From nobody Wed Jun 1 06:32:35 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E58612D1B5; Wed, 1 Jun 2016 06:32:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.326 X-Spam-Level: X-Spam-Status: No, score=-3.326 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mIxMuX-4lesK; Wed, 1 Jun 2016 06:32:18 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6E0D12D501; Wed, 1 Jun 2016 06:32:17 -0700 (PDT) Received: from unnumerable.local (inet-141-146-6-188.oracle.com [137.254.4.60]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u51DWEvH071338 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK); Wed, 1 Jun 2016 08:32:15 -0500 (CDT) (envelope-from rjsparks@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host inet-141-146-6-188.oracle.com [137.254.4.60] claimed to be unnumerable.local To: "secdir@ietf.org" , "iesg@ietf.org" , draft-ietf-mile-rfc5070-bis.all@ietf.org References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> From: Robert Sparks Message-ID: Date: Wed, 1 Jun 2016 09:32:09 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.1.0 MIME-Version: 1.0 In-Reply-To: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] Secdir review: draft-ietf-mile-rfc5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jun 2016 13:32:30 -0000 Retransmitting to fix a typo in the Subject to make this easier to find when searching on the draft name. Apologies for the extra noise. On 5/30/16 2:43 PM, Robert Sparks wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > Document : draft-ietf-mile-rfc5070bis-22 > > Summary: This document has minor issues that should be addressed > before publication as Proposed Standard > > This document defines a document format for exchanging information > between > operational security teams. It points out standardized mechanisms for > transporting the documents (RFC6545 and RFC6546), to provide > confidentiality, > integrity, and authenticity, but does not restrict the use of the > format to > within those protocols. Instead, it provides a generic set of > "Processing > Considerations" in section 4, which are augmented by the Security > Considerations in section 9. > > There are some minor issues with this approach that should be > addressed before > publication. > > 1) The document requires that implementations validate documents > against the > schema, and reject any documents that fail validation. In particular, > Section > 5.2 Item 4 requires rejecting documents with an unrecognized element in a > supported namespace as a syntax error. Section 4.3 requires > implementations to > ->dynamically generate the schema used for validation from IANA > registries<-. > Section 5.2 Item 5 calls out that this dynamic generation has security > and > performance implications, but does not describe them, and has a very > vague > "SHOULD NOT download schemas at runtime" to guard against them. I > seem to > recall significant discussion in other contexts of the issues with > generating > schema from IANA registries at runtime. Perhaps the ADs can provide > pointers > to material generated from those discussions that the group can > reference. > Otherwise, the threats need to be described in more detail, and the > operational > complexity of exercising these extension points (particularly given the > requirement to reject documents that do not validate against the > content of the > registries) needs to be spelled out. > > 2) The document notes (in Section 9.1) that some fields in the > document format > may contain executable content. It is not clear which fields are being > mentioned, or what _kind_ of executable content is being carried. > Explicitly > calling out the fields that this document defines at this point, and > characterizing their content would help. The precautions you might > need to take > against a regex are different from those you would take against arbitrary > bytecode the recipient might be asked to execute. > > 3) There are several fields that are characterized as "meaningful to > the sender > and recipient". This implies that the document cannot be interpreted > outside > some out-of-band prior arrangement defining the context in which those > fields > are meaningful. The document should explicitly mention the need for > such prior > arrangements in the Security Consideration section, and note the > danger of > attempting to interpret those fields if the ability to ensure the > message falls > within that pre-arranged context is suspect. The existing text around > ensuring > proper authentication of the sender and recipient is a start, but is not > sufficient. While considering the problems with interpreting these > fields in > the wrong context, the document should recognize the possibility that > a given > sender/recipient pair might have _two different_ arrangements about > what these > fields mean, especially given the passage of sufficient time. > > Nits: > > A) Section 2.11 calls out to RFC4519 to defined the syntax of telephone > numbers. The document calls out to E.123, which provides guidelines for > representing phone numbers but does not define a rigorous format > useful for a > protocol field. If it's important to exchange phone numbers in an > interoperable way, consider pointing to something with more structure. > Do you > want the string to conform to E.164? Would it be useful to have > something as > structured as a tel: URI? > > B) Section 4.1 says a character encoding MUST be explicitly specified, > but then > immediately shows an example of a document with no character encoding... > > C) (micronit) The use of [RFC-ENUM] as a reference number is distracting. > Please change the reference tag to [RFC7495]. > > Note: I did _not_ verify that the schema was well formed or that it > matched the > prose. > From nobody Wed Jun 1 07:07:43 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D421512D50A; Wed, 1 Jun 2016 07:07:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBZDJVDEKiul; Wed, 1 Jun 2016 07:07:40 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2F9D12D550; Wed, 1 Jun 2016 07:07:39 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id y126so15116385qke.1; Wed, 01 Jun 2016 07:07:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=woEwIpTA/NBkAJfe35IwBPRP0DUifUSPbC4fQFjZRLQ=; b=CY+CanVnWN6WnkLuQTJ4v7HbAGPo9atpb5TYcgh3LCvvi0EiGQrUSnxLudMgu4Z/4C FfAhFdNJLHxUH33XJ0PJk0m9TWULYg7TmGKYjoeNwoq9Ko6s85D69WKlBs281BalUsRH 9O2aa2u5eOYcaDuzY0USeeFnmfwVTLqy5QyO4UGPkPO8CDKfcPdUgTm/XXt2b2Ic+GSW u+rTTHupnP4oC2Auiob01qygIrSG9sCEw+d/Bm6t08jVVhW6darjVh13M5adZTGNAFac h/ahqgxzYB/aNSSHKXgbWesBlRE5xW9OwOvJQLWl4ZDjxn1piwCzBMEzkKiW9Qyt7E79 s7pA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=woEwIpTA/NBkAJfe35IwBPRP0DUifUSPbC4fQFjZRLQ=; b=JWYUPTEn/Ol2jLgjmhfySUuiwP1MUN9Cg627TNAlGzb99Vufq6Sjz3fiVRf0ytOAtC RRZt//oIA8jx9v6WfXRT+94mNy5rrFj/GIFsSpTLF4hRFwx3DgVxAzI4aveEaXrdk71U r9BkNNHMxvqWcsQpwK3JvHz3ClMBFGT6aNcXpX3hOw3r4h0u1mQCg2SSfEeQWmdDUmSY 5f2/WgrYrZylEL6CJBUdu7AcPMOq7t7LjRaOkA4LHcEKjRyff5s/v5vprl0dJfPt8Dzn xsD2+lNNxY4fnwJO1U2addpYj5NyYWVWRlsOBwhLL2kHZAkxgnA/LB+rAk7KFkz97snw AjWA== X-Gm-Message-State: ALyK8tJI8x0c+CtTf9qwG46BwsysMgRrz9BCowPeQ7nMpQ8cUI/bWdj6WxZLi1cZB4T8ow== X-Received: by 10.237.33.151 with SMTP id l23mr3729346qtc.81.1464790058936; Wed, 01 Jun 2016 07:07:38 -0700 (PDT) Received: from [192.168.1.6] (209-6-124-204.c3-0.arl-ubr1.sbo-arl.ma.cable.rcn.com. [209.6.124.204]) by smtp.gmail.com with ESMTPSA id s7sm5672051qhe.46.2016.06.01.07.07.38 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 01 Jun 2016 07:07:38 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: kathleen.moriarty.ietf@gmail.com X-Mailer: iPhone Mail (12H143) In-Reply-To: Date: Wed, 1 Jun 2016 10:07:37 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <7EAC1ED4-6504-41FB-8877-28EEF6CE2283@gmail.com> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> To: Robert Sparks Archived-At: Cc: "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review: draft-ietf-mile-rfc5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jun 2016 14:07:42 -0000 Thanks, Robert for the review and re sending it. Sent from my iPhone > On Jun 1, 2016, at 9:32 AM, Robert Sparks wrote: >=20 > Retransmitting to fix a typo in the Subject to make this easier to find wh= en searching on the draft name. >=20 > Apologies for the extra noise. >=20 >=20 >> On 5/30/16 2:43 PM, Robert Sparks wrote: >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the >> IESG. These comments were written primarily for the benefit of the >> security area directors. Document editors and WG chairs should treat >> these comments just like any other last call comments. >>=20 >> Document : draft-ietf-mile-rfc5070bis-22 >>=20 >> Summary: This document has minor issues that should be addressed before p= ublication as Proposed Standard >>=20 >> This document defines a document format for exchanging information betwee= n >> operational security teams. It points out standardized mechanisms for >> transporting the documents (RFC6545 and RFC6546), to provide confidential= ity, >> integrity, and authenticity, but does not restrict the use of the format t= o >> within those protocols. Instead, it provides a generic set of "Processin= g >> Considerations" in section 4, which are augmented by the Security >> Considerations in section 9. >>=20 >> There are some minor issues with this approach that should be addressed b= efore >> publication. >>=20 >> 1) The document requires that implementations validate documents against t= he >> schema, and reject any documents that fail validation. In particular, Se= ction >> 5.2 Item 4 requires rejecting documents with an unrecognized element in a= >> supported namespace as a syntax error. Section 4.3 requires implementatio= ns to >> ->dynamically generate the schema used for validation from IANA registrie= s<-. >> Section 5.2 Item 5 calls out that this dynamic generation has security an= d >> performance implications, but does not describe them, and has a very vagu= e >> "SHOULD NOT download schemas at runtime" to guard against them. I seem t= o >> recall significant discussion in other contexts of the issues with genera= ting >> schema from IANA registries at runtime. Perhaps the ADs can provide poin= ters >> to material generated from those discussions that the group can reference= . >> Otherwise, the threats need to be described in more detail, and the opera= tional >> complexity of exercising these extension points (particularly given the >> requirement to reject documents that do not validate against the content o= f the >> registries) needs to be spelled out. >>=20 >> 2) The document notes (in Section 9.1) that some fields in the document f= ormat >> may contain executable content. It is not clear which fields are being >> mentioned, or what _kind_ of executable content is being carried. Explici= tly >> calling out the fields that this document defines at this point, and >> characterizing their content would help. The precautions you might need t= o take >> against a regex are different from those you would take against arbitrary= >> bytecode the recipient might be asked to execute. >>=20 >> 3) There are several fields that are characterized as "meaningful to the s= ender >> and recipient". This implies that the document cannot be interpreted outs= ide >> some out-of-band prior arrangement defining the context in which those fi= elds >> are meaningful. The document should explicitly mention the need for such p= rior >> arrangements in the Security Consideration section, and note the danger o= f >> attempting to interpret those fields if the ability to ensure the message= falls >> within that pre-arranged context is suspect. The existing text around ens= uring >> proper authentication of the sender and recipient is a start, but is not >> sufficient. While considering the problems with interpreting these fields= in >> the wrong context, the document should recognize the possibility that a g= iven >> sender/recipient pair might have _two different_ arrangements about what t= hese >> fields mean, especially given the passage of sufficient time. >>=20 >> Nits: >>=20 >> A) Section 2.11 calls out to RFC4519 to defined the syntax of telephone >> numbers. The document calls out to E.123, which provides guidelines for >> representing phone numbers but does not define a rigorous format useful f= or a >> protocol field. If it's important to exchange phone numbers in an >> interoperable way, consider pointing to something with more structure. Do= you >> want the string to conform to E.164? Would it be useful to have somethin= g as >> structured as a tel: URI? >>=20 >> B) Section 4.1 says a character encoding MUST be explicitly specified, bu= t then >> immediately shows an example of a document with no character encoding... >>=20 >> C) (micronit) The use of [RFC-ENUM] as a reference number is distracting.= >> Please change the reference tag to [RFC7495]. >>=20 >> Note: I did _not_ verify that the schema was well formed or that it match= ed the >> prose. >=20 From nobody Wed Jun 1 22:03:33 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30C8012D15C; Wed, 1 Jun 2016 22:03:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hrBq-vRx2KnF; Wed, 1 Jun 2016 22:03:19 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6175E12D166; Wed, 1 Jun 2016 22:03:19 -0700 (PDT) Received: from pawpaw.sei.cmu.edu (pawpaw.sei.cmu.edu [10.64.21.22]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5253IfM016963; Thu, 2 Jun 2016 01:03:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1464843798; bh=3KKdW1g9y7FF4u6nAAMMP1Wq7qO3LbovWgGC8xZy0M0=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=ZXScq/WgNYAa8xL7hyOD47ZeU70L/D6nsSitItUtsEzfW1NYkNv6wcduy/1mw8abk 20oxsktqIWn6rHZBGvfJkl0XbxJwywKdBHIjhN1ltXale4PAHK/Lf8ClrqsO76/fop O3Ib1eo7VcRsp9n2OUuempRTwKQOAXAWru6nnv2M= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by pawpaw.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5253HX0004580; Thu, 2 Jun 2016 01:03:17 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0279.002; Thu, 2 Jun 2016 01:03:17 -0400 From: "Roman D. Danyliw" To: Robert Sparks Thread-Topic: Secdir review: draft-ietf-mile-5070-bis-22 Thread-Index: AQHRuqVpyhJwvFfMKk6M7OkSPkYlWZ/VizoA Date: Thu, 2 Jun 2016 05:03:16 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> In-Reply-To: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "mile@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 05:03:23 -0000 SGVsbG8gUm9iZXJ0IQ0KDQpUaGFua3MgYWdhaW4gZm9yIHRoaXMgcmV2aWV3LiAgQ29tbWVudHMg YXJlIGlubGluZSAuLi4NCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBS b2JlcnQgU3BhcmtzIFttYWlsdG86cmpzcGFya3NAbm9zdHJ1bS5jb21dDQo+IFNlbnQ6IE1vbmRh eSwgTWF5IDMwLCAyMDE2IDI6NDQgUE0NCj4gVG86IHNlY2RpckBpZXRmLm9yZzsgaWVzZ0BpZXRm Lm9yZzsgZHJhZnQtaWV0Zi1taWxlLXJmYzUwNzAtYmlzLmFsbEBpZXRmLm9yZw0KPiBTdWJqZWN0 OiBTZWNkaXIgcmV2aWV3OiBkcmFmdC1pZXRmLW1pbGUtNTA3MC1iaXMtMjINCj4gDQo+IEkgaGF2 ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9y YXRlJ3Mgb25nb2luZw0KPiBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWlu ZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuICBUaGVzZQ0KPiBjb21tZW50cyB3ZXJlIHdyaXR0ZW4g cHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgc2VjdXJpdHkgYXJlYQ0KPiBkaXJlY3Rv cnMuICBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNv bW1lbnRzDQo+IGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLg0KPiANCj4g RG9jdW1lbnQgOiBkcmFmdC1pZXRmLW1pbGUtcmZjNTA3MGJpcy0yMg0KPiANCj4gU3VtbWFyeTog VGhpcyBkb2N1bWVudCBoYXMgbWlub3IgaXNzdWVzIHRoYXQgc2hvdWxkIGJlIGFkZHJlc3NlZCBi ZWZvcmUNCj4gcHVibGljYXRpb24gYXMgUHJvcG9zZWQgU3RhbmRhcmQNCj4gDQo+IFRoaXMgZG9j dW1lbnQgZGVmaW5lcyBhIGRvY3VtZW50IGZvcm1hdCBmb3IgZXhjaGFuZ2luZyBpbmZvcm1hdGlv bg0KPiBiZXR3ZWVuIG9wZXJhdGlvbmFsIHNlY3VyaXR5IHRlYW1zLiBJdCBwb2ludHMgb3V0IHN0 YW5kYXJkaXplZCBtZWNoYW5pc21zDQo+IGZvciB0cmFuc3BvcnRpbmcgdGhlIGRvY3VtZW50cyAo UkZDNjU0NSBhbmQgUkZDNjU0NiksIHRvIHByb3ZpZGUNCj4gY29uZmlkZW50aWFsaXR5LCBpbnRl Z3JpdHksIGFuZCBhdXRoZW50aWNpdHksIGJ1dCBkb2VzIG5vdCByZXN0cmljdCB0aGUgdXNlIG9m IHRoZQ0KPiBmb3JtYXQgdG8gd2l0aGluIHRob3NlIHByb3RvY29scy4gIEluc3RlYWQsIGl0IHBy b3ZpZGVzIGEgZ2VuZXJpYyBzZXQgb2YNCj4gIlByb2Nlc3NpbmcgQ29uc2lkZXJhdGlvbnMiIGlu IHNlY3Rpb24gNCwgd2hpY2ggYXJlIGF1Z21lbnRlZCBieSB0aGUNCj4gU2VjdXJpdHkgQ29uc2lk ZXJhdGlvbnMgaW4gc2VjdGlvbiA5Lg0KPiANCj4gVGhlcmUgYXJlIHNvbWUgbWlub3IgaXNzdWVz IHdpdGggdGhpcyBhcHByb2FjaCB0aGF0IHNob3VsZCBiZSBhZGRyZXNzZWQNCj4gYmVmb3JlIHB1 YmxpY2F0aW9uLg0KPiANCj4gMSkgVGhlIGRvY3VtZW50IHJlcXVpcmVzIHRoYXQgaW1wbGVtZW50 YXRpb25zIHZhbGlkYXRlIGRvY3VtZW50cyBhZ2FpbnN0DQo+IHRoZSBzY2hlbWEsIGFuZCByZWpl Y3QgYW55IGRvY3VtZW50cyB0aGF0IGZhaWwgdmFsaWRhdGlvbi4gIEluIHBhcnRpY3VsYXIsDQo+ IFNlY3Rpb24NCj4gNS4yIEl0ZW0gNCByZXF1aXJlcyByZWplY3RpbmcgZG9jdW1lbnRzIHdpdGgg YW4gdW5yZWNvZ25pemVkIGVsZW1lbnQgaW4gYQ0KPiBzdXBwb3J0ZWQgbmFtZXNwYWNlIGFzIGEg c3ludGF4IGVycm9yLiBTZWN0aW9uIDQuMyByZXF1aXJlcw0KPiBpbXBsZW1lbnRhdGlvbnMgdG8N Cj4gLT5keW5hbWljYWxseSBnZW5lcmF0ZSB0aGUgc2NoZW1hIHVzZWQgZm9yIHZhbGlkYXRpb24g ZnJvbSBJQU5BDQo+IHJlZ2lzdHJpZXM8LS4NCj4gU2VjdGlvbiA1LjIgSXRlbSA1IGNhbGxzIG91 dCB0aGF0IHRoaXMgZHluYW1pYyBnZW5lcmF0aW9uIGhhcyBzZWN1cml0eSBhbmQNCj4gcGVyZm9y bWFuY2UgaW1wbGljYXRpb25zLCBidXQgZG9lcyBub3QgZGVzY3JpYmUgdGhlbSwgYW5kIGhhcyBh IHZlcnkgdmFndWUNCj4gIlNIT1VMRCBOT1QgZG93bmxvYWQgc2NoZW1hcyBhdCBydW50aW1lIiB0 byBndWFyZCBhZ2FpbnN0IHRoZW0uICBJIHNlZW0NCj4gdG8gcmVjYWxsIHNpZ25pZmljYW50IGRp c2N1c3Npb24gaW4gb3RoZXIgY29udGV4dHMgb2YgdGhlIGlzc3VlcyB3aXRoIGdlbmVyYXRpbmcN Cj4gc2NoZW1hIGZyb20gSUFOQSByZWdpc3RyaWVzIGF0IHJ1bnRpbWUuICBQZXJoYXBzIHRoZSBB RHMgY2FuIHByb3ZpZGUNCj4gcG9pbnRlcnMgdG8gbWF0ZXJpYWwgZ2VuZXJhdGVkIGZyb20gdGhv c2UgZGlzY3Vzc2lvbnMgdGhhdCB0aGUgZ3JvdXAgY2FuDQo+IHJlZmVyZW5jZS4NCj4gT3RoZXJ3 aXNlLCB0aGUgdGhyZWF0cyBuZWVkIHRvIGJlIGRlc2NyaWJlZCBpbiBtb3JlIGRldGFpbCwgYW5k IHRoZQ0KPiBvcGVyYXRpb25hbCBjb21wbGV4aXR5IG9mIGV4ZXJjaXNpbmcgdGhlc2UgZXh0ZW5z aW9uIHBvaW50cyAocGFydGljdWxhcmx5DQo+IGdpdmVuIHRoZSByZXF1aXJlbWVudCB0byByZWpl Y3QgZG9jdW1lbnRzIHRoYXQgZG8gbm90IHZhbGlkYXRlIGFnYWluc3QgdGhlDQo+IGNvbnRlbnQg b2YgdGhlDQo+IHJlZ2lzdHJpZXMpIG5lZWRzIHRvIGJlIHNwZWxsZWQgb3V0Lg0KDQpUbyB0aGlz IGFuYWx5c2lzLCBJJ2xsIGFsc28gYWRkIFN0ZXBoZW4gRmFycmVsbCdzIENPTU1FTlQgKGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvbWlsZS9jdXJyZW50L21zZzAxODg1Lmh0 bWwpIGFnYWluc3QgdXNpbmcgdmFsaWRhdGlvbiBhbmQgdGhlIHNlY3VyaXR5IGlzc3VlcyB3aGVu IGNoZWNraW5nIHRoZSBJQU5BIHJlZ2lzdHJ5OyBhbmQgdGhhdCBBbGV4ZXkgTWVsbmlrb3YgaGFz IG1hcmtlZCB0aGlzIGlzc3VlIGFzIGEgRElTQ1VTUyAoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtaWV0Zi1taWxlLXJmYzUwNzAtYmlzL2JhbGxvdC8pLg0KDQpUbyB0aGUg V0c6IA0KDQpDb25zaWRlcmF0aW9uICMxDQo9PT09PT09PT09PT09PQ0KDQotLS1bIGJlZ2luIEl0 ZW0gIzQgb2YgU2VjdGlvbiA1LjIgXS0tLQ0KICAgNC4gIEltcGxlbWVudGF0aW9ucyB0aGF0IGVu Y291bnRlciBhbiB1bnJlY29nbml6ZWQgZWxlbWVudCBpbiBhDQogICAgICAgc3VwcG9ydGVkIG5h bWVzcGFjZSBNVVNUIHJlamVjdCB0aGUgZG9jdW1lbnQgYXMgYSBzeW50YXggZXJyb3IuDQotLS1b IGVuZCBJdGVtICM0IG9mIFNlY3Rpb24gNS4yIF0tLS0NCg0KKiogRG8gd2Ugd2FudCB0byB3ZWFr ZW4gdGhlIHZhbGlkYXRpb24gcmVxdWlyZW1lbnQgaW4gSXRlbSAjNCBvZiBTZWN0aW9uIDUuMiBm cm9tIE1VU1QgdG8gTUFZPw0KDQpJTU8sIHRoaXMgaXMgYSBzdHJhaWdodGZvcndhcmQgY2hhbmdl IHRoYXQgd2lsbCBwcm92aWRlIG1vcmUgZmxleGliaWxpdHkgZm9yIGltcGxlbWVudGF0aW9ucyB0 byBwcm9jZXNzIGV2ZW4gbm9uLWNvbmZvcm1pbmcgZG9jdW1lbnRzLiANCg0KIE9uZSBtaW5vciBj b25jZXJuIGhlcmUgaXMgdGhhdCB0aGlzIG1heSBub3cgbGVhZCB0byBub24tc3RhbmRhcmQgZXh0 ZW5zaW9ucy4NCg0KQ29uc2lkZXJhdGlvbiAjMg0KPT09PT09PT09PT09PT0NCkl0ZW0gIzUgb2Yg U2VjdGlvbiA1LjIgY2F1dGlvbnMgYWdhaW5zdCBkeW5hbWljYWxseSByZWdlbmVyYXRpbmcgdGhl IHNjaGVtYSBmcm9tIHJlZ2lzdHJ5IHZhbHVlcyBhdCBydW4tdGltZTsgYnV0IGFsc28gZnJvbSBk b3dubG9hZGluZyB0aGUgYmFzZSBzY2hlbWEgdGhlbiB0b28uDQoNCi0tLVsgYmVnaW4gSXRlbSAj NSBvZiBTZWN0aW9uIDUuMiBdLS0tDQogICA1LiAgVGhlcmUgYXJlIHNlY3VyaXR5IGFuZCBwZXJm b3JtYW5jZSBpbXBsaWNhdGlvbnMgaW4gcmVxdWlyaW5nDQogICAgICAgaW1wbGVtZW50YXRpb25z IHRvIGR5bmFtaWNhbGx5IGRvd25sb2FkIHNjaGVtYXMgYXQgcnVuIHRpbWUuDQogICAgICAgVGhl cmVmb3JlLCBpbXBsZW1lbnRhdGlvbnMgU0hPVUxEIE5PVCBkb3dubG9hZCBzY2hlbWFzIGF0IHJ1 bnRpbWUNCiAgICAgICB1bmxlc3MgdGhlIGFwcHJvcHJpYXRlIHByZWNhdXRpb25zIGFyZSB0YWtl bi4gIEltcGxlbWVudGF0aW9ucw0KICAgICAgIGFsc28gbmVlZCB0byBjb250ZW5kIHdpdGggdGhl IHBvdGVudGlhbCBvZiBzaWduaWZpY2FudCBuZXR3b3JrDQogICAgICAgYW5kIHByb2Nlc3Npbmcg aXNzdWVzLg0KLS0tWyBlbmQgSXRlbSAjNSBvZiBTZWN0aW9uIDUuMiBdLS0tDQoNCioqIERvIHdl IHdhbnQgdG8gc3RyZW5ndGhlbiB0aGUgY2F1dGlvbiBvZiBub3QgZG93bmxvYWRpbmcgdGhlIHNj aGVtYSBpbiByZWFsLXRpbWUgaW4gSXRlbSAjNSBvZiBTZWN0aW9uIDUuMiBmcm9tIFNIT1VMRCBO T1QgdG8gTVVTVCBOT1Q/IA0KDQpJTU8sIHllcy4NCg0KQ29uc2lkZXJhdGlvbiAjMw0KPT09PT09 PT09PT09PT0NCg0KQXMgUm9iZXJ0IHN1Z2dlc3RzLCBtaW5pbWFsbHksIHRoZXJlIG5lZWRzIHRv IGJlIGEgZGlzY3Vzc2lvbiBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgb24gaG93IHRo ZXNlIG5ldyBlbnVtIHZhbHVlcyB3aWxsIHNlY3VyZWx5IGJlIGFkZGVkIHRvIHRoZSBzY2hlbWEv cGFyc2VyLiAgSG93ZXZlciwgdGhlIHF1ZXN0aW9uIHJlbWFpbnMsIHdoYXQgZ3VpZGFuY2UgZG8g d2UgcHJvdmlkZSBhYm91dCBob3cgb2Z0ZW4gdGhlIElBTkEgcmVnaXN0cnkgc2hvdWxkIGJlIGNo ZWNrZWQuDQoNCi0tLVsgYmVnaW4gU2VjdGlvbiA0LjNdLS0tDQogICBGdXJ0aGVybW9yZSwgdGhl DQogICBlbnVtZXJhdGVkIHZhbHVlcyBwcmVzZW50IGluIHRoaXMgZG9jdW1lbnQgYXJlIGEgc3Rh dGljIGxpc3QgdGhhdA0KICAgd2lsbCBiZSBpbmNvbXBsZXRlIG92ZXIgdGltZSBhcyBzZWxlY3Qg YXR0cmlidXRlcyBjYW4gYmUgZXh0ZW5kZWQgYnkNCiAgIGEgY29ycmVzcG9uZGluZyBJQU5BIHJl Z2lzdHJ5IHBlciBTZWN0aW9uIDEwLjIuICBUaGVyZWZvcmUsIHRoZQ0KICAgc2NoZW1hIHRvIHZh bGlkYXRlIGEgZ2l2ZW4gZG9jdW1lbnQgTVVTVCBiZSBkeW5hbWljYWxseSBnZW5lcmF0ZWQNCiAg IGZyb20gdGhlc2UgcmVnaXN0cnkgdmFsdWVzLg0KLS0tWyBlbmQgU2VjdGlvbiA0LjMgXS0tLQ0K DQoqKiBTaG91bGQgd2UgbW9kaWZ5IHRoZSBsYXN0IHNlbnRlbmNlIGFzIGZvbGxvd3M6DQoNCiJU aGVyZWZvcmUsIHRoZSBzY2hlbWEgdG8gdmFsaWRhdGUgYSBnaXZlbiBkb2N1bWVudCBNVVNUIGJl IHBlcmlvZGljYWxseSByZWdlbmVyYXRlZCBmcm9tIHRoZXNlIHJlZ2lzdHJ5IHZhbHVlcy4gIEl0 IGlzIFJFQ09NTUVOREVEIHRoYXQgdGhpcyBTSE9VTEQgTk9UIG9jY3VyIG1vcmUgZnJlcXVlbnRs eSB0aGFuIHh4eCINCg0KS2F0aGxlZW4vQWxleGV5L29yIGFueSByZWFkZXIgb2YgdGhpcyBub3Rl OiBkbyB5b3UgaGF2ZSBhIHBvaW50ZXIgdG8gdGhlIHByaW9yIGRpc2N1c3Npb24gb24gZHluYW1p Y2FsbHkgZ2VuZXJhdGluZyBhIHNjaGVtYSBmcm9tIGFuIElBTkEgcmVnaXN0cnkgcmVmZXJlbmNl ZCBieSBSb2JlcnQgc28gdGhhdCAieHh4IiBjYW4gYmUgcG9wdWxhdGVkPw0KDQogDQo+IDIpIFRo ZSBkb2N1bWVudCBub3RlcyAoaW4gU2VjdGlvbiA5LjEpIHRoYXQgc29tZSBmaWVsZHMgaW4gdGhl IGRvY3VtZW50DQo+IGZvcm1hdCBtYXkgY29udGFpbiBleGVjdXRhYmxlIGNvbnRlbnQuIEl0IGlz IG5vdCBjbGVhciB3aGljaCBmaWVsZHMgYXJlIGJlaW5nDQo+IG1lbnRpb25lZCwgb3Igd2hhdCBf a2luZF8gb2YgZXhlY3V0YWJsZSBjb250ZW50IGlzIGJlaW5nIGNhcnJpZWQuIEV4cGxpY2l0bHkN Cj4gY2FsbGluZyBvdXQgdGhlIGZpZWxkcyB0aGF0IHRoaXMgZG9jdW1lbnQgZGVmaW5lcyBhdCB0 aGlzIHBvaW50LCBhbmQNCj4gY2hhcmFjdGVyaXppbmcgdGhlaXIgY29udGVudCB3b3VsZCBoZWxw LiBUaGUgcHJlY2F1dGlvbnMgeW91IG1pZ2h0IG5lZWQgdG8NCj4gdGFrZSBhZ2FpbnN0IGEgcmVn ZXggYXJlIGRpZmZlcmVudCBmcm9tIHRob3NlIHlvdSB3b3VsZCB0YWtlIGFnYWluc3QNCj4gYXJi aXRyYXJ5IGJ5dGVjb2RlIHRoZSByZWNpcGllbnQgbWlnaHQgYmUgYXNrZWQgdG8gZXhlY3V0ZS4N Cg0KVGhlIGFyZWFzIG9mIGNvbmNlcm4gd291bGQgYmU6DQoNCigxKSBhbnkgY2xhc3NlcyB0aGF0 IGNhbiBoYXZlICJiaW5hcnkgc3RyaW5ncyIgcGVyIFNlY3Rpb24gMi41IHNpbmNlIHRoaXMgd291 bGQgYWxsb3cgYmluYXJ5IGNvZGUgdG8gYmUgZW1iZWRkZWQgaW4gdGhlIGRvY3VtZW50LiAgVGhl IGFmZmVjdGVkIGNsYXNzZXMgYXJlIHRob3NlIG9mIHR5cGUgaW9kZWY6RXh0ZW5zaW9uVHlwZSBh bmQgUmVjb3JkUGF0dGVybjsNCigyKSB0aGUgRW1haWxNZXNzYWdlIGFuZCBFbWFpbEJvZHkgY2xh c3Nlcw0KKDMpIHRoZSBEZXRlY3Rpb25QYXR0ZXJuIGNsYXNzLCBhcyBpdCBjb3VsZCBzcGVjaWZ5 IGEgbWFjaGluZSByZWFkYWJsZSBjb25maWd1cmF0aW9uIGZvciBhIGRldmljZSBvciBhcHBsaWNh dGlvbg0KKDQpIHRoZSBVUkwgY2xhc3MgdGhhdCBjb3VsZCByZWZlcmVuY2UgYSBsb2NhdGlvbiBj b250YWluaW5nIGV4ZWN1dGFibGUgY29udGVudA0KKDUpIHRoZSBBZGRpdGlvbmFsRGF0YSBjbGFz cyB3aGljaCBjb250YWluIHByZXR0eSBtdWNoIGFueXRoaW5nDQoNCigxKSAtICg0KSBhcmUgcGxh Y2VzIGluIHRoZSBkYXRhIG1vZGVsIHdoZXJlIGJpbmFyeSBibG9icyBvciB0ZXh0IHNjcmlwdHMg Y291bGQgYmUgaW5zZXJ0ZWQgYnkgZGVzaWduLiAgV2l0aCAoNSksIHRoaXMgaXMgYSBhbiBleHRl bnNpb24gb24gd2hpY2ggdGhlcmUgYXJlIG5vIGNvbnN0cmFpbnRzLiAgVGVjaG5pY2FsbHksIGV4 ZWN1dGFibGUgY29udGVudCBhbHNvIGJlIHB1dCBpbnRvIGFueSBvZiB0aGUgY2xhc3NlcyBidXQg dGhlIHBhcnNlciBpcyB1bmxpa2VseSB0byByZWFkIHRoZW0gYXMgc3VjaC4NCg0KQ2xhcmlmeWlu ZyBsYW5ndWFnZSByZWZlcmVuY2luZyB0aGVzZSBjbGFzc2VzIGNhbiBiZSBhZGRlZCB0byB0aGUg c2VjdXJpdHkgY29uc2lkZXJhdGlvbnMuDQoNCj4gMykgVGhlcmUgYXJlIHNldmVyYWwgZmllbGRz IHRoYXQgYXJlIGNoYXJhY3Rlcml6ZWQgYXMgIm1lYW5pbmdmdWwgdG8gdGhlDQo+IHNlbmRlciBh bmQgcmVjaXBpZW50Ii4gVGhpcyBpbXBsaWVzIHRoYXQgdGhlIGRvY3VtZW50IGNhbm5vdCBiZSBp bnRlcnByZXRlZA0KPiBvdXRzaWRlIHNvbWUgb3V0LW9mLWJhbmQgcHJpb3IgYXJyYW5nZW1lbnQg ZGVmaW5pbmcgdGhlIGNvbnRleHQgaW4gd2hpY2gNCj4gdGhvc2UgZmllbGRzIGFyZSBtZWFuaW5n ZnVsLiBUaGUgZG9jdW1lbnQgc2hvdWxkIGV4cGxpY2l0bHkgbWVudGlvbiB0aGUNCj4gbmVlZCBm b3Igc3VjaCBwcmlvciBhcnJhbmdlbWVudHMgaW4gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb24g c2VjdGlvbiwgYW5kDQo+IG5vdGUgdGhlIGRhbmdlciBvZiBhdHRlbXB0aW5nIHRvIGludGVycHJl dCB0aG9zZSBmaWVsZHMgaWYgdGhlIGFiaWxpdHkgdG8gZW5zdXJlDQo+IHRoZSBtZXNzYWdlIGZh bGxzIHdpdGhpbiB0aGF0IHByZS1hcnJhbmdlZCBjb250ZXh0IGlzIHN1c3BlY3QuIFRoZSBleGlz dGluZw0KPiB0ZXh0IGFyb3VuZCBlbnN1cmluZyBwcm9wZXIgYXV0aGVudGljYXRpb24gb2YgdGhl IHNlbmRlciBhbmQgcmVjaXBpZW50IGlzIGENCj4gc3RhcnQsIGJ1dCBpcyBub3Qgc3VmZmljaWVu dC4gV2hpbGUgY29uc2lkZXJpbmcgdGhlIHByb2JsZW1zIHdpdGggaW50ZXJwcmV0aW5nDQo+IHRo ZXNlIGZpZWxkcyBpbiB0aGUgd3JvbmcgY29udGV4dCwgdGhlIGRvY3VtZW50IHNob3VsZCByZWNv Z25pemUgdGhlDQo+IHBvc3NpYmlsaXR5IHRoYXQgYSBnaXZlbiBzZW5kZXIvcmVjaXBpZW50IHBh aXIgbWlnaHQgaGF2ZSBfdHdvIGRpZmZlcmVudF8NCj4gYXJyYW5nZW1lbnRzIGFib3V0IHdoYXQg dGhlc2UgZmllbGRzIG1lYW4sIGVzcGVjaWFsbHkgZ2l2ZW4gdGhlIHBhc3NhZ2Ugb2YNCj4gc3Vm ZmljaWVudCB0aW1lLg0KDQpBZ3JlZWQuICBUaGVyZSBuZWVkcyB0byBiZSBsYW5ndWFnZSBhZGRl ZCB0byB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgdG8gZGlzY3VzcyBwcm9maWxpbmcgYW5k IG91dC1vZi1iYW5kIGFycmFuZ2VtZW50cy4gIEluIHNjYW5uaW5nIHRocm91Z2ggdGhlIGRvY3Vt ZW50LCBEZWZpbmVkQ09BLCBpcyBvbmUgb2YgdGhvc2UuICBXaGF0IGFyZSB0aGUgb3RoZXIgZmll bGRzIHlvdSBjYXVnaHQ/DQoNCg0KPiBOaXRzOg0KPiANCj4gQSkgU2VjdGlvbiAyLjExIGNhbGxz IG91dCB0byBSRkM0NTE5IHRvIGRlZmluZWQgdGhlIHN5bnRheCBvZiB0ZWxlcGhvbmUNCj4gbnVt YmVycy4gIFRoZSBkb2N1bWVudCBjYWxscyBvdXQgdG8gRS4xMjMsIHdoaWNoIHByb3ZpZGVzIGd1 aWRlbGluZXMgZm9yDQo+IHJlcHJlc2VudGluZyBwaG9uZSBudW1iZXJzIGJ1dCBkb2VzIG5vdCBk ZWZpbmUgYSByaWdvcm91cyBmb3JtYXQgdXNlZnVsDQo+IGZvciBhIHByb3RvY29sIGZpZWxkLiAg SWYgaXQncyBpbXBvcnRhbnQgdG8gZXhjaGFuZ2UgcGhvbmUgbnVtYmVycyBpbiBhbg0KPiBpbnRl cm9wZXJhYmxlIHdheSwgY29uc2lkZXIgcG9pbnRpbmcgdG8gc29tZXRoaW5nIHdpdGggbW9yZSBz dHJ1Y3R1cmUuDQo+IERvIHlvdQ0KPiB3YW50IHRoZSBzdHJpbmcgdG8gY29uZm9ybSB0byBFLjE2 ND8gIFdvdWxkIGl0IGJlIHVzZWZ1bCB0byBoYXZlIHNvbWV0aGluZw0KPiBhcyBzdHJ1Y3R1cmVk IGFzIGEgdGVsOiBVUkk/DQo+IA0KPiBCKSBTZWN0aW9uIDQuMSBzYXlzIGEgY2hhcmFjdGVyIGVu Y29kaW5nIE1VU1QgYmUgZXhwbGljaXRseSBzcGVjaWZpZWQsIGJ1dA0KPiB0aGVuIGltbWVkaWF0 ZWx5IHNob3dzIGFuIGV4YW1wbGUgb2YgYSBkb2N1bWVudCB3aXRoIG5vIGNoYXJhY3Rlcg0KPiBl bmNvZGluZy4uLg0KDQpHb29kIHBvaW50LiAgVGhhdCB3aWxsIGJlIGZpeGVkLiAgVXBvbiBmdXJ0 aGVyIHJldmlldywgdGhlIGV4YW1wbGUgd2l0aCBubyBlbmNvZGluZyBhbHNvIGRvZXNuJ3QgbWFr ZSBzZW5zZSBnaXZlbiB0aGUgTVVTVCBhYm92ZSBpbiB0aGUgdGV4dCBzYXlpbmcgaXQgYWx3YXlz IG5lZWRzIHRvIGJlIHNwZWNpZmllZC4gIFRoZSB0d28gZXhhbXBsZXMgaW4gdGhpcyBzZWN0aW9u IGFyZSBmcm9tIFJGQzUwNzAgYnV0IHRoZXkgZG9uJ3QgYWxpZ24gd2l0aCB0aGUgdGV4dCB1cGRh dGVkIGluIHRoaXMgZHJhZnQuDQoNCj4gQykgKG1pY3Jvbml0KSBUaGUgdXNlIG9mIFtSRkMtRU5V TV0gYXMgYSByZWZlcmVuY2UgbnVtYmVyIGlzIGRpc3RyYWN0aW5nLg0KPiBQbGVhc2UgY2hhbmdl IHRoZSByZWZlcmVuY2UgdGFnIHRvIFtSRkM3NDk1XS4NCg0KR29vZCBwb2ludC4gIFRoaXMgd2ls bCBiZSBmaXhlZC4NCg0KUm9tYW4NCg0K From nobody Thu Jun 2 01:52:08 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C460B12D0F8; Thu, 2 Jun 2016 01:51:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.427 X-Spam-Level: X-Spam-Status: No, score=-3.427 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oi6Xt1WmF_16; Thu, 2 Jun 2016 01:51:51 -0700 (PDT) Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id 25B5C12D5DD; Thu, 2 Jun 2016 01:51:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1464857510; d=isode.com; s=selector; i=@isode.com; bh=aKrMg5vAaQQXCfEe+yHg8F9m+GoQNLU1Bfu7d0iqSF8=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=iboXYlbx5QPSa4VAB9hycllGi1RRIDb3UJyX6+oe6NxcnaGZp9E6ah7xM9aQjwzplk9ykR WL4PU22ESXKQGP2HP3mPYFeEhgryIcMk5zeBM55NJ9sGyLs97pKSYaRvTP5EhVSx4QWrsD tPA4UkWdVx08O8I3HDr/MZrN/U7zwzY=; Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Thu, 2 Jun 2016 09:51:49 +0100 To: "Roman D. Danyliw" , Robert Sparks References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> From: Alexey Melnikov Message-ID: <574FF391.6000806@isode.com> Date: Thu, 2 Jun 2016 09:51:29 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "mile@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 08:51:53 -0000 Hi Roman, On 02/06/2016 06:03, Roman D. Danyliw wrote: > Hello Robert! > > Thanks again for this review. Comments are inline ... > >> -----Original Message----- >> From: Robert Sparks [mailto:rjsparks@nostrum.com] >> Sent: Monday, May 30, 2016 2:44 PM >> To: secdir@ietf.org; iesg@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf.org >> Subject: Secdir review: draft-ietf-mile-5070-bis-22 >> >> I have reviewed this document as part of the security directorate's ongoing >> effort to review all IETF documents being processed by the IESG. These >> comments were written primarily for the benefit of the security area >> directors. Document editors and WG chairs should treat these comments >> just like any other last call comments. >> >> Document : draft-ietf-mile-rfc5070bis-22 >> >> Summary: This document has minor issues that should be addressed before >> publication as Proposed Standard >> >> This document defines a document format for exchanging information >> between operational security teams. It points out standardized mechanisms >> for transporting the documents (RFC6545 and RFC6546), to provide >> confidentiality, integrity, and authenticity, but does not restrict the use of the >> format to within those protocols. Instead, it provides a generic set of >> "Processing Considerations" in section 4, which are augmented by the >> Security Considerations in section 9. >> >> There are some minor issues with this approach that should be addressed >> before publication. >> >> 1) The document requires that implementations validate documents against >> the schema, and reject any documents that fail validation. In particular, >> Section >> 5.2 Item 4 requires rejecting documents with an unrecognized element in a >> supported namespace as a syntax error. Section 4.3 requires >> implementations to >> ->dynamically generate the schema used for validation from IANA >> registries<-. >> Section 5.2 Item 5 calls out that this dynamic generation has security and >> performance implications, but does not describe them, and has a very vague >> "SHOULD NOT download schemas at runtime" to guard against them. I seem >> to recall significant discussion in other contexts of the issues with generating >> schema from IANA registries at runtime. Perhaps the ADs can provide >> pointers to material generated from those discussions that the group can >> reference. >> Otherwise, the threats need to be described in more detail, and the >> operational complexity of exercising these extension points (particularly >> given the requirement to reject documents that do not validate against the >> content of the >> registries) needs to be spelled out. > To this analysis, I'll also add Stephen Farrell's COMMENT (https://www.ietf.org/mail-archive/web/mile/current/msg01885.html) against using validation and the security issues when checking the IANA registry; and that Alexey Melnikov has marked this issue as a DISCUSS (https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/ballot/). > > To the WG: > > Consideration #1 > ============== > > ---[ begin Item #4 of Section 5.2 ]--- > 4. Implementations that encounter an unrecognized element in a > supported namespace MUST reject the document as a syntax error. > ---[ end Item #4 of Section 5.2 ]--- > > ** Do we want to weaken the validation requirement in Item #4 of Section 5.2 from MUST to MAY? > > IMO, this is a straightforward change that will provide more flexibility for implementations to process even non-conforming documents. I don't mind, but I can also live with SHOULD here. > One minor concern here is that this may now lead to non-standard extensions. > > Consideration #2 > ============== > Item #5 of Section 5.2 cautions against dynamically regenerating the schema from registry values at run-time; but also from downloading the base schema then too. > > ---[ begin Item #5 of Section 5.2 ]--- > 5. There are security and performance implications in requiring > implementations to dynamically download schemas at run time. > Therefore, implementations SHOULD NOT download schemas at runtime > unless the appropriate precautions are taken. Implementations > also need to contend with the potential of significant network > and processing issues. > ---[ end Item #5 of Section 5.2 ]--- > > ** Do we want to strengthen the caution of not downloading the schema in real-time in Item #5 of Section 5.2 from SHOULD NOT to MUST NOT? > > IMO, yes. Yes. > Consideration #3 > ============== > > As Robert suggests, minimally, there needs to be a discussion in the security considerations on how these new enum values will securely be added to the schema/parser. However, the question remains, what guidance do we provide about how often the IANA registry should be checked. > > ---[ begin Section 4.3]--- > Furthermore, the > enumerated values present in this document are a static list that > will be incomplete over time as select attributes can be extended by > a corresponding IANA registry per Section 10.2. Therefore, the > schema to validate a given document MUST be dynamically generated > from these registry values. > ---[ end Section 4.3 ]--- > > ** Should we modify the last sentence as follows: > > "Therefore, the schema to validate a given document MUST be periodically regenerated from these registry values. It is RECOMMENDED that this SHOULD NOT occur more frequently than xxx" > > Kathleen/Alexey/or any reader of this note: do you have a pointer to the prior discussion on dynamically generating a schema from an IANA registry referenced by Robert so that "xxx" can be populated? I have no idea about reasonable "xxx" values. This was never done before. (When it was suggested before IESG persuaded authors to change their documents.) While talking to www.iana.org directly from devices/programs is tempting, it might be better if vendors periodically download new values from IANA and then devices/programs talk to vendor's websites (or use vendor's update mechanisms). Best Regards, Alexey From nobody Thu Jun 2 03:42:57 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F29712D0BE for ; Thu, 2 Jun 2016 03:42:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DbZ6QaE9Tta0 for ; Thu, 2 Jun 2016 03:42:54 -0700 (PDT) Received: from mail.kivinen.iki.