>N-s$@%#`9gKa z_InI5%1!jb)Ap)M5qDO@-ix#o@;0k@pECIn57}}XWwBniPD!OCBclvYbhRAE>dA)a zr^?V_gou8R*W;yn7#~8PwOglUIxP;16-B3K7sxM^^&ks%$_0wWUp-FOs!6r&muS=8 zsjr!cNx7s#R2h0Z;tTj#2u9{+8cAh#m+frc9E(iV3R)2~zq+Nt=AkUGFo5t!Ikx;1 zvPUaO6uJ+$R9M`hwS zWHsgAinBk$LLPcqSZ{7G*pxhMv^ODgB^j!|$%sCQ$u!&x)v9Zd6SC>p)cH={k)ZyM z(y)g&jY%utyNHpehl&Y%2)3`54uP(sXDotzsthdfbhWNLbpL~UGui~pK+&$6j(O!F zjuuVnQ<1#$01YQ)Lb)or=Na`VegC0fmvvE?SSL+Bdrrc|tw*8&fnT77vmjY`nL+L# zPY@d93~~YafE+>IARj>JcgqzdE0hI@Q)CH~j+(33ka{);w9fY2PG|%E1dsszuTKjC zrUXIxsbjl~m;@$x_Tk2bOTtdVF@TdO3G4ApmAwg)c55ma3d7A>>wO_CdHzG={{nYh Byr=*G delta 2401 zcmV-n37+=06p#~tFoFq;0s#Xsf(cRv2`Yw2hW8Bt2LYgh2}1;e2|qA`2|F-?1J4Et zDuzgg_YDCD2B3liz%YUXyaE9LFoFZM1_>&LNQU3Ns<4->99jrJqCRXN$HwE?T z5=@||Q2Hzh2eh!=_3h~m;c2REmuI26@FcEFr$)-T)Z+;Cs24<`gwOud~o zyf)Ez_hY0O%_yyz$wzPU1Gnn5ei4Mria|QWsrdd?hRiesgb)Ando3gcCfS4GnXasA z6q|UF%U@-Guzx$h7b*;5Rcpe7kK)m=B05wk^}P9`)_@Y+ts7%0os(D^kXrX!9=_X~ zhjF53GQ7F*V%In|*_2vgKibpd4S^>s$W+HG5%?X-Bv>qT+LuJK-8*E1d@1*{2~)bH zw!b(&rp8B#ujg)K;i+y$zOd*vgAleOH@6Ejoc6h!Z5T7^8 z_IM|exbmg|90Gyq(#oi3PH(!{Q*4!;G4X&B>(bN=&W;jrQ4qdbMvf<QO5lVZ$yAmL@ND+vC_p-S$ETmA!p5Q0jH2^APZWtQ3405P-ec$Q~b1D(& zzU3)EpWX^W78 z)m5|E5j5mTAS>TpI8EBe8MX8DmT|?6sa8j^mWwR}$~YvN<+J${fTsp99`%O1T=w!v z575UCCqOHy@=%*~Xpf~gO&ET?p1bKo3PEXel}+b*$&tC&t7ks!1a}=aFoFetWCjT; zhDe6@4FLxMpn?Te1cC)oFoFe5FoFe11`8^NNQUM$Gz3Mz(3 zhW8Bt3;_c$4g?65J-K4<)YeCXb_N`BQTZ%9QNWz~&;!F71s_3f|x&govtQPxu% z`tzM&Z`8fCX;Ai8lHUOiaSU$b`srP^fndR~)vjz0VO@DPKsQsjXSW@6 z^5u~I5d-7sZr|QLu(zdVzI=P#4oT-W^vBHU{%W*25w~3{rZ@K2s$q-Ua9;ZY5c;?e{Y-aHK_+>m4 zc7ZmwajrCXKSGRu2W|8AC`7bTB&}0|;$2v+4vKf31>doYUH}DhS-p~Nu2p^hl&bsz z!K&vV8yFh@F2VYjNlavQU7zx`bvnnCD?t zAP+fE21BF|*I18-{z;p*KyXaq!TaZykE)}pdfN=@vPdI;0*!?OGb^e{$41V=cZIP=kc4ff|aIUGAd2_zQy8I=_)QhiQx#k4siQPYabAYTB+vE_dbvYut zF~lae+Oj+++ilj}fy&D9g_*)(Zj(+;GoJLy`I@q+|6zmKgP~rkosih<1epfbhZo@2 z9t9Xr>-t}ROF5KaaCyQn_}|W-4W(yGaPXKRaSkwznq~3wyPp%I!FR53ggq5h&{MP! zl30`aCC%nBKf=x2`pJq`^n0`grB#^e+!gSN|{vgd!hF*8v zV0|B@Ny{8h++5x)rCAdcL|Wc)k>-L*>oi{8SD2OCPt5j>JH`*Pb!^4gG~mu66XQ=f zS{yG^{QkGP2B^FeJeRPFhjTn?S0r{~_*n5J?#l_oHyVjvd5x=qEN3I4RHb0s;sCAbEWZ diff --git a/build/pgo/server-locations.txt b/build/pgo/server-locations.txt index 7b8b65804266..ddd393968764 100644 --- a/build/pgo/server-locations.txt +++ b/build/pgo/server-locations.txt @@ -308,12 +308,14 @@ https://bad.include-subdomains.pinning-dynamic.example.com:443 privileged,cer https://badchain.include-subdomains.pinning.example.com:443 privileged,cert=staticPinningBad https://fail-handshake.example.com:443 privileged,failHandshake -# Host for bad cert domain fixup test +# Hosts for bad cert domain fixup tests https://badcertdomain.example.com:443 privileged,cert=badCertDomain https://www.badcertdomain.example.com:443 privileged,cert=badCertDomain https://127.0.0.3:433 privileged,cert=badCertDomain https://badcertdomain.example.com:82 privileged,cert=badCertDomain https://mismatch.badcertdomain.example.com:443 privileged,cert=badCertDomain +https://badcertdomain2.example.com:443 privileged,cert=badCertDomain2 +https://www.badcertdomain2.example.com:443 privileged,cert=badCertDomain2 # Hosts for HTTPS-First upgrades/downgrades http://httpsfirst.com:80 privileged diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index a164412f7c48..0dbf1c30f810 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -232,6 +232,7 @@ #include "nsWidgetsCID.h" #include "nsXULAppAPI.h" +#include "CertVerifier.h" #include "ThirdPartyUtil.h" #include "GeckoProfiler.h" #include "mozilla/NullPrincipal.h" @@ -5775,12 +5776,6 @@ already_AddRefed nsDocShell::MaybeFixBadCertDomainErrorURI( return nullptr; } - // No point in going further if "www." is included in the hostname - // already. That is the only hueristic we're applying in this function. - if (StringBeginsWith(host, "www."