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C404112B02C for ; Thu, 2 Jun 2016 03:42:53 -0700 (PDT) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id u52Agnel007038 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 2 Jun 2016 13:42:49 +0300 (EEST) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id u52AgmQk018699; Thu, 2 Jun 2016 13:42:48 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <22352.3496.868655.340014@fireball.acr.fi> Date: Thu, 2 Jun 2016 13:42:48 +0300 From: Tero Kivinen To: secdir@ietf.org X-Edit-Time: 0 min X-Total-Time: 0 min Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 10:42:56 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Brian Weis is next in the rotation. For telechat 2016-06-02 Reviewer LC end Draft Eric Osterweil T 2016-05-26 draft-hardie-rfc6455-iana-clarification-03 For telechat 2016-06-16 Tina TSOU T 2016-06-08 draft-ietf-ccamp-additional-signal-type-g709v3-04 Sean Turner T 2016-06-03 draft-ietf-dmarc-interoperability-15 Carl Wallace T 2016-06-22 draft-ietf-forces-interfelfb-04 David Waltermire T 2016-06-07 draft-ietf-idr-ix-bgp-route-server-10 Last calls and special requests: Alan DeKok 2016-04-30 draft-bradner-rfc3979bis-08 Daniel Kahn Gillmor E 2016-02-01 draft-ietf-rtcweb-security-08 Matthew Miller R2016-06-01 draft-ietf-avtext-splicing-notification-07 Yaron Sheffer 2016-05-23 draft-ietf-dhc-topo-conf-08 Hannes Tschofenig 2015-12-28 draft-ietf-hip-rfc5204-bis-07 Hannes Tschofenig E None draft-ietf-ntp-network-time-security-14 Hannes Tschofenig E None draft-ietf-ntp-cms-for-nts-message-06 Hannes Tschofenig E None draft-ietf-ntp-using-nts-for-ntp-05 Brian Weis E 2016-02-01 draft-ietf-cdni-uri-signing-07 -- kivinen@iki.fi From nobody Thu Jun 2 04:59:57 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FF8212D118; Thu, 2 Jun 2016 03:51:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1464864711; bh=LCajBwf5pxTvxq6mAO+QCyaUbGH7OuWKF6BKmiT9zaU=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=KLnHHyEmeAHIqvMg7KuISbMoqwV13IS9ZhyxjwLWGjCZR0PEloT48Ey36sqFNNiOq b1qREI2RrPY025tfXSakqPFUk3YMQN5rEaBE95dtpzREglP1o/OMiwTprCl8ofuUTY dIaQyBjXby06I24gcyE/vlQVork8S374EsK2dNv0= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D4ED12B02A for ; Thu, 2 Jun 2016 03:51:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.325 X-Spam-Level: X-Spam-Status: No, score=-3.325 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.001, RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id koLLa4-rrPbL for ; Thu, 2 Jun 2016 03:51:47 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [IPv6:2001:470:8b2d:804:52:12:128:0]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A8AC12D118 for ; Thu, 2 Jun 2016 03:51:47 -0700 (PDT) Received: from [2001:da8:203:80:2daf:a235:5085:505f] by raoul.w3.org with esmtpsa (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1b8QE4-0009gs-VB for new-work@ietf.org; Thu, 02 Jun 2016 10:51:45 +0000 To: new-work@ietf.org From: Xueyuan Jia Message-ID: <41d5f403-d5bc-8306-9518-c748e3f22b8a@w3.org> Date: Thu, 2 Jun 2016 18:54:03 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Thunderbird/45.1.0 MIME-Version: 1.0 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 04:59:57 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Web Performance Working Group (until 2016-06-30) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 10:51:51 -0000 Hello, Today W3C Advisory Committee Representatives received a Proposal to review a draft charter for the Web Performance Working Group:: https://w3c.github.io/charter-webperf/ As part of ensuring that the community is aware of proposed work at W3C, this draft charter is public during the Advisory Committee review period. W3C invites public comments through 2016-06-30 on the proposed charter. Please send comments to public-new-work@w3.org, which has a public archive: http://lists.w3.org/Archives/Public/public-new-work/ Other than comments sent in formal responses by W3C Advisory Committee Representatives, W3C cannot guarantee a response to comments. If you work for a W3C Member [1], please coordinate your comments with your Advisory Committee Representative. For example, you may wish to make public comments via this list and have your Advisory Committee Representative refer to it from his or her formal review comments. If you should have any questions or need further information, please contact Philippe Le Hegaret and Xiaoqian Wu , Web Performance Working Group Team Contacts. Thank you, Xueyuan Jia, W3C Marketing & Communications [1] http://www.w3.org/Consortium/Member/List _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Thu Jun 2 05:49:19 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65E3512B05F; Thu, 2 Jun 2016 05:49:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QjwrzOAPCZ6i; Thu, 2 Jun 2016 05:49:08 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9BEE12B027; Thu, 2 Jun 2016 05:49:06 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u52Cn528023562; Thu, 2 Jun 2016 08:49:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1464871745; bh=L3TlRDHEcUNUena0fLN48npXw36HdeYKa9GjI/QYUd0=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=Qj8V+Gzy/f0lX/JFiq81oSXyI/wj7TswzMwCVdhCiiy4+1W8Vb5T4jYYbNRSRa2Ln OZFwAbparkHLtHphLNuZAiO9LFHbm4ORTaK2xgjhxXnADhI3RdibSJtCAdhTdb33Ui rN0q/w0MG+6gcqfdBo9LodjhU7L/vQmM+rtEfB+8= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u52Ckkt7015422; Thu, 2 Jun 2016 08:46:46 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0279.002; Thu, 2 Jun 2016 08:49:00 -0400 From: "Roman D. Danyliw" To: Alexey Melnikov , Robert Sparks Thread-Topic: [mile] Secdir review: draft-ietf-mile-5070-bis-22 Thread-Index: AQHRuqVpyhJwvFfMKk6M7OkSPkYlWZ/VizoAgACacYD///tLAA== Date: Thu, 2 Jun 2016 12:49:00 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD9750115@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> <574FF391.6000806@isode.com> In-Reply-To: <574FF391.6000806@isode.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "mile@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 12:49:10 -0000 Hi Alexey! > -----Original Message----- > From: Alexey Melnikov [mailto:alexey.melnikov@isode.com] > Sent: Thursday, June 02, 2016 4:51 AM > To: Roman D. Danyliw ; Robert Sparks > > Cc: mile@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf.org; iesg@ietf.or= g; > secdir@ietf.org > Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22 >=20 > Hi Roman, >=20 > On 02/06/2016 06:03, Roman D. Danyliw wrote: > > Hello Robert! > > > > Thanks again for this review. Comments are inline ... > > > >> -----Original Message----- > >> From: Robert Sparks [mailto:rjsparks@nostrum.com] > >> Sent: Monday, May 30, 2016 2:44 PM > >> To: secdir@ietf.org; iesg@ietf.org; > >> draft-ietf-mile-rfc5070-bis.all@ietf.org > >> Subject: Secdir review: draft-ietf-mile-5070-bis-22 [snip] > > Consideration #3 > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > > As Robert suggests, minimally, there needs to be a discussion in the > security considerations on how these new enum values will securely be > added to the schema/parser. However, the question remains, what > guidance do we provide about how often the IANA registry should be > checked. > > > > ---[ begin Section 4.3]--- > > Furthermore, the > > enumerated values present in this document are a static list that > > will be incomplete over time as select attributes can be extended b= y > > a corresponding IANA registry per Section 10.2. Therefore, the > > schema to validate a given document MUST be dynamically generated > > from these registry values. > > ---[ end Section 4.3 ]--- > > > > ** Should we modify the last sentence as follows: > > > > "Therefore, the schema to validate a given document MUST be periodicall= y > regenerated from these registry values. It is RECOMMENDED that this > SHOULD NOT occur more frequently than xxx" > > > > Kathleen/Alexey/or any reader of this note: do you have a pointer to th= e > prior discussion on dynamically generating a schema from an IANA registry > referenced by Robert so that "xxx" can be populated? > I have no idea about reasonable "xxx" values. This was never done before. > (When it was suggested before IESG persuaded authors to change their > documents.) Understood. Thanks for channeling the historical wisdom. > While talking to www.iana.org directly from devices/programs is tempting,= it > might be better if vendors periodically download new values from IANA and > then devices/programs talk to vendor's websites (or use vendor's update > mechanisms). What about language like the following in Section 4.3: ---[ begin Section 4.3]--- -- Therefore, the schema to validate a given document MUST=20 -- be dynamically generated from these registry values. ++ Therefore, IODEF implementations MUST periodically update=20 ++ their schema and MAY need to update their parsing algorithms=20 ++ to incorporate newly registered values added=20 ++ to the IANA registries specified in Section xx. ---[ end Section 4.3 ]--- In addition, add text to the security considerations that this updating nee= ds to be done securely. Roman From nobody Thu Jun 2 05:49:37 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24D9512D6EF; Thu, 2 Jun 2016 05:49:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0C-fFOs6LN4L; Thu, 2 Jun 2016 05:49:12 -0700 (PDT) Received: from mail-qg0-x243.google.com (mail-qg0-x243.google.com [IPv6:2607:f8b0:400d:c04::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF9BF12D6D4; Thu, 2 Jun 2016 05:49:12 -0700 (PDT) Received: by mail-qg0-x243.google.com with SMTP id l75so15834619qgd.3; Thu, 02 Jun 2016 05:49:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=LCNxForQ4vwR6Yzu4k+MuTf/4bOYhgKT2RqFyoKFr/Y=; b=GCm8PfCmfrF/KuRA5PITAFNgWIohyaOH/k7t15goPV7no8X2nWpP8z+nMQo8MBOdkV b2lL67QZprFSX4gQFXjnpxdZGBoKGfMMFrCmYY4VGJU+RkpL5q8NglESTU/Ao2wpiuRn kL+HudnIcQiV8PaLDVT25fyOUVdkxWjbzo7JPk7ls1C4ji2aNGdjznffDgJ63CXF6FkJ EyZxORM25quOEuyoS2x7hnKw0r4L5jYd/MWwAS65symx7DaKaNdFT4JluDoDV9SjOiJB GA2CswD0fdsqYmrWli8WcPiq4a9yw3plyAKk4Z8UNDzAWNiw5dUpPAz7sBIqPQdNooZz dGiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=LCNxForQ4vwR6Yzu4k+MuTf/4bOYhgKT2RqFyoKFr/Y=; b=DVfRX7KWiDMpnaDDgfXPxm5cP4hbGk4hP5+It0l0R0fjvpgneWJeHdVcPYXQgszjZg 973EQY+P0vCfaEpWeL0CX4HCMV1rp4ZpRQxi39n4BB5RpfUEBYKQ50or1D0SfsmOrSk9 8pACnjT7G6GoakFFNIYkT8bysw6VsI00h/7ZeY4xpstPm6HJiJQuxrRx6Gim7IGjEcQL tlJYMSesMCkfh0RyyvbHVxlLpvVdHghRy/2hWI8rZ0lmDfUfo/RFqkMfiKo4HRriCBnl IRHXwByM3szfXUE1HkFZ223rgP53gqkmAKjDa9/lmzY5PvFlK0GMRHmfB+DSTNwQ64Hi ifWw== X-Gm-Message-State: ALyK8tIbmly0bqSS2rgDFGrowPilmh3dQyPkwlmGLXQM9O+moHDqhXjYa+JEJ3Dkg0ND5w== X-Received: by 10.140.249.5 with SMTP id u5mr43325123qhc.24.1464871751699; Thu, 02 Jun 2016 05:49:11 -0700 (PDT) Received: from [192.168.1.6] (209-6-124-204.c3-0.arl-ubr1.sbo-arl.ma.cable.rcn.com. [209.6.124.204]) by smtp.gmail.com with ESMTPSA id e50sm11053804qga.22.2016.06.02.05.49.11 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 02 Jun 2016 05:49:11 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable From: kathleen.moriarty.ietf@gmail.com Mime-Version: 1.0 (1.0) Date: Thu, 2 Jun 2016 08:13:01 -0400 Message-Id: References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> <574FF391.6000806@isode.com> In-Reply-To: <574FF391.6000806@isode.com> To: Alexey Melnikov X-Mailer: iPhone Mail (12H143) Archived-At: Cc: "Roman D. Danyliw" , "secdir@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "mile@ietf.org" Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 12:49:15 -0000 Hello, Thanks Robert for the detailed and helpful review. Inline=20 Sent from my iPhone > On Jun 2, 2016, at 4:51 AM, Alexey Melnikov wr= ote: >=20 > Hi Roman, >=20 >> On 02/06/2016 06:03, Roman D. Danyliw wrote: >> Hello Robert! >>=20 >> Thanks again for this review. Comments are inline ... >>=20 >>> -----Original Message----- >>> From: Robert Sparks [mailto:rjsparks@nostrum.com] >>> Sent: Monday, May 30, 2016 2:44 PM >>> To: secdir@ietf.org; iesg@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf= .org >>> Subject: Secdir review: draft-ietf-mile-5070-bis-22 >>>=20 >>> I have reviewed this document as part of the security directorate's ongo= ing >>> effort to review all IETF documents being processed by the IESG. These >>> comments were written primarily for the benefit of the security area >>> directors. Document editors and WG chairs should treat these comments >>> just like any other last call comments. >>>=20 >>> Document : draft-ietf-mile-rfc5070bis-22 >>>=20 >>> Summary: This document has minor issues that should be addressed before >>> publication as Proposed Standard >>>=20 >>> This document defines a document format for exchanging information >>> between operational security teams. It points out standardized mechanism= s >>> for transporting the documents (RFC6545 and RFC6546), to provide >>> confidentiality, integrity, and authenticity, but does not restrict the u= se of the >>> format to within those protocols. Instead, it provides a generic set of= >>> "Processing Considerations" in section 4, which are augmented by the >>> Security Considerations in section 9. >>>=20 >>> There are some minor issues with this approach that should be addressed >>> before publication. >>>=20 >>> 1) The document requires that implementations validate documents against= >>> the schema, and reject any documents that fail validation. In particula= r, >>> Section >>> 5.2 Item 4 requires rejecting documents with an unrecognized element in a= >>> supported namespace as a syntax error. Section 4.3 requires >>> implementations to >>> ->dynamically generate the schema used for validation from IANA >>> registries<-. >>> Section 5.2 Item 5 calls out that this dynamic generation has security a= nd >>> performance implications, but does not describe them, and has a very vag= ue >>> "SHOULD NOT download schemas at runtime" to guard against them. I seem >>> to recall significant discussion in other contexts of the issues with ge= nerating >>> schema from IANA registries at runtime. Perhaps the ADs can provide >>> pointers to material generated from those discussions that the group can= >>> reference. >>> Otherwise, the threats need to be described in more detail, and the >>> operational complexity of exercising these extension points (particularl= y >>> given the requirement to reject documents that do not validate against t= he >>> content of the >>> registries) needs to be spelled out. >> To this analysis, I'll also add Stephen Farrell's COMMENT (https://www.ie= tf.org/mail-archive/web/mile/current/msg01885.html) against using validation= and the security issues when checking the IANA registry; and that Alexey Me= lnikov has marked this issue as a DISCUSS (https://datatracker.ietf.org/doc/= draft-ietf-mile-rfc5070-bis/ballot/). >>=20 >> To the WG: >>=20 >> Consideration #1 >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>=20 >> ---[ begin Item #4 of Section 5.2 ]--- >> 4. Implementations that encounter an unrecognized element in a >> supported namespace MUST reject the document as a syntax error. >> ---[ end Item #4 of Section 5.2 ]--- >>=20 >> ** Do we want to weaken the validation requirement in Item #4 of Section 5= .2 from MUST to MAY? >>=20 >> IMO, this is a straightforward change that will provide more flexibility f= or implementations to process even non-conforming documents. > I don't mind, but I can also live with SHOULD here. Agreed, SHOULD is a bit stronger. >> One minor concern here is that this may now lead to non-standard extensi= ons. >>=20 >> Consideration #2 >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> Item #5 of Section 5.2 cautions against dynamically regenerating the sche= ma from registry values at run-time; but also from downloading the base sche= ma then too. >>=20 >> ---[ begin Item #5 of Section 5.2 ]--- >> 5. There are security and performance implications in requiring >> implementations to dynamically download schemas at run time. >> Therefore, implementations SHOULD NOT download schemas at runtime >> unless the appropriate precautions are taken. Implementations >> also need to contend with the potential of significant network >> and processing issues. >> ---[ end Item #5 of Section 5.2 ]--- >>=20 >> ** Do we want to strengthen the caution of not downloading the schema in r= eal-time in Item #5 of Section 5.2 from SHOULD NOT to MUST NOT? >>=20 >> IMO, yes. > Yes. Yes >> Consideration #3 >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>=20 >> As Robert suggests, minimally, there needs to be a discussion in the secu= rity considerations on how these new enum values will securely be added to t= he schema/parser. However, the question remains, what guidance do we provid= e about how often the IANA registry should be checked. >>=20 >> ---[ begin Section 4.3]--- >> Furthermore, the >> enumerated values present in this document are a static list that >> will be incomplete over time as select attributes can be extended by >> a corresponding IANA registry per Section 10.2. Therefore, the >> schema to validate a given document MUST be dynamically generated >> from these registry values. >> ---[ end Section 4.3 ]--- >>=20 >> ** Should we modify the last sentence as follows: >>=20 >> "Therefore, the schema to validate a given document MUST be periodically r= egenerated from these registry values. It is RECOMMENDED that this SHOULD N= OT occur more frequently than xxx" >>=20 >> Kathleen/Alexey/or any reader of this note: do you have a pointer to the p= rior discussion on dynamically generating a schema from an IANA registry ref= erenced by Robert so that "xxx" can be populated? > I have no idea about reasonable "xxx" values. This was never done before. (= When it was suggested before IESG persuaded authors to change their document= s.) >=20 > While talking to www.iana.org directly from devices/programs is tempting, i= t might be better if vendors periodically download new values from IANA and t= hen devices/programs talk to vendor's websites (or use vendor's update mecha= nisms). I like Alexey's suggestion as it would greatly reduce the hits to IANA and a= ccomplish the same goal. Best regards, Kathleen=20 >=20 > Best Regards, > Alexey From nobody Thu Jun 2 06:52:39 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02D2F12D71A; Thu, 2 Jun 2016 06:52:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.955 X-Spam-Level: X-Spam-Status: No, score=-1.955 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=messagingengine.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EVrZBda9oCwH; Thu, 2 Jun 2016 06:52:36 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AF6412D715; Thu, 2 Jun 2016 06:52:36 -0700 (PDT) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id B048E21DE2; Thu, 2 Jun 2016 09:52:35 -0400 (EDT) Received: from web5 ([10.202.2.215]) by compute7.internal (MEProxy); Thu, 02 Jun 2016 09:52:35 -0400 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-sasl-enc:x-sasl-enc; s=smtpout; bh=etAD5Tsv5k8TI5b v/RIm/U4iVso=; b=MHI2K1w8wrmoP5Yn3DbFACtZUsrO8Pxo57W+a9ab1C2WTGE ZcJZ7W9KkKNh7Tb1F7dxL+DJsXBzy4VtiRjnWn9Os3W5Qc2EgzQKCz1qh1LLf6v1 8LYI65roHziJtZAyOjY0j491GMhlKw2OpvOtu/Lbq+KPNDrbitRuQVcPU4ow= Received: by mailuser.nyi.internal (Postfix, from userid 99) id 80866A849C; Thu, 2 Jun 2016 09:52:35 -0400 (EDT) Message-Id: <1464875555.1299466.625917257.2D46286E@webmail.messagingengine.com> X-Sasl-Enc: 7qUNGmqSRcSxoXEq1M/eoyNLma8g9tA556RxoHYy+tAm 1464875555 From: Alexey Melnikov To: "Roman D. Danyliw" , Robert Sparks MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain X-Mailer: MessagingEngine.com Webmail Interface - ajax-38f217ef Date: Thu, 02 Jun 2016 14:52:35 +0100 In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD9750115@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> <574FF391.6000806@isode.com> <359EC4B99E040048A7131E0F4E113AFCD9750115@marathon> Archived-At: Cc: mile@ietf.org, draft-ietf-mile-rfc5070-bis.all@ietf.org, iesg@ietf.org, secdir@ietf.org Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 13:52:38 -0000 Hi, On Thu, Jun 2, 2016, at 01:49 PM, Roman D. Danyliw wrote: > Hi Alexey! > > > -----Original Message----- > > From: Alexey Melnikov [mailto:alexey.melnikov@isode.com] > > Sent: Thursday, June 02, 2016 4:51 AM > > To: Roman D. Danyliw ; Robert Sparks > > > > Cc: mile@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf.org; iesg@ietf.org; > > secdir@ietf.org > > Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22 > > > > Hi Roman, > > > > On 02/06/2016 06:03, Roman D. Danyliw wrote: > > > Hello Robert! > > > > > > Thanks again for this review. Comments are inline ... > > > > > >> -----Original Message----- > > >> From: Robert Sparks [mailto:rjsparks@nostrum.com] > > >> Sent: Monday, May 30, 2016 2:44 PM > > >> To: secdir@ietf.org; iesg@ietf.org; > > >> draft-ietf-mile-rfc5070-bis.all@ietf.org > > >> Subject: Secdir review: draft-ietf-mile-5070-bis-22 > > [snip] > > > > Consideration #3 > > > ============== > > > > > > As Robert suggests, minimally, there needs to be a discussion in the > > security considerations on how these new enum values will securely be > > added to the schema/parser. However, the question remains, what > > guidance do we provide about how often the IANA registry should be > > checked. > > > > > > ---[ begin Section 4.3]--- > > > Furthermore, the > > > enumerated values present in this document are a static list that > > > will be incomplete over time as select attributes can be extended by > > > a corresponding IANA registry per Section 10.2. Therefore, the > > > schema to validate a given document MUST be dynamically generated > > > from these registry values. > > > ---[ end Section 4.3 ]--- > > > > > > ** Should we modify the last sentence as follows: > > > > > > "Therefore, the schema to validate a given document MUST be periodically > > regenerated from these registry values. It is RECOMMENDED that this > > SHOULD NOT occur more frequently than xxx" > > > > > > Kathleen/Alexey/or any reader of this note: do you have a pointer to the > > prior discussion on dynamically generating a schema from an IANA registry > > referenced by Robert so that "xxx" can be populated? > > I have no idea about reasonable "xxx" values. This was never done before. > > (When it was suggested before IESG persuaded authors to change their > > documents.) > > Understood. Thanks for channeling the historical wisdom. > > > While talking to www.iana.org directly from devices/programs is tempting, it > > might be better if vendors periodically download new values from IANA and > > then devices/programs talk to vendor's websites (or use vendor's update > > mechanisms). > > What about language like the following in Section 4.3: > > ---[ begin Section 4.3]--- > > -- Therefore, the schema to validate a given document MUST > -- be dynamically generated from these registry values. > ++ Therefore, IODEF implementations MUST periodically update > ++ their schema and MAY need to update their parsing algorithms > ++ to incorporate newly registered values added > ++ to the IANA registries specified in Section xx. I think this is an improvement. But also see Kathleen's reply. > ---[ end Section 4.3 ]--- > > In addition, add text to the security considerations that this updating > needs to be done securely. Right. From nobody Thu Jun 2 07:23:27 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9342E12D1D5; Thu, 2 Jun 2016 07:23:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.947 X-Spam-Level: X-Spam-Status: No, score=-15.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9cZ0Uh6hpqpW; Thu, 2 Jun 2016 07:23:22 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7F5712D140; Thu, 2 Jun 2016 07:23:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2462; q=dns/txt; s=iport; t=1464877401; x=1466087001; h=from:to:cc:subject:date:message-id:mime-version; bh=PI3fwL1BQaUD4Sh5CeqsucZsjTMbPUS7a+Sbrv+AAho=; b=Pse7M22ESDkvl4sFrjMZcI69eDI4jA1gsBUAbjGR5z6AOqk8nlt7sIdT y7QomOq8iOaq6aVWG4BJPdtToxCoJqr7DQUW7C4mbkwzu7JlB0GGtNj1f /ScayP7UK/nxJjAFWVZfBg3/LdIshF8NKjuTZIFzYb27vTlVzTMlQn/18 s=; X-Files: signature.asc : 496 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B3AgCeQFBX/4ENJK1dgzpWfQEFuiiBe?= =?us-ascii?q?SKFcIExOBQBAQEBAQEBZRwLhEx3AhIBHGQnBA4TiCEOwgwBAQEBAQEBAQEBAQE?= =?us-ascii?q?BAQEBAQEBEA6IHoc2gwyCLgWYNQIBgyqBaG2IIIFpToQBiGSPSwEeNoNub4l8f?= =?us-ascii?q?wEBAQ?= X-IronPort-AV: E=Sophos;i="5.26,406,1459814400"; d="asc'?scan'208";a="114436703" Received: from alln-core-9.cisco.com ([173.36.13.129]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Jun 2016 14:23:20 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by alln-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id u52ENKIB013768 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 2 Jun 2016 14:23:20 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Jun 2016 09:23:20 -0500 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1104.009; Thu, 2 Jun 2016 09:23:20 -0500 From: "Matt Miller (mamille2)" To: "draft-ietf-avtext-splicing-notification.all@ietf.org" Thread-Topic: Gen-ART / SecDir Review of draft-ietf-avtext-splicing-notification-07 Thread-Index: AQHRvNpPibtHL96qDkeozOSyDRsFYQ== Date: Thu, 2 Jun 2016 14:23:20 +0000 Message-ID: <850F2C19-92CD-48AC-B88B-6C89E136786C@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-pgp-agent: GPGMail 2.6b2 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.129.24.56] Content-Type: multipart/signed; boundary="Apple-Mail=_25CD3621-7352-4A65-A4A8-5518968D53CF"; protocol="application/pgp-signature"; micalg=pgp-sha512 MIME-Version: 1.0 Archived-At: Cc: "gen-art@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: [secdir] Gen-ART / SecDir Review of draft-ietf-avtext-splicing-notification-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 14:23:23 -0000 --Apple-Mail=_25CD3621-7352-4A65-A4A8-5518968D53CF Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii I am the coincidentally-assigned Gen-ART and SecDir reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. The Security Directorate reviews all IETF documents being processed by the IESG for the security area directors. Please treat these comments just like any other last call comments that arrived on time. For more information on Gen-Art, please see the FAQ at < http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq >. Document: draft-ietf-avtext-splicing-notification-07 Reviewer: Matthew A. Miller Review Date: 2016-06-02 IETF LC End Date: 2016-06-01 IESG Telechat date: N/A Summary: This document is ready to be published as a Proposed Standard once the nit is taken care of. I reviewed a previous revision of this document (-04), and all of my concerns from the earlier review are addressed herein. I note this document includes normative references to two Informational documents (RFCs 7201 and 7667). The references are important to properly understand some of the security considerations of this document, but it appears the responsible AD is to add them to the approved downrefs registry. Major issues: N/A Minor issues: N/A Nits/editorial comments: * In Section 7 "Security Considerations", "the" is missing between "Since" and "splicer" in the first sentence of the third paragraph. -- - m&m Matt Miller Cisco Systems, Inc. --Apple-Mail=_25CD3621-7352-4A65-A4A8-5518968D53CF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="signature.asc" Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJXUEFXAAoJEDWi+S0W7cO1SXwIAJpZ/Ug+lbgXhczrk4ct0Laa Jg2bE/WW3nkeKgRVqncHLXjJqIQYlIVwqj/Z8tjRb3qKwwohtyYB/u8qjSpz7oe1 lgLC93cPoYBNqsWIjg2JJdkNcY8UJhhgC8tAxnH0xJISERVdzWmWtgjonLExRZ6J 6UhSrQFT4Uh2gT/5O8nlpBMjsTOE7yqNnkOaRGcxh7dHKhQI5WKTyI8quowlQ1Kg 3iQ9IZcHf86uHqEZVP7dZCow5yUoBfB1aJOJ/oyEpMUITM6VgcrP7PRvUdDKkoRG UjcNNgA2lSny0cUM1SyPMdNA4rxKBXUwGIqBGI/AHFkBHScg8OTwKc8uXWsUFQQ= =wTn4 -----END PGP SIGNATURE----- --Apple-Mail=_25CD3621-7352-4A65-A4A8-5518968D53CF-- From nobody Thu Jun 2 07:56:22 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B017512D511; Thu, 2 Jun 2016 07:56:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.326 X-Spam-Level: X-Spam-Status: No, score=-3.326 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3lULCY3JF6Ji; Thu, 2 Jun 2016 07:56:17 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13CFA12D1CD; Thu, 2 Jun 2016 07:56:16 -0700 (PDT) Received: from [10.10.1.4] ([162.216.46.192]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u52EuBQn098480 (version=TLSv1 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 2 Jun 2016 09:56:12 -0500 (CDT) (envelope-from ben@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host [162.216.46.192] claimed to be [10.10.1.4] From: "Ben Campbell" To: "Matt Miller" Date: Thu, 02 Jun 2016 10:56:10 -0400 Message-ID: In-Reply-To: <850F2C19-92CD-48AC-B88B-6C89E136786C@cisco.com> References: <850F2C19-92CD-48AC-B88B-6C89E136786C@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.4r5234) Archived-At: Cc: "gen-art@ietf.org" , "draft-ietf-avtext-splicing-notification.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Gen-ART / SecDir Review of draft-ietf-avtext-splicing-notification-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 14:56:19 -0000 On 2 Jun 2016, at 10:23, Matt Miller (mamille2) wrote: > I am the coincidentally-assigned Gen-ART and SecDir reviewer > for this draft. The General Area Review Team (Gen-ART) reviews all > IETF > documents being processed by the IESG for the IETF Chair. The > Security > Directorate reviews all IETF documents being processed by the IESG for > the security area directors. Please treat these comments just like > any > other last call comments that arrived on time. > > For more information on Gen-Art, please see the FAQ at > > < http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq >. > > Document: draft-ietf-avtext-splicing-notification-07 > Reviewer: Matthew A. Miller > Review Date: 2016-06-02 > IETF LC End Date: 2016-06-01 > IESG Telechat date: N/A > > Summary: > > This document is ready to be published as a Proposed Standard > once the nit is taken care of. > > I reviewed a previous revision of this document (-04), and all of my > concerns from the earlier review are addressed herein. > > I note this document includes normative references to two > Informational > documents (RFCs 7201 and 7667). The references are important to > properly understand some of the security considerations of this > document, but it appears the responsible AD is to add them to the > approved downrefs registry. Just an observation: we did do a second IETF last call for to the normative downrefs. [...] Thanks! Ben. From nobody Fri Jun 3 10:04:39 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABB8812D543; Fri, 3 Jun 2016 10:04:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FIMReiDdtuSn; Fri, 3 Jun 2016 10:04:35 -0700 (PDT) Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1972312D198; Fri, 3 Jun 2016 10:04:35 -0700 (PDT) Received: by mail-wm0-x22f.google.com with SMTP id n184so5000980wmn.1; Fri, 03 Jun 2016 10:04:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:subject:to:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=5S/8I5wsoA61Is6EedXLSunZuD/GmlMBNAuzGvjw49w=; b=FXpIOMPblQ6R3s4DZ/Ap5WtPPeUCjXCOvujjNXfM+VJ8cYf7OGWaH4SS5pY79Ah6Ot Yri6lKoWc0CtqspmdO6H4CrJLLi/lAxJNEHF9WDzJT9KyzLY2Gw4P7OrHFCNgnz9KesA YrETbK6lRpyaGYCsMA+azssOgVy+/Hcku0ENsHnF3OyGSPRftgpuVeOJa6LPve2fsbYp I/0aLvsnry9/MfmyjYR77X2TgqB+GxNak7GS7WYXmS1b8zOT90l3UzKVyQcBqrjdglKo PniHPBCAt6nyLFUVcWyTzqNsJP3kCSltYMqYs4S6QVD65Jw+StojW4h6D112Z4DI5ROh /cSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:to:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=5S/8I5wsoA61Is6EedXLSunZuD/GmlMBNAuzGvjw49w=; b=DWm2k28MCkHyRn1NMrhOU8yXujRH73cbk/YINj89oJx8jFRQwQ9SQKyZt77DnADlPx 0hmI6CDkSxaKLM97wxZhZrOSnz8vQ0wOP25j6n1qSxwMmuLD+Ur0uoluRHhkEKzjajc8 lETo3riEWEt7Kbwl9Ow2qh4sVM1HafJ8OpZPrws/4s2YGxiqsRjv00qILoJwH7IP3cWk ZWdENN0bz1ZKGinGriryYV5jwTFgPKLnmqw5CzxKcqXTmZr2jqV2ms1D473DCKW6Ohf4 hFgeU+fpUPPS1BuyiavLPv8OggC6MGUFjqNQIJkS0sGWcW0DKJmryw53XmMf19T088+l bHZg== X-Gm-Message-State: ALyK8tKqXjsNLlRuOdUPhIAuY/vhsWgu98IwlAFm0OELMu4umMB0Fl8m8NOSWAiE70QvKQ== X-Received: by 10.28.226.84 with SMTP id z81mr470407wmg.73.1464973473503; Fri, 03 Jun 2016 10:04:33 -0700 (PDT) Received: from [10.0.0.9] (bzq-109-67-2-59.red.bezeqint.net. [109.67.2.59]) by smtp.gmail.com with ESMTPSA id e1sm6636487wjv.9.2016.06.03.10.04.29 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 03 Jun 2016 10:04:32 -0700 (PDT) From: Yaron Sheffer To: IETF Security Directorate , The IESG , draft-ietf-dhc-topo-conf.all@tools.ietf.org Message-ID: <5751B895.1070400@gmail.com> Date: Fri, 3 Jun 2016 20:04:21 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jun 2016 17:04:38 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes current practices for configuring DHCP in complex network scenarios, where the goal is to allow servers to configure DHCP clients differently depending on the client's network location. Summary This is a very extensive document, but the security considerations do not do it justice. Details The Security Considerations section is essentially empty, saying only that drafts that define DHCP options each include their own security considerations. However this document references 12 other RFCs (and they in fact do have substantial security considerations) so this leaves the reader to research the matter on her own. Moreover, the technology covered spans more than 20 years (15 years, counting only Relay Agent Information), and security best practices have changed. Old security recommendations may not be today's best practices, and some previously recommended mechanisms may have never materialized in real-world deployment. This document is basically a survey of best practices in deploying DHCP in complex networks. As such, I would expect the Security Considerations section to include: - Recommendations about which configuration practices are to be preferred from a security point of view. - Up to date security recommendations in summary form, at least for the main use cases covered. - An architectural view, at the same level as the rest of the document, of how these configurations interact with common security practices like firewall-based network separation or NAC. I realize that the document is 3 years old and everyone just wants to see it published, but in my opinion it is incomplete in its current form. Thanks, Yaron From nobody Fri Jun 3 11:55:26 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7A4312D890; Fri, 3 Jun 2016 11:55:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.327 X-Spam-Level: X-Spam-Status: No, score=-3.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ApfQM9Y9xZry; Fri, 3 Jun 2016 11:55:23 -0700 (PDT) Received: from sjc1-mx02-inside.nominum.com (sjc1-mx02-inside.nominum.com [64.89.234.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F32912D79E; Fri, 3 Jun 2016 11:55:23 -0700 (PDT) Received: from webmail.nominum.com (cas-03.win.nominum.com [64.89.235.66]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (Client CN "mail.nominum.com", Issuer "Go Daddy Secure Certificate Authority - G2" (verified OK)) by sjc1-mx02-inside.nominum.com (Postfix) with ESMTPS id 02D5C740057; Fri, 3 Jun 2016 18:55:23 +0000 (UTC) Received: from mbx-03.WIN.NOMINUM.COM ([169.254.4.19]) by CAS-03.WIN.NOMINUM.COM ([64.89.235.66]) with mapi id 14.03.0224.002; Fri, 3 Jun 2016 11:55:22 -0700 From: Ted Lemon To: Yaron Sheffer , IETF Security Directorate , The IESG , "draft-ietf-dhc-topo-conf.all@tools.ietf.org" Thread-Topic: SecDir review of draft-ietf-dhc-topo-conf-08 Thread-Index: AQHRvboIwWZ+4oxi9kOjVXNkE7+iIJ/YFijQ Date: Fri, 3 Jun 2016 18:55:22 +0000 Message-ID: <8D23D4052ABE7A4490E77B1A012B630797A4F7ED@mbx-03.WIN.NOMINUM.COM> References: <5751B895.1070400@gmail.com> In-Reply-To: <5751B895.1070400@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [72.182.60.179] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jun 2016 18:55:25 -0000 With all due respect, Yaron, I think that your proposal here is surprising = and unrealistic. Enumerating the security tradeoffs you've proposed would= be very difficult, and we would almost certainly get it wrong. Furthermo= re, there is no pressing need to do this, or if there is, you have not said= what it is. The scope of what you are proposing here would be an entire new document. = If you are interested in working on such a document, I would encourage you = to do so, but to increase the scope of work of this document to talk about = address allocation with DHCP from a security perspective is not a reasonabl= e ask. ________________________________________ From: Yaron Sheffer [yaronf.ietf@gmail.com] Sent: Friday, June 3, 2016 13:04 To: IETF Security Directorate; The IESG; draft-ietf-dhc-topo-conf.all@tools= .ietf.org Subject: SecDir review of draft-ietf-dhc-topo-conf-08 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes current practices for configuring DHCP in complex network scenarios, where the goal is to allow servers to configure DHCP clients differently depending on the client's network location. Summary This is a very extensive document, but the security considerations do not do it justice. Details The Security Considerations section is essentially empty, saying only that drafts that define DHCP options each include their own security considerations. However this document references 12 other RFCs (and they in fact do have substantial security considerations) so this leaves the reader to research the matter on her own. Moreover, the technology covered spans more than 20 years (15 years, counting only Relay Agent Information), and security best practices have changed. Old security recommendations may not be today's best practices, and some previously recommended mechanisms may have never materialized in real-world deployment. This document is basically a survey of best practices in deploying DHCP in complex networks. As such, I would expect the Security Considerations section to include: - Recommendations about which configuration practices are to be preferred from a security point of view. - Up to date security recommendations in summary form, at least for the main use cases covered. - An architectural view, at the same level as the rest of the document, of how these configurations interact with common security practices like firewall-based network separation or NAC. I realize that the document is 3 years old and everyone just wants to see it published, but in my opinion it is incomplete in its current form. Thanks, Yaron From nobody Fri Jun 3 12:05:18 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AA8E12D5D5; Fri, 3 Jun 2016 12:05:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_TVD_FUZZY_SECURITIES=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RKULhfeTZHgQ; Fri, 3 Jun 2016 12:05:15 -0700 (PDT) Received: from mail-lf0-x22d.google.com (mail-lf0-x22d.google.com [IPv6:2a00:1450:4010:c07::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B59712D7B5; Fri, 3 Jun 2016 12:05:15 -0700 (PDT) Received: by mail-lf0-x22d.google.com with SMTP id s64so60413506lfe.0; Fri, 03 Jun 2016 12:05:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=jI+ByUd/5pPvYrVsEw8b0z4jMP9wQ7PeevAqbtsnXqM=; b=ALAJdtaO5y636LbXtfNU4lhQ6YwDQxyq8c1vkwky4xRP6Cw7W+QdDnrcCm+xy/4/mF Xicq+xvaIQz1+/54erVGLowD66Lthvoqj+YQ1k7Jl6Vk+gR3NcMhXO5+wBAXeeW484CB gIsAf1kDNLkQUvmqYlwQKw9ytqixo0uRSW/vbPNcc3MB+47hn+MPV9+j3kdZPzXlpESg tMs52Gib+RUoja57WcsKXa7vA/ovNSzoYRmCFSR2Ob/55eL5OKGoHIrpitAyp61MmQLF XqrbcNFM0Aa1EUKleOsV9P+XX43g3Hv1sOZRaLDwVoj4598YRrEQ4B+0penGlJfvTflA Yw0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=jI+ByUd/5pPvYrVsEw8b0z4jMP9wQ7PeevAqbtsnXqM=; b=PGKvsbXRg6MBu2eqGPDDX/BGEUcZpWeNfGNUuwgJ5mnv3z8ANY81YdO+CqPkUH6jg/ 6wOWdVOK1GsB6g+DUtNunGRvciA+WDGgyun47uSo0MRuKiLYWTGw/xCSDTgn8XGO/gXy 6rmsTL1MA4fkIo6Gn5g9al+yvMtOt4aGC9c57piYux7wHMaS3z27UtUbRj6Th+BC248J tEbm6LD7pjWAL7Yjfdop+b/IvWJ2rL7IBTmVYORDpURZVG3KrhrqvQPtlonT9z5DY2F+ ZHx2hTBtOoPjm1NrA3rtAuqKfHjNvIe6SHTpNBaB9Qu9+QtD7c0BQiDtzaOdbs5URpZf +wUw== X-Gm-Message-State: ALyK8tJlYXtveq+Sxbp8gY+KhIfJ72bipm+ChUQlL6BQZyq0JUQODuJmiSTio6CqbCy1eQ== X-Received: by 10.25.207.70 with SMTP id f67mr1215530lfg.62.1464980713275; Fri, 03 Jun 2016 12:05:13 -0700 (PDT) Received: from [10.0.0.100] (088156132194.dynamic-ww-04.vectranet.pl. [88.156.132.194]) by smtp.googlemail.com with ESMTPSA id f6sm656542lbt.31.2016.06.03.12.05.11 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 03 Jun 2016 12:05:12 -0700 (PDT) To: Yaron Sheffer , IETF Security Directorate , The IESG , draft-ietf-dhc-topo-conf.all@tools.ietf.org References: <5751B895.1070400@gmail.com> From: Tomek Mrugalski X-Enigmail-Draft-Status: N1110 Message-ID: <5751D4E6.6000709@gmail.com> Date: Fri, 3 Jun 2016 21:05:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 In-Reply-To: <5751B895.1070400@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jun 2016 19:05:17 -0000 Hi Yaron, Thanks a lot for your review. See my responses inline: On 03.06.2016 19:04, Yaron Sheffer wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG= =2E > These comments were written primarily for the benefit of the security > area directors. Document editors and WG chairs should treat these > comments just like any other last call comments. > > This document describes current practices for configuring DHCP in > complex network scenarios, where the goal is to allow servers to > configure DHCP clients differently depending on the client's network > location. > > Summary > > This is a very extensive document, but the security considerations do > not do it justice. > > Details > > The Security Considerations section is essentially empty, saying only > that drafts that define DHCP options each include their own security > considerations. However this document references 12 other RFCs (and > they in fact do have substantial security considerations) so this > leaves the reader to research the matter on her own. > > Moreover, the technology covered spans more than 20 years (15 years, > counting only Relay Agent Information), and security best practices > have changed. Old security recommendations may not be today's best > practices, and some previously recommended mechanisms may have never > materialized in real-world deployment. > > This document is basically a survey of best practices in deploying > DHCP in complex networks. As such, I would expect the Security > Considerations section to include: > > - Recommendations about which configuration practices are to be > preferred from a security point of view. This document essentially explains how the DHCP server determines where the client is attached. This document does not recommend any practices, security related or otherwise. Note it's informational, not BCP. I suppose I could write a text that explains implications of point of attachment determination for security: especially how fooling this mechanism could be used as an attack vector. A client tricking the server to be located in some other location than it really is, could get options related to some secured network, potentially revealing DNS servers and other services in that network. Would that be adequate to address your comment here? > - Up to date security recommendations in summary form, at least for > the main use cases covered. This document does not make any recommendations. If you think about something like "how to secure your DHCP deployment", that's definitely a great idea and a topic for separate draft. I'm serious about it. As a co-chair of DHC, I'd love to see such a document written by someone who actually runs DHCP in a large network. But in the context of topo-conf, I don't see how the topic of DHCP security (a much larger problem than the subnet selection described in topo-conf) could fit in here. > - An architectural view, at the same level as the rest of the > document, of how these configurations interact with common security > practices like firewall-based network separation or NAC. What you are asking here is impossible to answer, at least in a generic sense. This document explains one aspect of DHCP server implementations. It explains what the tool can do for you, not how you are supposed to use it. I could add some basic recommendations, like "you should not accept incoming DHCP traffic from outside of your network", but would that be of any help? Also, speaking of security, there are other drafts that attempt to improve the situation by introducing strong cryptography. See draft-ietf-dhc-sedhcpv6-12. Some of your suggestions could be addressed by that draft. However, you mentioned the time scales of DHCP. If you are thinking about "how to secure your DHCP deployment" type of text, this is definitely a material for separate draft. If you support this idea, I'm more than willing to ask in Berlin if there's enough manpower to write such a draft. Such a draft would be perfect for DHC-OPS, but there's no such WG. And there likely never will be, as DHCP is inherently internal problem. Also, there's an effort well under way to update DHCPv6 (draft-ietf-dhc-rfc3315bis-04). That may be a good place to address your questions (at least partially, because it's DHCPv6-only). Note it has fairly large Section 23 about security considerations and a separate section about privacy, too. The direct link is https://tools.ietf.org/html/draft-ietf-dhc-rfc3315bis-04#section-23. Does this text addresses your concerns? I would really keep in rfc3315bis, but if you think it's helpful, I certainly can link it in topo-conf (or copy over parts of the text if you think it's necessary to have it in topo-conf). If you consider privacy part of security problems, then there are RFC7819 (DHCPv4 privacy analysis), RFC7824 (DHCPv6 privacy analysis) and RFC7844 (Anonymity profile for DHCPv4 and DHCPv6). > > I realize that the document is 3 years old and everyone just wants to > see it published, but in my opinion it is incomplete in its current for= m. There's no rush here. It's been around for a long time, so a month or two more doesn't matter. My objection here is not based on time, but on the scope of this document. This document was created to explain one aspect of DHCP operation. Lots of people don't understand how the DHCP server knows which options and addresses are selected for which clients. This draft was created to explain this specific aspect of the protocol. These are my answers to your comments. I'll do my best to propose appropriate updated text for security considerations, but please don't expect general DHCP security recommendations here. Finally, I'm a software developer guy and I have never ran any network larger network. My ops experience is limited at best, so I don't feel qualified to give advice on operational aspects to others. Tomek From nobody Sat Jun 4 14:14:32 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A49712D199; Sat, 4 Jun 2016 14:14:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_TVD_FUZZY_SECURITIES=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F0SplCH5-25y; Sat, 4 Jun 2016 14:14:28 -0700 (PDT) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 945D812B00A; Sat, 4 Jun 2016 14:14:27 -0700 (PDT) Received: by mail-wm0-x230.google.com with SMTP id n184so40875989wmn.1; Sat, 04 Jun 2016 14:14:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=KLCzrsZBmShQMtWr3DRynqlVRUep6t6SLeWNVNpONHc=; b=p2t9PifUI8QaB8KgnYkAgJEuKL+wOfpLUq+04nxifGKkyM7m1+xnLwKR06LC8E3I77 ql/U97tWzyPrNiMVZGog+K9Wrnl0cRbJro5ROMjzSS2lfmJO/NK/YF9+u6K34RjMxnWy HAApcJfyAMUyay8i2S+uB2NCaKWBO/QibcQfRovMTg+Isru7BlXd1wIrbuU2EsQ7o+BV WgLTxCpgNitrzEA5SL9GrjTVvKGhpnxFfhwz2itqDYXVG4rawEUU7sBU+gda91LX3/Bl 4i5/BMX68ES6LEdJMDar5MBOjxnhsVKCxcK6027Uh26AfWGPArSCVHqUEo+NzL6sE3cA btzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=KLCzrsZBmShQMtWr3DRynqlVRUep6t6SLeWNVNpONHc=; b=U46Iq02OFH16c7vJZBhGumZlKBIAca6terwDFPhR3u44vSljx96y5jypTT9g572F7c X36Yt/JnhZqFw4g57toA5Gw4dUBmglXIDfwmVyH2uyEKg/jQ2Xx112HYZL4WdLTbLjCO ZyySUTKU7DVYLGLSpgTwPHggzpZqF7Pf7GwdW6wogsm7OwX7m/WQnFzEL0gQDeb068j7 d9VyTRJ1x0VDInFo1Q3JO8R38ssjOdZno53AxiBhrbVaJNgwUC0SZxCwe8aQG40MD1ql 1Cj5TySAW5uDBAWsgJd/OPsLtFZpwvvf8pGGeN7FG4x3JbQZta9e5G/vlAgWndx2YUeM jzYw== X-Gm-Message-State: ALyK8tLJwgMcF92lW9KA2ZCSGXjJmbEONxt/PrUg0bQ+SnWRXN6TJSm40VwbhaZ339Fyzw== X-Received: by 10.28.230.200 with SMTP id e69mr5163348wmi.53.1465074865953; Sat, 04 Jun 2016 14:14:25 -0700 (PDT) Received: from [10.0.0.9] (bzq-109-67-2-59.red.bezeqint.net. [109.67.2.59]) by smtp.gmail.com with ESMTPSA id o129sm6103720wmb.17.2016.06.04.14.14.20 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 04 Jun 2016 14:14:24 -0700 (PDT) To: Tomek Mrugalski , IETF Security Directorate , The IESG , draft-ietf-dhc-topo-conf.all@tools.ietf.org References: <5751B895.1070400@gmail.com> <5751D4E6.6000709@gmail.com> From: Yaron Sheffer Message-ID: <575344A7.30002@gmail.com> Date: Sun, 5 Jun 2016 00:14:15 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 In-Reply-To: <5751D4E6.6000709@gmail.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jun 2016 21:14:30 -0000 Hi Tomek, Thank you for your thorough response. While I may have read this draft as more than it is intended to be, it seems to me that security is an important consideration in engineering the kind of networks described here, and in selecting which DHCP server should respond to requests from which link and with what information. Specifically I have in mind complex networks where links have different sensitivity levels (e.g. guest vs. generic access vs. data center) and where people employ the mechanisms described in this document with the goal of keeping the networks separate even in the face of malicious actors. So let us try to understand what security advice is appropriate in this context. Please see further comments below. Thanks, Yaron On 03/06/16 22:05, Tomek Mrugalski wrote: > Hi Yaron, > Thanks a lot for your review. See my responses inline: > > On 03.06.2016 19:04, Yaron Sheffer wrote: >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the IESG. >> These comments were written primarily for the benefit of the security >> area directors. Document editors and WG chairs should treat these >> comments just like any other last call comments. >> >> This document describes current practices for configuring DHCP in >> complex network scenarios, where the goal is to allow servers to >> configure DHCP clients differently depending on the client's network >> location. >> >> Summary >> >> This is a very extensive document, but the security considerations do >> not do it justice. >> >> Details >> >> The Security Considerations section is essentially empty, saying only >> that drafts that define DHCP options each include their own security >> considerations. However this document references 12 other RFCs (and >> they in fact do have substantial security considerations) so this >> leaves the reader to research the matter on her own. >> >> Moreover, the technology covered spans more than 20 years (15 years, >> counting only Relay Agent Information), and security best practices >> have changed. Old security recommendations may not be today's best >> practices, and some previously recommended mechanisms may have never >> materialized in real-world deployment. >> >> This document is basically a survey of best practices in deploying >> DHCP in complex networks. As such, I would expect the Security >> Considerations section to include: >> >> - Recommendations about which configuration practices are to be >> preferred from a security point of view. > This document essentially explains how the DHCP server determines where > the client is attached. This document does not recommend any practices, > security related or otherwise. Note it's informational, not BCP. > I suppose I could write a text that explains implications of point of > attachment determination for security: especially how fooling this > mechanism could be used as an attack vector. A client tricking the > server to be located in some other location than it really is, could get > options related to some secured network, potentially revealing DNS > servers and other services in that network. Would that be adequate to > address your comment here? That would be useful. I wonder if there are additional security considerations, such as: can a fake relay obtain any sensitive information by looking at requests? >> - Up to date security recommendations in summary form, at least for >> the main use cases covered. > This document does not make any recommendations. If you think about > something like "how to secure your DHCP deployment", that's definitely a > great idea and a topic for separate draft. I'm serious about it. As a > co-chair of DHC, I'd love to see such a document written by someone who > actually runs DHCP in a large network. But in the context of topo-conf, > I don't see how the topic of DHCP security (a much larger problem than > the subnet selection described in topo-conf) could fit in here. I understand why generic DHCP security advice is out of scope here. >> - An architectural view, at the same level as the rest of the >> document, of how these configurations interact with common security >> practices like firewall-based network separation or NAC. > What you are asking here is impossible to answer, at least in a generic > sense. This document explains one aspect of DHCP server implementations. > It explains what the tool can do for you, not how you are supposed to > use it. I could add some basic recommendations, like "you should not > accept incoming DHCP traffic from outside of your network", but would > that be of any help? Also, speaking of security, there are other drafts > that attempt to improve the situation by introducing strong > cryptography. See draft-ietf-dhc-sedhcpv6-12. Some of your suggestions > could be addressed by that draft. I am a bit skeptical of real-world deployment of cryptographic solutions at this level of the stack, but let's wait an see. However, can the security of sedhcpv6 be affected if there are multiple DHCP servers/relays in a complex network and a client talks to the wrong server/relay? However, you mentioned the time scales > of DHCP. If you are thinking about "how to secure your DHCP deployment" > type of text, this is definitely a material for separate draft. If you > support this idea, I'm more than willing to ask in Berlin if there's > enough manpower to write such a draft. Such a draft would be perfect for > DHC-OPS, but there's no such WG. And there likely never will be, as DHCP > is inherently internal problem. > > Also, there's an effort well under way to update DHCPv6 > (draft-ietf-dhc-rfc3315bis-04). That may be a good place to address your > questions (at least partially, because it's DHCPv6-only). Note it has > fairly large Section 23 about security considerations and a separate > section about privacy, too. The direct link is > https://tools.ietf.org/html/draft-ietf-dhc-rfc3315bis-04#section-23. > Does this text addresses your concerns? The text is lengthy and very interesting, but does not seem to discuss any issues related to multiple DHCP servers and relays sharing the same physical network. I would really keep in > rfc3315bis, but if you think it's helpful, I certainly can link it in > topo-conf (or copy over parts of the text if you think it's necessary to > have it in topo-conf). I am not proposing to copy text between documents. But a link to a few specific documents where the security considerations are best clarified (and are most relevant to the kind of networks discussed here) would be appreciated. > > If you consider privacy part of security problems, then there are > RFC7819 (DHCPv4 privacy analysis), RFC7824 (DHCPv6 privacy analysis) and > RFC7844 (Anonymity profile for DHCPv4 and DHCPv6). > Again, are there privacy considerations that are specifically pertinent to the type of connectivity discussed in this document? >> >> I realize that the document is 3 years old and everyone just wants to >> see it published, but in my opinion it is incomplete in its current form. > There's no rush here. It's been around for a long time, so a month or > two more doesn't matter. My objection here is not based on time, but on > the scope of this document. This document was created to explain one > aspect of DHCP operation. Lots of people don't understand how the DHCP > server knows which options and addresses are selected for which clients. > This draft was created to explain this specific aspect of the protocol. > > These are my answers to your comments. I'll do my best to propose > appropriate updated text for security considerations, but please don't > expect general DHCP security recommendations here. Sounds good, and thanks in advance! Finally, I'm a > software developer guy and I have never ran any network larger network. > My ops experience is limited at best, so I don't feel qualified to give > advice on operational aspects to others. > > Tomek > > From nobody Sun Jun 5 17:33:13 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E51C812D1BB; Sun, 5 Jun 2016 17:33:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pT2xvISIMY9p; Sun, 5 Jun 2016 17:33:09 -0700 (PDT) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0120.outbound.protection.outlook.com [23.103.201.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8224B12D09A; Sun, 5 Jun 2016 17:33:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=g2KL9iHfYMSJWVtfrez9BXeDQUxnDhLrJlxfhS7Lo6Q=; b=x0DawwM+/scjZ+Svj9rNY+L+spH1ruyjztRYsptq3QuSl0aThFfrjWHbvpExtWGxIjyY0vg3RuxOf4sdUrn81YN97B7cGTSriQdW63GXZrdm60xwqmylYw6lJ326uWSUsy/yMROHTIzNUMsBQ2RTQJb+m55XV+IQbtTYMdh2UHY= Received: from DM2PR09MB0365.namprd09.prod.outlook.com (10.160.247.18) by DM2PR09MB0366.namprd09.prod.outlook.com (10.160.247.20) with Microsoft SMTP Server (TLS) id 15.1.506.9; Mon, 6 Jun 2016 00:33:04 +0000 Received: from DM2PR09MB0365.namprd09.prod.outlook.com ([10.160.247.18]) by DM2PR09MB0365.namprd09.prod.outlook.com ([10.160.247.18]) with mapi id 15.01.0506.014; Mon, 6 Jun 2016 00:33:04 +0000 From: "Waltermire, David A. (Fed)" To: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-idr-ix-bgp-route-server.all@ietf.org" Thread-Topic: Secdir review of draft-ietf-idr-ix-bgp-route-server-10 Thread-Index: AdG/hLlPQmwDmXgkRK61Q8ZB5wAFgw== Date: Mon, 6 Jun 2016 00:33:04 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nist.gov; x-originating-ip: [129.6.224.58] x-ms-office365-filtering-correlation-id: 98b05895-e579-43a4-023a-08d38da21ff7 x-microsoft-exchange-diagnostics: 1; DM2PR09MB0366; 5:mn3qA//sRaRGcphBfPIUx+8tmnclR1hWOux44G4u/jDH7XzKDEZsO0E4tflb1Z0FXWFclZ2x3HgrjPI13Oaxsy9tAHIo1rabqBbAObwWvMGwtk8eyaSW39UYnbPrecRB0Af9s8Oy15wy92iuJTyPkg==; 24:pdEH6lY9dqUmVoQIA0ChgxEWDD7115bniBracARoZzO8o5rKR9RsfEHNGOOqUWBZr6JipZEeCmmtpUSSUIYZ/ANPncvmaZLsohDsRCaHsIo=; 7:7FjPoMyX+FBdXB76eVT4GNI8dm4uH2yEanrppEZwMz6Q4iH7ZhCP9Hf80XetYzbDHuTCrj4O3OkhPsUSf1Ass74tnmqFjCtMghlukC4trI0s0aFvt+dI+mcQFMPjCl09eaneh38U621xhkfh9AXLb3dH3tuxish4KlarbvCkBnMdwqbH3E7fuYxSbhKv+Rok3JMXGzreA3XFoPBAa0emGTzJ5nRuUXnZZSszGWmf6s0= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0366; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026); SRVR:DM2PR09MB0366; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0366; x-forefront-prvs: 096507C068 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(92566002)(2501003)(2906002)(81166006)(76576001)(74316001)(5003600100002)(5004730100002)(189998001)(107886002)(5002640100001)(6116002)(9686002)(8676002)(102836003)(586003)(3846002)(8936002)(3660700001)(230783001)(10400500002)(86362001)(87936001)(77096005)(5008740100001)(66066001)(99286002)(2900100001)(54356999)(2201001)(122556002)(33656002)(11100500001)(50986999)(450100001)(3280700002)(5001770100001)(229853001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0366; H:DM2PR09MB0365.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jun 2016 00:33:04.4871 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0366 Archived-At: Subject: [secdir] Secdir review of draft-ietf-idr-ix-bgp-route-server-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2016 00:33:12 -0000 I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments. Summary: ready with (potential) issues. This standards track draft describes a method to exchange routing informati= on between 3 or more BGP peers on shared network access media. The approach= is intended to reduce the overhead involved in sharing routes in densely p= opulated interconnection points through the use of a common route broker. I found the draft clearly articulates the problem it is trying to solve. The following is a minor nit on the organization of the text: In general the security considerations section covers the issues fairly wel= l. In the first paragraph, the last sentence suggests that steps should be = taken to address path hiding, but the text does not point to the text in se= ction 2.3.2 on this topic. One way to improve this consideration would be t= o move the text in 2.3.3 to the end of this paragraph. Section 2.3.3 is adj= acent to the security consideration section, so I don't see this as a signi= ficant change. Some (potentially) minor issues: A number of the requirements in section 2.2 and the subsections define requ= irements that differ and often conflict with requirements in RFC 4271. It w= ould be good to indicate this at the start of 2.2. Should this relationshi= p also be called out in the abstract? I am not an expert in BGP security, so please consider this issue in that c= ontext: The statement at the end of the security considerations section points the = reader to RFC7454. I was left wondering if this draft changes any of consid= erations in RFC7454. It would be beneficial if some text was added to this = draft speaking to this point. Again not being an expert in BGP security, I = am not certain what the new text should say on this matter. Regards, Dave Waltermire From nobody Tue Jun 7 11:00:30 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F210312D828; Tue, 7 Jun 2016 10:58:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1465322283; bh=zb1uzic2VxAQlHei97MQBzJ3zTBro3NbKfjI+vJ6o2k=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=W5FrklO19FgiPo6gT4E46kkC+26ibfd0Npz6zjZIr5QkflRp7Hngm+5CfOk9qaG8m /FhoE25A0r/sHFX/54rC4CrB25BNqQxQxvIpYXzwzjikGhuoMS3vxZ9vJtwVFrkNE4 u6XBmuFl+l+NuiIQGB5aI5JdY/fP4MaTdPKJmcLc= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 79BAF12D817 for ; Tue, 7 Jun 2016 10:57:56 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.21.0 Auto-Submitted: auto-generated Precedence: bulk Reply_to: Message-ID: <20160607175756.13708.36456.idtracker@ietfa.amsl.com> Date: Tue, 07 Jun 2016 10:57:56 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Tue, 07 Jun 2016 11:00:28 -0700 Subject: [secdir] [new-work] WG Review: Babel routing protocol (babel) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jun 2016 17:58:05 -0000 The Babel routing protocol (babel) WG in the Routing Area of the IETF is undergoing rechartering. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2016-06-14. Babel routing protocol (babel) ----------------------------------------------------------------------- Current status: BOF WG Chairs: Donald Eastlake Russ White Assigned Area Director: Alia Atlas Routing Area Directors: Alia Atlas Alvaro Retana Deborah Brungard Mailing list: Address: babel@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/babel Archive: https://mailarchive.ietf.org/arch/browse/babel/ Charter: https://datatracker.ietf.org/doc/charter-ietf-babel/ Babel is a loop-avoiding, distance vector routing protocol with good provisions for dynamically computed link metrics. It is robust even in the presence of link metric oscillations and the failure of transitivity. The core of the Babel protocol and security extensions are described in Experimental Independent Stream RFCs 6126, 7557, and 7298. These RFCs are the basis of three independent, open source implementations. There is some production deployment of these implementations, notably in hybrid networks (networks that include classical, wired parts with meshy radio bits) and in global overlay networks (networks built out of large numbers of tunnels spanning continents). The Working Group will focus on moving the Babel protocol to IETF Proposed Standard with IETF review. This includes clarifying RFC 6126 and integrating RFC 7557 and feedback provided by independent implementations, and resolving comments. It is not a requirement that the Babel protocol produced is backwards compatible with RFC 6126. It is a requirement that Babel support at least one profile that is auto-configuring. Other documents that are relevant to the above work can also be produced. Particular emphasis will be placed on work needed for a Proposed Standard routing protocol, such as ensuring manageability and strong security. Link metric measurement or link metric calculation procedures significantly more complex that those currently in Babel are out of scope. Work Items: - Produce a revision of RFC 6126 suitable for publication as a Proposed Standard -- incorporate in the revision developments since RFC 6126 -- resolve technical issues found -- include in the base specification the extensibility work in RFC 7557 -- support auto-configuration -- consider any important changes based on experience with Babel to date. - Address security needs for BABEL. This may include using the techniques in RFC 7298, or other alternatives. Security may be included in the base spec or the base spec may normatively reference a separate Proposed Standard specification. This is required as part of moving Babel to Proposed Standard. - Address manageability of Babel by producing an informational model for use by other network management such as the Broadband Forum TR-069, and a YANG data module based on that information model. The former supports the case where the Customer-Premise Equipment (CPE) is managed by the Service Provider (SP) as is done today. The latter YANG model supports management of home gateway routers and is consistent with the ongoing effort to use YANG data modules in the Routing Area. This work is required as part of moving Babel to Proposed Standard. - As the Proposed Standard version of Babel is completed, an Applicability Statement should be finalized to guide those potentially interested in deploying Babel. This Applicability Statement may include deployment advice and will be published as an RFC. - Coordinate with other Working Groups, such as the HOMENET WG for likely applicability, the RTGWG and V6OPS WG about Source-Specific Routing to support IPv6 multihoming, the PIM WG for discussion around multicast, and the MANET WG for considerations around wireless. - Liaise as necessary with the Broadband Forum to facilitate use of the Babel management Information Model for TR-069. - The Working Group should document its ongoing implementation experience with Babel, so that new WG participants can understand the state that is driving this work and the experience driving changes. This documentation may be on the Working Group's wiki, in an internet-draft that isn't expected to be published as an RFC, or a combination. - As a secondary focus, the Working Group may work on multicast aspects of Babel. This may include discussion of any potential issues for supporting Babel running with PIM-SM in an auto-configuration profile. It may include exploring Babel carrying separate metrics for multicast. It may include discussion and consultation with the PIM WG about Babel providing the ability to build multicast routing tables. With AD and WG agreement, once an approach is understood, then a milestone may be added for an associated document targeted as Proposed Standard. - As a secondary focus, the Working Group may work on documents defining source specific routing extensions for Babel as a way of handling IPv6 multihoming. Thus, the Working Group will produce a Proposed Standard Babel specification, including or paired with a suitable Proposed Standard specification covering the security mechanism(s) for BABEL. It will also produce a management information and data model for BABEL as a Proposed Standard RFC. An applicability statement will be produced as an Informational RFC. Milestones: Jul 2016 - WG adoption of Babel Applicability draft Jul 2016 - WG adoption of RFC6126bis Oct 2016 - WG adoption of Babel Management (Info Model & YANG Model) draft Jul 2017 - IESG Submission of RFC6126bis and potentially companion security mechanisms draft Jul 2017 - IESG Submission of Babel Management draft Aug 2017 - IESG Submission of Babel Applicability draft _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Thu Jun 9 03:52:47 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6EF612B069 for ; Thu, 9 Jun 2016 03:52:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G4q77cIiHUI9 for ; Thu, 9 Jun 2016 03:52:44 -0700 (PDT) Received: from mail.kivinen.iki.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6EED12B076 for ; Thu, 9 Jun 2016 03:52:43 -0700 (PDT) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id u59Aqd72013155 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 9 Jun 2016 13:52:39 +0300 (EEST) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id u59Aqdoe001664; Thu, 9 Jun 2016 13:52:39 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <22361.19063.138276.899256@fireball.acr.fi> Date: Thu, 9 Jun 2016 13:52:39 +0300 From: Tero Kivinen To: secdir@ietf.org X-Edit-Time: 1 min X-Total-Time: 0 min Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2016 10:52:45 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Dacheng Zhang is next in the rotation. For telechat 2016-06-16 Reviewer LC end Draft Yoav Nir TR2016-06-06 draft-ietf-rtgwg-bgp-routing-large-dc-11 Tina TSOU T 2016-06-08 draft-ietf-ccamp-additional-signal-type-g709v3-04 Sean Turner T 2016-06-03 draft-ietf-dmarc-interoperability-16 Carl Wallace T 2016-06-22 draft-ietf-forces-interfelfb-04 For telechat 2016-06-30 Klaas Wierenga T 2016-06-21 draft-ietf-alto-deployments-15 Tom Yu T 2016-07-01 draft-pal-eidr-urn-2016-01 For telechat 2016-07-07 Liang Xia T 2016-06-22 draft-ietf-calext-extensions-03 Last calls and special requests: Alan DeKok 2016-04-30 draft-bradner-rfc3979bis-08 Daniel Kahn Gillmor E 2016-02-01 draft-ietf-rtcweb-security-08 Hannes Tschofenig 2015-12-28 draft-ietf-hip-rfc5204-bis-07 Hannes Tschofenig E None draft-ietf-ntp-network-time-security-14 Hannes Tschofenig E None draft-ietf-ntp-cms-for-nts-message-06 Hannes Tschofenig E None draft-ietf-ntp-using-nts-for-ntp-05 Brian Weis E 2016-02-01 draft-ietf-cdni-uri-signing-07 Brian Weis 2016-06-21 draft-ietf-mile-implementreport-09 Paul Wouters 2016-06-17 draft-ietf-dnsop-dnssec-roadblock-avoidance-04 -- kivinen@iki.fi From nobody Thu Jun 9 06:12:26 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B241E12D61C; Thu, 9 Jun 2016 06:12:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id thlR6qmV0fsm; Thu, 9 Jun 2016 06:12:21 -0700 (PDT) Received: from mail-wm0-x232.google.com (mail-wm0-x232.google.com [IPv6:2a00:1450:400c:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A583F12D639; Thu, 9 Jun 2016 06:12:20 -0700 (PDT) Received: by mail-wm0-x232.google.com with SMTP id n184so224816865wmn.1; Thu, 09 Jun 2016 06:12:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=FawuBGZTA9We8STA016hzginUM34diLDv704xCyBT50=; b=KF1lbMYOyhGE7Xd6jWIalBZq4+z/pOOf8FqX8yTegnVov1b7/xegSqr6gQOjgyGZoU lcKCD++FdrH3ZNICoGdkhLrrQjwRr8h9ibT2xI1Xxycwa4sttjRDrl5PaINnKivXoO0q iixLj/NfnkoerdnDOjMbTRf7c4/8yw5mQ4X3LjMJKLkei9zxUqbKT7Vmcsr1SFgC0KZO HNMK4Y4eDcNK6WR8sHFOo9Uc5d5MBx8XRS2s4Qb2u7vL/tXJN3sarHFTHlPfGYF8GvCQ Vi/T9kaTHldumzxURhow4lXh5I+O6FstcZIKU2lLVL0jYtSKIqpaJ+lYUo2UNwaE+/Ce 3u5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=FawuBGZTA9We8STA016hzginUM34diLDv704xCyBT50=; b=SljuzzTZufe2FKCYPo8hH6IH6HU2+AD4D+Wx7BEycmjCrXH5NR7tluFILwNlCxd7vd G0kZHQvLwxacOnYPE3NgsNqUPO84WplhLMSXil7LtAdnAfylhFOTu8zZPdWbWz8XVxIp XH26+V4t2IWqmQLLbt2OrzY4Ck6GzxJ63z8P7fHRiaUKFQA5l7VbOLSslwpjLB8xJloT gQooFckHgIirlutNvwKUrU2RN3OXn0tUtZIlBdYr5tMcn8vBYtpxnEXzZRfOq4hbBMhw satGjvQ3WPPdwe4JEDCcsQ1YhDHd2yar0aP+p0gOu9K2lhfFVjZZujqXJFbXbWoEG5Nh rQEQ== X-Gm-Message-State: ALyK8tKY9n8CrX+rDCh7FfbMEYTulJM2YQCiKsCS3De/+sfNOhpx9qgQaUQySBupHnfbfQ== X-Received: by 10.28.184.199 with SMTP id i190mr9778585wmf.57.1465477938970; Thu, 09 Jun 2016 06:12:18 -0700 (PDT) Received: from [172.24.249.196] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id t199sm7622198wmt.11.2016.06.09.06.12.17 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 09 Jun 2016 06:12:18 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Yoav Nir In-Reply-To: Date: Thu, 9 Jun 2016 16:12:15 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: <78EC7A14-FA30-4369-9059-90EE1C51B21D@gmail.com> References: To: secdir , The IESG , draft-ietf-rtgwg-bgp-routing-large-dc.all@ietf.org X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [secdir] SecDir review of draft-ietf-rtgwg-bgp-routing-large-dc-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2016 13:12:23 -0000 Hi The new version addresses my concern from the message below. The = document is now ready IMO. Thanks Yoav > On 5 May 2016, at 10:24 AM, Yoav Nir wrote: >=20 > Hi. >=20 > I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the=20 > IESG. These comments were written primarily for the benefit of the = security area directors. Document editors and WG chairs should treat = these comments just like any other last call comments. >=20 > Summary: Almost Ready >=20 > This document is an Informational discussion of packet routing within = data centers. It describes existing practice with using layer-2 = protocols such as STP or TRILL, hybrid setups, and layer-3 routing = protocols, mostly IGPs. It finally recommends replacing these with EBGP = and a Clos structure. The document is very clear and quite an = interesting read. >=20 > The document does not deal with security questions such as what kind = of damage a rogue node can do, and that is fine. That is not the subject = of this document.