_ns)) { - return nullptr; - } - // Return if fixup enable pref is turned off. if (!mozilla::StaticPrefs::security_bad_cert_domain_error_url_fix_enabled()) { return nullptr; @@ -5857,27 +5852,45 @@ already_AddRefed nsDocShell::MaybeFixBadCertDomainErrorURI( } mozilla::pkix::Input serverCertInput; - mozilla::pkix::Result rv1 = + mozilla::pkix::Result result = serverCertInput.Init(certBytes.Elements(), certBytes.Length()); - if (rv1 != mozilla::pkix::Success) { + if (result != mozilla::pkix::Success) { return nullptr; } - nsAutoCString newHost("www."_ns); - newHost.Append(host); + constexpr auto wwwPrefix = "www."_ns; + nsAutoCString newHost; + if (StringBeginsWith(host, wwwPrefix)) { + // Try www.example.com -> example.com + newHost.Assign(Substring(host, wwwPrefix.Length())); + } else { + // Try example.com -> www.example.com + newHost.Assign(wwwPrefix); + newHost.Append(host); + } mozilla::pkix::Input newHostInput; - rv1 = newHostInput.Init( + result = newHostInput.Init( BitwiseCast(newHost.BeginReading()), newHost.Length()); - if (rv1 != mozilla::pkix::Success) { + if (result != mozilla::pkix::Success) { return nullptr; } - // Check if adding a "www." prefix to the request's hostname will - // cause the response's certificate to match. - rv1 = mozilla::pkix::CheckCertHostname(serverCertInput, newHostInput); - if (rv1 != mozilla::pkix::Success) { + // Because certificate verification returned Result::ERROR_BAD_CERT_DOMAIN / + // SSL_ERROR_BAD_CERT_DOMAIN, a chain was built and we know whether or not + // the root was a built-in. + bool rootIsBuiltIn; + if (NS_FAILED(tsi->GetIsBuiltCertChainRootBuiltInRoot(&rootIsBuiltIn))) { + return nullptr; + } + mozilla::psm::SkipInvalidSANsForNonBuiltInRootsPolicy nameMatchingPolicy( + rootIsBuiltIn); + + // Check if the certificate is valid for the new hostname. + result = mozilla::pkix::CheckCertHostname(serverCertInput, newHostInput, + nameMatchingPolicy); + if (result != mozilla::pkix::Success) { return nullptr; } @@ -6062,9 +6075,10 @@ already_AddRefed nsDocShell::AttemptURIFixup( } } - // If we have a SSL_ERROR_BAD_CERT_DOMAIN error, try prefixing the domain name - // with www. to see if we can avoid showing the cert error page. For example, - // https://example.com -> https://www.example.com. + // If we have a SSL_ERROR_BAD_CERT_DOMAIN error, try adding or removing + // "www." to/from the beginning of the domain name to see if we can avoid + // showing the cert error page. For example, https://example.com -> + // https://www.example.com or https://www.example.com -> https://example.com. if (aStatus == mozilla::psm::GetXPCOMFromNSSError(SSL_ERROR_BAD_CERT_DOMAIN)) { newPostData = nullptr; diff --git a/docshell/test/browser/browser_badCertDomainFixup.js b/docshell/test/browser/browser_badCertDomainFixup.js index 4bf6ddcef309..1bc8cfa47717 100644 --- a/docshell/test/browser/browser_badCertDomainFixup.js +++ b/docshell/test/browser/browser_badCertDomainFixup.js @@ -7,19 +7,6 @@ // with