=20 >=20 > My one issue is with the Security Considerations section. Section 9 = defers to the BGP RFCs (4271 and 4272) for the security considerations. = This is a common pattern and it's usually fine, but in this case it is = missing something. RFC 4271 requires the use of TCP-MD5 (RFC 2385) for = authenticating the BGP connections between routers. RFC 4271 also = mentions (but does not solve) the problem of key management. ISTM that = in a large-scale and dynamically scalable data center, the problem of = key management should be addressed. It might also be nice to use = something less antiquated than TCP-MD5.=20 >=20 > Now it's possible to decide that all elements within the data center = are trusted and under the administrator's control, and that therefore no = authentication is necessary as long as BGP is somehow blocked from = outside the DC to internal nodes. But if these assumptions exist, I = believe they should be stated. >=20 > Yoav From nobody Fri Jun 10 04:38:44 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E9CE12D94C; Fri, 10 Jun 2016 04:38:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.124 X-Spam-Level: X-Spam-Status: No, score=-0.124 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_TAG_BALANCE_BODY=1.157, LONGWORDS=2.035, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001, T_HTML_ATTACH=0.01] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yskLcpjdV0P1; Fri, 10 Jun 2016 04:38:29 -0700 (PDT) Received: from mx2.cnes.fr (mx2.cnes.fr [194.199.174.201]) by ietfa.amsl.com (Postfix) with ESMTP id 50E2012D9AA; Fri, 10 Jun 2016 04:38:25 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.26,449,1459814400"; d="htm'217?scan'217,208,217";a="3969028" X-IPAS-Result: A2GmBABWplpX/wUBeApTChoBAQEBgyBJDX0GhUStbolkJASCOIFbgVgCgTM8EAEBAQEBAQEDYieERQEBAQECARgCARI7BAQGAwULAgEFAw0FEBYBBgcCMBQDDgIECgQFCAYGBQKIDQgOvhABAQEBAQEBAQEBAQEBAQEBAQEBAQEODolxgQOEBwoBBgQBBgEGGBWDFYIvAQSFeoILBwKGGHqGSIFTgSSDLoJWgniCcIMhgQQXN4QEgyAMhB+BGo9rNR+BTDgCHYFLPDIBiEMBDhcfAX4BAQE From: Kuhn Nicolas To: Tero Kivinen Thread-Topic: Secdir review of draft-ietf-aqm-eval-guidelines-11 Thread-Index: AQHRoIyZ3aFSg9THzUGEGUMXQuD6up+860sggAAbloCAAFcrgIACmNoAgCKwRHA= Date: Fri, 10 Jun 2016 11:37:58 +0000 Message-ID: References: <22304.47475.765923.579337@fireball.acr.fi> <22331.2463.998319.871791@fireball.acr.fi> <22333.32886.374388.282687@fireball.acr.fi> In-Reply-To: <22333.32886.374388.282687@fireball.acr.fi> Accept-Language: en-US Content-Language: fr-FR X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-tm-as-product-ver: SMEX-11.0.0.4179-8.000.1202-22382.006 x-tm-as-result: No--50.791600-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: multipart/mixed; boundary="_002_F3B0A07CFD358240926B78A680E166FF8FD63ATWMBXP03cnesnetad_" MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-aqm-eval-guidelines.all@tools.ietf.org" , "Mirja Kuehlewind \(IETF\)" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review of draft-ietf-aqm-eval-guidelines-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2016 11:38:37 -0000 --_002_F3B0A07CFD358240926B78A680E166FF8FD63ATWMBXP03cnesnetad_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dear Tero Kivinen,=20 Thank you for your review and sorry for the delay of our answer. We will co= nsider your comments as you can see inline. We will push an updated version including the changes as soon as possible. Please find attached to this email the diff between v11 and expected v12. Kind regards,=20 The authors -----Message d'origine----- De=A0: Tero Kivinen [mailto:kivinen@iki.fi]=20 Envoy=E9=A0: jeudi 19 mai 2016 11:00 =C0=A0: Kuhn Nicolas Cc=A0: iesg@ietf.org; secdir@ietf.org; draft-ietf-aqm-eval-guidelines.all@t= ools.ietf.org; Mirja Kuehlewind (IETF) Objet=A0: RE: Secdir review of draft-ietf-aqm-eval-guidelines-11 Kuhn Nicolas writes: > I agree with you: this format does not ease the reading. This is=20 > however how it is done in, e.g. RFC 7567. This is more readable for=20 > someone aware of the activity in the working group (for someone=20 > familiar with the mentioned RFCs, seeing [RFC7567] is easier than=20 > [5]). Yes, using "as specified in [RFC7567]" is better than using "as specified i= n [5]", but using "as specified in the AQM recommendations document [RFC756= 7]" is even better, and provides the RFC number for those who knows those, = but also tells those who just read this document information what that docu= ment is without the need to go and check the document title. [NK] Indeed. We have had a look at the references to RFC and tried to impro= ve the way they are cited, when we thought that including details was inter= esting.=20 Also you have several references ot the RFC7567 even in the same sentence: Not all endpoints (or applications) using TCP use the same flavor of TCP. Variety of senders generate different classes of traffic which may not react to congestion signals (aka non-responsive flows [RFC7567]) or may not reduce their sending rate as expected (aka Transport Flows that are less responsive than TCP[RFC7567], also called "aggressive flows"). In these cases, AQM schemes seek to control the queuing delay. IF those refer to the specific recommendations in the RFC7567 then pointing= the section number or similar would make this text much more useful than j= ust pointing to the same document multiple times in same sentence.=20 [NK] You are right. We have checked the references to that RFC and be more = precised on the sections that are pointed when it makes sense. > It depends who is targeted by the draft. I have no idea who the intended audience for this draft is. I could not fin= d that from the draft. [NK] True. We have clarified in the abstract that the intended audience is = lab tester. > I think (hope?) that someone using these guidelines would have read > RFC7567 first. That hope is completely unjustified. There are always several people readin= g RFCs, who have no idea what the referenced document specifies. Quite often it is someone pointing them out that the RFC xxxx in section yy= y says zzz, do something, and then the person starts reading that RFC xxxx = without any prior knowledge about the subject. He might end up reading rele= vant RFCs later, but he has to start from somewehere. I think it is better = if we can make RFCs easier to understand for persons who just start reading= them. Also architecture, recommendations, and guidelines documents are quite ofte= n so that actual implementors are not that interested reading on them until= they are forced to do so. They are important while we are writing the actu= al specifications, as that creates the base work for making protocol design= , but when you are implementing the actual bits on the wire, implementors u= sually just go directly to the bits on wire and try to make them work, igno= ring as much of other documents as they can. [NK] We agree on that and believe that with the more specified pointers to = e.g. RFC 7567 it is better. Thanks,=20 > Nico >=20 > -----Message d'origine----- > De=A0: Tero Kivinen [mailto:kivinen@iki.fi] Envoy=E9=A0: mardi 17 mai 201= 6=20 > 14:08 =C0=A0: Kuhn Nicolas Cc=A0: iesg@ietf.org; secdir@ietf.org;=20 > draft-ietf-aqm-eval-guidelines.all@tools.ietf.org; Mirja Kuehlewind=20 > (IETF) Objet=A0: RE: Secdir review of draft-ietf-aqm-eval-guidelines-11 >=20 > Kuhn Nicolas writes: > > Thanks a lot for your review. If you believe that your proposed=20 > > changes on the references format should deserve changes in the=20 > > document and a new ID, please let us know, we would try to integrate=20 > > them ASAP. >=20 > > Current format makes the document hard to read, especially for those=20 > > who do are not very familiar with the area, as it is hard to=20 > > remember which rfc is which (7567, 5481, 2679 etc) >=20 > > My recommendation would be to fix that, but this is my personal prefere= nce on the matter. >=20 >=20 > -- > kivinen@iki.fi -- kivinen@iki.fi --_002_F3B0A07CFD358240926B78A680E166FF8FD63ATWMBXP03cnesnetad_ Content-Type: text/html; name="Diff draft-ietf-aqm-eval-guidelines-11.txt - draft-ietf-aqm-eval-guidelines-12.txt.htm" Content-Description: Diff draft-ietf-aqm-eval-guidelines-11.txt - draft-ietf-aqm-eval-guidelines-12.txt.htm Content-Disposition: attachment; filename="Diff draft-ietf-aqm-eval-guidelines-11.txt - draft-ietf-aqm-eval-guidelines-12.txt.htm"; size=363821; creation-date="Fri, 10 Jun 2016 11:04:39 GMT"; modification-date="Fri, 10 Jun 2016 11:35:12 GMT" Content-Transfer-Encoding: base64 PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFs Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25h bC5kdGQiPg0KPCEtLSBHZW5lcmF0ZWQgYnkgcmZjZGlmZiAxLjQ1OiByZmNkaWZmICAtLT4NCjwh LS0gPCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEgVHJhbnNpdGlv bmFsIiA+IC0tPg0KPCEtLSBTeXN0ZW06IExpbnV4IHppbmZhbmRlbCAzLjIuMC00LWFtZDY0ICMx IFNNUCBEZWJpYW4gMy4yLjY4LTErZGViN3UyIHg4Nl82NCBHTlUvTGludXggLS0+DQo8IS0tIFVz aW5nIGF3azogL3Vzci9iaW4vZ2F3azogR05VIEF3ayA0LjAuMSAtLT4NCjwhLS0gVXNpbmcgZGlm ZjogL3Vzci9iaW4vZGlmZjogZGlmZiAoR05VIGRpZmZ1dGlscykgMy4yIC0tPg0KPCEtLSBVc2lu ZyB3ZGlmZjogL3Vzci9iaW4vd2RpZmY6IHdkaWZmIChHTlUgd2RpZmYpIDEuMS4yIC0tPg0KPGh0 bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPjxoZWFkPiANCiAgPG1ldGEg aHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiPiANCiAgPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1TdHlsZS1UeXBlIiBjb250ZW50PSJ0 ZXh0L2NzcyI+IA0KICA8dGl0bGU+RGlmZjogZHJhZnQtaWV0Zi1hcW0tZXZhbC1ndWlkZWxpbmVz LTExLnR4dCAtIGRyYWZ0LWlldGYtYXFtLWV2YWwtZ3VpZGVsaW5lcy0xMi50eHQ8L3RpdGxlPiAN CiAgPHN0eWxlIHR5cGU9InRleHQvY3NzIj4gDQogICAgYm9keSAgICB7IG1hcmdpbjogMC40ZXg7 IG1hcmdpbi1yaWdodDogYXV0bzsgfSANCiAgICB0ciAgICAgIHsgfSANCiAgICB0ZCAgICAgIHsg d2hpdGUtc3BhY2U6IHByZTsgZm9udC1mYW1pbHk6IG1vbm9zcGFjZTsgdmVydGljYWwtYWxpZ246 IHRvcDsgZm9udC1zaXplOiAwLjg2ZW07fSANCiAgICB0aCAgICAgIHsgZm9udC1zaXplOiAwLjg2 ZW07IH0gDQogICAgLnNtYWxsICB7IGZvbnQtc2l6ZTogMC42ZW07IGZvbnQtc3R5bGU6IGl0YWxp YzsgZm9udC1mYW1pbHk6IFZlcmRhbmEsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgfSANCiAgICAu bGVmdCAgIHsgYmFja2dyb3VuZC1jb2xvcjogI0VFRTsgfSANCiAgICAucmlnaHQgIHsgYmFja2dy b3VuZC1jb2xvcjogI0ZGRjsgfSANCiAgICAuZGlmZiAgIHsgYmFja2dyb3VuZC1jb2xvcjogI0ND RjsgfSANCiAgICAubGJsb2NrIHsgYmFja2dyb3VuZC1jb2xvcjogI0JGQjsgfSANCiAgICAucmJs b2NrIHsgYmFja2dyb3VuZC1jb2xvcjogI0ZGODsgfSANCiAgICAuaW5zZXJ0IHsgYmFja2dyb3Vu ZC1jb2xvcjogIzhGRjsgfSANCiAgICAuZGVsZXRlIHsgYmFja2dyb3VuZC1jb2xvcjogI0FDRjsg fSANCiAgICAudm9pZCAgIHsgYmFja2dyb3VuZC1jb2xvcjogI0ZGQjsgfSANCiAgICAuY29udCAg IHsgYmFja2dyb3VuZC1jb2xvcjogI0VFRTsgfSANCiAgICAubGluZWJyIHsgYmFja2dyb3VuZC1j b2xvcjogI0FBQTsgfSANCiAgICAubGluZW5vIHsgY29sb3I6IHJlZDsgYmFja2dyb3VuZC1jb2xv cjogI0ZGRjsgZm9udC1zaXplOiAwLjdlbTsgdGV4dC1hbGlnbjogcmlnaHQ7IHBhZGRpbmc6IDAg MnB4OyB9IA0KICAgIC5lbGlwc2lzeyBiYWNrZ3JvdW5kLWNvbG9yOiAjQUFBOyB9IA0KICAgIC5s ZWZ0IC5jb250IHsgYmFja2dyb3VuZC1jb2xvcjogI0RERDsgfSANCiAgICAucmlnaHQgLmNvbnQg eyBiYWNrZ3JvdW5kLWNvbG9yOiAjRUVFOyB9IA0KICAgIC5sYmxvY2sgLmNvbnQgeyBiYWNrZ3Jv dW5kLWNvbG9yOiAjOUQ5OyB9IA0KICAgIC5yYmxvY2sgLmNvbnQgeyBiYWNrZ3JvdW5kLWNvbG9y OiAjREQ2OyB9IA0KICAgIC5pbnNlcnQgLmNvbnQgeyBiYWNrZ3JvdW5kLWNvbG9yOiAjMEREOyB9 IA0KICAgIC5kZWxldGUgLmNvbnQgeyBiYWNrZ3JvdW5kLWNvbG9yOiAjOEFEOyB9IA0KICAgIC5z dGF0cywgLnN0YXRzIHRkLCAuc3RhdHMgdGggeyBiYWNrZ3JvdW5kLWNvbG9yOiAjRUVFOyBwYWRk aW5nOiAycHggMDsgfSANCiAgICBzcGFuLmhpZGUgeyBkaXNwbGF5OiBub25lOyBjb2xvcjogI2Fh YTt9ICAgIGE6aG92ZXIgc3BhbiB7IGRpc3BsYXk6IGlubGluZTsgfSAgICB0ci5jaGFuZ2UgeyBi YWNrZ3JvdW5kLWNvbG9yOiBncmF5OyB9IA0KICAgIHRyLmNoYW5nZSBhIHsgdGV4dC1kZWNvcmF0 aW9uOiBub25lOyBjb2xvcjogYmxhY2sgfSANCiAgPC9zdHlsZT4gDQogICAgIDxzY3JpcHQ+DQp2 YXIgY2h1bmtfaW5kZXggPSAwOw0KdmFyIG9sZF9jaHVuayA9IG51bGw7DQoNCmZ1bmN0aW9uIGZv cm1hdF9jaHVuayhpbmRleCkgew0KICAgIHZhciBwcmVmaXggPSAiZGlmZiI7DQogICAgdmFyIHN0 ciA9IGluZGV4LnRvU3RyaW5nKCk7DQogICAgZm9yICh4PTA7IHg8KDQtc3RyLmxlbmd0aCk7ICsr eCkgew0KICAgICAgICBwcmVmaXgrPScwJzsNCiAgICB9DQogICAgcmV0dXJuIHByZWZpeCArIHN0 cjsNCn0NCg0KZnVuY3Rpb24gZmluZF9jaHVuayhuKXsNCiAgICByZXR1cm4gZG9jdW1lbnQucXVl cnlTZWxlY3RvcigndHJbaWQkPSInICsgbiArICciXScpOw0KfQ0KDQpmdW5jdGlvbiBjaGFuZ2Vf Y2h1bmsob2Zmc2V0KSB7DQogICAgdmFyIGluZGV4ID0gY2h1bmtfaW5kZXggKyBvZmZzZXQ7DQog ICAgdmFyIG5ld19zdHI7DQogICAgdmFyIG5ld19jaHVuazsNCg0KICAgIG5ld19zdHIgPSBmb3Jt YXRfY2h1bmsoaW5kZXgpOw0KICAgIG5ld19jaHVuayA9IGZpbmRfY2h1bmsobmV3X3N0cik7DQog ICAgaWYgKCFuZXdfY2h1bmspIHsNCiAgICAgICAgcmV0dXJuOw0KICAgIH0NCiAgICBpZiAob2xk X2NodW5rKSB7DQogICAgICAgIG9sZF9jaHVuay5zdHlsZS5vdXRsaW5lID0gIiI7DQogICAgfQ0K ICAgIG9sZF9jaHVuayA9IG5ld19jaHVuazsNCiAgICBvbGRfY2h1bmsuc3R5bGUub3V0bGluZSA9 ICIxcHggc29saWQgcmVkIjsNCiAgICB3aW5kb3cubG9jYXRpb24uaGFzaCA9ICIjIiArIG5ld19z dHI7DQogICAgd2luZG93LnNjcm9sbEJ5KDAsLTEwMCk7DQogICAgY2h1bmtfaW5kZXggPSBpbmRl eDsNCn0NCg0KZG9jdW1lbnQub25rZXlkb3duID0gZnVuY3Rpb24oZSkgew0KICAgIHN3aXRjaCAo ZS5rZXlDb2RlKSB7DQogICAgY2FzZSA3ODoNCiAgICAgICAgY2hhbmdlX2NodW5rKDEpOw0KICAg ICAgICBicmVhazsNCiAgICBjYXNlIDgwOg0KICAgICAgICBjaGFuZ2VfY2h1bmsoLTEpOw0KICAg ICAgICBicmVhazsNCiAgICB9DQp9Ow0KICAgPC9zY3JpcHQ+IA0KPC9oZWFkPiANCjxib2R5PiAN CiAgPHRhYmxlIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIj4gDQog IDx0Ym9keT48dHIgaWQ9InBhcnQtMSIgYmdjb2xvcj0ib3JhbmdlIj48dGg+PC90aD48dGg+PGEg aHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0Zi1hcW0t ZXZhbC1ndWlkZWxpbmVzLTExLnR4dCIgc3R5bGU9ImNvbG9yOiMwMDg7IHRleHQtZGVjb3JhdGlv bjpub25lOyI+Jmx0OzwvYT4mbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi1hcW0tZXZhbC1ndWlkZWxpbmVzLTExLnR4dCIgc3R5bGU9ImNvbG9yOiMw MDgiPmRyYWZ0LWlldGYtYXFtLWV2YWwtZ3VpZGVsaW5lcy0xMS50eHQ8L2E+Jm5ic3A7PC90aD48 dGg+IDwvdGg+PHRoPiZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLWFxbS1ldmFsLWd1aWRlbGluZXMtMTIudHh0IiBzdHlsZT0iY29sb3I6IzAwOCI+ ZHJhZnQtaWV0Zi1hcW0tZXZhbC1ndWlkZWxpbmVzLTEyLnR4dDwvYT4mbmJzcDs8YSBocmVmPSJo dHRwczovL3Rvb2xzLmlldGYub3JnL3JmY2RpZmY/dXJsMT1kcmFmdC1pZXRmLWFxbS1ldmFsLWd1 aWRlbGluZXMtMTIudHh0IiBzdHlsZT0iY29sb3I6IzAwODsgdGV4dC1kZWNvcmF0aW9uOm5vbmU7 Ij4mZ3Q7PC9hPjwvdGg+PHRoPjwvdGg+PC90cj4gDQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij5JbnRlcm5ldCBFbmdpbmVlcmluZyBUYXNr IEZvcmNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOLiBLdWhuLCBFZC48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij5JbnRlcm5ldCBFbmdpbmVlcmluZyBUYXNrIEZvcmNlICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBOLiBLdWhuLCBFZC48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij5JbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIENORVMsIFRlbGVjb20gQnJldGFnbmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij5JbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENORVMs IFRlbGVjb20gQnJldGFnbmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij5JbnRlbmRlZCBz dGF0dXM6IEluZm9ybWF0aW9uYWwgICAgICAgICAgICAgICAgICAgICAgICAgUC4gTmF0YXJhamFu LCBFZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij5JbnRlbmRlZCBzdGF0dXM6IElu Zm9ybWF0aW9uYWwgICAgICAgICAgICAgICAgICAgICAgICAgUC4gTmF0YXJhamFuLCBFZC48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDAxIj48 dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj5FeHBpcmVzOiA8c3BhbiBjbGFzcz0iZGVsZXRlIj5BdWd1c3QgNCwgMjAxNiAg PC9zcGFuPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaXNjbyBTeXN0ZW1zPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPkV4cGlyZXM6IDxzcGFuIGNsYXNzPSJpbnNl cnQiPk5vdmVtYmVyIDIsIDIwMTY8L3NwYW4+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIENpc2NvIFN5c3RlbXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOLiBLaGFkZW1p LCBFZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOLiBLaGFkZW1pLCBFZC48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBVbml2ZXJzaXR5IG9mIE9zbG88L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBVbml2ZXJzaXR5IG9mIE9zbG88L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBELiBSb3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBELiBSb3M8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgU2ltdWxhIFJlc2VhcmNoIExhYm9yYXRvcnkgQVM8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgU2ltdWxhIFJlc2VhcmNoIExhYm9yYXRvcnkgQVM8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDAyIj48dGQ+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPkZlYnJ1YXI8L3NwYW4+eSAyMDE2PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICBNYTwv c3Bhbj55IDIwMTY8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAg ICAgICAgICAgIEFRTSBDaGFyYWN0ZXJpemF0aW9uIEd1aWRlbGluZXM8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgIEFRTSBDaGFyYWN0ZXJpemF0aW9u IEd1aWRlbGluZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIg aWQ9ImRpZmYwMDAzIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgZHJhZnQtaWV0Zi1h cW0tZXZhbC1ndWlkZWxpbmVzLTE8c3BhbiBjbGFzcz0iZGVsZXRlIj4xPC9zcGFuPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgICAgICAgICAgICAgZHJhZnQtaWV0Zi1h cW0tZXZhbC1ndWlkZWxpbmVzLTE8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yPC9zcGFuPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPkFic3RyYWN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+QWJzdHJhY3Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBVbm1hbmFnZWQgbGFyZ2UgYnVmZmVycyBpbiB0b2RheSdzIG5ldHdvcmtzIGhhdmUgZ2l2ZW4g cmlzZSB0byBhIHNsZXc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBVbm1hbmFn ZWQgbGFyZ2UgYnVmZmVycyBpbiB0b2RheSdzIG5ldHdvcmtzIGhhdmUgZ2l2ZW4gcmlzZSB0byBh IHNsZXc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvZiBwZXJmb3JtYW5jZSBpc3N1 ZXMuICBUaGVzZSBwZXJmb3JtYW5jZSBpc3N1ZXMgY2FuIGJlIGFkZHJlc3NlZCBieTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9mIHBlcmZvcm1hbmNlIGlzc3Vlcy4gIFRoZXNl IHBlcmZvcm1hbmNlIGlzc3VlcyBjYW4gYmUgYWRkcmVzc2VkIGJ5PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgc29tZSBmb3JtIG9mIEFjdGl2ZSBRdWV1ZSBNYW5hZ2VtZW50IChBUU0p IG1lY2hhbmlzbSwgb3B0aW9uYWxseSBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIHNvbWUgZm9ybSBvZiBBY3RpdmUgUXVldWUgTWFuYWdlbWVudCAoQVFNKSBtZWNoYW5pc20s IG9wdGlvbmFsbHkgaW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb21iaW5hdGlv biB3aXRoIGEgcGFja2V0IHNjaGVkdWxpbmcgc2NoZW1lIHN1Y2ggYXMgZmFpciBxdWV1aW5nLjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvbWJpbmF0aW9uIHdpdGggYSBwYWNr ZXQgc2NoZWR1bGluZyBzY2hlbWUgc3VjaCBhcyBmYWlyIHF1ZXVpbmcuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAwNCI+PHRkPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgVGhpcyBkb2N1bWVudCBkZXNjcmliZXMgdmFyaW91cyBjcml0ZXJpYSBmb3IgcGVyZm9ybWlu ZyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5wcmVjYXV0aW9uYXJ5PC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyB2YXJpb3VzIGNy aXRlcmlhIGZvciBwZXJmb3JtaW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBj aGFyYWN0ZXJpemF0aW9ucyBvZiBBUU0gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+c2NoZW1lcy48L3Nw YW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGNoYXJhY3Rlcml6YXRpb25z IG9mIEFRTSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zY2hlbWVzLCB0aGF0IGNhbiBiZSB1c2VkIGlu IGxhYiB0ZXN0aW5nPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIGR1cmlu ZyBkZXZlbG9wbWVudCwgcHJpb3IgdG8gZGVwbG95bWVudC48L3NwYW4+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+U3RhdHVzIG9mIFRoaXMgTWVtbzwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPlN0YXR1cyBvZiBUaGlzIE1lbW88L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBUaGlzIEludGVybmV0LURyYWZ0IGlzIHN1Ym1pdHRlZCBpbiBmdWxs IGNvbmZvcm1hbmNlIHdpdGggdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg VGhpcyBJbnRlcm5ldC1EcmFmdCBpcyBzdWJtaXR0ZWQgaW4gZnVsbCBjb25mb3JtYW5jZSB3aXRo IHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb3Zpc2lvbnMgb2YgQkNQIDc4 IGFuZCBCQ1AgNzkuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcHJvdmlzaW9u cyBvZiBCQ1AgNzggYW5kIEJDUCA3OS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9mIHRoZSBJbnRlcm5l dCBFbmdpbmVlcmluZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEludGVybmV0 LURyYWZ0cyBhcmUgd29ya2luZyBkb2N1bWVudHMgb2YgdGhlIEludGVybmV0IEVuZ2luZWVyaW5n PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGFzayBGb3JjZSAoSUVURikuICBOb3Rl IHRoYXQgb3RoZXIgZ3JvdXBzIG1heSBhbHNvIGRpc3RyaWJ1dGU8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBUYXNrIEZvcmNlIChJRVRGKS4gIE5vdGUgdGhhdCBvdGhlciBncm91 cHMgbWF5IGFsc28gZGlzdHJpYnV0ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHdv cmtpbmcgZG9jdW1lbnRzIGFzIEludGVybmV0LURyYWZ0cy4gIFRoZSBsaXN0IG9mIGN1cnJlbnQg SW50ZXJuZXQtPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgd29ya2luZyBkb2N1 bWVudHMgYXMgSW50ZXJuZXQtRHJhZnRzLiAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC08 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBEcmFmdHMgaXMgYXQgaHR0cDovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RyYWZ0cy9jdXJyZW50Ly48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBEcmFmdHMgaXMgYXQgaHR0cDovL2RhdGF0cmFja2VyLmlldGYub3JnL2RyYWZ0 cy9jdXJyZW50Ly48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBJbnRlcm5l dC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBt b250aHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJbnRlcm5ldC1EcmFmdHMg YXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBtb250aHM8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2Vk LCBvciBvYnNvbGV0ZWQgYnkgb3RoZXIgZG9jdW1lbnRzIGF0IGFueTwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGFuZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQsIG9yIG9ic29s ZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgdGltZS4gIEl0IGlzIGluYXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBh cyByZWZlcmVuY2U8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aW1lLiAgSXQg aXMgaW5hcHByb3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVyZW5jZTwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG1hdGVyaWFsIG9yIHRvIGNpdGUgdGhlbSBvdGhl ciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBtYXRlcmlhbCBvciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAid29yayBpbiBw cm9ncmVzcy4iPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyIGlkPSJkaWZmMDAwNSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhpcyBJbnRlcm5ldC1EcmFmdCB3aWxs IGV4cGlyZSBvbiA8c3BhbiBjbGFzcz0iZGVsZXRlIj5BdWd1c3QgNDwvc3Bhbj4sIDIwMTYuPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgd2ls bCBleHBpcmUgb24gPHNwYW4gY2xhc3M9Imluc2VydCI+Tm92ZW1iZXIgMjwvc3Bhbj4sIDIwMTYu PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Q29weXJpZ2h0IE5vdGljZTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPkNvcHlyaWdodCBOb3RpY2U8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBDb3B5cmlnaHQgKGMpIDIwMTYgSUVURiBUcnVzdCBh bmQgdGhlIHBlcnNvbnMgaWRlbnRpZmllZCBhcyB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBDb3B5cmlnaHQgKGMpIDIwMTYgSUVURiBUcnVzdCBhbmQgdGhlIHBlcnNvbnMg aWRlbnRpZmllZCBhcyB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkb2N1bWVu dCBhdXRob3JzLiAgQWxsIHJpZ2h0cyByZXNlcnZlZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBkb2N1bWVudCBhdXRob3JzLiAgQWxsIHJpZ2h0cyByZXNlcnZlZC48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIGRvY3VtZW50IGlzIHN1YmplY3Qg dG8gQkNQIDc4IGFuZCB0aGUgSUVURiBUcnVzdCdzIExlZ2FsPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgVGhpcyBkb2N1bWVudCBpcyBzdWJqZWN0IHRvIEJDUCA3OCBhbmQgdGhl IElFVEYgVHJ1c3QncyBMZWdhbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFByb3Zp c2lvbnMgUmVsYXRpbmcgdG8gSUVURiBEb2N1bWVudHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBQcm92aXNpb25zIFJlbGF0aW5nIHRvIElFVEYgRG9jdW1lbnRzPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKGh0dHA6Ly90cnVzdGVlLmlldGYub3JnL2xpY2Vuc2Ut aW5mbykgaW4gZWZmZWN0IG9uIHRoZSBkYXRlIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgKGh0dHA6Ly90cnVzdGVlLmlldGYub3JnL2xpY2Vuc2UtaW5mbykgaW4gZWZmZWN0 IG9uIHRoZSBkYXRlIG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcHVibGljYXRp b24gb2YgdGhpcyBkb2N1bWVudC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1lbnRzPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVu dC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1lbnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgY2FyZWZ1bGx5LCBhcyB0aGV5IGRlc2NyaWJlIHlvdXIgcmlnaHRzIGFuZCByZXN0 cmljdGlvbnMgd2l0aCByZXNwZWN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg Y2FyZWZ1bGx5LCBhcyB0aGV5IGRlc2NyaWJlIHlvdXIgcmlnaHRzIGFuZCByZXN0cmljdGlvbnMg d2l0aCByZXNwZWN0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdG8gdGhpcyBkb2N1 bWVudC4gIENvZGUgQ29tcG9uZW50cyBleHRyYWN0ZWQgZnJvbSB0aGlzIGRvY3VtZW50IG11c3Q8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0byB0aGlzIGRvY3VtZW50LiAgQ29k ZSBDb21wb25lbnRzIGV4dHJhY3RlZCBmcm9tIHRoaXMgZG9jdW1lbnQgbXVzdDwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGluY2x1ZGUgU2ltcGxpZmllZCBCU0QgTGljZW5zZSB0ZXh0 IGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQuZSBvZjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIGluY2x1ZGUgU2ltcGxpZmllZCBCU0QgTGljZW5zZSB0ZXh0IGFzIGRlc2NyaWJl ZCBpbiBTZWN0aW9uIDQuZSBvZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSBU cnVzdCBMZWdhbCBQcm92aXNpb25zIGFuZCBhcmUgcHJvdmlkZWQgd2l0aG91dCB3YXJyYW50eSBh czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBUcnVzdCBMZWdhbCBQcm92 aXNpb25zIGFuZCBhcmUgcHJvdmlkZWQgd2l0aG91dCB3YXJyYW50eSBhczwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIGRlc2NyaWJlZCBpbiB0aGUgU2ltcGxpZmllZCBCU0QgTGljZW5z ZS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBkZXNjcmliZWQgaW4gdGhlIFNp bXBsaWZpZWQgQlNEIExpY2Vuc2UuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ VGFibGUgb2YgQ29udGVudHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij5UYWJsZSBv ZiBDb250ZW50czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIDEuICBJbnRy b2R1Y3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICAgMzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIDEuICBJbnRyb2R1Y3Rpb24g IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgMzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMDYiPjx0 ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPiAgICAgMS4xLiAgR29hbHMgb2YgdGhpcyBkb2N1bWVudCAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgIDEuMS4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPlJlZHVjaW5nIHRoZSBsYXRlbmN5IGFu ZCBtYXhpbWl6aW5nIHRoZSBnb29kcHV0IC4gLiAuIC4gLiAgIDU8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPjEuMi48L3NwYW4+ ICBSZXF1aXJlbWVudHMgTGFuZ3VhZ2UgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gICA2PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgICAgMS4yLjwvc3Bhbj4gIEdvYWxzIG9mIHRoaXMgZG9jdW1lbnQgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MS4zLjwvc3Bhbj4gIEdsb3NzYXJ5ICAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDY8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xLjMuPC9zcGFu PiAgUmVxdWlyZW1lbnRzIExhbmd1YWdlIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuICAgNjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgMi4gIEVuZC10by1lbmQg bWV0cmljcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA8c3Bh biBjbGFzcz0iZGVsZXRlIj42PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjEuNC48L3NwYW4+ICBHbG9zc2FyeSAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA2PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg Mi4gIEVuZC10by1lbmQgbWV0cmljcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij43PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgICAgMi4xLiAgRmxvdyBjb21wbGV0aW9uIHRpbWUgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgMi4xLiAgRmxvdyBjb21wbGV0aW9uIHRpbWUgIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICAgNzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0ciBpZD0iZGlmZjAwMDciPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMi4yLiAgRmxvdyBzdGFydCB1 cCB0aW1lICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+Nzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg ICAyLjIuICBGbG93IHN0YXJ0IHVwIHRpbWUgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij44PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+ICAgICAyLjMuICBQYWNrZXQgbG9zcyAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA8c3BhbiBjbGFzcz0iZGVsZXRlIj43PC9zcGFu PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDIuMy4gIFBhY2tldCBsb3Nz IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDxzcGFuIGNs YXNzPSJpbnNlcnQiPjg8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAg IDIuNC4gIFBhY2tldCBsb3NzIHN5bmNocm9uaXphdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPjg8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgMi40LiAgUGFja2V0IGxvc3Mgc3luY2hyb25pemF0aW9uIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgPHNwYW4gY2xhc3M9Imluc2VydCI+OTwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgIDIuNS4gIEdvb2RwdXQgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDk8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgIDIuNS4gIEdvb2RwdXQgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDk8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDA4Ij48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAg IDIuNi4gIExhdGVuY3kgYW5kIGppdHRlciAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+IDk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgMi42LiAgTGF0ZW5jeSBhbmQgaml0dGVyICAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xMDwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgIDIuNy4gIERpc2N1c3Npb24gb24g dGhlIHRyYWRlLW9mZiBiZXR3ZWVuIGxhdGVuY3kgYW5kIGdvb2RwdXQgLiAgMTA8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgIDIuNy4gIERpc2N1c3Npb24gb24gdGhlIHRyYWRl LW9mZiBiZXR3ZWVuIGxhdGVuY3kgYW5kIGdvb2RwdXQgLiAgMTA8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDA5Ij48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAz LiAgR2VuZXJpYyBzZXR1cCBmb3IgZXZhbHVhdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgMTxzcGFuIGNsYXNzPSJkZWxldGUiPjA8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIDMuICBHZW5lcmljIHNldHVwIGZvciBldmFsdWF0aW9ucyAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxPHNwYW4gY2xhc3M9Imluc2VydCI+MTwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgIDMuMS4gIFRvcG9sb2d5IGFuZCBu b3RhdGlvbnMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTE8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgIDMuMS4gIFRvcG9sb2d5IGFuZCBub3RhdGlvbnMg IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTE8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDEwIj48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAg IDMuMi4gIEJ1ZmZlciBzaXplIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTI8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgMy4yLiAgQnVmZmVyIHNpemUgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xMzwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMy4zLiAgQ29uZ2VzdGlvbiBj b250cm9scyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFz cz0iZGVsZXRlIj4xMjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg ICAzLjMuICBDb25nZXN0aW9uIGNvbnRyb2xzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjEzPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIDQuICBNZXRob2RvbG9neSwgTWV0cmljcywgQVFNIENvbXBhcmlzb25z LCBQYWNrZXQgU2l6ZXMsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgNC4gIE1l dGhvZG9sb2d5LCBNZXRyaWNzLCBBUU0gQ29tcGFyaXNvbnMsIFBhY2tldCBTaXplcyw8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDExIj48dGQ+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICAgICAgU2NoZWR1bGluZyBhbmQgRUNOICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTM8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICBTY2hlZHVsaW5nIGFuZCBFQ04gIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4xNDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgNC4xLiAg TWV0aG9kb2xvZ3kgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4xMzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgICA0LjEuICBNZXRob2RvbG9neSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjE0PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA0LjIuICBDb21tZW50cyBvbiBtZXRyaWNz IG1lYXN1cmVtZW50IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxl dGUiPjEzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDQuMi4g IENvbW1lbnRzIG9uIG1ldHJpY3MgbWVhc3VyZW1lbnQgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MTQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICAgIDQuMy4gIENvbXBhcmluZyBBUU0gc2NoZW1lcyAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTQ8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgNC4zLiAgQ29tcGFyaW5nIEFRTSBzY2hl bWVzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4xNTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICA0LjMu MS4gIFBlcmZvcm1hbmNlIGNvbXBhcmlzb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4xNDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgICAgIDQuMy4xLiAgUGVyZm9ybWFuY2UgY29tcGFyaXNvbiAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjE1PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgIDQuMy4yLiAgRGVwbG95bWVudCBjb21w YXJpc29uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxl dGUiPjE1PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgNC4z LjIuICBEZXBsb3ltZW50IGNvbXBhcmlzb24gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MTY8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICAgIDQuNC4gIFBhY2tldCBzaXplcyBhbmQgY29uZ2VzdGlvbiBub3RpZmljYXRp b24gIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTU8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgNC40LiAgUGFja2V0IHNpemVzIGFuZCBj b25nZXN0aW9uIG5vdGlmaWNhdGlvbiAgLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4xNjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgNC41LiAg SW50ZXJhY3Rpb24gd2l0aCBFQ04gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4xNTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgICA0LjUuICBJbnRlcmFjdGlvbiB3aXRoIEVDTiAgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjE3PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA0LjYuICBJbnRlcmFjdGlvbiB3aXRoIFNj aGVkdWxpbmcgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxl dGUiPjE2PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDQuNi4g IEludGVyYWN0aW9uIHdpdGggU2NoZWR1bGluZyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MTc8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICA1LiAgVHJhbnNwb3J0IFByb3RvY29scyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTY8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDUuICBUcmFuc3BvcnQgUHJvdG9jb2xzIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4xODwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgNS4xLiAg VENQLWZyaWVuZGx5IHNlbmRlciAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4xNzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgICA1LjEuICBUQ1AtZnJpZW5kbHkgc2VuZGVyIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjE4PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICA1LjEuMS4gIFRDUC1mcmllbmRseSBzZW5k ZXIgd2l0aCB0aGUgc2FtZSBpbml0aWFsIGNvbmdlc3Rpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICAgNS4xLjEuICBUQ1AtZnJpZW5kbHkgc2VuZGVyIHdpdGggdGhlIHNh bWUgaW5pdGlhbCBjb25nZXN0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyIGlkPSJkaWZmMDAxMiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAgICAgICAgd2luZG93 ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDE8c3BhbiBj bGFzcz0iZGVsZXRlIj43PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICAgICAgICAgICAgICB3aW5kb3cgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgMTxzcGFuIGNsYXNzPSJpbnNlcnQiPjg8L3NwYW4+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgICAgIDUuMS4yLiAgVENQLWZyaWVuZGx5IHNlbmRlciB3aXRoIGRp ZmZlcmVudCBpbml0aWFsIGNvbmdlc3Rpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICAgNS4xLjIuICBUQ1AtZnJpZW5kbHkgc2VuZGVyIHdpdGggZGlmZmVyZW50IGluaXRp YWwgY29uZ2VzdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 ciBpZD0iZGlmZjAwMTMiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgIHdpbmRvd3MgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVs ZXRlIj4xNzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgICAg ICAgICAgd2luZG93cyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjE5PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgICA1LjIuICBBZ2dyZXNzaXZlIHRyYW5zcG9ydCBzZW5kZXIgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjE4PC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDUuMi4gIEFnZ3Jlc3NpdmUgdHJhbnNw b3J0IHNlbmRlciAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imlu c2VydCI+MTk8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDUuMy4g IFVucmVzcG9uc2l2ZSB0cmFuc3BvcnQgc2VuZGVyIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTg8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgICAgNS4zLiAgVW5yZXNwb25zaXZlIHRyYW5zcG9ydCBzZW5kZXIgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xOTwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgNS40LiAgTGVzcy10aGFuIEJlc3QgRWZm b3J0IHRyYW5zcG9ydCBzZW5kZXIgIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVs ZXRlIj4xOTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA1LjQu ICBMZXNzLXRoYW4gQmVzdCBFZmZvcnQgdHJhbnNwb3J0IHNlbmRlciAgLiAuIC4gLiAuIC4gLiAu IC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjIwPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgNi4gIFJvdW5kIFRyaXAgVGltZSBGYWlybmVzcyAgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjE5PC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA2LiAgUm91bmQgVHJpcCBUaW1lIEZhaXJu ZXNzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imlu c2VydCI+MjE8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDYuMS4g IE1vdGl2YXRpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgICAgNi4xLiAgTW90aXZhdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yMTwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgNi4yLiAgUmVjb21tZW5kZWQgdGVzdHMg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVs ZXRlIj4yMDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA2LjIu ICBSZWNvbW1lbmRlZCB0ZXN0cyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjIxPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgICA2LjMuICBNZXRyaWNzIHRvIGV2YWx1YXRlIHRoZSBSVFQgZmFpcm5lc3Mg IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjIwPC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDYuMy4gIE1ldHJpY3MgdG8gZXZhbHVh dGUgdGhlIFJUVCBmYWlybmVzcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imlu c2VydCI+MjE8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDcuICBCdXJzdCBBYnNv cnB0aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yMjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIDcuICBCdXJzdCBBYnNvcnB0aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yMDwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA3LjEuICBNb3RpdmF0aW9uICAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjIy PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA3LjEuICBNb3RpdmF0 aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJkZWxldGUiPjIwPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgIDcuMi4gIFJlY29tbWVuZGVkIHRlc3RzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjI8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDcuMi4gIFJlY29tbWVuZGVkIHRlc3RzIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjE8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDguICBTdGFiaWxpdHkg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yMzwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIDguICBTdGFiaWxpdHkgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yMjwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA4LjEuICBNb3RpdmF0aW9uICAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjIz PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA4LjEuICBNb3RpdmF0 aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJkZWxldGUiPjIyPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgIDguMi4gIFJlY29tbWVuZGVkIHRlc3RzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjQ8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDguMi4gIFJlY29tbWVuZGVkIHRlc3RzIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjM8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICA4LjIuMS4gIERl ZmluaXRpb24gb2YgdGhlIGNvbmdlc3Rpb24gTGV2ZWwgIC4gLiAuIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yNDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgICAgICA4LjIuMS4gIERlZmluaXRpb24gb2YgdGhlIGNvbmdlc3Rpb24gTGV2ZWwgIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yMzwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgIDguMi4yLiAgTWlsZCBjb25nZXN0aW9uIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjI1 PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgIDguMi4yLiAgTWls ZCBjb25nZXN0aW9uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJkZWxldGUiPjIzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgICAgOC4yLjMuICBNZWRpdW0gY29uZ2VzdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjU8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgOC4yLjMuICBNZWRpdW0gY29uZ2VzdGlvbiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjM8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICA4LjIuNC4gIEhl YXZ5IGNvbmdlc3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yNTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgICAgICA4LjIuNC4gIEhlYXZ5IGNvbmdlc3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yNDwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgIDguMi41LiAgVmFyeWluZyB0aGUgY29uZ2VzdGlv biBsZXZlbCAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjI1 PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgIDguMi41LiAgVmFy eWluZyB0aGUgY29uZ2VzdGlvbiBsZXZlbCAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJkZWxldGUiPjI0PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgICAgOC4yLjYuICBWYXJ5aW5nIGF2YWlsYWJsZSBjYXBhY2l0eSAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjU8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgOC4yLjYuICBWYXJ5aW5nIGF2YWlsYWJsZSBjYXBh Y2l0eSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjQ8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgOC4zLiAgUGFyYW1l dGVyIHNlbnNpdGl2aXR5IGFuZCBzdGFiaWxpdHkgYW5hbHlzaXMgIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yNjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgICAgOC4zLiAgUGFyYW1ldGVyIHNlbnNpdGl2aXR5IGFuZCBzdGFiaWxpdHkgYW5hbHlzaXMg IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yNTwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgOS4gIFZhcmlvdXMgVHJhZmZpYyBQcm9maWxlcyAgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjI3 PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgOS4gIFZhcmlvdXMgVHJh ZmZpYyBQcm9maWxlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJkZWxldGUiPjI2PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgIDkuMS4gIFRyYWZmaWMgbWl4IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+Mjc8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDkuMS4gIFRyYWZmaWMgbWl4IC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjY8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgOS4yLiAgQmktZGly ZWN0aW9uYWwgdHJhZmZpYyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij4yODwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgICAgOS4yLiAgQmktZGlyZWN0aW9uYWwgdHJhZmZpYyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yNjwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgMTAuIDxzcGFuIGNsYXNzPSJpbnNlcnQiPkV4YW1wbGUg b2YgbXVsdGktQVFNIHNjZW5hcmlvPC9zcGFuPiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yODwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPiAgIDEwLiA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NdWx0aS1BUU0gU2NlbmFyaW8g IC4gLiAuIC4gLjwvc3Bhbj4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+Mjc8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PiAgICAgMTAuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yODwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMTAuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yNzwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAxMC4yLiAgRGV0YWls cyBvbiB0aGUgZXZhbHVhdGlvbiBzY2VuYXJpbyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJpbnNlcnQiPjI4PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgICAxMC4yLiAgRGV0YWlscyBvbiB0aGUgZXZhbHVhdGlvbiBzY2VuYXJpbyAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjI3PC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICAxMS4gSW1wbGVtZW50YXRpb24gY29zdCAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+Mjk8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAxMS4gSW1wbGVtZW50YXRp b24gY29zdCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+Mjc8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PiAgICAgMTEuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yOTwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMTEuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yNzwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAxMS4yLiAgUmVjb21t ZW5kZWQgZGlzY3Vzc2lvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJpbnNlcnQiPjI5PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgICAxMS4yLiAgUmVjb21tZW5kZWQgZGlzY3Vzc2lvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjI4PC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICAxMi4gT3BlcmF0b3IgQ29udHJvbCBhbmQgQXV0by10dW5p bmcgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MzA8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAxMi4gT3BlcmF0b3IgQ29u dHJvbCBhbmQgQXV0by10dW5pbmcgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+Mjg8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PiAgICAgMTIuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4zMDwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMTIuMS4gIE1vdGl2YXRpb24gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4yODwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAxMi4yLiAgUmVjb21t ZW5kZWQgZGlzY3Vzc2lvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFu IGNsYXNzPSJpbnNlcnQiPjMwPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgICAxMi4yLiAgUmVjb21tZW5kZWQgZGlzY3Vzc2lvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjI5PC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICAxMy4gPHNwYW4gY2xhc3M9Imluc2VydCI+U3VtbWFyeTwv c3Bhbj4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4uIC4gIDMxPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgMTMuIDxzcGFuIGNsYXNzPSJkZWxldGUiPkNvbmNsdXNpb248L3NwYW4+ICAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBj bGFzcz0iZGVsZXRlIj4yOTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgMTQuIEFja25vd2xlZGdlbWVudHMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjMyPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgMTQuIEFja25vd2xlZGdlbWVudHMgIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjMwPC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAxNS4gQ29udHJpYnV0b3Jz ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4g Y2xhc3M9Imluc2VydCI+MzI8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICAxNS4gQ29udHJpYnV0b3JzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MzA8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIDE2LiBJQU5BIENvbnNpZGVyYXRpb25zIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4zMjwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIDE2LiBJQU5BIENvbnNpZGVy YXRpb25zIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBj bGFzcz0iZGVsZXRlIj4zMTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgMTcuIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjMyPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgMTcuIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjMxPC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAxOC4gUmVmZXJlbmNlcyAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4g Y2xhc3M9Imluc2VydCI+MzI8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICAxOC4gUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MzE8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgMTguMS4gIE5vcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4zMjwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgMTguMS4gIE5vcm1hdGl2 ZSBSZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBj bGFzcz0iZGVsZXRlIj4zMTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAxOC4yLiAgSW5mb3JtYXRpdmUgUmVm ZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDMzPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAxOC4yLiAgSW5mb3JtYXRpdmUgUmVmZXJlbmNlcyAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDMzPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAxNCI+PHRkPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgQXV0 aG9ycycgQWRkcmVzc2VzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gIDM8c3BhbiBjbGFzcz0iZGVsZXRlIj40PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBBdXRob3JzJyBBZGRyZXNzZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMzxzcGFuIGNsYXNzPSJpbnNlcnQiPjU8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+MS4gIEludHJvZHVjdGlvbjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjEuICBJbnRyb2R1Y3Rpb248L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDE1Ij48dGQ+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICBBY3RpdmUgUXVldWUgTWFuYWdlbWVudCAoQVFNKSA8c3BhbiBjbGFzcz0iZGVs ZXRlIj5bUkZDNzU2N108L3NwYW4+IGFkZHJlc3NlcyB0aGUgY29uY2VybnM8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgQWN0aXZlIFF1ZXVlIE1hbmFnZW1lbnQgKEFRTSkgYWRk cmVzc2VzIHRoZSBjb25jZXJucyBhcmlzaW5nIGZyb208L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPiAgIGFyaXNpbmcgZnJvbSB1c2luZyB1bm5lY2Vzc2FyaWx5IGxhcmdlIGFuZCB1bm1h bmFnZWQgYnVmZmVycyB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICB1c2lu ZyB1bm5lY2Vzc2FyaWx5IGxhcmdlIGFuZCB1bm1hbmFnZWQgYnVmZmVycyB0byBpbXByb3ZlIG5l dHdvcms8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGltcHJvdmUgbmV0d29yayBh bmQgYXBwbGljYXRpb24gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+cGVyZm9ybWFuY2UuPC9zcGFuPiAg U2V2ZXJhbCBBUU0gYWxnb3JpdGhtczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBhbmQgYXBwbGljYXRpb24gPHNwYW4gY2xhc3M9Imluc2VydCI+cGVyZm9ybWFuY2UsIHN1Y2gg YXMgcHJlc2VudGVkIGluIHRoZSBzZWN0aW9uIDEuMiBvZjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBj bGFzcz0iaW5zZXJ0Ij4gICB0aGUgQVFNIHJlY29tbWVuZGF0aW9ucyBkb2N1bWVudCBbUkZDNzU2 N10uPC9zcGFuPiAgU2V2ZXJhbCBBUU0gYWxnb3JpdGhtczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGhhdmUgYmVlbiBwcm9wb3NlZCBpbiB0aGUgcGFzdCB5ZWFycywgbW9zdCBub3Rh Ymx5IFJhbmRvbSBFYXJseTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGhhdmUg YmVlbiBwcm9wb3NlZCBpbiB0aGUgcGFzdCB5ZWFycywgbW9zdCBub3RhYmx5IFJhbmRvbSBFYXJs eTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIERldGVjdGlvbiAoUkVEKSwgQkxVRSwg YW5kIFByb3BvcnRpb25hbCBJbnRlZ3JhbCBjb250cm9sbGVyIChQSSksIGFuZDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIERldGVjdGlvbiAoUkVEKSwgQkxVRSwgYW5kIFByb3Bv cnRpb25hbCBJbnRlZ3JhbCBjb250cm9sbGVyIChQSSksIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMTYiPjx0ZD48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIG1v cmUgcmVjZW50bHkgQ29EZWwgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W05JQ0gyMDEyXTwvc3Bhbj4g YW5kIFBJRSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5bUEFOMjAxM10uPC9zcGFuPiAgSW4gZ2VuZXJh bCwgdGhlc2U8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgbW9yZSByZWNlbnRs eSBDb0RlbCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5bSS1ELmlldGYtYXFtLWNvZGVsXTwvc3Bhbj4g YW5kIFBJRSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5bSS1ELmlldGYtYXFtLXBpZV0uPC9zcGFuPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgYWxnb3JpdGhtcyBhY3RpdmVseSBpbnRl cmFjdCB3aXRoIHRoZSBUcmFuc21pc3Npb24gQ29udHJvbCBQcm90b2NvbDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBJbiBnZW5lcmFsLCB0aGVzZSBhbGdvcml0aG1zIGFjdGl2 ZWx5IGludGVyYWN0IHdpdGggdGhlIFRyYW5zbWlzc2lvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgKFRDUCkgYW5kIGFueSBvdGhlciB0cmFuc3BvcnQgcHJvdG9jb2wgdGhhdCBk ZXBsb3lzIGEgY29uZ2VzdGlvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBD b250cm9sIFByb3RvY29sIChUQ1ApIGFuZCBhbnkgb3RoZXIgdHJhbnNwb3J0IHByb3RvY29sIHRo YXQgZGVwbG95czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgY29udHJvbCBzY2hl bWUgdG8gbWFuYWdlIHRoZSBhbW91bnQgb2YgZGF0YSB0aGV5IGtlZXAgaW4gdGhlIG5ldHdvcmsu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGEgY29uZ2VzdGlvbiBjb250cm9s IHNjaGVtZSB0byBtYW5hZ2UgdGhlIGFtb3VudCBvZiBkYXRhIHRoZXkga2VlcCBpbjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhlIGF2YWlsYWJsZSBidWZmZXIgc3BhY2UgaW4g dGhlIHJvdXRlcnMgYW5kIHN3aXRjaGVzIHNob3VsZCBiZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICB0aGUgbmV0d29yay4gIFRoZSBhdmFpbGFibGUgYnVmZmVyIHNwYWNlIGlu IHRoZSByb3V0ZXJzIGFuZCBzd2l0Y2hlczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgbGFyZ2UgZW5vdWdoIHRvIGFjY29tbW9kYXRlIHRoZSBzaG9ydC10ZXJtIGJ1ZmZlcmluZyBy ZXF1aXJlbWVudHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHNob3VsZCBi ZSBsYXJnZSBlbm91Z2ggdG8gYWNjb21tb2RhdGUgdGhlIHNob3J0LXRlcm0gYnVmZmVyaW5nPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHJlcXVpcmVtZW50cy4gIEFRTSBzY2hlbWVzIGFpbSBh dCByZWR1Y2luZyBidWZmZXIgb2NjdXBhbmN5LCBhbmQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPiAgIEFRTSBzY2hlbWVzIGFpbSBhdCByZWR1Y2luZyBidWZmZXIgb2NjdXBhbmN5LCBh bmQgdGhlcmVmb3JlIHRoZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5lbmQtPC9zcGFuPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICB0aGVyZWZvcmUgdGhlIDxzcGFuIGNsYXNzPSJp bnNlcnQiPmVuZC10by1lbmQ8L3NwYW4+IGRlbGF5LiAgU29tZSBvZiB0aGVzZSBhbGdvcml0aG1z LCBub3RhYmx5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVs ZXRlIj4gICB0by1lbmQ8L3NwYW4+IGRlbGF5LiAgU29tZSBvZiB0aGVzZSBhbGdvcml0aG1zLCBu b3RhYmx5IFJFRCwgaGF2ZSBhbHNvIGJlZW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgUkVELCBoYXZlIGFsc28gYmVlbiB3aWRlbHkgaW1wbGVtZW50ZWQgaW4gc29tZSBuZXR3 b3JrIGRldmljZXMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICB3aWRlbHkgaW1w bGVtZW50ZWQgaW4gc29tZSBuZXR3b3JrIGRldmljZXMuICBIb3dldmVyLCB0aGUgcG90ZW50aWFs PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEhvd2V2ZXIsIHRoZSBwb3RlbnRp YWwgYmVuZWZpdHMgb2YgdGhlIFJFRCBzY2hlbWUgaGF2ZSBub3QgYmVlbjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgYmVuZWZpdHMgb2YgdGhlIFJFRCBzY2hlbWUgaGF2ZSBub3Qg YmVlbiByZWFsaXplZCBzaW5jZSBSRUQgaXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgcmVhbGl6ZWQgc2luY2UgUkVEIGlzIHJlcG9ydGVkIHRvIGJlIHVzdWFsbHkgdHVybmVk IG9mZi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHJlcG9ydGVkIHRvIGJlIHVz dWFsbHkgdHVybmVkIG9mZi4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPlRoZSBtYWluIHJlYXNvbiBv ZiB0aGlzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIHJlbHVjdGFuY2Ug dG8gdXNlIFJFRCBpbiB0b2RheSdzIGRlcGxveW1lbnRzIGNvbWVzIGZyb20gaXRzPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIHNlbnNpdGl2aXR5IHRvIHRoZSBvcGVyYXRp bmcgY29uZGl0aW9ucyBpbiB0aGUgbmV0d29yayBhbmQgdGhlPC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFu IGNsYXNzPSJkZWxldGUiPiAgIGRpZmZpY3VsdHkgb2YgdHVuaW5nIGl0cyBwYXJhbWV0ZXJzLjwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgQSBidWZmZXIgaXMgYSBwaHlzaWNhbCB2b2x1bWUgb2YgbWVt b3J5IGluIHdoaWNoIGEgcXVldWUgb3Igc2V0IG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgQSBidWZmZXIgaXMgYSBwaHlzaWNhbCB2b2x1bWUgb2YgbWVtb3J5IGluIHdoaWNo IGEgcXVldWUgb3Igc2V0IG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcXVldWVz IGFyZSBzdG9yZWQuICBXaGVuIHNwZWFraW5nIG9mIGEgc3BlY2lmaWMgcXVldWUgaW4gdGhpczwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHF1ZXVlcyBhcmUgc3RvcmVkLiAgV2hl biBzcGVha2luZyBvZiBhIHNwZWNpZmljIHF1ZXVlIGluIHRoaXM8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBkb2N1bWVudCwgImJ1ZmZlciBvY2N1cGFuY3kiIHJlZmVycyB0byB0aGUg YW1vdW50IG9mIGRhdGEgKG1lYXN1cmVkPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgZG9jdW1lbnQsICJidWZmZXIgb2NjdXBhbmN5IiByZWZlcnMgdG8gdGhlIGFtb3VudCBvZiBk YXRhIChtZWFzdXJlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGluIGJ5dGVzIG9y IHBhY2tldHMpIHRoYXQgYXJlIGluIHRoZSBxdWV1ZSwgYW5kIHRoZSAibWF4aW11bSBidWZmZXI8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBpbiBieXRlcyBvciBwYWNrZXRzKSB0 aGF0IGFyZSBpbiB0aGUgcXVldWUsIGFuZCB0aGUgIm1heGltdW0gYnVmZmVyPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAxNyI+PHRkPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgc2l6ZSIgcmVmZXJzIHRvIHRoZSBtYXhpbXVtIGJ1ZmZlciBvY2N1cGFuY3kuICBJbiA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5yZWFsPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj4gICBzaXplIiByZWZlcnMgdG8gdGhlIG1heGltdW0gYnVmZmVyIG9jY3VwYW5jeS4g IEluIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnN3aXRjaGVzIGFuZDwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIGltcGxlbWVudGF0aW9u cyBvZiBzd2l0Y2hlcyw8L3NwYW4+IGEgZ2xvYmFsIG1lbW9yeSBpcyBvZnRlbiBzaGFyZWQgYmV0 d2VlbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0 Ij4gICByb3V0ZXJzLDwvc3Bhbj4gYSBnbG9iYWwgbWVtb3J5IDxzcGFuIGNsYXNzPSJpbnNlcnQi PnNwYWNlPC9zcGFuPiBpcyBvZnRlbiBzaGFyZWQgYmV0d2VlbiB0aGUgYXZhaWxhYmxlPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICB0aGUgYXZhaWxhYmxlIDxzcGFuIGNsYXNzPSJk ZWxldGUiPmRldmljZXMsPC9zcGFuPiBhbmQgdGh1cywgdGhlIG1heGltdW0gYnVmZmVyIHNpemUg bWF5IHZhcnk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xhc3M9 Imluc2VydCI+aW50ZXJmYWNlcyw8L3NwYW4+IGFuZCB0aHVzLCB0aGUgbWF4aW11bSBidWZmZXIg c2l6ZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5mb3IgYW55IGdpdmVuIGludGVyZmFjZTwvc3Bhbj48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIG92ZXIgdGhlIHRpbWUuPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIG1heSB2YXJ5IG92ZXIgdGhlIHRpbWUuPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgQnVmZmVyYmxvYXQgW0JCMjAxMV0gaXMg dGhlIGNvbnNlcXVlbmNlIG9mIGRlcGxveWluZyBsYXJnZSB1bm1hbmFnZWQ8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBCdWZmZXJibG9hdCBbQkIyMDExXSBpcyB0aGUgY29uc2Vx dWVuY2Ugb2YgZGVwbG95aW5nIGxhcmdlIHVubWFuYWdlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGJ1ZmZlcnMgb24gdGhlIEludGVybmV0IC0tIHRoZSBidWZmZXJpbmcgaGFzIG9m dGVuIGJlZW4gbWVhc3VyZWQgdG88L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBi dWZmZXJzIG9uIHRoZSBJbnRlcm5ldCAtLSB0aGUgYnVmZmVyaW5nIGhhcyBvZnRlbiBiZWVuIG1l YXN1cmVkIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYmUgdGVuIHRpbWVzIG9y IGh1bmRyZWQgdGltZXMgbGFyZ2VyIHRoYW4gbmVlZGVkLiAgTGFyZ2UgYnVmZmVyIHNpemVzPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYmUgdGVuIHRpbWVzIG9yIGh1bmRyZWQg dGltZXMgbGFyZ2VyIHRoYW4gbmVlZGVkLiAgTGFyZ2UgYnVmZmVyIHNpemVzPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW4gY29tYmluYXRpb24gd2l0aCBUQ1AgYW5kL29yIHVucmVz cG9uc2l2ZSBmbG93cyBpbmNyZWFzZXMgZW5kLXRvLTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIGluIGNvbWJpbmF0aW9uIHdpdGggVENQIGFuZC9vciB1bnJlc3BvbnNpdmUgZmxv d3MgaW5jcmVhc2VzIGVuZC10by08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBlbmQg ZGVsYXkuICBUaGlzIHJlc3VsdHMgaW4gcG9vciBwZXJmb3JtYW5jZSBmb3IgbGF0ZW5jeS1zZW5z aXRpdmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBlbmQgZGVsYXkuICBUaGlz IHJlc3VsdHMgaW4gcG9vciBwZXJmb3JtYW5jZSBmb3IgbGF0ZW5jeS1zZW5zaXRpdmU8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhcHBsaWNhdGlvbnMgc3VjaCBhcyByZWFsLXRpbWUg bXVsdGltZWRpYSAoZS5nLiwgdm9pY2UsIHZpZGVvLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIGFwcGxpY2F0aW9ucyBzdWNoIGFzIHJlYWwtdGltZSBtdWx0aW1lZGlhIChlLmcu LCB2b2ljZSwgdmlkZW8sPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZ2FtaW5nLCBl dGMpLiAgVGhlIGRlZ3JlZSB0byB3aGljaCB0aGlzIGFmZmVjdHMgbW9kZXJuIG5ldHdvcmtpbmc8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBnYW1pbmcsIGV0YykuICBUaGUgZGVn cmVlIHRvIHdoaWNoIHRoaXMgYWZmZWN0cyBtb2Rlcm4gbmV0d29ya2luZzwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIGVxdWlwbWVudCwgZXNwZWNpYWxseSBjb25zdW1lci1ncmFkZSBl cXVpcG1lbnQncywgcHJvZHVjZXMgcHJvYmxlbXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBlcXVpcG1lbnQsIGVzcGVjaWFsbHkgY29uc3VtZXItZ3JhZGUgZXF1aXBtZW50J3Ms IHByb2R1Y2VzIHByb2JsZW1zPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZXZlbiB3 aXRoIGNvbW1vbmx5IHVzZWQgd2ViIHNlcnZpY2VzLiAgQWN0aXZlIHF1ZXVlIG1hbmFnZW1lbnQg aXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBldmVuIHdpdGggY29tbW9ubHkg dXNlZCB3ZWIgc2VydmljZXMuICBBY3RpdmUgcXVldWUgbWFuYWdlbWVudCBpczwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRodXMgZXNzZW50aWFsIHRvIGNvbnRyb2wgcXVldWluZyBk ZWxheSBhbmQgZGVjcmVhc2UgbmV0d29yayBsYXRlbmN5LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHRodXMgZXNzZW50aWFsIHRvIGNvbnRyb2wgcXVldWluZyBkZWxheSBhbmQg ZGVjcmVhc2UgbmV0d29yayBsYXRlbmN5LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIFRoZSBBY3RpdmUgUXVldWUgTWFuYWdlbWVudCBhbmQgUGFja2V0IFNjaGVkdWxpbmcg V29ya2luZyBHcm91cCAoQVFNPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhl IEFjdGl2ZSBRdWV1ZSBNYW5hZ2VtZW50IGFuZCBQYWNrZXQgU2NoZWR1bGluZyBXb3JraW5nIEdy b3VwIChBUU08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBXRykgd2FzIGNoYXJ0ZXJl ZCB0byBhZGRyZXNzIHRoZSBwcm9ibGVtcyB3aXRoIGxhcmdlIHVubWFuYWdlZDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFdHKSB3YXMgY2hhcnRlcmVkIHRvIGFkZHJlc3MgdGhl IHByb2JsZW1zIHdpdGggbGFyZ2UgdW5tYW5hZ2VkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgYnVmZmVycyBpbiB0aGUgSW50ZXJuZXQuICBTcGVjaWZpY2FsbHksIHRoZSBBUU0gV0cg aXMgdGFza2VkIHdpdGg8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBidWZmZXJz IGluIHRoZSBJbnRlcm5ldC4gIFNwZWNpZmljYWxseSwgdGhlIEFRTSBXRyBpcyB0YXNrZWQgd2l0 aDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHN0YW5kYXJkaXppbmcgQVFNIHNjaGVt ZXMgdGhhdCBub3Qgb25seSBhZGRyZXNzIGNvbmNlcm5zIHdpdGggc3VjaDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIHN0YW5kYXJkaXppbmcgQVFNIHNjaGVtZXMgdGhhdCBub3Qg b25seSBhZGRyZXNzIGNvbmNlcm5zIHdpdGggc3VjaDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIGJ1ZmZlcnMsIGJ1dCBhbHNvIGFyZSByb2J1c3QgdW5kZXIgYSB3aWRlIHZhcmlldHkg b2Ygb3BlcmF0aW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYnVmZmVycywg YnV0IGFsc28gYXJlIHJvYnVzdCB1bmRlciBhIHdpZGUgdmFyaWV0eSBvZiBvcGVyYXRpbmc8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb25kaXRpb25zLiAgVGhpcyBkb2N1bWVudCBw cm92aWRlcyBjaGFyYWN0ZXJpemF0aW9uIGd1aWRlbGluZXMgdGhhdDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGNvbmRpdGlvbnMuICBUaGlzIGRvY3VtZW50IHByb3ZpZGVzIGNo YXJhY3Rlcml6YXRpb24gZ3VpZGVsaW5lcyB0aGF0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAxOCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgY2FuIGJlIHVz ZWQgdG8gYXNzZXNzIHRoZSBkZXBsb3lhYmlsaXR5IG9mIGFuIEFRTSwgd2hldGhlciBpdCBpczwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBjYW4gYmUgdXNlZCB0byBhc3Nlc3Mg dGhlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmFwcGxpY2FiaWxpdHksIHBlcmZvcm1hbmNlIGFuZDwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGNhbmRpZGF0ZSBmb3Igc3Rh bmRhcmRpemF0aW9uIGF0IElFVEYgb3Igbm90LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICBkZXBsb3lhYmlsaXR5IG9mIGFuIEFRTSwgd2hldGhlciBpdCBpcyBjYW5kaWRhdGUg Zm9yIHN0YW5kYXJkaXphdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGF0IElFVEYgb3Igbm90LjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMTkiPjx0 ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPltSRkM3NTY3XSBzZXBhcmF0ZWx5IGRl c2NyaWJlcyB0aGU8L3NwYW4+IEFRTSBhbGdvcml0aG0gaW1wbGVtZW50ZWQgaW4gYTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBBUU0gYWxnb3JpdGhtIGltcGxlbWVudGVkIGlu IGEgcm91dGVyIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmNhbiBiZSBzZXBhcmF0ZWQ8L3NwYW4+IGZy b20gdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICByb3V0ZXIgZnJvbSB0aGUg c2NoZWR1bGluZyBvZiBwYWNrZXRzIHNlbnQgYnkgdGhlIDxzcGFuIGNsYXNzPSJkZWxldGUiPnJv dXRlci48L3NwYW4+ICBUaGUgcmVzdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBzY2hlZHVsaW5nIG9mIHBhY2tldHMgc2VudCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5vdXQ8L3Nw YW4+IGJ5IHRoZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yb3V0ZXIgYXMgZGlzY3Vzc2VkIGluIHRo ZSBBUU08L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBvZiB0aGlzIG1l bW8gcmVmZXJzIHRvIHRoZSBBUU0gYXMgYSBkcm9wcGluZy9tYXJraW5nIHBvbGljeSBhcyBhPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIHJl Y29tbWVuZGF0aW9ucyBkb2N1bWVudCBbUkZDNzU2N10uPC9zcGFuPiAgVGhlIHJlc3Qgb2YgdGhp cyBtZW1vIHJlZmVycyB0bzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgc2VwYXJh dGUgZmVhdHVyZSB0byBhbnkgaW50ZXJmYWNlIHNjaGVkdWxpbmcgc2NoZW1lLiAgVGhpcyBkb2N1 bWVudDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICB0aGUgQVFNIGFzIGEgZHJv cHBpbmcvbWFya2luZyBwb2xpY3kgYXMgYSBzZXBhcmF0ZSBmZWF0dXJlIHRvIGFueTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgbWF5IGJlIGNvbXBsZW1lbnRlZCB3aXRoIGFub3Ro ZXIgb25lIG9uIGd1aWRlbGluZXMgZm9yIGFzc2Vzc2luZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBpbnRlcmZhY2Ugc2NoZWR1bGluZyBzY2hlbWUuICBUaGlzIGRvY3VtZW50 IG1heSBiZSBjb21wbGVtZW50ZWQgd2l0aDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgY29tYmluYXRpb24gb2YgcGFja2V0IHNjaGVkdWxpbmcgYW5kIEFRTS4gIFdlIG5vdGUgdGhh dCBzdWNoIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgYW5vdGhlciBvbmUg b24gZ3VpZGVsaW5lcyBmb3IgYXNzZXNzaW5nIGNvbWJpbmF0aW9uIG9mIHBhY2tldDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZG9jdW1lbnQgd2lsbCBpbmhlcml0IGFsbCB0aGUg Z3VpZGVsaW5lcyBmcm9tIHRoaXMgZG9jdW1lbnQgcGx1cyBhbnk8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+ICAgc2NoZWR1bGluZyBhbmQgQVFNLiAgV2Ugbm90ZSB0aGF0IHN1Y2gg YSBkb2N1bWVudCB3aWxsIGluaGVyaXQgYWxsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICBhZGRpdGlvbmFsIHNjZW5hcmlvcyByZWxldmFudCBmb3IgcGFja2V0IHNjaGVkdWxpbmcg c3VjaCBhcyBmbG93PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHRoZSBndWlk ZWxpbmVzIGZyb20gdGhpcyBkb2N1bWVudCBwbHVzIGFueSBhZGRpdGlvbmFsIHNjZW5hcmlvczwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgc3RhcnZhdGlvbiBldmFsdWF0aW9uIG9y IGltcGFjdCBvZiB0aGUgbnVtYmVyIG9mIGhhc2ggYnVja2V0cy48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+ICAgcmVsZXZhbnQgZm9yIHBhY2tldCBzY2hlZHVsaW5nIHN1Y2ggYXMg ZmxvdyBzdGFydmF0aW9uIGV2YWx1YXRpb24gb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBpbXBhY3Qgb2YgdGhlIG51 bWJlciBvZiBoYXNoIGJ1Y2tldHMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAyMCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+MS4xLiAgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+R29hbHMgb2YgdGhpcyBkb2N1bWVuPC9zcGFuPnQ8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+MS4xLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+UmVkdWNpbmcgdGhl IGxhdGVuY3kgYW5kIG1heGltaXppbmcgdGhlIGdvb2RwdTwvc3Bhbj50PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIHRyYWRlLW9mZiBiZXR3ZWVuIHJlZHVjaW5nIHRo ZSBsYXRlbmN5IGFuZCBtYXhpbWl6aW5nIHRoZSBnb29kcHV0PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgVGhlIHRyYWRlLW9mZiBiZXR3ZWVuIHJlZHVjaW5nIHRoZSBsYXRlbmN5 IGFuZCBtYXhpbWl6aW5nIHRoZSBnb29kcHV0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgaXMgaW50cmluc2ljYWxseSBsaW5rZWQgdG8gZWFjaCBBUU0gc2NoZW1lIGFuZCBpcyBrZXkg dG8gZXZhbHVhdGluZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGlzIGludHJp bnNpY2FsbHkgbGlua2VkIHRvIGVhY2ggQVFNIHNjaGVtZSBhbmQgaXMga2V5IHRvIGV2YWx1YXRp bmc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYw MDIxIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj4gICBpdHMgcGVyZm9ybWFuY2UuICA8c3BhbiBjbGFzcz0iZGVsZXRl Ij5XaGVuZXZlciBwb3NzaWJsZSwgc29sdXRpb25zIG91Z2h0IHRvIGFpbSBhdCBib3RoPC9zcGFu PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBpdHMgcGVyZm9ybWFuY2UuICA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij5Ubzwvc3Bhbj4gZW5zdXJlIHRoZSBzYWZldHkgZGVwbG95bWVu dCBvZiBhbiBBUU0sIGl0czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xh c3M9ImRlbGV0ZSI+ICAgbWF4aW1pemluZyBnb29kcHV0IGFuZCBtaW5pbWl6aW5nIGxhdGVuY3ku ICBNb3Jlb3ZlciwgdG88L3NwYW4+IGVuc3VyZSB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgYmVoYXZpb3VyIHNob3VsZCBiZSBhc3Nlc3NlZCBpbiBhIHZhcmlldHkgb2Yg c2NlbmFyaW9zLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+V2hlbmV2ZXI8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBzYWZldHkgZGVwbG95bWVudCBvZiBhbiBBUU0sIGl0 cyBiZWhhdmlvdXIgc2hvdWxkIGJlIGFzc2Vzc2VkIGluIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgcG9zc2libGUsIHNvbHV0aW9ucyBv dWdodCB0byBhaW0gYXQgYm90aCBtYXhpbWl6aW5nIGdvb2RwdXQgYW5kPC9zcGFuPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdmFyaWV0eSBvZiBzY2VuYXJpb3MuPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIG1pbmltaXpp bmcgbGF0ZW5jeS48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjEuMi4gIEdvYWxzIG9mIHRoaXMgZG9jdW1lbnQ8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhpcyBkb2N1bWVu dCByZWNvbW1lbmRzIGEgZ2VuZXJpYyBsaXN0IG9mIHNjZW5hcmlvcyBhZ2FpbnN0IHdoaWNoIGFu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhpcyBkb2N1bWVudCByZWNvbW1l bmRzIGEgZ2VuZXJpYyBsaXN0IG9mIHNjZW5hcmlvcyBhZ2FpbnN0IHdoaWNoIGFuPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgQVFNIHByb3Bvc2FsIHNob3VsZCBiZSBldmFsdWF0ZWQs IGNvbnNpZGVyaW5nIGJvdGggcG90ZW50aWFsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgQVFNIHByb3Bvc2FsIHNob3VsZCBiZSBldmFsdWF0ZWQsIGNvbnNpZGVyaW5nIGJvdGgg cG90ZW50aWFsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcGVyZm9ybWFuY2UgZ2Fp biBhbmQgc2FmZXR5IG9mIGRlcGxveW1lbnQuICBUaGUgZ3VpZGVsaW5lcyBoZWxwIHRvPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcGVyZm9ybWFuY2UgZ2FpbiBhbmQgc2FmZXR5 IG9mIGRlcGxveW1lbnQuICBUaGUgZ3VpZGVsaW5lcyBoZWxwIHRvPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgcXVhbnRpZnkgcGVyZm9ybWFuY2Ugb2YgQVFNIHNjaGVtZXMgaW4gdGVy bXMgb2YgbGF0ZW5jeSByZWR1Y3Rpb24sPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgcXVhbnRpZnkgcGVyZm9ybWFuY2Ugb2YgQVFNIHNjaGVtZXMgaW4gdGVybXMgb2YgbGF0ZW5j eSByZWR1Y3Rpb24sPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZ29vZHB1dCBtYXhp bWl6YXRpb24gYW5kIHRoZSB0cmFkZS1vZmYgYmV0d2VlbiB0aGVzZSB0d28uICBUaGU8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBnb29kcHV0IG1heGltaXphdGlvbiBhbmQgdGhl IHRyYWRlLW9mZiBiZXR3ZWVuIHRoZXNlIHR3by4gIFRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGRvY3VtZW50IHByZXNlbnRzIGNlbnRyYWwgYXNwZWN0cyBvZiBhbiBBUU0gYWxn b3JpdGhtIHRoYXQgc2hvdWxkIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ZG9jdW1lbnQgcHJlc2VudHMgY2VudHJhbCBhc3BlY3RzIG9mIGFuIEFRTSBhbGdvcml0aG0gdGhh dCBzaG91bGQgYmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb25zaWRlcmVkIHdo YXRldmVyIHRoZSBjb250ZXh0LCBzdWNoIGFzIGJ1cnN0IGFic29ycHRpb24gY2FwYWNpdHksPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY29uc2lkZXJlZCB3aGF0ZXZlciB0aGUg Y29udGV4dCwgc3VjaCBhcyBidXJzdCBhYnNvcnB0aW9uIGNhcGFjaXR5LDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIFJUVCBmYWlybmVzcyBvciByZXNpbGllbmNlIHRvIGZsdWN0dWF0 aW5nIG5ldHdvcmsgY29uZGl0aW9ucy4gIFRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIFJUVCBmYWlybmVzcyBvciByZXNpbGllbmNlIHRvIGZsdWN0dWF0aW5nIG5ldHdvcmsg Y29uZGl0aW9ucy4gIFRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGd1aWRlbGlu ZXMgYWxzbyBkaXNjdXNzIG1ldGhvZHMgdG8gdW5kZXJzdGFuZCB0aGUgdmFyaW91cyBhc3BlY3Rz PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZ3VpZGVsaW5lcyBhbHNvIGRpc2N1 c3MgbWV0aG9kcyB0byB1bmRlcnN0YW5kIHRoZSB2YXJpb3VzIGFzcGVjdHM8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBhc3NvY2lhdGVkIHdpdGggc2FmZWx5IGRlcGxveWluZyBhbmQg b3BlcmF0aW5nIHRoZSBBUU0gc2NoZW1lLiAgVGh1cyw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBhc3NvY2lhdGVkIHdpdGggc2FmZWx5IGRlcGxveWluZyBhbmQgb3BlcmF0aW5n IHRoZSBBUU0gc2NoZW1lLiAgVGh1cyw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBv bmUgb2YgdGhlIGtleSBvYmplY3RpdmVzIGJlaGluZCBmb3JtdWxhdGluZyB0aGUgZ3VpZGVsaW5l cyBpcyB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9uZSBvZiB0aGUga2V5 IG9iamVjdGl2ZXMgYmVoaW5kIGZvcm11bGF0aW5nIHRoZSBndWlkZWxpbmVzIGlzIHRvPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaGVscCBhc2NlcnRhaW4gd2hldGhlciBhIHNwZWNp ZmljIEFRTSBpcyBub3Qgb25seSBiZXR0ZXIgdGhhbiBkcm9wLTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIGhlbHAgYXNjZXJ0YWluIHdoZXRoZXIgYSBzcGVjaWZpYyBBUU0gaXMg bm90IG9ubHkgYmV0dGVyIHRoYW4gZHJvcC08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICB0YWlsIChpLmUuIHdpdGhvdXQgQVFNIGFuZCB3aXRoIGEgQkRQLXNpemVkIGJ1ZmZlcikgYnV0 IGFsc28gc2FmZSB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRhaWwgKGku ZS4gd2l0aG91dCBBUU0gYW5kIHdpdGggYSBCRFAtc2l6ZWQgYnVmZmVyKSBidXQgYWxzbyBzYWZl IHRvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZGVwbG95OiB0aGUgZ3VpZGVsaW5l cyBjYW4gYmUgdXNlZCB0byBjb21wYXJlIHNldmVyYWwgQVFNIHByb3Bvc2FsczwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRlcGxveTogdGhlIGd1aWRlbGluZXMgY2FuIGJlIHVz ZWQgdG8gY29tcGFyZSBzZXZlcmFsIEFRTSBwcm9wb3NhbHM8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDIyIj48dGQ+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICB3aXRo IGVhY2ggb3RoZXIsIDxzcGFuIGNsYXNzPSJkZWxldGUiPmFuZDwvc3Bhbj4gc2hvdWxkIGJlIHVz ZWQgdG8gY29tcGFyZSBhIHByb3Bvc2FsIHdpdGggZHJvcC08L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+ICAgd2l0aCBlYWNoIG90aGVyLCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5idXQ8 