www. when we encounter a SSL_ERROR_BAD_CERT_DOMAIN error. // For example, https://example.com -> https://www.example.com. -const PREF_BAD_CERT_DOMAIN_FIX_ENABLED = - "security.bad_cert_domain_error.url_fix_enabled"; -const PREF_ALLOW_HIJACKING_LOCALHOST = - "network.proxy.allow_hijacking_localhost"; - -const BAD_CERT_DOMAIN_ERROR_URL = "https://badcertdomain.example.com:443"; -const FIXED_URL = "https://www.badcertdomain.example.com/"; - -const BAD_CERT_DOMAIN_ERROR_URL2 = - "https://mismatch.badcertdomain.example.com:443"; -const IPV4_ADDRESS = "https://127.0.0.3:433"; -const BAD_CERT_DOMAIN_ERROR_PORT = "https://badcertdomain.example.com:82"; - async function verifyErrorPage(errorPageURL) { let certErrorLoaded = BrowserTestUtils.waitForErrorPage( gBrowser.selectedBrowser @@ -41,52 +28,73 @@ async function verifyErrorPage(errorPageURL) { }); } +// Turn off the pref and ensure that we show the error page as expected. +add_task(async function testNoFixupDisabledByPref() { + await SpecialPowers.pushPrefEnv({ + set: [["security.bad_cert_domain_error.url_fix_enabled", false]], + }); + gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser); + + await verifyErrorPage("https://badcertdomain.example.com"); + await verifyErrorPage("https://www.badcertdomain2.example.com"); + + BrowserTestUtils.removeTab(gBrowser.selectedTab); + await SpecialPowers.popPrefEnv(); +}); + // Test that "www." is prefixed to a https url when we encounter a bad cert domain // error if the "www." form is included in the certificate's subjectAltNames. -add_task(async function prefixBadCertDomain() { - // Turn off the pref and ensure that we show the error page as expected. - Services.prefs.setBoolPref(PREF_BAD_CERT_DOMAIN_FIX_ENABLED, false); - - gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser); - await verifyErrorPage(BAD_CERT_DOMAIN_ERROR_URL); - info("Cert error is shown as expected when the fixup pref is disabled"); - - // Turn on the pref and test that we fix the HTTPS URL. - Services.prefs.setBoolPref(PREF_BAD_CERT_DOMAIN_FIX_ENABLED, true); +add_task(async function testAddPrefixForBadCertDomain() { gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser); let loadSuccessful = BrowserTestUtils.browserLoaded( gBrowser.selectedBrowser, false, - FIXED_URL + "https://www.badcertdomain.example.com/" + ); + BrowserTestUtils.startLoadingURIString( + gBrowser, + "https://badcertdomain.example.com" ); - BrowserTestUtils.startLoadingURIString(gBrowser, BAD_CERT_DOMAIN_ERROR_URL); await loadSuccessful; - info("The URL was fixed as expected"); - - BrowserTestUtils.removeTab(gBrowser.selectedTab); BrowserTestUtils.removeTab(gBrowser.selectedTab); }); // Test that we don't prefix "www." to a https url when we encounter a bad cert domain // error under certain conditions. -add_task(async function ignoreBadCertDomain() { - Services.prefs.setBoolPref(PREF_BAD_CERT_DOMAIN_FIX_ENABLED, true); +add_task(async function testNoFixupCases() { gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser); // Test for when "www." form is not present in the certificate. - await verifyErrorPage(BAD_CERT_DOMAIN_ERROR_URL2); - info("Certificate error was shown as expected"); + await verifyErrorPage("https://mismatch.badcertdomain.example.com"); // Test that urls with IP addresses are not fixed. - Services.prefs.setBoolPref(PREF_ALLOW_HIJACKING_LOCALHOST, true); - await verifyErrorPage(IPV4_ADDRESS); - Services.prefs.clearUserPref(PREF_ALLOW_HIJACKING_LOCALHOST); - info("Certificate error was shown as expected for an IP address"); + await SpecialPowers.pushPrefEnv({ + set: [["network.proxy.allow_hijacking_localhost", true]], + }); + await verifyErrorPage("https://127.0.0.3:433"); + await SpecialPowers.popPrefEnv(); // Test that urls with ports are not fixed. - await verifyErrorPage(BAD_CERT_DOMAIN_ERROR_PORT); - info("Certificate error was shown as expected for a host with port"); + await verifyErrorPage("https://badcertdomain.example.com:82"); + + BrowserTestUtils.removeTab(gBrowser.selectedTab); +}); + +// Test removing "www." prefix if the "www."-less form is included in the +// certificate's subjectAltNames. +add_task(async function testRemovePrefixForBadCertDomain() { + gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser); + let loadSuccessful = BrowserTestUtils.browserLoaded( + gBrowser.selectedBrowser, + false, + "https://badcertdomain2.example.com/" + ); + BrowserTestUtils.startLoadingURIString( + gBrowser, + "https://www.badcertdomain2.example.com" + ); + await loadSuccessful; BrowserTestUtils.removeTab(gBrowser.selectedTab); }); diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp index bc9b9627fbfa..c7cee4b1c5ef 100644 --- a/security/certverifier/CertVerifier.cpp +++ b/security/certverifier/CertVerifier.cpp @@ -784,28 +784,6 @@ static bool CertIsSelfSigned(const BackCert& backCert, void* pinarg) { return rv == Success; } -class SkipInvalidSANsForNonBuiltInRootsPolicy : public NameMatchingPolicy { - public: - explicit SkipInvalidSANsForNonBuiltInRootsPolicy(bool rootIsBuiltIn) - : mRootIsBuiltIn(rootIsBuiltIn) {} - - virtual Result FallBackToCommonName( - Time, - /*out*/ FallBackToSearchWithinSubject& fallBackToCommonName) override { - fallBackToCommonName = FallBackToSearchWithinSubject::No; - return Success; - } - - virtual HandleInvalidSubjectAlternativeNamesBy - HandleInvalidSubjectAlternativeNames() override { - return mRootIsBuiltIn ? HandleInvalidSubjectAlternativeNamesBy::Halting - : HandleInvalidSubjectAlternativeNamesBy::Skipping; - } - - private: - bool mRootIsBuiltIn; -}; - static Result CheckCertHostnameHelper(Input peerCertInput, const nsACString& hostname, bool rootIsBuiltIn) { diff --git a/security/certverifier/CertVerifier.h b/security/certverifier/CertVerifier.h index ddf42108ace3..6748a6ab887e 100644 --- a/security/certverifier/CertVerifier.h +++ b/security/certverifier/CertVerifier.h @@ -135,6 +135,31 @@ class DelegatedCredentialInfo { uint32_t authKeyBits; }; +class SkipInvalidSANsForNonBuiltInRootsPolicy + : public pkix::NameMatchingPolicy { + public: + explicit SkipInvalidSANsForNonBuiltInRootsPolicy(bool rootIsBuiltIn) + : mRootIsBuiltIn(rootIsBuiltIn) {} + + virtual pkix::Result FallBackToCommonName( + pkix::Time, + /*out*/ pkix::FallBackToSearchWithinSubject& fallBackToCommonName) + override { + fallBackToCommonName = pkix::FallBackToSearchWithinSubject::No; + return pkix::Success; + } + + virtual pkix::HandleInvalidSubjectAlternativeNamesBy + HandleInvalidSubjectAlternativeNames() override { + return mRootIsBuiltIn + ? pkix::HandleInvalidSubjectAlternativeNamesBy::Halting + : pkix::HandleInvalidSubjectAlternativeNamesBy::Skipping; + } + + private: + bool mRootIsBuiltIn; +}; + class NSSCertDBTrustDomain; class CertVerifier {