L3NwYW4+IHNob3VsZCBiZSB1c2VkIHRvIGNvbXBhcmUgYSBwcm9wb3NhbCB3aXRoIGRyb3AtPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGFpbC48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICB0YWlsLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMjMiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UaGlzIG1lbW8gZGV0YWls cyBnZW5lcmljIGNoYXJhY3Rlcml6YXRpb24gc2NlbmFyaW9zIGFnYWluc3Qgd2hpY2g8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgYW55IEFRTSBwcm9wb3NhbCBzaG91bGQg YmUgZXZhbHVhdGVkLCBpcnJlc3BlY3RpdmUgb2Ygd2hldGhlciBvciBub3Q8L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgYW4gQVFNIGlzIHN0YW5kYXJkaXplZCBieSB0aGUg SUVURi4gIFRoaXMgZG9jdW1lbnRzIHJlY29tbWVuZHMgdGhlPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFu IGNsYXNzPSJpbnNlcnQiPiAgIHJlbGV2YW50IHNjZW5hcmlvcyBhbmQgbWV0cmljcyB0byBiZSBj b25zaWRlcmVkLiAgVGhlIGRvY3VtZW50PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgIHByZXNlbnRzIGNlbnRyYWwgYXNwZWN0cyBvZiBhbiBBUU0gYWxnb3JpdGhtIHRoYXQg c2hvdWxkIGJlPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIGNvbnNpZGVy ZWQgd2hhdGV2ZXIgdGhlIGNvbnRleHQsIHN1Y2ggYXMgYnVyc3QgYWJzb3JwdGlvbiBjYXBhY2l0 eSw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgUlRUIGZhaXJuZXNzIG9y IHJlc2lsaWVuY2UgdG8gZmx1Y3R1YXRpbmcgbmV0d29yayBjb25kaXRpb25zLjwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhl c2UgZ3VpZGVsaW5lcyBkbyBub3QgZGVmaW5lIGFuZCBhcmUgbm90IGJvdW5kIHRvIGEgcGFydGlj dWxhcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZXNlIGd1aWRlbGluZXMg ZG8gbm90IGRlZmluZSBhbmQgYXJlIG5vdCBib3VuZCB0byBhIHBhcnRpY3VsYXI8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDI0Ij48dGQ+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICA8c3BhbiBjbGFzcz0iZGVsZXRlIj5lbnZpcm9ubWVudDwvc3Bhbj4gb3IgZXZhbHVh dGlvbiB0b29sc2V0LiAgSW5zdGVhZCB0aGUgZ3VpZGVsaW5lcyBjYW4gYmU8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xhc3M9Imluc2VydCI+ZGVwbG95bWVudCBz Y2VuYXJpbzwvc3Bhbj4gb3IgZXZhbHVhdGlvbiB0b29sc2V0LiAgSW5zdGVhZCB0aGUgZ3VpZGVs aW5lczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdXNlZCB0byBhc3NlcnQgdGhl IHBvdGVudGlhbCBnYWluIG9mIGludHJvZHVjaW5nIGFuIEFRTSBmb3IgdGhlPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGNhbiBiZSB1c2VkIHRvIGFzc2VydCB0aGUgcG90ZW50 aWFsIGdhaW4gb2YgaW50cm9kdWNpbmcgYW4gQVFNIGZvcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgcGFydGljdWxhciBlbnZpcm9ubWVudCwgd2hpY2ggaXMgb2YgaW50ZXJlc3Qg dG8gdGhlIHRlc3RlcnMuICBUaGVzZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICB0aGUgcGFydGljdWxhciBlbnZpcm9ubWVudCwgd2hpY2ggaXMgb2YgaW50ZXJlc3QgdG8gdGhl IHRlc3RlcnMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBndWlkZWxpbmVzIGRv IG5vdCBjb3ZlciBldmVyeSBwb3NzaWJsZSBhc3BlY3Qgb2YgYSBwYXJ0aWN1bGFyPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFRoZXNlIGd1aWRlbGluZXMgZG8gbm90IGNvdmVy IGV2ZXJ5IHBvc3NpYmxlIGFzcGVjdCBvZiBhIHBhcnRpY3VsYXI8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBhbGdvcml0aG0uICBUaGVzZSBndWlkZWxpbmVzIGRvIG5vdCBwcmVzZW50 IGNvbnRleHQtZGVwZW5kZW50PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYWxn b3JpdGhtLiAgVGhlc2UgZ3VpZGVsaW5lcyBkbyBub3QgcHJlc2VudCBjb250ZXh0LWRlcGVuZGVu dDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHNjZW5hcmlvcyAoc3VjaCBhcyA4MDIu MTEgV0xBTnMsIGRhdGEtY2VudGVycyBvciBydXJhbCBicm9hZGJhbmQ8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBzY2VuYXJpb3MgKHN1Y2ggYXMgODAyLjExIFdMQU5zLCBkYXRh LWNlbnRlcnMgb3IgcnVyYWwgYnJvYWRiYW5kPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgbmV0d29ya3MpLiAgVG8ga2VlcCB0aGUgZ3VpZGVsaW5lcyBnZW5lcmljLCBhIG51bWJlciBv ZiBwb3RlbnRpYWw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBuZXR3b3Jrcyku ICBUbyBrZWVwIHRoZSBndWlkZWxpbmVzIGdlbmVyaWMsIGEgbnVtYmVyIG9mIHBvdGVudGlhbDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHJvdXRlciBjb21wb25lbnRzIGFuZCBhbGdv cml0aG1zIChzdWNoIGFzIERpZmZTZXJ2KSBhcmUgb21pdHRlZC48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICByb3V0ZXIgY29tcG9uZW50cyBhbmQgYWxnb3JpdGhtcyAoc3VjaCBh cyBEaWZmU2VydikgYXJlIG9taXR0ZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgVGhlIGdvYWxzIG9mIHRoaXMgZG9jdW1lbnQgY2FuIHRodXMgYmUgc3VtbWFyaXplZCBh cyBmb2xsb3dzOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBnb2FscyBv ZiB0aGlzIGRvY3VtZW50IGNhbiB0aHVzIGJlIHN1bW1hcml6ZWQgYXMgZm9sbG93czo8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBUaGUgcHJlc2VudCBjaGFyYWN0ZXJp emF0aW9uIGd1aWRlbGluZXMgcHJvdmlkZSBhIG5vbi1leGhhdXN0aXZlPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgVGhlIHByZXNlbnQgY2hhcmFjdGVyaXphdGlvbiBndWlk ZWxpbmVzIHByb3ZpZGUgYSBub24tZXhoYXVzdGl2ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgIGxpc3Qgb2Ygc2NlbmFyaW9zIHRvIGhlbHAgYXNjZXJ0YWluIHdoZXRoZXIgYW4g QVFNIGlzIG5vdCBvbmx5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgbGlz dCBvZiBzY2VuYXJpb3MgdG8gaGVscCBhc2NlcnRhaW4gd2hldGhlciBhbiBBUU0gaXMgbm90IG9u bHk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBiZXR0ZXIgdGhhbiBkcm9wLXRh aWwgKHdpdGggYSBCRFAtc2l6ZWQgYnVmZmVyKSwgYnV0IGFsc28gc2FmZSB0bzwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGJldHRlciB0aGFuIGRyb3AtdGFpbCAod2l0aCBh IEJEUC1zaXplZCBidWZmZXIpLCBidXQgYWxzbyBzYWZlIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJwYXJ0LTIiIGNsYXNzPSJjaGFuZ2Ui Pjx0ZD48L3RkPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVm PSIjcGFydC0yIj48ZW0+IHBhZ2UgNiwgbGluZSAxMjxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3Nw YW4+PC9lbT48L2E+PC90aD48dGg+IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2Ug YXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTIiPjxlbT4gcGFnZSA2LCBsaW5lIDI0PHNwYW4gY2xh c3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBwYXJ0aWN1 bGFyIGV2YWx1YXRpb24gdG9vbHNldCBhbmQgKDIpIGNhbiBiZSB1c2VkIGZvciB2YXJpb3VzPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgcGFydGljdWxhciBldmFsdWF0aW9u IHRvb2xzZXQgYW5kICgyKSBjYW4gYmUgdXNlZCBmb3IgdmFyaW91czwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgICAgIGRlcGxveW1lbnQgY29udGV4dHM7IHRlc3RlcnMgYXJlIGZyZWUg dG8gc2VsZWN0IGEgdG9vbHNldCB0aGF0IGlzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgICAgZGVwbG95bWVudCBjb250ZXh0czsgdGVzdGVycyBhcmUgZnJlZSB0byBzZWxlY3Qg YSB0b29sc2V0IHRoYXQgaXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBiZXN0 IHN1aXRlZCBmb3IgdGhlIGVudmlyb25tZW50IGluIHdoaWNoIHRoZWlyIHByb3Bvc2FsIHdpbGwg YmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBiZXN0IHN1aXRlZCBmb3Ig dGhlIGVudmlyb25tZW50IGluIHdoaWNoIHRoZWlyIHByb3Bvc2FsIHdpbGwgYmU8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBkZXBsb3llZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICBkZXBsb3llZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBvICBUaGUgcHJlc2VudCBjaGFyYWN0ZXJpemF0aW9uIGd1aWRlbGluZXMgYXJlIGlu dGVuZGVkIHRvIHByb3ZpZGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBU aGUgcHJlc2VudCBjaGFyYWN0ZXJpemF0aW9uIGd1aWRlbGluZXMgYXJlIGludGVuZGVkIHRvIHBy b3ZpZGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBndWlkYW5jZSBmb3IgYmV0 dGVyIHNlbGVjdGluZyBhbiBBUU0gZm9yIGEgc3BlY2lmaWMgZW52aXJvbm1lbnQ7PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgZ3VpZGFuY2UgZm9yIGJldHRlciBzZWxlY3Rp bmcgYW4gQVFNIGZvciBhIHNwZWNpZmljIGVudmlyb25tZW50OzwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgIGl0IGlzIG5vdCByZXF1aXJlZCB0aGF0IGFuIEFRTSBwcm9wb3NhbCBp cyBldmFsdWF0ZWQgZm9sbG93aW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgaXQgaXMgbm90IHJlcXVpcmVkIHRoYXQgYW4gQVFNIHByb3Bvc2FsIGlzIGV2YWx1YXRlZCBm b2xsb3dpbmc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB0aGVzZSBndWlkZWxp bmVzIGZvciBpdHMgc3RhbmRhcmRpemF0aW9uLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgIHRoZXNlIGd1aWRlbGluZXMgZm9yIGl0cyBzdGFuZGFyZGl6YXRpb24uPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAy NSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+MS48c3BhbiBjbGFzcz0iZGVsZXRlIj4yPC9zcGFuPi4gIFJlcXVpcmVt ZW50cyBMYW5ndWFnZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4xLjxzcGFuIGNs YXNzPSJpbnNlcnQiPjM8L3NwYW4+LiAgUmVxdWlyZW1lbnRzIExhbmd1YWdlPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIGtleSB3b3JkcyAiTVVTVCIsICJNVVNUIE5P VCIsICJSRVFVSVJFRCIsICJTSEFMTCIsICJTSEFMTCBOT1QiLDwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAiUkVRVUlS RUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAiU0hPVUxEIiwgIlNIT1VMRCBOT1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZIiwgYW5kICJPUFRJ T05BTCIgaW4gdGhpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICJTSE9VTEQi LCAiU0hPVUxEIE5PVCIsICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0 aGlzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZG9jdW1lbnQgYXJlIHRvIGJlIGlu dGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBSRkMgMjExOSBbUkZDMjExOV0uPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFz IGRlc2NyaWJlZCBpbiBSRkMgMjExOSBbUkZDMjExOV0uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAyNiI+PHRkPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+MS48 c3BhbiBjbGFzcz0iZGVsZXRlIj4zPC9zcGFuPi4gIEdsb3NzYXJ5PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPjEuPHNwYW4gY2xhc3M9Imluc2VydCI+NDwvc3Bhbj4uICBHbG9zc2Fy eTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0i ZGlmZjAwMjciPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIG8gIEFRTTogPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W1JG Qzc1NjddIHNlcGFyYXRlbHkgZGVzY3JpYmVzPC9zcGFuPiB0aGUgQWN0aXZlIFF1ZXVlIE1hbmFn bWVudDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBvICA8c3BhbiBjbGFzcz0i aW5zZXJ0Ij5hcHBsaWNhdGlvbi1saW1pdGVkIHRyYWZmaWM6IGEgdHlwZSBvZiB0cmFmZmljIHRo YXQgZG9lcyBub3QgaGF2ZTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg ICAgIChBUU0pIGFsZ29yaXRobSBpbXBsZW1lbnRlZCBpbiBhIHJvdXRlciBmcm9tIHRoZSBzY2hl ZHVsaW5nIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJp bnNlcnQiPiAgICAgIGFuIHVubGltaXRlZCBhbW91bnQgb2YgZGF0YSB0byB0cmFuc21pdC48L3Nw YW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICBwYWNrZXRzIHNlbnQgYnkg dGhlIHJvdXRlci4gIFRoZSByZXN0IG9mIHRoaXMgbWVtbyByZWZlcnMgdG8gdGhlPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIEFRTSBhcyBhIDxzcGFuIGNsYXNzPSJk ZWxldGUiPmRyb3BwaW5nL21hcmtpbmc8L3NwYW4+IHBvbGljeSBhcyBhIHNlcGFyYXRlIGZlYXR1 cmUgdG8gYW55PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJp bnNlcnQiPiAgIG88L3NwYW4+ICBBUU06IHRoZSBBY3RpdmUgUXVldWUgTWFuYWdtZW50IChBUU0p IGFsZ29yaXRobSBpbXBsZW1lbnRlZCBpbiBhPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICAgICBpbnRlcmZhY2Ugc2NoZWR1bGluZyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5zY2hlbWUu PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICByb3V0ZXIgPHNw YW4gY2xhc3M9Imluc2VydCI+Y2FuIGJlIHNlcGFyYXRlZDwvc3Bhbj4gZnJvbSB0aGUgc2NoZWR1 bGluZyBvZiBwYWNrZXRzIHNlbnQgYnkgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgcm91dGVyLiAgVGhlIHJl c3Qgb2YgdGhpcyBtZW1vIHJlZmVycyB0byB0aGUgQVFNIGFzIGEgPHNwYW4gY2xhc3M9Imluc2Vy dCI+ZHJvcHBpbmcvPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIG1h cmtpbmc8L3NwYW4+IHBvbGljeSBhcyBhIHNlcGFyYXRlIGZlYXR1cmUgdG8gYW55IGludGVyZmFj ZSBzY2hlZHVsaW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgPHNwYW4gY2xhc3M9Imluc2VydCI+c2NoZW1lIFtS RkM3NTY3XS48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIG8gIEJEUDogQmFuZHdpZHRoIERlbGF5IFByb2R1 Y3QuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIGJ1ZmZl cjogYSBwaHlzaWNhbCB2b2x1bWUgb2YgbWVtb3J5IGluIHdoaWNoIGEgcXVldWUgb3Igc2V0IG9m PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgYnVmZmVyOiBhIHBoeXNpY2Fs IHZvbHVtZSBvZiBtZW1vcnkgaW4gd2hpY2ggYSBxdWV1ZSBvciBzZXQgb2Y8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBxdWV1ZXMgYXJlIHN0b3JlZC48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBxdWV1ZXMgYXJlIHN0b3JlZC48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBidWZmZXIgb2NjdXBhbmN5OiBhbW91bnQgb2YgZGF0 YSB0aGF0IGFyZSBzdG9yZWQgaW4gYSBidWZmZXIsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgbyAgYnVmZmVyIG9jY3VwYW5jeTogYW1vdW50IG9mIGRhdGEgdGhhdCBhcmUgc3Rv cmVkIGluIGEgYnVmZmVyLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIG1lYXN1 cmVkIGluIGJ5dGVzIG9yIHBhY2tldHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgICAgbWVhc3VyZWQgaW4gYnl0ZXMgb3IgcGFja2V0cy48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBvICBidWZmZXIgc2l6ZTogbWF4aW11bSBidWZmZXIgb2NjdXBhbmN5 LCB0aGF0IGlzIHRoZSBtYXhpbXVtIGFtb3VudDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIG8gIGJ1ZmZlciBzaXplOiBtYXhpbXVtIGJ1ZmZlciBvY2N1cGFuY3ksIHRoYXQgaXMg dGhlIG1heGltdW0gYW1vdW50PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgb2Yg ZGF0YSB0aGF0IG1heSBiZSBzdG9yZWQgaW4gYSBidWZmZXIsIG1lYXN1cmVkIGluIGJ5dGVzIG9y PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgb2YgZGF0YSB0aGF0IG1heSBi ZSBzdG9yZWQgaW4gYSBidWZmZXIsIG1lYXN1cmVkIGluIGJ5dGVzIG9yPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgICAgcGFja2V0cy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAgICBwYWNrZXRzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMjgiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5vICBJVzEwOiBUQ1AgaW5p dGlhbCBjb25nZXN0aW9uIHdpbmRvdyBzZXQgdG8gMTAgcGFja2V0cy48L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQi PiAgIG8gIGxhdGVuY3k6IG9uZS13YXkgZGVsYXkgb2YgcGFja2V0cyBhY3Jvc3MgSW50ZXJuZXQg cGF0aHMuICBUaGlzPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIGRl ZmluaXRpb24gc3VpdHMgdHJhbnNwb3J0IGxheWVyIGRlZmluaXRpb24gb2YgdGhlIGxhdGVuY3ks IHRoYXQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgc2hhbGwgbm90 IGJlIGNvbmZ1c2VkIHdpdGggYW4gYXBwbGljYXRpb24gbGF5ZXIgdmlldyBvZiB0aGU8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgbGF0ZW5jeS48L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIGdv b2RwdXQ6IGdvb2RwdXQgaXMgZGVmaW5lZCBhcyB0aGUgbnVtYmVyIG9mIGJpdHMgcGVyIHVuaXQg b2YgdGltZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIGdvb2RwdXQ6IGdv b2RwdXQgaXMgZGVmaW5lZCBhcyB0aGUgbnVtYmVyIG9mIGJpdHMgcGVyIHVuaXQgb2YgdGltZTwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIGZvcndhcmRlZCB0byB0aGUgY29ycmVj dCBkZXN0aW5hdGlvbiBtaW51cyBhbnkgYml0cyBsb3N0IG9yPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgICAgZm9yd2FyZGVkIHRvIHRoZSBjb3JyZWN0IGRlc3RpbmF0aW9uIG1p bnVzIGFueSBiaXRzIGxvc3Qgb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHIgaWQ9ImRpZmYwMDI5Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICByZXRyYW5zbWl0dGVkIFtS RkMyNjQ3XS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgcmV0cmFuc21p dHRlZCBbUkZDMjY0N10uICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UaGUgZ29vZHB1dCBzaG91bGQg YmUgZGV0ZXJtaW5lZCBmb3I8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAg ICAgZWFjaCBmbG93IGFuZCBub3QgZm9yIGFnZ3JlZ2F0ZXMgb2YgZmxvd3MuPC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIFNRUlQ6IHRoZSBzcXVhcmUgcm9v dCBmdW5jdGlvbi48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBTUVJUOiB0 aGUgc3F1YXJlIHJvb3QgZnVuY3Rpb24uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgbyAgUk9VTkQ6IHRoZSByb3VuZCBmdW5jdGlvbi48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICBvICBST1VORDogdGhlIHJvdW5kIGZ1bmN0aW9uLjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjIuICBFbmQtdG8tZW5kIG1ldHJpY3M8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4yLiAgRW5kLXRvLWVuZCBtZXRyaWNzPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgRW5kLXRvLWVuZCBkZWxheSBpcyB0aGUgcmVzdWx0IG9m IHByb3BhZ2F0aW9uIGRlbGF5LCBzZXJpYWxpemF0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgRW5kLXRvLWVuZCBkZWxheSBpcyB0aGUgcmVzdWx0IG9mIHByb3BhZ2F0aW9u IGRlbGF5LCBzZXJpYWxpemF0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZGVs YXksIHNlcnZpY2UgZGVsYXkgaW4gYSBzd2l0Y2gsIG1lZGl1bS1hY2Nlc3MgZGVsYXkgYW5kIHF1 ZXVpbmc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBkZWxheSwgc2VydmljZSBk ZWxheSBpbiBhIHN3aXRjaCwgbWVkaXVtLWFjY2VzcyBkZWxheSBhbmQgcXVldWluZzwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRlbGF5LCBzdW1tZWQgb3ZlciB0aGUgbmV0d29yayBl bGVtZW50cyBhbG9uZyB0aGUgcGF0aC4gIEFRTSBzY2hlbWVzPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgZGVsYXksIHN1bW1lZCBvdmVyIHRoZSBuZXR3b3JrIGVsZW1lbnRzIGFs b25nIHRoZSBwYXRoLiAgQVFNIHNjaGVtZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9InBhcnQtMyIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+ PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTMi PjxlbT4gcGFnZSA3LCBsaW5lIDE5PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwv YT48L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+ PGEgaHJlZj0iI3BhcnQtMyI+PGVtPiBwYWdlIDcsIGxpbmUgNDQ8c3BhbiBjbGFzcz0iaGlkZSI+ IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFNvbWUgbWV0cmljcyBsaXN0ZWQg aW4gdGhpcyBzZWN0aW9uIGFyZSBub3Qgc3VpdGVkIHRvIGV2ZXJ5IHR5cGUgb2Y8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBTb21lIG1ldHJpY3MgbGlzdGVkIGluIHRoaXMgc2Vj dGlvbiBhcmUgbm90IHN1aXRlZCB0byBldmVyeSB0eXBlIG9mPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgdHJhZmZpYyBkZXRhaWxlZCBpbiB0aGUgcmVzdCBvZiB0aGlzIGRvY3VtZW50 LiAgSXQgaXMgdGhlcmVmb3JlIG5vdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IHRyYWZmaWMgZGV0YWlsZWQgaW4gdGhlIHJlc3Qgb2YgdGhpcyBkb2N1bWVudC4gIEl0IGlzIHRo ZXJlZm9yZSBub3Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBuZWNlc3NhcnkgdG8g bWVhc3VyZSBhbGwgb2YgdGhlIGZvbGxvd2luZyBtZXRyaWNzOiB0aGUgY2hvc2VuIG1ldHJpYzwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG5lY2Vzc2FyeSB0byBtZWFzdXJlIGFs bCBvZiB0aGUgZm9sbG93aW5nIG1ldHJpY3M6IHRoZSBjaG9zZW4gbWV0cmljPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgbWF5IG5vdCBiZSByZWxldmFudCB0byB0aGUgY29udGV4dCBv ZiB0aGUgZXZhbHVhdGlvbiBzY2VuYXJpbyAoZS5nLiw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBtYXkgbm90IGJlIHJlbGV2YW50IHRvIHRoZSBjb250ZXh0IG9mIHRoZSBldmFs dWF0aW9uIHNjZW5hcmlvIChlLmcuLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGxh dGVuY3kgdnMuIGdvb2RwdXQgdHJhZGUtb2ZmIGluIGFwcGxpY2F0aW9uLWxpbWl0ZWQgdHJhZmZp YzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGxhdGVuY3kgdnMuIGdvb2RwdXQg dHJhZGUtb2ZmIGluIGFwcGxpY2F0aW9uLWxpbWl0ZWQgdHJhZmZpYzwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHNjZW5hcmlvcykuICBHdWlkYW5jZSBpcyBwcm92aWRlZCBmb3IgZWFj aCBtZXRyaWMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgc2NlbmFyaW9zKS4g IEd1aWRhbmNlIGlzIHByb3ZpZGVkIGZvciBlYWNoIG1ldHJpYy48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4yLjEuICBGbG93IGNvbXBsZXRpb24gdGltZTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjIuMS4gIEZsb3cgY29tcGxldGlvbiB0aW1lPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIGZsb3cgY29tcGxldGlvbiB0aW1lIGlzIGFu IGltcG9ydGFudCBwZXJmb3JtYW5jZSBtZXRyaWMgZm9yIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIFRoZSBmbG93IGNvbXBsZXRpb24gdGltZSBpcyBhbiBpbXBvcnRhbnQg cGVyZm9ybWFuY2UgbWV0cmljIGZvciB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDMwIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBlbmQtdXNlciB3aGVu IHRoZSBmbG93IHNpemUgaXMgZmluaXRlLiAgQ29uc2lkZXJpbmcgdGhlIGZhY3QgdGhhdCBhbjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBlbmQtdXNlciB3aGVuIHRoZSBmbG93 IHNpemUgaXMgZmluaXRlLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+VGhlIGRlZmluaXRpb24gb2Yg dGhlIGZsb3c8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBBUU0gc2No ZW1lIG1heSBkcm9wL21hcmsgcGFja2V0cywgdGhlIGZsb3cgY29tcGxldGlvbiB0aW1lIGlzPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIHNp emUgbWF5IGJlIHNvdXJjZSBvZiBjb250cmFkaWN0aW9ucywgdGh1cywgdGhpcyBtZXRyaWMgY2Fu IGNvbnNpZGVyPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZGlyZWN0 bHkgbGlua2VkIHRvIHRoZSBkcm9wcGluZy9tYXJraW5nIHBvbGljeSBvZiB0aGUgQVFNIHNjaGVt ZS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ ICAgYSBmbG93IGFzIGEgc2luZ2xlIGZpbGUuPC9zcGFuPiAgQ29uc2lkZXJpbmcgdGhlIGZhY3Qg dGhhdCBhbiBBUU0gc2NoZW1lIG1heTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAg VGhpcyBtZXRyaWMgaGVscHMgdG8gYmV0dGVyIGFzc2VzcyB0aGUgcGVyZm9ybWFuY2Ugb2YgYW4g QVFNPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGRyb3AvbWFyayBwYWNrZXRz LCB0aGUgZmxvdyBjb21wbGV0aW9uIHRpbWUgaXMgZGlyZWN0bHkgbGlua2VkIHRvIHRoZTwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZGVwZW5kaW5nIG9uIHRoZSBmbG93IHNpemUu ICBUaGUgRmxvdyBDb21wbGV0aW9uIFRpbWUgKEZDVCkgaXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+ICAgZHJvcHBpbmcvbWFya2luZyBwb2xpY3kgb2YgdGhlIEFRTSBzY2hlbWUu ICBUaGlzIG1ldHJpYyBoZWxwcyB0bzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAg cmVsYXRlZCB0byB0aGUgZmxvdyBzaXplIChGcykgYW5kIHRoZSBnb29kcHV0IGZvciB0aGUgZmxv dyAoRykgYXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgYmV0dGVyIGFzc2Vz cyB0aGUgcGVyZm9ybWFuY2Ugb2YgYW4gQVFNIGRlcGVuZGluZyBvbiB0aGUgZmxvdyBzaXplLjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZm9sbG93czo8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+ICAgVGhlIEZsb3cgQ29tcGxldGlvbiBUaW1lIChGQ1QpIGlzIHJl bGF0ZWQgdG8gdGhlIGZsb3cgc2l6ZSAoRnMpIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHRoZSBnb29kcHV0IGZv ciB0aGUgZmxvdyAoRykgYXMgZm9sbG93czo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBGQ1QgW3NdID0gRnMgW0J5dGVdIC8gKCBHIFtCaXQvc10gLyA4IFtCaXQvQnl0ZV0g KTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEZDVCBbc10gPSBGcyBbQnl0ZV0g LyAoIEcgW0JpdC9zXSAvIDggW0JpdC9CeXRlXSApPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAzMSI+PHRkPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPldoZXJl IGZsb3cgc2l6ZSBpcyB0aGUgc2l6ZSBvZiB0aGUgYXBwbGljYXRpb24tbGV2ZWwgZmxvdyBpbiBi aXRzIGFuZDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBnb29kcHV0IGlz IHRoZSBhcHBsaWNhdGlvbi1sZXZlbCB0cmFuc2ZlciB0aW1lIChkZXNjcmliZWQgaW48L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgU2VjdGlvbiAyLjUpLjwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgSWYg dGhpcyBtZXRyaWMgaXMgdXNlZCB0byBldmFsdWF0ZSB0aGUgcGVyZm9ybWFuY2Ugb2Ygd2ViIHRy YW5zZmVycyw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJZiB0aGlzIG1ldHJp YyBpcyB1c2VkIHRvIGV2YWx1YXRlIHRoZSBwZXJmb3JtYW5jZSBvZiB3ZWIgdHJhbnNmZXJzLDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGl0IGlzIHN1Z2dlc3RlZCB0byByYXRoZXIg Y29uc2lkZXIgdGhlIHRpbWUgbmVlZGVkIHRvIGRvd25sb2FkIGFsbDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGl0IGlzIHN1Z2dlc3RlZCB0byByYXRoZXIgY29uc2lkZXIgdGhl IHRpbWUgbmVlZGVkIHRvIGRvd25sb2FkIGFsbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHRoZSBvYmplY3RzIHRoYXQgY29tcG9zZSB0aGUgd2ViIHBhZ2UsIGFzIHRoaXMgbWFrZXMg bW9yZSBzZW5zZSBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBvYmpl Y3RzIHRoYXQgY29tcG9zZSB0aGUgd2ViIHBhZ2UsIGFzIHRoaXMgbWFrZXMgbW9yZSBzZW5zZSBp bjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRlcm1zIG9mIHVzZXIgZXhwZXJpZW5j ZSB0aGFuIGFzc2Vzc2luZyB0aGUgdGltZSBuZWVkZWQgdG8gZG93bmxvYWQ8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0ZXJtcyBvZiB1c2VyIGV4cGVyaWVuY2UgdGhhbiBhc3Nl c3NpbmcgdGhlIHRpbWUgbmVlZGVkIHRvIGRvd25sb2FkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgZWFjaCBvYmplY3QuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ZWFjaCBvYmplY3QuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Mi4yLiAgRmxv dyBzdGFydCB1cCB0aW1lPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+Mi4yLiAgRmxv dyBzdGFydCB1cCB0aW1lPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhl IGZsb3cgc3RhcnQgdXAgdGltZSBpcyB0aGUgdGltZSBiZXR3ZWVuIHRoZSByZXF1ZXN0IGhhcyBi ZWVuIHNlbnQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgZmxvdyBzdGFy dCB1cCB0aW1lIGlzIHRoZSB0aW1lIGJldHdlZW4gdGhlIHJlcXVlc3QgaGFzIGJlZW4gc2VudDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGZyb20gdGhlIGNsaWVudCBhbmQgdGhlIHNl cnZlciBzdGFydHMgdG8gdHJhbnNtaXQgZGF0YS4gIFRoZSBhbW91bnQ8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBmcm9tIHRoZSBjbGllbnQgYW5kIHRoZSBzZXJ2ZXIgc3RhcnRz IHRvIHRyYW5zbWl0IGRhdGEuICBUaGUgYW1vdW50PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgb2YgcGFja2V0cyBkcm9wcGVkIGJ5IGFuIEFRTSBtYXkgc2VyaW91c2x5IGFmZmVjdCB0 aGUgd2FpdGluZyBwZXJpb2Q8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvZiBw YWNrZXRzIGRyb3BwZWQgYnkgYW4gQVFNIG1heSBzZXJpb3VzbHkgYWZmZWN0IHRoZSB3YWl0aW5n IHBlcmlvZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGR1cmluZyB3aGljaCB0aGUg ZGF0YSB0cmFuc2ZlciBoYXMgbm90IHN0YXJ0ZWQuICBUaGlzIG1ldHJpYyB3b3VsZDwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGR1cmluZyB3aGljaCB0aGUgZGF0YSB0cmFuc2Zl ciBoYXMgbm90IHN0YXJ0ZWQuICBUaGlzIG1ldHJpYyB3b3VsZDwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIHNwZWNpZmljYWxseSBmb2N1cyBvbiB0aGUgb3BlcmF0aW9ucyBzdWNoIGFz IEROUyBsb29rdXBzLCBUQ1Agb3BlbnM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBzcGVjaWZpY2FsbHkgZm9jdXMgb24gdGhlIG9wZXJhdGlvbnMgc3VjaCBhcyBETlMgbG9va3Vw cywgVENQIG9wZW5zPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy IGlkPSJkaWZmMDAzMiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+b2Y8L3Nw YW4+IFNTTCBoYW5kc2hha2VzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij5hbmQ8L3NwYW4+IFNTTCBoYW5kc2hha2VzLjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjIuMy4gIFBhY2tldCBsb3NzPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+Mi4zLiAgUGFja2V0IGxvc3M8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBQYWNrZXQgbG9zcyBjYW4gb2NjdXIgZW4tcm91dGUsIHRoaXMgY2Fu IGltcGFjdCB0aGUgZW5kLXRvLWVuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IFBhY2tldCBsb3NzIGNhbiBvY2N1ciBlbi1yb3V0ZSwgdGhpcyBjYW4gaW1wYWN0IHRoZSBlbmQt dG8tZW5kPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcGVyZm9ybWFuY2UgbWVhc3Vy ZWQgYXQgcmVjZWl2ZXIuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcGVyZm9y bWFuY2UgbWVhc3VyZWQgYXQgcmVjZWl2ZXIuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAzMyI+PHRkPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhlIHRl c3RlciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5TSE9VTEQ8L3NwYW4+IGV2YWx1YXRlIGxvc3MgZXhw ZXJpZW5jZWQgYXQgdGhlIHJlY2VpdmVyIHVzaW5nIG9uZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBUaGUgdGVzdGVyIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3VsZDwvc3Bh bj4gZXZhbHVhdGUgbG9zcyBleHBlcmllbmNlZCBhdCB0aGUgcmVjZWl2ZXIgdXNpbmcgb25lPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgb2YgdGhlIHR3byBtZXRyaWNzOjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9mIHRoZSB0d28gbWV0cmljczo8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICB0aGUgcGFja2V0IGxvc3MgcmF0aW86IHRo aXMgbWV0cmljIGlzIHRvIGJlIGZyZXF1ZW50bHkgbWVhc3VyZWQ8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBvICB0aGUgcGFja2V0IGxvc3MgcmF0aW86IHRoaXMgbWV0cmljIGlz IHRvIGJlIGZyZXF1ZW50bHkgbWVhc3VyZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAgICBkdXJpbmcgdGhlIGV4cGVyaW1lbnQuICBUaGUgbG9uZy10ZXJtIGxvc3MgcmF0aW8gaXMg b2YgaW50ZXJlc3Q8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBkdXJpbmcg dGhlIGV4cGVyaW1lbnQuICBUaGUgbG9uZy10ZXJtIGxvc3MgcmF0aW8gaXMgb2YgaW50ZXJlc3Q8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBmb3Igc3RlYWR5LXN0YXRlIHNjZW5h cmlvcyBvbmx5OzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGZvciBzdGVh ZHktc3RhdGUgc2NlbmFyaW9zIG9ubHk7PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgbyAgdGhlIGludGVydmFsIGJldHdlZW4gY29uc2VjdXRpdmUgbG9zc2VzOiB0aGUgdGlt ZSBiZXR3ZWVuIHR3bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIHRoZSBp bnRlcnZhbCBiZXR3ZWVuIGNvbnNlY3V0aXZlIGxvc3NlczogdGhlIHRpbWUgYmV0d2VlbiB0d288 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBsb3NzZXMgaXMgdG8gYmUgbWVhc3Vy ZWQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgbG9zc2VzIGlzIHRvIGJl IG1lYXN1cmVkLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBwYWNr ZXQgbG9zcyByYXRpbyBjYW4gYmUgYXNzZXNzZWQgYnkgc2ltcGx5IGV2YWx1YXRpbmcgdGhlIGxv c3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgcGFja2V0IGxvc3MgcmF0 aW8gY2FuIGJlIGFzc2Vzc2VkIGJ5IHNpbXBseSBldmFsdWF0aW5nIHRoZSBsb3NzPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcmF0aW8gYXMgYSBmdW5jdGlvbiBvZiB0aGUgbnVtYmVy IG9mIGxvc3QgcGFja2V0cyBhbmQgdGhlIHRvdGFsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgcmF0aW8gYXMgYSBmdW5jdGlvbiBvZiB0aGUgbnVtYmVyIG9mIGxvc3QgcGFja2V0 cyBhbmQgdGhlIHRvdGFsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbnVtYmVyIG9m IHBhY2tldHMgc2VudC4gIFRoaXMgbWlnaHQgbm90IGJlIGVhc2lseSBkb25lIGluIGxhYm9yYXRv cnk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBudW1iZXIgb2YgcGFja2V0cyBz ZW50LiAgVGhpcyBtaWdodCBub3QgYmUgZWFzaWx5IGRvbmUgaW4gbGFib3JhdG9yeTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRlc3RpbmcsIGZvciB3aGljaCB0aGVzZSBndWlkZWxp bmVzIGFkdmljZSB0aGUgdGVzdGVyOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IHRlc3RpbmcsIGZvciB3aGljaCB0aGVzZSBndWlkZWxpbmVzIGFkdmljZSB0aGUgdGVzdGVyOjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIHRvIGNoZWNrIHRoYXQgZm9y IGV2ZXJ5IHBhY2tldCwgYSBjb3JyZXNwb25kaW5nIHBhY2tldCB3YXM8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBvICB0byBjaGVjayB0aGF0IGZvciBldmVyeSBwYWNrZXQsIGEg Y29ycmVzcG9uZGluZyBwYWNrZXQgd2FzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyIGlkPSJkaWZmMDAzNCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgcmVjZWl2ZWQgd2l0 aGluIGEgcmVhc29uYWJsZSB0aW1lLCBhcyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5leHBsYWluZWQ8 L3NwYW4+IGluIFtSRkMyNjgwXS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg ICAgcmVjZWl2ZWQgd2l0aGluIGEgcmVhc29uYWJsZSB0aW1lLCBhcyA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij5wcmVzZW50ZWQ8L3NwYW4+IGluIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnRoZSBkb2N1bWVu dDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICB0aGF0IHByb3Bvc2Vz IGEgbWV0cmljIGZvciBvbmUtd2F5IHBhY2tldCBsb3NzIGFjcm9zcyBJbnRlcm5ldDwvc3Bhbj48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBwYXRoczwvc3Bhbj4gW1JGQzI2ODBd LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIHRvIGtlZXAgYSBjb3Vu dCBvZiBhbGwgcGFja2V0cyBzZW50LCBhbmQgYSBjb3VudCBvZiB0aGUgbm9uLTwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIHRvIGtlZXAgYSBjb3VudCBvZiBhbGwgcGFja2V0 cyBzZW50LCBhbmQgYSBjb3VudCBvZiB0aGUgbm9uLTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMzUiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIGR1cGxp Y2F0ZSBwYWNrZXRzIHJlY2VpdmVkLCBhcyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5leHBsYWluZWQ8 L3NwYW4+IGluIDxzcGFuIGNsYXNzPSJkZWxldGUiPnRoZSBzZWN0aW9uIDEwIG9mPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICBkdXBsaWNhdGUgcGFja2V0cyBy ZWNlaXZlZCwgYXMgPHNwYW4gY2xhc3M9Imluc2VydCI+ZGlzY3Vzc2VkPC9zcGFuPiBpbiA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij5SRkMgdGhhdCBwcmVzZW50cyBhPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgICAgW1JGQzI1NDRdLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBiZW5jaG1hcmtpbmcgbWV0aG9k b2xvZ3k8L3NwYW4+IFtSRkMyNTQ0XS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBUaGUgaW50ZXJ2YWwgYmV0d2VlbiBjb25zZWN1dGl2ZSBsb3NzZXMsIHdoaWNoIGlzIGFs c28gY2FsbGVkIGEgZ2FwLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBp bnRlcnZhbCBiZXR3ZWVuIGNvbnNlY3V0aXZlIGxvc3Nlcywgd2hpY2ggaXMgYWxzbyBjYWxsZWQg YSBnYXAsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJk aWZmMDAzNiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgaXMgYSBtZXRyaWMgb2YgaW50ZXJlc3QgZm9yIFZvSVAg dHJhZmZpYyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5hbmQsIGFzIGEgcmVzdWx0LCBoYXMgYmVlbjwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgaXMgYSBtZXRyaWMgb2Yg aW50ZXJlc3QgZm9yIFZvSVAgdHJhZmZpYyBbUkZDMzYxMV0uPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBmdXJ0aGVyIHNwZWNpZmllZCBpbjwv c3Bhbj4gW1JGQzM2MTFdLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4yLjQuICBQYWNrZXQgbG9zcyBzeW5jaHJvbml6 YXRpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4yLjQuICBQYWNrZXQgbG9zcyBz eW5jaHJvbml6YXRpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBPbmUg Z29hbCBvZiBhbiBBUU0gYWxnb3JpdGhtIGlzIHRvIGhlbHAgdG8gYXZvaWQgZ2xvYmFsPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgT25lIGdvYWwgb2YgYW4gQVFNIGFsZ29yaXRo bSBpcyB0byBoZWxwIHRvIGF2b2lkIGdsb2JhbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHN5bmNocm9uaXphdGlvbiBvZiBmbG93cyBzaGFyaW5nIGEgYm90dGxlbmVjayBidWZmZXIg b24gd2hpY2ggdGhlIEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHN5bmNo cm9uaXphdGlvbiBvZiBmbG93cyBzaGFyaW5nIGEgYm90dGxlbmVjayBidWZmZXIgb24gd2hpY2gg dGhlIEFRTTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG9wZXJhdGVzIChbUkZDMjMw OV0sW1JGQzc1NjddKS4gIFRoZSAiZGVncmVlIiBvZiBwYWNrZXQtbG9zczwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9wZXJhdGVzIChbUkZDMjMwOV0sW1JGQzc1NjddKS4gIFRo ZSAiZGVncmVlIiBvZiBwYWNrZXQtbG9zczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMzciPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHN5bmNocm9uaXphdGlv biBiZXR3ZWVuIGZsb3dzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gYmUgYXNz ZXNzZWQsIHdpdGggYW5kIHdpdGhvdXQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgc3luY2hyb25pemF0aW9uIGJldHdlZW4gZmxvd3MgPHNwYW4gY2xhc3M9Imluc2VydCI+c2hv dWxkPC9zcGFuPiBiZSBhc3Nlc3NlZCwgd2l0aCBhbmQgd2l0aG91dDwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHRoZSBBUU0gdW5kZXIgY29uc2lkZXJhdGlvbi48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgQVFNIHVuZGVyIGNvbnNpZGVyYXRpb24uPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDAz OCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+QXMgZGlzY3Vzc2VkIGUuZy4s IGluIFtIQVNTMjAwOF0sIGxvc3M8L3NwYW4+IHN5bmNocm9uaXphdGlvbiBhbW9uZyBmbG93czwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5M b3NzPC9zcGFuPiBzeW5jaHJvbml6YXRpb24gYW1vbmcgZmxvd3MgbWF5IGJlIHF1YW50aWZpZWQg Ynkgc2V2ZXJhbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgbWF5IGJlIHF1YW50 aWZpZWQgYnkgc2V2ZXJhbCBzbGlnaHRseSBkaWZmZXJlbnQgbWV0cmljcyB0aGF0IGNhcHR1cmU8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgc2xpZ2h0bHkgZGlmZmVyZW50IG1l dHJpY3MgdGhhdCBjYXB0dXJlIGRpZmZlcmVudCBhc3BlY3RzIG9mIHRoZSBzYW1lPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBkaWZmZXJlbnQgYXNwZWN0cyBvZiB0aGUgc2FtZSA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5pc3N1ZS48L3NwYW4+ICBIb3dldmVyLCBpbiByZWFsLXdvcmxk PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJpbnNlcnQi Pmlzc3VlIFtIQVNTMjAwOF0uPC9zcGFuPiAgSG93ZXZlciwgaW4gcmVhbC13b3JsZCBtZWFzdXJl bWVudHMgdGhlIGNob2ljZSBvZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgbWVh c3VyZW1lbnRzIHRoZSBjaG9pY2Ugb2YgbWV0cmljIGNvdWxkIGJlIGltcG9zZWQgYnkgcHJhY3Rp Y2FsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIG1ldHJpYyBjb3VsZCBiZSBp bXBvc2VkIGJ5IHByYWN0aWNhbCBjb25zaWRlcmF0aW9ucyAtLSBlLmcuLCB3aGV0aGVyPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBjb25zaWRlcmF0aW9ucyAtLSBlLmcuLCB3aGV0 aGVyIGZpbmUtZ3JhaW5lZCBpbmZvcm1hdGlvbiBvbiBwYWNrZXQ8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+ICAgZmluZS1ncmFpbmVkIGluZm9ybWF0aW9uIG9uIHBhY2tldCBsb3Nz ZXMgPHNwYW4gY2xhc3M9Imluc2VydCI+YXQ8L3NwYW4+IHRoZSBib3R0bGVuZWNrIDxzcGFuIGNs YXNzPSJpbnNlcnQiPmlzPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAg bG9zc2VzIDxzcGFuIGNsYXNzPSJkZWxldGUiPmluPC9zcGFuPiB0aGUgYm90dGxlbmVjayBhdmFp bGFibGUgb3Igbm90LiAgRm9yIHRoZSBwdXJwb3NlIG9mIEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBhdmFpbGFibGUgb3Igbm90LiAgRm9yIHRoZSBwdXJwb3NlIG9mIEFR TSBjaGFyYWN0ZXJpemF0aW9uLCBhIGdvb2Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIGNoYXJhY3Rlcml6YXRpb24sIGEgZ29vZCBjYW5kaWRhdGUgbWV0cmljIGlzIHRoZSBnbG9i YWw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgY2FuZGlkYXRlIG1ldHJpYyBp cyB0aGUgZ2xvYmFsIHN5bmNocm9uaXphdGlvbiByYXRpbywgbWVhc3VyaW5nIHRoZTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgc3luY2hyb25pemF0aW9uIHJhdGlvLCBtZWFzdXJp bmcgdGhlIHByb3BvcnRpb24gb2YgZmxvd3MgbG9zaW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgIHByb3BvcnRpb24gb2YgZmxvd3MgbG9zaW5nIHBhY2tldHMgZHVyaW5nIGEg bG9zcyBldmVudC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPlRoaXM8L3NwYW4+IG1ldHJpYzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcGFja2V0cyBkdXJpbmcgYSBsb3NzIGV2ZW50 LiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W0pBWTIwMDZdIHVzZWQgdGhpczwvc3Bhbj4gbWV0cmlj IGluIDxzcGFuIGNsYXNzPSJkZWxldGUiPnJlYWwtPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5jYW4gYmUgdXNlZDwvc3Bhbj4g aW4gPHNwYW4gY2xhc3M9Imluc2VydCI+cmVhbC13b3JsZDwvc3Bhbj4gZXhwZXJpbWVudHMgdG8g Y2hhcmFjdGVyaXplIHN5bmNocm9uaXphdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgd29ybGQ8L3NwYW4+IGV4cGVyaW1lbnRzIHRvIGNo YXJhY3Rlcml6ZSBzeW5jaHJvbml6YXRpb24gYWxvbmcgYXJiaXRyYXJ5PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIGFsb25nIGFyYml0cmFyeSBJbnRlcm5ldCA8c3BhbiBjbGFz cz0iaW5zZXJ0Ij5wYXRoczwvc3Bhbj4gW0pBWTIwMDZdLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgSW50ZXJuZXQgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+cGF0aHM7IHRoZSBmdWxs IG1ldGhvZG9sb2d5IGlzIGRlc2NyaWJlZCBpbjwvc3Bhbj4gW0pBWTIwMDZdLjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBJZiBhbiBBUU0gc2NoZW1lIGlzIGV2YWx1YXRlZCB1c2luZyByZWFsLWxpZmUgbmV0d29y ayBlbnZpcm9ubWVudHMsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgSWYgYW4g QVFNIHNjaGVtZSBpcyBldmFsdWF0ZWQgdXNpbmcgcmVhbC1saWZlIG5ldHdvcmsgZW52aXJvbm1l bnRzLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGl0IGlzIHdvcnRoIHBvaW50aW5n IG91dCB0aGF0IHNvbWUgbmV0d29yayBldmVudHMsIHN1Y2ggYXMgZmFpbGVkPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaXQgaXMgd29ydGggcG9pbnRpbmcgb3V0IHRoYXQgc29t ZSBuZXR3b3JrIGV2ZW50cywgc3VjaCBhcyBmYWlsZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBsaW5rIHJlc3RvcmF0aW9uIG1heSBjYXVzZSBzeW5jaHJvbml6ZWQgbG9zc2VzIGJl dHdlZW4gYWN0aXZlIGZsb3dzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbGlu ayByZXN0b3JhdGlvbiBtYXkgY2F1c2Ugc3luY2hyb25pemVkIGxvc3NlcyBiZXR3ZWVuIGFjdGl2 ZSBmbG93czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFuZCB0aHVzIGNvbmZ1c2Ug dGhlIG1lYW5pbmcgb2YgdGhpcyBtZXRyaWMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgYW5kIHRodXMgY29uZnVzZSB0aGUgbWVhbmluZyBvZiB0aGlzIG1ldHJpYy48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4yLjUuICBHb29kcHV0PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+Mi41LiAgR29vZHB1dDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwMzkiPjx0ZD48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRo ZSBnb29kcHV0IGhhcyBiZWVuIGRlZmluZWQgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+aW4gc2VjdGlv biAzLjE3IG9mIFtSRkMyNjQ3XTwvc3Bhbj4gYXMgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgIFRoZSBnb29kcHV0IGhhcyBiZWVuIGRlZmluZWQgYXMgdGhlIG51bWJlciBv ZiBiaXRzIHBlciB1bml0IG9mIHRpbWU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg IG51bWJlciBvZiBiaXRzIHBlciB1bml0IG9mIHRpbWUgZm9yd2FyZGVkIHRvIHRoZSBjb3JyZWN0 IGRlc3RpbmF0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGZvcndhcmRl ZCB0byB0aGUgY29ycmVjdCBkZXN0aW5hdGlvbiBpbnRlcmZhY2UsIG1pbnVzIGFueSBiaXRzIGxv c3Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGludGVyZmFjZSwgbWludXMgYW55 IGJpdHMgbG9zdCBvciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5yZXRyYW5zbWl0dGVkLjwvc3Bhbj4g IFRoaXMgZGVmaW5pdGlvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBvciA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZXRyYW5zbWl0dGVkLCBzdWNoIGFzIHByb3Bvc2VkIGluIHRo ZSBzZWN0b24gMy4xNyBvZiB0aGUgUkZDPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+aW5kdWNlczwvc3Bhbj4gdGhhdCB0aGUgdGVz dCBzZXR1cCBuZWVkcyB0byBiZSBxdWFsaWZpZWQgdG8gYXNzdXJlIHRoYXQgaXQ8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgZGVzY3JpYmlu ZyB0aGUgYmVuY2htYXJraW5nIHRlcm1pbm9sb2d5IGZvciBmaXJld2FsbCBwZXJmb3JtYW5jZXM8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBpcyBub3QgZ2VuZXJhdGlu ZyBsb3NzZXMgb24gaXRzIG93bi48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNw YW4gY2xhc3M9Imluc2VydCI+ICAgW1JGQzI2NDddLjwvc3Bhbj4gIFRoaXMgZGVmaW5pdGlvbiA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZXF1aXJlczwvc3Bhbj4gdGhhdCB0aGUgdGVzdCBzZXR1cCBu ZWVkcyB0byBiZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIHF1YWxpZmllZCB0byBhc3N1cmUgdGhhdCBpdCBpcyBub3Qg Z2VuZXJhdGluZyBsb3NzZXMgb24gaXRzIG93bi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBNZWFzdXJpbmcgdGhlIGVuZC10by1lbmQgZ29vZHB1dCBwcm92aWRlcyBhbiBh cHByZWNpYXRpb24gb2YgaG93IHdlbGw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBNZWFzdXJpbmcgdGhlIGVuZC10by1lbmQgZ29vZHB1dCBwcm92aWRlcyBhbiBhcHByZWNpYXRp b24gb2YgaG93IHdlbGw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhbiBBUU0gc2No ZW1lIGltcHJvdmVzIHRyYW5zcG9ydCBhbmQgYXBwbGljYXRpb24gcGVyZm9ybWFuY2UuICBUaGU8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhbiBBUU0gc2NoZW1lIGltcHJvdmVz IHRyYW5zcG9ydCBhbmQgYXBwbGljYXRpb24gcGVyZm9ybWFuY2UuICBUaGU8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBtZWFzdXJlZCBlbmQtdG8tZW5kIGdvb2RwdXQgaXMgbGlua2Vk IHRvIHRoZSBkcm9wcGluZy9tYXJraW5nIHBvbGljeTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIG1lYXN1cmVkIGVuZC10by1lbmQgZ29vZHB1dCBpcyBsaW5rZWQgdG8gdGhlIGRy b3BwaW5nL21hcmtpbmcgcG9saWN5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgb2Yg dGhlIEFRTSBzY2hlbWUgLS0gZS5nLiwgdGhlIGZld2VyIHRoZSBudW1iZXIgb2YgcGFja2V0IGRy b3BzLCB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvZiB0aGUgQVFNIHNj aGVtZSAtLSBlLmcuLCB0aGUgZmV3ZXIgdGhlIG51bWJlciBvZiBwYWNrZXQgZHJvcHMsIHRoZTwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGZld2VyIHBhY2tldHMgbmVlZCByZXRyYW5z bWlzc2lvbiwgbWluaW1pemluZyB0aGUgaW1wYWN0IG9mIEFRTSBvbjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGZld2VyIHBhY2tldHMgbmVlZCByZXRyYW5zbWlzc2lvbiwgbWlu aW1pemluZyB0aGUgaW1wYWN0IG9mIEFRTSBvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHRyYW5zcG9ydCBhbmQgYXBwbGljYXRpb24gcGVyZm9ybWFuY2UuICBBZGRpdGlvbmFsbHks IGFuIEFRTSBzY2hlbWU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0cmFuc3Bv cnQgYW5kIGFwcGxpY2F0aW9uIHBlcmZvcm1hbmNlLiAgQWRkaXRpb25hbGx5LCBhbiBBUU0gc2No ZW1lPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbWF5IHJlc29ydCB0byBFeHBsaWNp dCBDb25nZXN0aW9uIE5vdGlmaWNhdGlvbiAoRUNOKSBtYXJraW5nIGFzIGFuPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbWF5IHJlc29ydCB0byBFeHBsaWNpdCBDb25nZXN0aW9u IE5vdGlmaWNhdGlvbiAoRUNOKSBtYXJraW5nIGFzIGFuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgaW5pdGlhbCBtZWFucyB0byBjb250cm9sIGRlbGF5LiAgQWdhaW4sIG1hcmtpbmcg cGFja2V0cyBpbnN0ZWFkIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW5p dGlhbCBtZWFucyB0byBjb250cm9sIGRlbGF5LiAgQWdhaW4sIG1hcmtpbmcgcGFja2V0cyBpbnN0 ZWFkIG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZHJvcHBpbmcgdGhlbSByZWR1 Y2VzIHRoZSBudW1iZXIgb2YgcGFja2V0IHJldHJhbnNtaXNzaW9ucyBhbmQ8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBkcm9wcGluZyB0aGVtIHJlZHVjZXMgdGhlIG51bWJlciBv ZiBwYWNrZXQgcmV0cmFuc21pc3Npb25zIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIGluY3JlYXNlcyBnb29kcHV0LiAgRW5kLXRvLWVuZCBnb29kcHV0IHZhbHVlcyBoZWxwIHRv IGV2YWx1YXRlIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGluY3JlYXNl cyBnb29kcHV0LiAgRW5kLXRvLWVuZCBnb29kcHV0IHZhbHVlcyBoZWxwIHRvIGV2YWx1YXRlIHRo ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEFRTSBzY2hlbWUncyBlZmZlY3RpdmVu ZXNzIG9mIGFuIEFRTSBzY2hlbWUgaW4gbWluaW1pemluZyBwYWNrZXQ8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBBUU0gc2NoZW1lJ3MgZWZmZWN0aXZlbmVzcyBvZiBhbiBBUU0g c2NoZW1lIGluIG1pbmltaXppbmcgcGFja2V0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgZHJvcHMgdGhhdCBpbXBhY3QgYXBwbGljYXRpb24gcGVyZm9ybWFuY2UgYW5kIHRvIGVzdGlt YXRlIGhvdyB3ZWxsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZHJvcHMgdGhh dCBpbXBhY3QgYXBwbGljYXRpb24gcGVyZm9ybWFuY2UgYW5kIHRvIGVzdGltYXRlIGhvdyB3ZWxs PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGhlIEFRTSBzY2hlbWUgd29ya3Mgd2l0 aCBFQ04uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdGhlIEFRTSBzY2hlbWUg d29ya3Mgd2l0aCBFQ04uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyIGlkPSJkaWZmMDA0MCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhlIG1lYXN1cmVtZW50IG9m IHRoZSBnb29kcHV0IGFsbG93cyB0aGUgdGVzdGVyIGV2YWx1YXRlIHRvIHdoaWNoPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFRoZSBtZWFzdXJlbWVudCBvZiB0aGUgZ29vZHB1 dCBhbGxvd3MgdGhlIHRlc3RlciA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij50byA8L3NwYW4+ZXZhbHVh dGUgdG8gd2hpY2g8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBleHRlbnQgYW4gQVFN IGlzIGFibGUgdG8gbWFpbnRhaW4gYSBoaWdoIGJvdHRsZW5lY2sgdXRpbGl6YXRpb24uPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZXh0ZW50IGFuIEFRTSBpcyBhYmxlIHRvIG1h aW50YWluIGEgaGlnaCBib3R0bGVuZWNrIHV0aWxpemF0aW9uLjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNDEiPjx0ZD48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRo aXMgbWV0cmljIHNob3VsZCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5iZSBhbHNvPC9zcGFuPiBvYnRh aW5lZCBmcmVxdWVudGx5IGR1cmluZyBhbiBleHBlcmltZW50PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyYmxvY2siPiAgIFRoaXMgbWV0cmljIHNob3VsZCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5h bHNvIGJlPC9zcGFuPiBvYnRhaW5lZCBmcmVxdWVudGx5IGR1cmluZyBhbiBleHBlcmltZW50PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYXMgdGhlIGxvbmctdGVybSBnb29kcHV0IGlz IHJlbGV2YW50IGZvciBzdGVhZHktc3RhdGUgc2NlbmFyaW9zIG9ubHk8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBhcyB0aGUgbG9uZy10ZXJtIGdvb2RwdXQgaXMgcmVsZXZhbnQg Zm9yIHN0ZWFkeS1zdGF0ZSBzY2VuYXJpb3Mgb25seTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIGFuZCBtYXkgbm90IG5lY2Vzc2FyaWx5IHJlZmxlY3QgaG93IHRoZSBpbnRyb2R1Y3Rp b24gb2YgYW4gQVFNPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYW5kIG1heSBu b3QgbmVjZXNzYXJpbHkgcmVmbGVjdCBob3cgdGhlIGludHJvZHVjdGlvbiBvZiBhbiBBUU08L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhY3R1YWxseSBpbXBhY3RzIHRoZSBsaW5rIHV0 aWxpemF0aW9uIGR1cmluZyBhdCBhIGNlcnRhaW4gcGVyaW9kIG9mPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgYWN0dWFsbHkgaW1wYWN0cyB0aGUgbGluayB1dGlsaXphdGlvbiBk dXJpbmcgYXQgYSBjZXJ0YWluIHBlcmlvZCBvZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHRpbWUuICBGbHVjdHVhdGlvbnMgaW4gdGhlIHZhbHVlcyBvYnRhaW5lZCBmcm9tIHRoZXNl IG1lYXN1cmVtZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRpbWUuICBG bHVjdHVhdGlvbnMgaW4gdGhlIHZhbHVlcyBvYnRhaW5lZCBmcm9tIHRoZXNlIG1lYXN1cmVtZW50 czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG1heSBkZXBlbmQgb24gb3RoZXIgZmFj dG9ycyB0aGFuIHRoZSBpbnRyb2R1Y3Rpb24gb2YgYW4gQVFNLCBzdWNoIGFzPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbWF5IGRlcGVuZCBvbiBvdGhlciBmYWN0b3JzIHRoYW4g dGhlIGludHJvZHVjdGlvbiBvZiBhbiBBUU0sIHN1Y2ggYXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBsaW5rIGxheWVyIGxvc3NlcyBkdWUgdG8gZXh0ZXJuYWwgbm9pc2Ugb3IgY29y cnVwdGlvbiwgZmx1Y3R1YXRpbmc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBs aW5rIGxheWVyIGxvc3NlcyBkdWUgdG8gZXh0ZXJuYWwgbm9pc2Ugb3IgY29ycnVwdGlvbiwgZmx1 Y3R1YXRpbmc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBiYW5kd2lkdGhzICg4MDIu MTEgV0xBTnMpLCBoZWF2eSBjb25nZXN0aW9uIGxldmVscyBvciB0cmFuc3BvcnQ8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBiYW5kd2lkdGhzICg4MDIuMTEgV0xBTnMpLCBoZWF2 eSBjb25nZXN0aW9uIGxldmVscyBvciB0cmFuc3BvcnQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBsYXllcidzIHJhdGUgcmVkdWN0aW9uIGJ5IGNvbmdlc3Rpb24gY29udHJvbCBtZWNo YW5pc20uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbGF5ZXIncyByYXRlIHJl ZHVjdGlvbiBieSBjb25nZXN0aW9uIGNvbnRyb2wgbWVjaGFuaXNtLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjIuNi4gIExhdGVuY3kgYW5kIGppdHRlcjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjIuNi4gIExhdGVuY3kgYW5kIGppdHRlcjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBsYXRlbmN5LCBvciB0aGUgb25lLXdheSBkZWxh eSBtZXRyaWMsIGlzIGRpc2N1c3NlZCBpbiBbUkZDMjY3OV0uPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgVGhlIGxhdGVuY3ksIG9yIHRoZSBvbmUtd2F5IGRlbGF5IG1ldHJpYywg aXMgZGlzY3Vzc2VkIGluIFtSRkMyNjc5XS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBUaGVyZSBpcyBhIGNvbnNlbnN1cyBvbiBhbiBhZGVxdWF0ZSBtZXRyaWMgZm9yIHRoZSBqaXR0 ZXIsIHRoYXQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGVyZSBpcyBhIGNv bnNlbnN1cyBvbiBhbiBhZGVxdWF0ZSBtZXRyaWMgZm9yIHRoZSBqaXR0ZXIsIHRoYXQ8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICByZXByZXNlbnRzIHRoZSBvbmUtd2F5IGRlbGF5IHZh cmlhdGlvbnMgZm9yIHBhY2tldHMgZnJvbSB0aGUgc2FtZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHJlcHJlc2VudHMgdGhlIG9uZS13YXkgZGVsYXkgdmFyaWF0aW9ucyBmb3Ig cGFja2V0cyBmcm9tIHRoZSBzYW1lPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyIGlkPSJkaWZmMDA0MiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZmxvdzogdGhlIFBhY2tldCBE ZWxheSBWYXJpYXRpb24gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+KFBEViksIGRldGFpbGVkIGluIFtS RkM1NDgxXSw8L3NwYW4+IHNlcnZlczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBmbG93OiB0aGUgUGFja2V0IERlbGF5IFZhcmlhdGlvbiA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4o UERWKTwvc3Bhbj4gc2VydmVzIHdlbGwgYWxsIHVzZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5jYXNl czwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHdlbGwgYWxsIHVzZSA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5jYXNlcy48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIFtSRkM1NDgxXS48L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIGVuZC10by1lbmQgbGF0ZW5jeSBp bmNsdWRlcyBjb21wb25lbnRzIG90aGVyIHRoYW4ganVzdCB0aGU8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBUaGUgZW5kLXRvLWVuZCBsYXRlbmN5IGluY2x1ZGVzIGNvbXBvbmVu dHMgb3RoZXIgdGhhbiBqdXN0IHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHF1 ZXVpbmcgZGVsYXksIHN1Y2ggYXMgdGhlIHNpZ25hbCBwcm9jZXNzaW5nIGRlbGF5LCB0cmFuc21p c3Npb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBxdWV1aW5nIGRlbGF5LCBz dWNoIGFzIHRoZSBzaWduYWwgcHJvY2Vzc2luZyBkZWxheSwgdHJhbnNtaXNzaW9uPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZGVsYXkgYW5kIHRoZSBwcm9jZXNzaW5nIGRlbGF5LiAg TW9yZW92ZXIsIHRoZSBqaXR0ZXIgaXMgY2F1c2VkIGJ5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgZGVsYXkgYW5kIHRoZSBwcm9jZXNzaW5nIGRlbGF5LiAgTW9yZW92ZXIsIHRo ZSBqaXR0ZXIgaXMgY2F1c2VkIGJ5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdmFy aWF0aW9ucyBpbiBxdWV1aW5nIGFuZCBwcm9jZXNzaW5nIGRlbGF5IChlLmcuLCBzY2hlZHVsaW5n PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdmFyaWF0aW9ucyBpbiBxdWV1aW5n IGFuZCBwcm9jZXNzaW5nIGRlbGF5IChlLmcuLCBzY2hlZHVsaW5nPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA0MyI+PHRkPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAg ZWZmZWN0cykuICBUaGUgaW50cm9kdWN0aW9uIG9mIGFuIEFRTSBzY2hlbWUgd291bGQgaW1wYWN0 IDxzcGFuIGNsYXNzPSJkZWxldGUiPnRoZXNlPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBlZmZlY3RzKS4gIFRoZSBpbnRyb2R1Y3Rpb24gb2YgYW4gQVFNIHNjaGVt ZSB3b3VsZCBpbXBhY3QgPHNwYW4gY2xhc3M9Imluc2VydCI+ZW5kLXRvLWVuZDwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIG1ldHJp Y3MgKGVuZC10by1lbmQ8L3NwYW4+IGxhdGVuY3kgYW5kIDxzcGFuIGNsYXNzPSJkZWxldGUiPmpp dHRlcik8L3NwYW4+IGFuZCB0aGVyZWZvcmUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+dGhleTwvc3Bh bj4gc2hvdWxkIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGxhdGVuY3kg YW5kIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmppdHRlciw8L3NwYW4+IGFuZCB0aGVyZWZvcmUgPHNw YW4gY2xhc3M9Imluc2VydCI+dGhlc2UgbWV0cmljczwvc3Bhbj4gc2hvdWxkIGJlIGNvbnNpZGVy ZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGNvbnNpZGVyZWQgaW4gdGhlIGVu ZC10by1lbmQgZXZhbHVhdGlvbiBvZiBwZXJmb3JtYW5jZS48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+ICAgaW4gdGhlIGVuZC10by1lbmQgZXZhbHVhdGlvbiBvZiBwZXJmb3JtYW5j ZS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4yLjcuICBEaXNjdXNzaW9uIG9u IHRoZSB0cmFkZS1vZmYgYmV0d2VlbiBsYXRlbmN5IGFuZCBnb29kcHV0PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+Mi43LiAgRGlzY3Vzc2lvbiBvbiB0aGUgdHJhZGUtb2ZmIGJldHdl ZW4gbGF0ZW5jeSBhbmQgZ29vZHB1dDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNDQiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRoZSBtZXRyaWNz IHByZXNlbnRlZCBpbiB0aGlzIHNlY3Rpb24gbWF5IGJlIGNvbnNpZGVyZWQgPHNwYW4gY2xhc3M9 ImRlbGV0ZSI+YXMgZXhwbGFpbmVkPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICBUaGUgbWV0cmljcyBwcmVzZW50ZWQgaW4gdGhpcyBzZWN0aW9uIG1heSBiZSBjb25z aWRlcmVkIGluIG9yZGVyIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBj bGFzcz0iZGVsZXRlIj4gICBpbiB0aGUgcmVzdCBvZiB0aGlzIGRvY3VtZW50LDwvc3Bhbj4gaW4g b3JkZXIgdG8gZGlzY3VzcyBhbmQgcXVhbnRpZnkgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgIGRpc2N1c3MgYW5kIHF1YW50aWZ5IHRoZSB0cmFkZS1vZmYgYmV0d2VlbiBs YXRlbmN5IGFuZCBnb29kcHV0LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdHJh ZGUtb2ZmIGJldHdlZW4gbGF0ZW5jeSBhbmQgZ29vZHB1dC48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgV2l0aCBy ZWdhcmRzIHRvIHRoZSBnb29kcHV0LCBhbmQgaW4gYWRkaXRpb24gdG8gdGhlIGxvbmctdGVybTwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFdpdGggcmVnYXJkcyB0byB0aGUgZ29v ZHB1dCwgYW5kIGluIGFkZGl0aW9uIHRvIHRoZSBsb25nLXRlcm08L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDQ1Ij48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBz dGF0aW9uYXJ5IGdvb2RwdXQgdmFsdWUsIGl0IGlzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlJFQ09N TUVOREVEPC9zcGFuPiB0byB0YWtlIG1lYXN1cmVtZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBzdGF0aW9uYXJ5IGdvb2RwdXQgdmFsdWUsIGl0IGlzIDxzcGFuIGNsYXNz PSJpbnNlcnQiPnJlY29tbWVuZGVkPC9zcGFuPiB0byB0YWtlIG1lYXN1cmVtZW50czwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGV2ZXJ5IG11bHRpcGxlIG9mIHRoZSBtaW5pbXVtIFJU VCAobWluUlRUKSBiZXR3ZWVuIEEgYW5kIEIuICBJdCBpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIGV2ZXJ5IG11bHRpcGxlIG9mIHRoZSBtaW5pbXVtIFJUVCAobWluUlRUKSBi ZXR3ZWVuIEEgYW5kIEIuICBJdCBpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHN1 Z2dlc3RlZCB0byB0YWtlIG1lYXN1cmVtZW50cyBhdCBsZWFzdCBldmVyeSBLIHggbWluUlRUICh0 byBzbW9vdGg8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzdWdnZXN0ZWQgdG8g dGFrZSBtZWFzdXJlbWVudHMgYXQgbGVhc3QgZXZlcnkgSyB4IG1pblJUVCAodG8gc21vb3RoPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA0NiI+ PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+ICAgb3V0IHRoZSBmbHVjdHVhdGlvbnMpLCB3aXRoIEs9MTAuICBIaWdoZXIg dmFsdWVzIGZvciBLIDxzcGFuIGNsYXNzPSJkZWxldGUiPmFyZSBlbmNvdXJhZ2VkPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBvdXQgdGhlIGZsdWN0dWF0aW9ucyks IHdpdGggSz0xMC4gIEhpZ2hlciB2YWx1ZXMgZm9yIEsgPHNwYW4gY2xhc3M9Imluc2VydCI+Y2Fu IGJlPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgd2hlbmV2ZXIgaXQg aXMgbW9yZSBhcHByb3ByaWF0ZSBmb3IgdGhlIHByZXNlbnRhdGlvbiBvZiB0aGUgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+cmVzdWx0cy48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIGNvbnNpZGVyZWQ8L3NwYW4+IHdoZW5ldmVyIGl0 IGlzIG1vcmUgYXBwcm9wcmlhdGUgZm9yIHRoZSBwcmVzZW50YXRpb24gb2Y8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIFRoZTwvc3Bhbj4gdmFs dWUgZm9yIEsgbWF5IGRlcGVuZCBvbiB0aGUgbmV0d29yaydzIHBhdGggY2hhcmFjdGVyaXN0aWNz LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICB0aGUgPHNwYW4gY2xhc3M9Imlu c2VydCI+cmVzdWx0cywgc2luY2UgdGhlPC9zcGFuPiB2YWx1ZSBmb3IgSyBtYXkgZGVwZW5kIG9u IHRoZSBuZXR3b3JrJ3MgcGF0aDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhl IG1lYXN1cmVtZW50IHBlcmlvZCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBiZSBk aXNjbG9zZWQgZm9yIGVhY2ggZXhwZXJpbWVudCBhbmQgd2hlbjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBjaGFyYWN0ZXJpc3RpY3MuICBUaGUgbWVhc3VyZW1lbnQgcGVyaW9k IDxzcGFuIGNsYXNzPSJpbnNlcnQiPm11c3Q8L3NwYW4+IGJlIGRpc2Nsb3NlZCBmb3IgZWFjaDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcmVzdWx0cy92YWx1ZXMgYXJlIGNvbXBh cmVkIGFjcm9zcyBkaWZmZXJlbnQgQVFNIHNjaGVtZXMsIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBleHBlcmltZW50IGFuZCB3aGVuIHJlc3VsdHMvdmFsdWVzIGFyZSBj b21wYXJlZCBhY3Jvc3MgZGlmZmVyZW50IEFRTTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgY29tcGFyaXNvbnMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFuPiB1c2Ug ZXhhY3RseSB0aGUgc2FtZSBtZWFzdXJlbWVudCBwZXJpb2RzLiAgV2l0aDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBzY2hlbWVzLCB0aGUgY29tcGFyaXNvbnMgPHNwYW4gY2xh c3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPiB1c2UgZXhhY3RseSB0aGUgc2FtZSBtZWFzdXJlbWVu dDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcmVnYXJkcyB0byBsYXRlbmN5LCBp dCBpcyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5SRUNPTU1FTkRFRDwvc3Bhbj4gdG8gdGFrZSB0aGUg c2FtcGxlcyBvbiA8c3BhbiBjbGFzcz0iZGVsZXRlIj5wZXItPC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBwZXJpb2RzLiAgV2l0aCByZWdhcmRzIHRvIGxhdGVuY3ks IGl0IGlzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnJlY29tbWVuZGVkPC9zcGFuPiB0byB0YWtlIHRo ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAg cGFja2V0PC9zcGFuPiBiYXNpcyB3aGVuZXZlciBwb3NzaWJsZSBkZXBlbmRpbmcgb24gdGhlIGZl YXR1cmVzIHByb3ZpZGVkIGJ5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHNh bXBsZXMgb24gPHNwYW4gY2xhc3M9Imluc2VydCI+cGVyLXBhY2tldDwvc3Bhbj4gYmFzaXMgd2hl bmV2ZXIgcG9zc2libGUgZGVwZW5kaW5nIG9uIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgaGFyZHdhcmUvc29mdHdhcmUgYW5kIHRoZSBpbXBhY3Qgb2Ygc2FtcGxpbmcgaXRz ZWxmIG9uIHRoZSBoYXJkd2FyZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBm ZWF0dXJlcyBwcm92aWRlZCBieSBoYXJkd2FyZS9zb2Z0d2FyZSBhbmQgdGhlIGltcGFjdCBvZiBz YW1wbGluZzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcGVyZm9ybWFuY2UuICA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5JdCBpcyBnZW5lcmFsbHkgUkVDT01NRU5ERUQgdG8gcHJvdmlk ZSBhdCBsZWFzdCAxMDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg aXRzZWxmIG9uIHRoZSBoYXJkd2FyZSBwZXJmb3JtYW5jZS48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIHNhbXBsZXMgcGVyIFJUVC48L3NwYW4+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIEZyb20gZWFjaCBvZiB0aGVzZSBzZXRzIG9mIG1lYXN1cmVtZW50cywg dGhlIGN1bXVsYXRpdmUgZGVuc2l0eTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IEZyb20gZWFjaCBvZiB0aGVzZSBzZXRzIG9mIG1lYXN1cmVtZW50cywgdGhlIGN1bXVsYXRpdmUg ZGVuc2l0eTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0i ZGlmZjAwNDciPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGZ1bmN0aW9uIChDREYpIG9mIHRoZSBjb25zaWRlcmVk IG1ldHJpY3MgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFuPiBiZSBjb21wdXRlZC4g IElmIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBmdW5jdGlvbiAoQ0RG KSBvZiB0aGUgY29uc2lkZXJlZCBtZXRyaWNzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3VsZDwv c3Bhbj4gYmUgY29tcHV0ZWQuICBJZiB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBjb25zaWRlcmVkIHNjZW5hcmlvIGludHJvZHVjZXMgZHluYW1pY2FsbHkgdmFyeWluZyBwYXJh bWV0ZXJzLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvbnNpZGVyZWQgc2Nl bmFyaW8gaW50cm9kdWNlcyBkeW5hbWljYWxseSB2YXJ5aW5nIHBhcmFtZXRlcnMsPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGVtcG9yYWwgZXZvbHV0aW9uIG9mIHRoZSBtZXRyaWNz IGNvdWxkIGFsc28gYmUgZ2VuZXJhdGVkLiAgRm9yIGVhY2g8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICB0ZW1wb3JhbCBldm9sdXRpb24gb2YgdGhlIG1ldHJpY3MgY291bGQgYWxz byBiZSBnZW5lcmF0ZWQuICBGb3IgZWFjaDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IHNjZW5hcmlvLCB0aGUgZm9sbG93aW5nIGdyYXBoIG1heSBiZSBnZW5lcmF0ZWQ6IHRoZSB4LWF4 aXMgc2hvd3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzY2VuYXJpbywgdGhl IGZvbGxvd2luZyBncmFwaCBtYXkgYmUgZ2VuZXJhdGVkOiB0aGUgeC1heGlzIHNob3dzPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcXVldWluZyBkZWxheSAodGhhdCBpcyB0aGUgYXZl cmFnZSBwZXItcGFja2V0IGRlbGF5IGluIGV4Y2VzcyBvZjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHF1ZXVpbmcgZGVsYXkgKHRoYXQgaXMgdGhlIGF2ZXJhZ2UgcGVyLXBhY2tl dCBkZWxheSBpbiBleGNlc3Mgb2Y8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBtaW5p bXVtIFJUVCksIHRoZSB5LWF4aXMgdGhlIGdvb2RwdXQuICBFbGxpcHNlcyBhcmUgY29tcHV0ZWQg c3VjaCBhczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG1pbmltdW0gUlRUKSwg dGhlIHktYXhpcyB0aGUgZ29vZHB1dC4gIEVsbGlwc2VzIGFyZSBjb21wdXRlZCBzdWNoIGFzPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZGV0YWlsZWQgaW4gW1dJTlMyMDE0XTogIldl IHRha2UgZWFjaCBpbmRpdmlkdWFsIFsuLi5dIHJ1biBbLi4uXSBhczwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGRldGFpbGVkIGluIFtXSU5TMjAxNF06ICJXZSB0YWtlIGVhY2gg aW5kaXZpZHVhbCBbLi4uXSBydW4gWy4uLl0gYXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBvbmUgcG9pbnQsIGFuZCB0aGVuIGNvbXB1dGUgdGhlIDEtZXBzaWxvbiBlbGxpcHRpYyBj b250b3VyIG9mIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9uZSBwb2lu dCwgYW5kIHRoZW4gY29tcHV0ZSB0aGUgMS1lcHNpbG9uIGVsbGlwdGljIGNvbnRvdXIgb2YgdGhl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbWF4aW11bS1saWtlbGlob29kIDJEIEdh dXNzaWFuIGRpc3RyaWJ1dGlvbiB0aGF0IGV4cGxhaW5zIHRoZSBwb2ludHMuPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbWF4aW11bS1saWtlbGlob29kIDJEIEdhdXNzaWFuIGRp c3RyaWJ1dGlvbiB0aGF0IGV4cGxhaW5zIHRoZSBwb2ludHMuPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgWy4uLl0gd2UgcGxvdCB0aGUgbWVkaWFuIHBlci1zZW5kZXIgdGhyb3VnaHB1 dCBhbmQgcXVldWVpbmcgZGVsYXkgYXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBbLi4uXSB3ZSBwbG90IHRoZSBtZWRpYW4gcGVyLXNlbmRlciB0aHJvdWdocHV0IGFuZCBxdWV1 ZWluZyBkZWxheSBhczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGEgY2lyY2xlLiBb Li4uXSBUaGUgb3JpZW50YXRpb24gb2YgYW4gZWxsaXBzZSByZXByZXNlbnRzIHRoZTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGEgY2lyY2xlLiBbLi4uXSBUaGUgb3JpZW50YXRp b24gb2YgYW4gZWxsaXBzZSByZXByZXNlbnRzIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIGNvdmFyaWFuY2UgYmV0d2VlbiB0aGUgdGhyb3VnaHB1dCBhbmQgZGVsYXkgbWVhc3Vy ZWQgZm9yIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvdmFyaWFuY2Ug YmV0d2VlbiB0aGUgdGhyb3VnaHB1dCBhbmQgZGVsYXkgbWVhc3VyZWQgZm9yIHRoZTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb3RvY29sLiIgIFRoaXMgZ3JhcGggcHJvdmlkZXMg cGFydCBvZiBhIGJldHRlciB1bmRlcnN0YW5kaW5nIG9mICgxKTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIHByb3RvY29sLiIgIFRoaXMgZ3JhcGggcHJvdmlkZXMgcGFydCBvZiBh IGJldHRlciB1bmRlcnN0YW5kaW5nIG9mICgxKTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHRoZSBkZWxheS9nb29kcHV0IHRyYWRlLW9mZiBmb3IgYSBnaXZlbiBjb25nZXN0aW9uIGNv bnRyb2wgbWVjaGFuaXNtPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdGhlIGRl bGF5L2dvb2RwdXQgdHJhZGUtb2ZmIGZvciBhIGdpdmVuIGNvbmdlc3Rpb24gY29udHJvbCBtZWNo YW5pc208L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRp ZmYwMDQ4Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA8c3BhbiBjbGFzcz0iZGVsZXRlIj5TZWN0aW9uIDUsPC9z cGFuPiBhbmQgKDIpIGhvdyB0aGUgZ29vZHB1dCBhbmQgYXZlcmFnZSBxdWV1ZSBkZWxheSB2YXJ5 IGFzIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xhc3M9Imlu c2VydCI+KFNlY3Rpb24gNSksPC9zcGFuPiBhbmQgKDIpIGhvdyB0aGUgZ29vZHB1dCBhbmQgYXZl cmFnZSBxdWV1ZSBkZWxheSB2YXJ5IGFzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICBmdW5jdGlvbiBvZiB0aGUgdHJhZmZpYyBsb2FkIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNlY3Rp b24gOC4yLjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgYSBmdW5j dGlvbiBvZiB0aGUgdHJhZmZpYyBsb2FkIDxzcGFuIGNsYXNzPSJpbnNlcnQiPihTZWN0aW9uIDgu MikuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjMuICBHZW5lcmlj IHNldHVwIGZvciBldmFsdWF0aW9uczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjMu ICBHZW5lcmljIHNldHVwIGZvciBldmFsdWF0aW9uczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIFRoaXMgc2VjdGlvbiBwcmVzZW50cyB0aGUgdG9wb2xvZ3kgdGhhdCBjYW4g YmUgdXNlZCBmb3IgZWFjaCBvZiB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBUaGlzIHNlY3Rpb24gcHJlc2VudHMgdGhlIHRvcG9sb2d5IHRoYXQgY2FuIGJlIHVzZWQgZm9y IGVhY2ggb2YgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZm9sbG93aW5nIHNj ZW5hcmlvcywgdGhlIGNvcnJlc3BvbmRpbmcgbm90YXRpb25zIGFuZCBkaXNjdXNzZXM8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBmb2xsb3dpbmcgc2NlbmFyaW9zLCB0aGUgY29y cmVzcG9uZGluZyBub3RhdGlvbnMgYW5kIGRpc2N1c3NlczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIHZhcmlvdXMgYXNzdW1wdGlvbnMgdGhhdCBoYXZlIGJlZW4gbWFkZSBpbiB0aGUg ZG9jdW1lbnQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdmFyaW91cyBhc3N1 bXB0aW9ucyB0aGF0IGhhdmUgYmVlbiBtYWRlIGluIHRoZSBkb2N1bWVudC48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4zLjEuICBUb3BvbG9neSBhbmQgbm90YXRpb25zPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+My4xLiAgVG9wb2xvZ3kgYW5kIG5vdGF0aW9uczwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNDki Pjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA8c3BhbiBjbGFzcz0iZGVs ZXRlIj4rLS0tLS0tLS0tKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAr LS0tLS0tLS0tLS0rPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIHxzZW5k ZXJzIEF8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxyZWNlaXZlcnMg Qnw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgKy0tLS0tLS0tLSsgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tKzwvc3Bhbj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICstLS0tLS0tLS0tLS0tLSsgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICstLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0tLS0tLS0rICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICArLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA1MCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgfDxzcGFuIGNsYXNz PSJkZWxldGUiPnRyYWZmaWMgY2xhc3MxfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fHRyYWZmaWMgY2xhc3MxPC9zcGFuPnw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgfDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNlbmRlciBBX2kgICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgfHJlY2VpdmUgQl9pICAgPC9zcGFuPnw8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICB8LS0tLS0tLS0tLS0tLS18ICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8LS0tLS0tLS0tLS0tLS18PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg fC0tLS0tLS0tLS0tLS0tfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfC0tLS0tLS0t LS0tLS0tfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHwgU0VOLkZsb3cxLjEgKy0t LS0tLS0tLSsgICAgICAgICAgICArLS0tLS0tLS0tLS0rIFJFQy5GbG93MS4xIHw8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8IFNFTi5GbG93MS4xICstLS0tLS0tLS0rICAgICAg ICAgICAgKy0tLS0tLS0tLS0tKyBSRUMuRmxvdzEuMSB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgfCAgICAgICAgKyAgICAgfCAgICAgICAgfCAgICAgICAgICAgIHwgICAgICAgICAg fCAgICAgICAgKyAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHwgICAg ICAgICsgICAgIHwgICAgICAgIHwgICAgICAgICAgICB8ICAgICAgICAgIHwgICAgICAgICsgICAg IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8ICAgICAgICB8ICAgICB8ICAgICAg ICB8ICAgICAgICAgICAgfCAgICAgICAgICB8ICAgICAgICB8ICAgICB8PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgfCAgICAgICAgfCAgICAgfCAgICAgICAgfCAgICAgICAgICAg IHwgICAgICAgICAgfCAgICAgICAgfCAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHwgICAgICAgICsgICAgIHwgICAgICAgIHwgICAgICAgICAgICB8ICAgICAgICAgIHwgICAg ICAgICsgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8ICAgICAgICAr ICAgICB8ICAgICAgICB8ICAgICAgICAgICAgfCAgICAgICAgICB8ICAgICAgICArICAgICB8PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfCBTRU4uRmxvdzEuWCArLS0tLS0rICAgfCAg ICAgICAgICAgIHwgICstLS0tLS0tLSsgUkVDLkZsb3cxLlggfDwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIHwgU0VOLkZsb3cxLlggKy0tLS0tKyAgIHwgICAgICAgICAgICB8ICAr LS0tLS0tLS0rIFJFQy5GbG93MS5YIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAr LS0tLS0tLS0tLS0tLS0rICAgIHwgICB8ICAgICAgICAgICAgfCAgfCAgICAgICArLS0tLS0tLS0t LS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgKy0tLS0tLS0tLS0tLS0t KyAgICB8ICAgfCAgICAgICAgICAgIHwgIHwgICAgICAgKy0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgKyAgICAgICAgICAgICstKy0tLSstLS0rICAg ICArLS0rLS0rLS0tKyAgICAgICAgICAgICs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICAgICsgICAgICAgICAgICArLSstLS0rLS0tKyAgICAgKy0tKy0tKy0tLSsgICAgICAg ICAgICArPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICB8ICAgICAgICAgICAg fFJvdXRlciBMIHwgICAgIHxSb3V0ZXIgUiB8ICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgfCAgICAgICAgICAgIHxSb3V0ZXIgTCB8ICAgICB8Um91 dGVyIFIgfCAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAg IHwgICAgICAgICAgICB8LS0tLS0tLS0tfCAgICAgfC0tLS0tLS0tLXwgICAgICAgICAgICB8PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICB8ICAgICAgICAgICAgfC0tLS0t LS0tLXwgICAgIHwtLS0tLS0tLS18ICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgfCAgICAgICAgICAgIHwgQVFNICAgICB8ICAgICB8ICAgICAgICAgfCAg ICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgIHwgICAg ICAgICAgICB8IEFRTSAgICAgfCAgICAgfCAgICAgICAgIHwgICAgICAgICAgICB8PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICB8ICAgICAgICAgICAgfCBCdWZmU2l6ZXwgICAg IHwgQnVmZlNpemV8ICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgICAgICAgfCAgICAgICAgICAgIHwgQnVmZlNpemV8ICAgICB8IEJ1ZmZTaXplfCAgICAgICAg ICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgIHwgICAgICAgICAgICB8 IChCc2l6ZSkgKy0tLS0tKyAoQnNpemUpIHwgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgICB8ICAgICAgICAgICAgfCAoQnNpemUpICstLS0tLSsgKEJz aXplKSB8ICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAg fCAgICAgICAgICAgICstLS0tLSstLSsrICAgICArKy0rLS0tLS0tKyAgICAgICAgICAgIHw8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgIHwgICAgICAgICAgICArLS0tLS0r LS0rKyAgICAgKystKy0tLS0tLSsgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgICAgICArICAgICAgICAgICAgICAgICAgfCAgfCAgICAgICB8IHwgICAgICAgICAg ICAgICAgICAgKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgKyAgICAg ICAgICAgICAgICAgIHwgIHwgICAgICAgfCB8ICAgICAgICAgICAgICAgICAgICs8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0tLS0tLS0tLS0tLS0rICAgICAgICB8ICB8ICAgICAg IHwgfCAgICAgICAgICArLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgKy0tLS0tLS0tLS0tLS0tKyAgICAgICAgfCAgfCAgICAgICB8IHwgICAgICAgICAg Ky0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0ciBpZD0iZGlmZjAwNTEiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHw8c3BhbiBjbGFzcz0iZGVsZXRlIj50 cmFmZmljIGNsYXNzTnwgICAgICAgIHwgIHwgICAgICAgfCB8ICAgICAgICAgIHx0cmFmZmljIGNs YXNzTjwvc3Bhbj58PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHw8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5zZW5kZXIgQV9uICAgIHwgICAgICAgIHwgIHwgICAgICAgfCB8ICAgICAg ICAgIHxyZWNlaXZlIEJfbiAgIDwvc3Bhbj58PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgfC0tLS0tLS0tLS0tLS0tfCAgICAgICAgfCAgfCAgICAgICB8IHwgICAgICAgICAgfC0tLS0t LS0tLS0tLS0tfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHwtLS0tLS0tLS0t LS0tLXwgICAgICAgIHwgIHwgICAgICAgfCB8ICAgICAgICAgIHwtLS0tLS0tLS0tLS0tLXw8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8IFNFTi5GbG93Ti4xICstLS0tLS0tLS0rICB8 ICAgICAgIHwgKy0tLS0tLS0tLS0tKyBSRUMuRmxvd04uMSB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgfCBTRU4uRmxvd04uMSArLS0tLS0tLS0tKyAgfCAgICAgICB8ICstLS0t LS0tLS0tLSsgUkVDLkZsb3dOLjEgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHwg ICAgICAgICsgICAgIHwgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICAgIHwgICAgICAgICsg ICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8ICAgICAgICArICAgICB8 ICAgICAgICAgICB8ICAgICAgIHwgICAgICAgICAgICB8ICAgICAgICArICAgICB8PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfCAgICAgICAgfCAgICAgfCAgICAgICAgICAgfCAgICAg ICB8ICAgICAgICAgICAgfCAgICAgICAgfCAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIHwgICAgICAgIHwgICAgIHwgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICAg IHwgICAgICAgIHwgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8ICAgICAg ICArICAgICB8ICAgICAgICAgICB8ICAgICAgIHwgICAgICAgICAgICB8ICAgICAgICArICAgICB8 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfCAgICAgICAgKyAgICAgfCAgICAg ICAgICAgfCAgICAgICB8ICAgICAgICAgICAgfCAgICAgICAgKyAgICAgfDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIHwgU0VOLkZsb3dOLlkgKy0tLS0tLS0tLS0tLSsgICAgICAgKy0t LS0tLS0tLS0tLS0rIFJFQy5GbG93Ti5ZIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICB8IFNFTi5GbG93Ti5ZICstLS0tLS0tLS0tLS0rICAgICAgICstLS0tLS0tLS0tLS0tKyBS RUMuRmxvd04uWSB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0tLS0t LS0tKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0tKzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0tLS0tLSsgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICstLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAgICBGaWd1cmUgMTogVG9wb2xvZ3kg YW5kIG5vdGF0aW9uczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAg ICAgICAgICAgIEZpZ3VyZSAxOiBUb3BvbG9neSBhbmQgbm90YXRpb25zPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgRmlndXJlIDEgaXMgYSBnZW5lcmljIHRvcG9sb2d5IHdo ZXJlOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEZpZ3VyZSAxIGlzIGEgZ2Vu ZXJpYyB0b3BvbG9neSB3aGVyZTo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDUyIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBvICA8c3BhbiBjbGFz cz0iZGVsZXRlIj5zZW5kZXI8L3NwYW4+IHdpdGggZGlmZmVyZW50IHRyYWZmaWMgY2hhcmFjdGVy aXN0aWNzIChpLmUuLCB0cmFmZmljPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IG8gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnRyYWZmaWMgcHJvZmlsZSBpcyBhIHNldCBvZiBmbG93 cyB3aXRoIHNpbWlsYXIgY2hhcmFjdGVyaXN0aWNzIC08L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+ICAgICAgUlRULCBjb25nZXN0aW9uIGNvbnRyb2wgc2NoZW1lLCB0cmFuc3Bv cnQgcHJvdG9jb2wsIGV0Yy47PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvICBzZW5kZXJzPC9zcGFuPiB3 aXRoIGRpZmZlcmVudCB0cmFmZmljIGNoYXJhY3RlcmlzdGljcyAoaS5lLiwgdHJhZmZpYzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHByb2ZpbGVzKSBjYW4gYmUgaW50cm9kdWNl ZDs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBwcm9maWxlcykgY2FuIGJl IGludHJvZHVjZWQ7PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgdGhl IHRpbWluZyBvZiBlYWNoIGZsb3cgY291bGQgYmUgZGlmZmVyZW50IChpLmUuLCB3aGVuIGRvZXMg ZWFjaDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIHRoZSB0aW1pbmcgb2Yg ZWFjaCBmbG93IGNvdWxkIGJlIGRpZmZlcmVudCAoaS5lLiwgd2hlbiBkb2VzIGVhY2g8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBmbG93IHN0YXJ0IGFuZCBzdG9wKTs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBmbG93IHN0YXJ0IGFuZCBzdG9wKTs8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBlYWNoIHRyYWZmaWMgcHJvZmls ZSBjYW4gY29tcHJpc2UgdmFyaW91cyBudW1iZXIgb2YgZmxvd3M7PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgbyAgZWFjaCB0cmFmZmljIHByb2ZpbGUgY2FuIGNvbXByaXNlIHZh cmlvdXMgbnVtYmVyIG9mIGZsb3dzOzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIG8gIGVhY2ggbGluayBpcyBjaGFyYWN0ZXJpemVkIGJ5IGEgY291cGxlIChvbmUtd2F5IGRl bGF5LCBjYXBhY2l0eSk7PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgZWFj aCBsaW5rIGlzIGNoYXJhY3Rlcml6ZWQgYnkgYSBjb3VwbGUgKG9uZS13YXkgZGVsYXksIGNhcGFj aXR5KTs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRp ZmYwMDUzIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA8c3BhbiBjbGFzcz0iZGVsZXRlIj5vICBmbG93cyBhcmUg Z2VuZXJhdGVkIGF0IEEgYW5kIHNlbnQgdG8gQiwgc2hhcmluZyBhIGJvdHRsZW5lY2sgKHRoZTwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICBsaW5rIGJldHdlZW4gcm91 dGVycyBMIGFuZCBSKTs8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlm ZjAwNTQiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgIG8gIHRoZSB0ZXN0ZXIgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+ U0hPVUxEPC9zcGFuPiBjb25zaWRlciBib3RoIHNjZW5hcmlvcyBvZiBhc3ltbWV0cmljIGFuZDwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBvICA8c3BhbiBjbGFzcz0iaW5zZXJ0 Ij5zZW5kZXIgQV9pIGlzIGluc3RhbnRpYXRlZCBmb3IgZWFjaCB0cmFmZmljIHByb2ZpbGUuICBB PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIGNvcnJlc3BvbmRpbmcg cmVjZWl2ZXIgQl9pIGlzIGluc3RhbnRpYXRlZCBmb3IgcmVjZWl2aW5nIHRoZSBmbG93czwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBpbiB0aGUgcHJvZmlsZTs8L3Nw YW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNs YXNzPSJpbnNlcnQiPiAgIG8gIGZsb3dzIHNoYXJpbmcgYSBib3R0bGVuZWNrICh0aGUgbGluayBi ZXR3ZWVuIHJvdXRlcnMgTCBhbmQgUik7PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvPC9zcGFuPiAgdGhl IHRlc3RlciA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+IGNvbnNpZGVyIGJvdGgg c2NlbmFyaW9zIG9mIGFzeW1tZXRyaWMgYW5kPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgICAgc3ltbWV0cmljIGJvdHRsZW5lY2sgbGlua3MgaW4gdGVybXMgb2YgYmFuZHdpZHRoLiAg SW4gY2FzZSBvZjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHN5bW1ldHJp YyBib3R0bGVuZWNrIGxpbmtzIGluIHRlcm1zIG9mIGJhbmR3aWR0aC4gIEluIGNhc2Ugb2Y8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBhc3ltbWV0cmljIGxpbmssIHRoZSBjYXBh Y2l0eSBmcm9tIHNlbmRlcnMgdG8gcmVjZWl2ZXJzIGlzIGhpZ2hlcjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgIGFzeW1tZXRyaWMgbGluaywgdGhlIGNhcGFjaXR5IGZyb20g c2VuZGVycyB0byByZWNlaXZlcnMgaXMgaGlnaGVyPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgdGhhbiB0aGUgb25lIGZyb20gcmVjZWl2ZXJzIHRvIHNlbmRlcnM7IHRoZSBzeW1t ZXRyaWMgbGluazwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHRoYW4gdGhl IG9uZSBmcm9tIHJlY2VpdmVycyB0byBzZW5kZXJzOyB0aGUgc3ltbWV0cmljIGxpbms8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBzY2VuYXJpbyBwcm92aWRlcyBhIGJhc2ljIHVu ZGVyc3RhbmRpbmcgb2YgdGhlIG9wZXJhdGlvbiBvZiB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICBzY2VuYXJpbyBwcm92aWRlcyBhIGJhc2ljIHVuZGVyc3RhbmRpbmcg b2YgdGhlIG9wZXJhdGlvbiBvZiB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAg ICBBUU0gbWVjaGFuaXNtIHdoZXJlYXMgdGhlIGFzeW1tZXRyaWMgbGluayBzY2VuYXJpbyBldmFs dWF0ZXMgYW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBBUU0gbWVjaGFu aXNtIHdoZXJlYXMgdGhlIGFzeW1tZXRyaWMgbGluayBzY2VuYXJpbyBldmFsdWF0ZXMgYW48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBBUU0gbWVjaGFuaXNtIGluIGEgbW9yZSBy ZWFsaXN0aWMgc2V0dXA7PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgQVFN IG1lY2hhbmlzbSBpbiBhIG1vcmUgcmVhbGlzdGljIHNldHVwOzwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNTUiPjx0ZD48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIG8gIGluIGFzeW1tZXRyaWMgbGluayBzY2VuYXJpb3MsIHRoZSB0ZXN0ZXIgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFuPiBzdHVkeSB0aGUgYmktPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIG8gIGluIGFzeW1tZXRyaWMgbGluayBzY2VuYXJpb3MsIHRoZSB0 ZXN0ZXIgPHNwYW4gY2xhc3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPiBzdHVkeSB0aGUgYmktPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgZGlyZWN0aW9uYWwgdHJhZmZpYyBiZXR3 ZWVuIEEgYW5kIEIgKGRvd25saW5rIGFuZCB1cGxpbmspIHdpdGggdGhlPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgZGlyZWN0aW9uYWwgdHJhZmZpYyBiZXR3ZWVuIEEgYW5k IEIgKGRvd25saW5rIGFuZCB1cGxpbmspIHdpdGggdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA1NiI+PHRkPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgQVFN IG1lY2hhbmlzbSBkZXBsb3llZCBvbiBvbmUgZGlyZWN0aW9uIG9ubHkuICBUaGUgdGVzdGVyIDxz cGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgICAgQVFNIG1lY2hhbmlzbSBkZXBsb3llZCBvbiBvbmUgZGlyZWN0aW9uIG9ubHku ICBUaGUgdGVzdGVyIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm1heTwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBhZGRpdGlvbmFsbHkgY29uc2lkZXIgYSBzY2VuYXJpbyB3 aXRoIEFRTSBtZWNoYW5pc20gYmVpbmcgZGVwbG95ZWQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgICBhZGRpdGlvbmFsbHkgY29uc2lkZXIgYSBzY2VuYXJpbyB3aXRoIEFRTSBt ZWNoYW5pc20gYmVpbmcgZGVwbG95ZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHIgaWQ9ImRpZmYwMDU3Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICBvbiBib3RoIGRpcmVj dGlvbnMuICBJbiBlYWNoIHNjZW5hcmlvLCB0aGUgdGVzdGVyIDxzcGFuIGNsYXNzPSJkZWxldGUi PlNIT1VMRDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgb24g Ym90aCBkaXJlY3Rpb25zLiAgSW4gZWFjaCBzY2VuYXJpbywgdGhlIHRlc3RlciA8c3BhbiBjbGFz cz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ICAgaW52ZXN0aWdhdGUgdGhlIGltcGFjdCBvZiBkcm9wIHBvbGljeSBvZiB0aGUgQVFNIG9uIFRD UCBBQ0s8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBpbnZlc3RpZ2F0ZSB0 aGUgaW1wYWN0IG9mIGRyb3AgcG9saWN5IG9mIHRoZSBBUU0gb24gVENQIEFDSzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNTgiPjx0ZD48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPiAgICAgIHBhY2tldHMgYW5kIGl0cyBpbXBhY3Qgb24gdGhlIHBlcmZvcm1hbmNlLjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICBwYWNrZXRzIGFuZCBpdHMgaW1wYWN0 IG9uIHRoZSBwZXJmb3JtYW5jZTxzcGFuIGNsYXNzPSJpbnNlcnQiPiAoU2VjdGlvbiA5LjIpPC9z cGFuPi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBBbHRob3VnaCB0aGlz IHRvcG9sb2d5IG1heSBub3QgcGVyZmVjdGx5IHJlZmxlY3QgYWN0dWFsIHRvcG9sb2dpZXMsPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQWx0aG91Z2ggdGhpcyB0b3BvbG9neSBt YXkgbm90IHBlcmZlY3RseSByZWZsZWN0IGFjdHVhbCB0b3BvbG9naWVzLDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSBzaW1wbGUgdG9wb2xvZ3kgaXMgY29tbW9ubHkgdXNlZCBp biB0aGUgd29ybGQgb2Ygc2ltdWxhdGlvbnMgYW5kPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgdGhlIHNpbXBsZSB0b3BvbG9neSBpcyBjb21tb25seSB1c2VkIGluIHRoZSB3b3Js ZCBvZiBzaW11bGF0aW9ucyBhbmQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzbWFs bCB0ZXN0YmVkcy4gIEl0IGNhbiBiZSBjb25zaWRlcmVkIGFzIGFkZXF1YXRlIHRvIGV2YWx1YXRl IEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNtYWxsIHRlc3RiZWRzLiAg SXQgY2FuIGJlIGNvbnNpZGVyZWQgYXMgYWRlcXVhdGUgdG8gZXZhbHVhdGUgQVFNPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA1OSI+PHRkPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+cHJvcG9zYWxzLCBzaW1pbGFybHkgdG8gdGhl IHRvcG9sb2d5IHByb3Bvc2VkIGluPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5wcm9wb3NhbHM8L3NwYW4+IFtJLUQuaXJ0Zi1p Y2NyZy10Y3BldmFsXS4gIFRlc3RlcnMgb3VnaHQgdG8gcGF5IGF0dGVudGlvbjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgW0ktRC5pcnRmLWljY3JnLXRjcGV2YWxdLiAgVGVzdGVy cyBvdWdodCB0byBwYXkgYXR0ZW50aW9uIHRvIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj4gICB0byB0aGUgdG9wb2xvZ3kgdGhhdCBoYXMgYmVlbiB1c2VkIHRvIGV2YWx1YXRl IGFuIEFRTSBzY2hlbWUgd2hlbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdG9w b2xvZ3kgdGhhdCBoYXMgYmVlbiB1c2VkIHRvIGV2YWx1YXRlIGFuIEFRTSBzY2hlbWUgd2hlbiBj b21wYXJpbmc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgY29tcGFyaW5nIHRo aXMgc2NoZW1lIHdpdGggYSBuZXdseSBwcm9wb3NlZCBBUU0gc2NoZW1lLjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgdGhpcyBzY2hlbWUgd2l0aCBhIG5ld2x5IHByb3Bvc2VkIEFR TSBzY2hlbWUuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjMuMi4gIEJ1ZmZlciBzaXplPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+My4yLiAgQnVmZmVyIHNpemU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDYwIj48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBU aGUgc2l6ZSBvZiB0aGUgYnVmZmVycyBzaG91bGQgYmUgY2FyZWZ1bGx5IGNob3NlbiwgYW5kIDxz cGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj4gYmUgc2V0IHRvPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIFRoZSBzaXplIG9mIHRoZSBidWZmZXJzIHNob3VsZCBiZSBjYXJl ZnVsbHkgY2hvc2VuLCBhbmQgPHNwYW4gY2xhc3M9Imluc2VydCI+bWF5PC9zcGFuPiBiZSBzZXQg dG88L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0aGUgYmFuZHdpZHRoLWRlbGF5IHBy b2R1Y3Q7IHRoZSBiYW5kd2lkdGggYmVpbmcgdGhlIGJvdHRsZW5lY2s8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgYmFuZHdpZHRoLWRlbGF5IHByb2R1Y3Q7IHRoZSBiYW5k d2lkdGggYmVpbmcgdGhlIGJvdHRsZW5lY2s8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBjYXBhY2l0eSBhbmQgdGhlIGRlbGF5IHRoZSBsYXJnZXN0IFJUVCBpbiB0aGUgY29uc2lkZXJl ZCBuZXR3b3JrLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNhcGFjaXR5IGFu ZCB0aGUgZGVsYXkgdGhlIGxhcmdlc3QgUlRUIGluIHRoZSBjb25zaWRlcmVkIG5ldHdvcmsuPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIHNpemUgb2YgdGhlIGJ1ZmZlciBjYW4g aW1wYWN0IHRoZSBBUU0gcGVyZm9ybWFuY2UgYW5kIGlzIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICBUaGUgc2l6ZSBvZiB0aGUgYnVmZmVyIGNhbiBpbXBhY3QgdGhlIEFRTSBw ZXJmb3JtYW5jZSBhbmQgaXMgYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRpbWVu c2lvbmluZyBwYXJhbWV0ZXIgdGhhdCB3aWxsIGJlIGNvbnNpZGVyZWQgd2hlbiBjb21wYXJpbmcg QVFNPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZGltZW5zaW9uaW5nIHBhcmFt ZXRlciB0aGF0IHdpbGwgYmUgY29uc2lkZXJlZCB3aGVuIGNvbXBhcmluZyBBUU08L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBwcm9wb3NhbHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgcHJvcG9zYWxzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNjEiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIElmIGEgc3BlY2lm aWMgYnVmZmVyIHNpemUgaXMgcmVxdWlyZWQsIHRoZSB0ZXN0ZXIgPHNwYW4gY2xhc3M9ImRlbGV0 ZSI+TVVTVDwvc3Bhbj4ganVzdGlmeSBhbmQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgSWYgYSBzcGVjaWZpYyBidWZmZXIgc2l6ZSBpcyByZXF1aXJlZCwgdGhlIHRlc3RlciA8 c3BhbiBjbGFzcz0iaW5zZXJ0Ij5tdXN0PC9zcGFuPiBqdXN0aWZ5IGFuZDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIGRldGFpbCB0aGUgd2F5IHRoZSBtYXhpbXVtIHF1ZXVlIHNpemUg aXMgc2V0LiAgSW5kZWVkLCB0aGUgbWF4aW11bTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGRldGFpbCB0aGUgd2F5IHRoZSBtYXhpbXVtIHF1ZXVlIHNpemUgaXMgc2V0LiAgSW5k ZWVkLCB0aGUgbWF4aW11bTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHNpemUgb2Yg dGhlIGJ1ZmZlciBtYXkgYWZmZWN0IHRoZSBBUU0ncyBwZXJmb3JtYW5jZSBhbmQgaXRzIGNob2lj ZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNpemUgb2YgdGhlIGJ1ZmZlciBt YXkgYWZmZWN0IHRoZSBBUU0ncyBwZXJmb3JtYW5jZSBhbmQgaXRzIGNob2ljZTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNjIiPjx0ZD48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gYmUgZWxhYm9yYXRlZCBm b3IgYSBmYWlyIGNvbXBhcmlzb24gYmV0d2VlbiBBUU0gcHJvcG9zYWxzLjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+ IGJlIGVsYWJvcmF0ZWQgZm9yIGEgZmFpciBjb21wYXJpc29uIGJldHdlZW4gQVFNIHByb3Bvc2Fs cy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFdoaWxlIGNvbXBhcmluZyBBUU0g c2NoZW1lcyB0aGUgYnVmZmVyIHNpemUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFu PiByZW1haW4gdGhlIHNhbWU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgV2hp bGUgY29tcGFyaW5nIEFRTSBzY2hlbWVzIHRoZSBidWZmZXIgc2l6ZSA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij5zaG91bGQ8L3NwYW4+IHJlbWFpbiB0aGUgc2FtZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGFjcm9zcyB0aGUgdGVzdHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgYWNyb3NzIHRoZSB0ZXN0cy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4zLjMuICBDb25nZXN0aW9uIGNvbnRyb2xzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+My4zLiAgQ29uZ2VzdGlvbiBjb250cm9sczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIFRoaXMgZG9jdW1lbnQgY29uc2lkZXJzIHJ1bm5pbmcgdGhyZWUgZGlmZmVyZW50 IGNvbmdlc3Rpb24gY29udHJvbDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRo aXMgZG9jdW1lbnQgY29uc2lkZXJzIHJ1bm5pbmcgdGhyZWUgZGlmZmVyZW50IGNvbmdlc3Rpb24g Y29udHJvbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFsZ29yaXRobXMgYmV0d2Vl biBBIGFuZCBCPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYWxnb3JpdGhtcyBi ZXR3ZWVuIEEgYW5kIEI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHIgaWQ9ImRpZmYwMDYzIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvc3Bhbj48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBTdGFuZGFyZCBUQ1AgY29uZ2VzdGlvbiBjb250 cm9sOiB0aGUgYmFzZS1saW5lIGNvbmdlc3Rpb24gY29udHJvbDwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIG8gIFN0YW5kYXJkIFRDUCBjb25nZXN0aW9uIGNvbnRyb2w6IHRoZSBi YXNlLWxpbmUgY29uZ2VzdGlvbiBjb250cm9sPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA2NCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgaXMgVENQIE5l d1Jlbm8gd2l0aCBTQUNLPHNwYW4gY2xhc3M9ImRlbGV0ZSI+LCBhcyBleHBsYWluZWQgaW48L3Nw YW4+IFtSRkM1NjgxXS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgaXMg VENQIE5ld1Jlbm8gd2l0aCBTQUNLIFtSRkM1NjgxXS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBvICBBZ2dyZXNzaXZlIGNvbmdlc3Rpb24gY29udHJvbHM6IGEgYmFzZS1s aW5lIGNvbmdlc3Rpb24gY29udHJvbCBmb3I8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBBZ2dyZXNzaXZlIGNvbmdlc3Rpb24gY29udHJvbHM6IGEgYmFzZS1saW5lIGNvbmdl c3Rpb24gY29udHJvbCBmb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB0aGlz IGNhdGVnb3J5IGlzIFRDUCBDdWJpYyBbSS1ELmlldGYtdGNwbS1jdWJpY10uPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgdGhpcyBjYXRlZ29yeSBpcyBUQ1AgQ3ViaWMgW0kt RC5pZXRmLXRjcG0tY3ViaWNdLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IG8gIExlc3MtdGhhbiBCZXN0IEVmZm9ydCAoTEJFKSBjb25nZXN0aW9uIGNvbnRyb2xzOiBhbiBM QkUgY29uZ2VzdGlvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIExlc3Mt dGhhbiBCZXN0IEVmZm9ydCAoTEJFKSBjb25nZXN0aW9uIGNvbnRyb2xzOiBhbiBMQkUgY29uZ2Vz dGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIGNvbnRyb2wgJ3Jlc3VsdHMg aW4gc21hbGxlciBiYW5kd2lkdGggYW5kL29yIGRlbGF5IGltcGFjdCBvbjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGNvbnRyb2wgJ3Jlc3VsdHMgaW4gc21hbGxlciBiYW5k d2lkdGggYW5kL29yIGRlbGF5IGltcGFjdCBvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgICAgIHN0YW5kYXJkIFRDUCB0aGFuIHN0YW5kYXJkIFRDUCBpdHNlbGYsIHdoZW4gc2hhcmlu ZyBhIGJvdHRsZW5lY2s8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBzdGFu ZGFyZCBUQ1AgdGhhbiBzdGFuZGFyZCBUQ1AgaXRzZWxmLCB3aGVuIHNoYXJpbmcgYSBib3R0bGVu ZWNrPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZm MDA2NSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgICAgd2l0aCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5pdC4nICBb UkZDNjI5N108L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgIHdp dGggPHNwYW4gY2xhc3M9Imluc2VydCI+aXQuJzogYSBiYXNlLWxpbmUgY29uZ2VzdGlvbiBjb250 cm9sIGZvciB0aGlzIGNhdGVnb3J5IGlzPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgICAgIExFREJBVCBbUkZDNjgxN10uPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIE90aGVyIHRyYW5zcG9ydCBjb25nZXN0aW9uIGNvbnRyb2xzIGNhbiBP UFRJT05BTExZIGJlIGV2YWx1YXRlZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIE90aGVyIHRyYW5zcG9ydCBjb25nZXN0aW9uIGNvbnRyb2xzIGNhbiBPUFRJT05BTExZIGJl IGV2YWx1YXRlZCBpbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFkZGl0aW9uLiAg UmVjZW50IHRyYW5zcG9ydCBsYXllciBwcm90b2NvbHMgYXJlIG5vdCBtZW50aW9uZWQgaW4gdGhl PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYWRkaXRpb24uICBSZWNlbnQgdHJh bnNwb3J0IGxheWVyIHByb3RvY29scyBhcmUgbm90IG1lbnRpb25lZCBpbiB0aGU8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBmb2xsb3dpbmcgc2VjdGlvbnMsIGZvciB0aGUgc2FrZSBv ZiBzaW1wbGljaXR5LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGZvbGxvd2lu ZyBzZWN0aW9ucywgZm9yIHRoZSBzYWtlIG9mIHNpbXBsaWNpdHkuPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+NC4gIE1ldGhvZG9sb2d5LCBNZXRyaWNzLCBBUU0gQ29tcGFyaXNv bnMsIFBhY2tldCBTaXplcywgU2NoZWR1bGluZyBhbmQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij40LiAgTWV0aG9kb2xvZ3ksIE1ldHJpY3MsIEFRTSBDb21wYXJpc29ucywgUGFja2V0 IFNpemVzLCBTY2hlZHVsaW5nIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICBF Q048L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgRUNOPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+NC4xLiAgTWV0aG9kb2xvZ3k8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij40LjEuICBNZXRob2RvbG9neTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNjYiPjx0ZD48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIEEg ZGVzY3JpcHRpb24gb2YgZWFjaCB0ZXN0IHNldHVwIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VM RDwvc3Bhbj4gYmUgZGV0YWlsZWQgdG8gYWxsb3cgdGhpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBBIGRlc2NyaXB0aW9uIG9mIGVhY2ggdGVzdCBzZXR1cCA8c3BhbiBjbGFz cz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+IGJlIGRldGFpbGVkIHRvIGFsbG93IHRoaXM8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0ZXN0IHRvIGJlIGNvbXBhcmVkIHdpdGggb3RoZXIg dGVzdHMuICBUaGlzIGFsc28gYWxsb3dzIG90aGVycyB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHRlc3QgdG8gYmUgY29tcGFyZWQgd2l0aCBvdGhlciB0ZXN0cy4gIFRoaXMg YWxzbyBhbGxvd3Mgb3RoZXJzIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyIGlkPSJkaWZmMDA2NyI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcmVwbGljYXRlIHRoZSB0ZXN0 cyBpZiBuZWVkZWQuICBUaGlzIHRlc3Qgc2V0dXAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxE PC9zcGFuPiBkZXRhaWw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgcmVwbGlj YXRlIHRoZSB0ZXN0cyBpZiBuZWVkZWQuICBUaGlzIHRlc3Qgc2V0dXAgPHNwYW4gY2xhc3M9Imlu c2VydCI+c2hvdWxkPC9zcGFuPiBkZXRhaWw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBzb2Z0d2FyZSBhbmQgaGFyZHdhcmUgdmVyc2lvbnMuICBUaGUgdGVzdGVyIGNvdWxkIG1ha2Ug aXRzIGRhdGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzb2Z0d2FyZSBhbmQg aGFyZHdhcmUgdmVyc2lvbnMuICBUaGUgdGVzdGVyIGNvdWxkIG1ha2UgaXRzIGRhdGE8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhdmFpbGFibGUuPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgYXZhaWxhYmxlLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNjgiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRoZSBwcm9w b3NhbHMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEIGJlIGV2YWx1YXRlZCBvbiByZWFsLWxp ZmUgc3lzdGVtcywgb3IgdGhleSBNQVk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPiAgIFRoZSBwcm9wb3NhbHMgPHNwYW4gY2xhc3M9Imluc2VydCI+c2hvdWxkIGJlIGV2 YWx1YXRlZCBvbiByZWFsLWxpZmUgc3lzdGVtcywgb3IgdGhleSBtYXk8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYmUgZXZhbHVhdGVkIHdpdGggZXZlbnQtZHJpdmVuIHNp bXVsYXRpb25zIChzdWNoIGFzIG5zLTIsIG5zLTMsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgYmUgZXZhbHVhdGVkIHdpdGggZXZlbnQtZHJpdmVuIHNpbXVsYXRpb25zIChzdWNo IGFzIG5zLTIsIG5zLTMsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgT01ORVQsIGV0 YykuICBUaGUgcHJvcG9zZWQgc2NlbmFyaW9zIGFyZSBub3QgYm91bmQgdG8gYSBwYXJ0aWN1bGFy PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgT01ORVQsIGV0YykuICBUaGUgcHJv cG9zZWQgc2NlbmFyaW9zIGFyZSBub3QgYm91bmQgdG8gYSBwYXJ0aWN1bGFyPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgZXZhbHVhdGlvbiB0b29sc2V0LjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGV2YWx1YXRpb24gdG9vbHNldC48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGUgdGVzdGVyIGlzIGVuY291cmFnZWQgdG8gbWFrZSB0aGUg ZGV0YWlsZWQgdGVzdCBzZXR1cCBhbmQgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgVGhlIHRlc3RlciBpcyBlbmNvdXJhZ2VkIHRvIG1ha2UgdGhlIGRldGFpbGVkIHRlc3Qg c2V0dXAgYW5kIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHJlc3VsdHMgcHVi bGljbHkgYXZhaWxhYmxlLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHJlc3Vs dHMgcHVibGljbHkgYXZhaWxhYmxlLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjQuMi4gIENvbW1lbnRzIG9uIG1ldHJpY3MgbWVhc3VyZW1lbnQ8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij40LjIuICBDb21tZW50cyBvbiBtZXRyaWNzIG1lYXN1cmVtZW50PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIGRvY3VtZW50IHByZXNlbnRzIHRo ZSBlbmQtdG8tZW5kIG1ldHJpY3MgdGhhdCBvdWdodCB0byBiZSB1c2VkIHRvPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhlIGRvY3VtZW50IHByZXNlbnRzIHRoZSBlbmQtdG8t ZW5kIG1ldHJpY3MgdGhhdCBvdWdodCB0byBiZSB1c2VkIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgZXZhbHVhdGUgdGhlIHRyYWRlLW9mZiBiZXR3ZWVuIGxhdGVuY3kgYW5kIGdv b2RwdXQgaW4gU2VjdGlvbiAyLiAgSW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBldmFsdWF0ZSB0aGUgdHJhZGUtb2ZmIGJldHdlZW4gbGF0ZW5jeSBhbmQgZ29vZHB1dCBpbiBT ZWN0aW9uIDIuICBJbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFkZGl0aW9uIHRv IHRoZSBlbmQtdG8tZW5kIG1ldHJpY3MsIHRoZSBxdWV1ZS1sZXZlbCBtZXRyaWNzIChub3JtYWxs eTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFkZGl0aW9uIHRvIHRoZSBlbmQt dG8tZW5kIG1ldHJpY3MsIHRoZSBxdWV1ZS1sZXZlbCBtZXRyaWNzIChub3JtYWxseTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGNvbGxlY3RlZCBhdCB0aGUgZGV2aWNlIG9wZXJhdGlu ZyB0aGUgQVFNKSBwcm92aWRlIGEgYmV0dGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgY29sbGVjdGVkIGF0IHRoZSBkZXZpY2Ugb3BlcmF0aW5nIHRoZSBBUU0pIHByb3ZpZGUg YSBiZXR0ZXI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB1bmRlcnN0YW5kaW5nIG9m IHRoZSBBUU0gYmVoYXZpb3IgdW5kZXIgc3R1ZHkgYW5kIHRoZSBpbXBhY3Qgb2YgaXRzPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdW5kZXJzdGFuZGluZyBvZiB0aGUgQVFNIGJl aGF2aW9yIHVuZGVyIHN0dWR5IGFuZCB0aGUgaW1wYWN0IG9mIGl0czwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIGludGVybmFsIHBhcmFtZXRlcnMuICBXaGVuZXZlciBpdCBpcyBwb3Nz aWJsZSAoZS5nLiwgZGVwZW5kaW5nIG9uIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGludGVybmFsIHBhcmFtZXRlcnMuICBXaGVuZXZlciBpdCBpcyBwb3NzaWJsZSAoZS5n LiwgZGVwZW5kaW5nIG9uIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0ciBpZD0iZGlmZjAwNjkiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGZlYXR1cmVzIHByb3ZpZGVkIGJ5 IHRoZSBoYXJkd2FyZS9zb2Z0d2FyZSksIHRoZXNlIGd1aWRlbGluZXMgYWR2aTxzcGFuIGNsYXNz PSJkZWxldGUiPmM8L3NwYW4+ZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBm ZWF0dXJlcyBwcm92aWRlZCBieSB0aGUgaGFyZHdhcmUvc29mdHdhcmUpLCB0aGVzZSBndWlkZWxp bmVzIGFkdmk8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zPC9zcGFuPmU8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICB0byBjb25zaWRlciBxdWV1ZS1sZXZlbCBtZXRyaWNzLCBzdWNoIGFzIGxp bmsgdXRpbGl6YXRpb24sIHF1ZXVpbmc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICB0byBjb25zaWRlciBxdWV1ZS1sZXZlbCBtZXRyaWNzLCBzdWNoIGFzIGxpbmsgdXRpbGl6YXRp b24sIHF1ZXVpbmc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkZWxheSwgcXVldWUg c2l6ZSBvciBwYWNrZXQgZHJvcC9tYXJrIHN0YXRpc3RpY3MgaW4gYWRkaXRpb24gdG8gdGhlPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZGVsYXksIHF1ZXVlIHNpemUgb3IgcGFj a2V0IGRyb3AvbWFyayBzdGF0aXN0aWNzIGluIGFkZGl0aW9uIHRvIHRoZTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNzAiPjx0ZD48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIEFRTS1zcGVjaWZpYyBwYXJhbWV0ZXJzLiAgSG93ZXZlciwgdGhlIGV2YWx1YXRpb24gPHNw YW4gY2xhc3M9ImRlbGV0ZSI+TVVTVDwvc3Bhbj4gYmUgcHJpbWFyaWx5PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIEFRTS1zcGVjaWZpYyBwYXJhbWV0ZXJzLiAgSG93ZXZlciwg dGhlIGV2YWx1YXRpb24gPHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gYmUgcHJpbWFy aWx5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYmFzZWQgb24gZXh0ZXJuYWxseSBv YnNlcnZlZCBlbmQtdG8tZW5kIG1ldHJpY3MuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgYmFzZWQgb24gZXh0ZXJuYWxseSBvYnNlcnZlZCBlbmQtdG8tZW5kIG1ldHJpY3MuPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlc2UgZ3VpZGVsaW5lcyBkbyBu b3QgYWltIHRvIGRldGFpbCBvbiB0aGUgd2F5IHRoZXNlIG1ldHJpY3MgY2FuIGJlPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhlc2UgZ3VpZGVsaW5lcyBkbyBub3QgYWltIHRv IGRldGFpbCBvbiB0aGUgd2F5IHRoZXNlIG1ldHJpY3MgY2FuIGJlPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgbWVhc3VyZWQsIHNpbmNlIHRoZSB3YXkgdGhlc2UgbWV0cmljcyBhcmUg bWVhc3VyZWQgaXMgZXhwZWN0ZWQgdG88L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBtZWFzdXJlZCwgc2luY2UgdGhlIHdheSB0aGVzZSBtZXRyaWNzIGFyZSBtZWFzdXJlZCBpcyBl eHBlY3RlZCB0bzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRlcGVuZCBvbiB0aGUg ZXZhbHVhdGlvbiB0b29sc2V0LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRl cGVuZCBvbiB0aGUgZXZhbHVhdGlvbiB0b29sc2V0LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjQuMy4gIENvbXBhcmluZyBBUU0gc2NoZW1lczwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjQuMy4gIENvbXBhcmluZyBBUU0gc2NoZW1lczwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgZG9jdW1lbnQgcmVjb2duaXplcyB0aGF0IHRoZXNl IGd1aWRlbGluZXMgbWF5IGJlIHVzZWQgZm9yPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgVGhpcyBkb2N1bWVudCByZWNvZ25pemVzIHRoYXQgdGhlc2UgZ3VpZGVsaW5lcyBtYXkg YmUgdXNlZCBmb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb21wYXJpbmcgQVFN IHNjaGVtZXMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY29tcGFyaW5nIEFR TSBzY2hlbWVzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEFRTSBzY2hl bWVzIG5lZWQgdG8gYmUgY29tcGFyZWQgYWdhaW5zdCBib3RoIHBlcmZvcm1hbmNlIGFuZDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEFRTSBzY2hlbWVzIG5lZWQgdG8gYmUgY29t cGFyZWQgYWdhaW5zdCBib3RoIHBlcmZvcm1hbmNlIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGRlcGxveW1lbnQgY2F0ZWdvcmllcy4gIEluIGFkZGl0aW9uLCB0aGlzIHNlY3Rp b24gZGV0YWlscyBob3cgYmVzdCB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IGRlcGxveW1lbnQgY2F0ZWdvcmllcy4gIEluIGFkZGl0aW9uLCB0aGlzIHNlY3Rpb24gZGV0YWls cyBob3cgYmVzdCB0bzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFjaGlldmUgYSBm YWlyIGNvbXBhcmlzb24gb2YgQVFNIHNjaGVtZXMgYnkgYXZvaWRpbmcgY2VydGFpbjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFjaGlldmUgYSBmYWlyIGNvbXBhcmlzb24gb2Yg QVFNIHNjaGVtZXMgYnkgYXZvaWRpbmcgY2VydGFpbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIHBpdGZhbGxzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHBpdGZh bGxzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjQuMy4xLiAgUGVyZm9ybWFu Y2UgY29tcGFyaXNvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjQuMy4xLiAgUGVy Zm9ybWFuY2UgY29tcGFyaXNvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IEFRTSBzY2hlbWVzIHNob3VsZCBiZSBjb21wYXJlZCBhZ2FpbnN0IHRoZSBnZW5lcmljIHNjZW5h cmlvcyB0aGF0IGFyZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEFRTSBzY2hl bWVzIHNob3VsZCBiZSBjb21wYXJlZCBhZ2FpbnN0IHRoZSBnZW5lcmljIHNjZW5hcmlvcyB0aGF0 IGFyZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlm ZjAwNzEiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgIHN1bW1hcml6ZWQgaW4gU2VjdGlvbiAxMy4gIEFRTSBzY2hl bWVzIDxzcGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj4gYmUgY29tcGFyZWQgZm9yIHNwZWNp ZmljPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHN1bW1hcml6ZWQgaW4gU2Vj dGlvbiAxMy4gIEFRTSBzY2hlbWVzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm1heTwvc3Bhbj4gYmUg Y29tcGFyZWQgZm9yIHNwZWNpZmljPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbmV0 d29yayBlbnZpcm9ubWVudHMgc3VjaCBhcyBkYXRhIGNlbnRlcnMsIGhvbWUgbmV0d29ya3MsIGV0 Yy4gIElmIGFuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbmV0d29yayBlbnZp cm9ubWVudHMgc3VjaCBhcyBkYXRhIGNlbnRlcnMsIGhvbWUgbmV0d29ya3MsIGV0Yy4gIElmIGFu PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgQVFNIHNjaGVtZSBoYXMgcGFyYW1ldGVy KHMpIHRoYXQgd2VyZSBleHRlcm5hbGx5IHR1bmVkIGZvcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIEFRTSBzY2hlbWUgaGFzIHBhcmFtZXRlcihzKSB0aGF0IHdlcmUgZXh0ZXJu YWxseSB0dW5lZCBmb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHIgaWQ9ImRpZmYwMDcyIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBvcHRpbWl6YXRpb24gb3Igb3RoZXIgcHVy cG9zZXMsIHRoZXNlIHZhbHVlcyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBiZSBk aXNjbG9zZWQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIG9wdGltaXphdGlv biBvciBvdGhlciBwdXJwb3NlcywgdGhlc2UgdmFsdWVzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm11 c3Q8L3NwYW4+IGJlIGRpc2Nsb3NlZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBBUU0gc2NoZW1lcyBiZWxvbmcgdG8gZGlmZmVyZW50IHZhcmlldGllcyBzdWNoIGFzIHF1 ZXVlLWxlbmd0aCBiYXNlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEFRTSBz Y2hlbWVzIGJlbG9uZyB0byBkaWZmZXJlbnQgdmFyaWV0aWVzIHN1Y2ggYXMgcXVldWUtbGVuZ3Ro IGJhc2VkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc2NoZW1lcyAoZXguICBSRUQp IG9yIHF1ZXVlaW5nLWRlbGF5IGJhc2VkIHNjaGVtZSAoZXguICBDb0RlbCwgUElFKS48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzY2hlbWVzIChleC4gIFJFRCkgb3IgcXVldWVp bmctZGVsYXkgYmFzZWQgc2NoZW1lIChleC4gIENvRGVsLCBQSUUpLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIEFRTSBzY2hlbWVzIGV4cG9zZSBkaWZmZXJlbnQgY29udHJvbCBrbm9i cyBhc3NvY2lhdGVkIHdpdGggZGlmZmVyZW50PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgQVFNIHNjaGVtZXMgZXhwb3NlIGRpZmZlcmVudCBjb250cm9sIGtub2JzIGFzc29jaWF0 ZWQgd2l0aCBkaWZmZXJlbnQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzZW1hbnRp Y3MuICBGb3IgZXhhbXBsZSwgd2hpbGUgYm90aCBQSUUgYW5kIENvRGVsIGFyZSBxdWV1ZWluZy1k ZWxheTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNlbWFudGljcy4gIEZvciBl eGFtcGxlLCB3aGlsZSBib3RoIFBJRSBhbmQgQ29EZWwgYXJlIHF1ZXVlaW5nLWRlbGF5PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYmFzZWQgc2NoZW1lcyBhbmQgZWFjaCBleHBvc2Ug YSBrbm9iIHRvIGNvbnRyb2wgdGhlIHF1ZXVlaW5nIGRlbGF5IC0tPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgYmFzZWQgc2NoZW1lcyBhbmQgZWFjaCBleHBvc2UgYSBrbm9iIHRv IGNvbnRyb2wgdGhlIHF1ZXVlaW5nIGRlbGF5IC0tPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgUElFJ3MgInF1ZXVlaW5nIGRlbGF5IHJlZmVyZW5jZSIgdnMuIENvRGVsJ3MgInF1ZXVl aW5nIGRlbGF5IHRhcmdldCIsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgUElF J3MgInF1ZXVlaW5nIGRlbGF5IHJlZmVyZW5jZSIgdnMuIENvRGVsJ3MgInF1ZXVlaW5nIGRlbGF5 IHRhcmdldCIsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGhlIHR3byB0dW5pbmcg cGFyYW1ldGVycyBvZiB0aGUgdHdvIHNjaGVtZXMgaGF2ZSBkaWZmZXJlbnQ8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgdHdvIHR1bmluZyBwYXJhbWV0ZXJzIG9mIHRoZSB0 d28gc2NoZW1lcyBoYXZlIGRpZmZlcmVudDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IHNlbWFudGljcywgcmVzdWx0aW5nIGluIGRpZmZlcmVudCBjb250cm9sIHBvaW50cy4gIFN1Y2gg ZGlmZmVyZW5jZXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzZW1hbnRpY3Ms IHJlc3VsdGluZyBpbiBkaWZmZXJlbnQgY29udHJvbCBwb2ludHMuICBTdWNoIGRpZmZlcmVuY2Vz PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW4gQVFNIHNjaGVtZXMgY2FuIGJlIGVh c2lseSBvdmVybG9va2VkIHdoaWxlIG1ha2luZyBjb21wYXJpc29ucy48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBpbiBBUU0gc2NoZW1lcyBjYW4gYmUgZWFzaWx5IG92ZXJsb29r ZWQgd2hpbGUgbWFraW5nIGNvbXBhcmlzb25zLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwNzMiPjx0ZD48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRoaXMg ZG9jdW1lbnQgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+UkVDT01NRU5EUzwvc3Bhbj4gdGhlIGZvbGxv d2luZyBwcm9jZWR1cmVzIGZvciBhIGZhaXI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgVGhpcyBkb2N1bWVudCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZWNvbW1lbmRzPC9zcGFu PiB0aGUgZm9sbG93aW5nIHByb2NlZHVyZXMgZm9yIGEgZmFpcjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIHBlcmZvcm1hbmNlIGNvbXBhcmlzb24gYmV0d2VlbiB0aGUgQVFNIHNjaGVt ZXM6PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcGVyZm9ybWFuY2UgY29tcGFy aXNvbiBiZXR3ZWVuIHRoZSBBUU0gc2NoZW1lczo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDc0Ij48dGQ+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAxLiAg PHNwYW4gY2xhc3M9ImRlbGV0ZSI+Y29tcGFyYWJsZTwvc3Bhbj4gY29udHJvbCBwYXJhbWV0ZXJz IGFuZCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5jb21wYXJhYmxlIGlucHV0IHZhbHVlczo8L3NwYW4+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDEuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij5zaW1pbGFyPC9zcGFuPiBjb250cm9sIHBhcmFtZXRlcnMgYW5kIDxzcGFuIGNsYXNzPSJp bnNlcnQiPmltcGxpY2F0aW9uczogVGVzdGVycyBzaG91bGQgYmU8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgY2FyZWZ1bGx5 IGlkZW50aWZ5IHRoZSBzZXQ8L3NwYW4+IG9mIHBhcmFtZXRlcnMgdGhhdCBjb250cm9sIHNpbWls YXI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ ICAgICAgIGF3YXJlPC9zcGFuPiBvZiA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij50aGUgY29udHJvbDwv c3Bhbj4gcGFyYW1ldGVycyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5vZiB0aGUgZGlmZmVyZW50IHNj aGVtZXM8L3NwYW4+IHRoYXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5iZWhhdmlvciBiZXR3ZWVuPC9zcGFuPiB0aGUgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+dHdvIEFRTSBzY2hlbWVzIGFuZCBlbnN1cmUgdGhlc2UgcGFyYW1ldGVyczwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgIGNvbnRyb2wgc2lt aWxhciA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5iZWhhdmlvci4gIFRlc3RlcnMgc2hvdWxkIGFsc28g YmUgYXdhcmUgb2Y8L3NwYW4+IHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNw YW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgIGhhdmUgY29tcGFyYWJsZTwvc3Bhbj4gaW5wdXQgPHNw YW4gY2xhc3M9ImRlbGV0ZSI+dmFsdWVzLjwvc3Bhbj4gIEZvciBleGFtcGxlLCA8c3BhbiBjbGFz cz0iZGVsZXRlIj50byBjb21wYXJlIGhvdyB3ZWxsIGE8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgICBpbnB1dCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij52YWx1ZSBy YW5nZXMgYW5kIGNvcnJlc3BvbmRpbmcgaW1wbGljYXRpb25zLjwvc3Bhbj4gIEZvciBleGFtcGxl LDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgIHF1ZXVlLWxlbmd0aCBiYXNl ZCBBUU0gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+c2NoZW1lIGNvbnRyb2xzIHF1ZXVlaW5nIGRlbGF5 IHZzLiBhPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgPHNw YW4gY2xhc3M9Imluc2VydCI+Y29uc2lkZXIgdHdvIGRpZmZlcmVudCBzY2hlbWVzIC0gKEEpPC9z cGFuPiBxdWV1ZS1sZW5ndGggYmFzZWQgQVFNPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICAgICAgcXVldWVpbmctZGVsYXkgYmFzZWQgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+QVFNIHNj aGVtZSwgYSB0ZXN0ZXIgY2FuIGlkZW50aWZ5IHRoZTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+ICAgICAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNjaGVtZSwgYW5kIChC KTwvc3Bhbj4gcXVldWVpbmctZGVsYXkgYmFzZWQgPHNwYW4gY2xhc3M9Imluc2VydCI+c2NoZW1l LiAgQSBhbmQgQiBhcmUgbGlrZWx5PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgIHBhcmFtZXRlcnM8L3NwYW4+IG9mIDxzcGFu IGNsYXNzPSJkZWxldGUiPnRoZSBzY2hlbWVzIHRoYXQ8L3NwYW4+IGNvbnRyb2wgcXVldWUgZGVs YXkgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+YW5kIGVuc3VyZTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgIHRvIGhhdmUgZGlm ZmVyZW50IGtpbmRzPC9zcGFuPiBvZiBjb250cm9sIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmlucHV0 cyB0byBjb250cm9sIHRoZSB0YXJnZXQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgdGhhdCB0aGVpciBpbnB1dDwvc3Bhbj4g dmFsdWVzIDxzcGFuIGNsYXNzPSJkZWxldGUiPmFyZSBjb21wYXJhYmxlLiAgU2ltaWxhcmx5LCB0 byBjb21wYXJlPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBj bGFzcz0iaW5zZXJ0Ij4gICAgICAgZGVsYXkgLSB0YXJnZXQ8L3NwYW4+IHF1ZXVlIDxzcGFuIGNs YXNzPSJpbnNlcnQiPmxlbmd0aCBpbiBBIHZzLiB0YXJnZXQgcXVldWluZzwvc3Bhbj4gZGVsYXkg PHNwYW4gY2xhc3M9Imluc2VydCI+aW4gQiw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgaG93IHdlbGwgdHdvIEFRTSBzY2hl bWVzIGFjY29tbW9kYXRlIHBhY2tldCBidXJzdHMsIHRoZSB0ZXN0ZXI8L3NwYW4+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICBmb3Ig ZXhhbXBsZS4gIFNldHRpbmcgcGFyYW1ldGVyPC9zcGFuPiB2YWx1ZXMgPHNwYW4gY2xhc3M9Imlu c2VydCI+c3VjaCBhcyAxMDBNQiBmb3IgQSB2cy48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgY2FuIGlkZW50aWZ5IGJ1cnN0 LXJlbGF0ZWQgY29udHJvbCBwYXJhbWV0ZXJzIGFuZCBlbnN1cmUgdGhleSBhcmU8L3NwYW4+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAg ICAxMG1zIGZvciBCIHdpbGwgaGF2ZSBkaWZmZXJlbnQgaW1wbGljYXRpb25zIGRlcGVuZGluZyBv bjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxl dGUiPiAgICAgICBjb25maWd1cmVkIHdpdGggc2ltaWxhciB2YWx1ZXMuICBBZGRpdGlvbmFsbHks PC9zcGFuPiBpdCB3b3VsZCBiZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3Bh biBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgZXZhbHVhdGlvbiBjb250ZXh0LiAgU3VjaCBjb250ZXh0 LWRlcGVuZGVudCBpbXBsaWNhdGlvbnMgbXVzdCBiZTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgICAgICBwcmVmZXJhYmxlIGlmIGFuIEFRTSBwcm9wb3NhbCBsaXN0ZWQg c3VjaCBwYXJhbWV0ZXJzIGFuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3Bh biBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgY29uc2lkZXJlZCBiZWZvcmUgZHJhd2luZyBjb25jbHVz aW9ucyBvbiBwZXJmb3JtYW5jZSBjb21wYXJpc29ucy48L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj4gICAgICAgZGlzY3Vzc2VkIGhvdyBlYWNoIHJlbGF0ZXMgdG8gbmV0d29y ayBjaGFyYWN0ZXJpc3RpY3Mgc3VjaCBhczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgQWxzbyw8L3NwYW4+IGl0IHdvdWxkIGJlIHBy ZWZlcmFibGUgaWYgYW4gQVFNIHByb3Bvc2FsIGxpc3RlZCBzdWNoPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj4gICAgICAgY2FwYWNpdHksIGF2ZXJhZ2UgUlRUIGV0Yy48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgIHBhcmFtZXRlcnMgYW5kIGRpc2N1c3NlZCBo b3cgZWFjaCByZWxhdGVzIHRvIG5ldHdvcms8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgY2hhcmFjdGVyaXN0aWNz IHN1Y2ggYXMgY2FwYWNpdHksIGF2ZXJhZ2UgUlRUIGV0Yy48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAyLiAgY29tcGFyZSBvdmVyIGEgcmFuZ2Ugb2YgaW5wdXQgY29uZmln dXJhdGlvbnM6IHRoZXJlIGNvdWxkIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgMi4gIGNvbXBhcmUgb3ZlciBhIHJhbmdlIG9mIGlucHV0IGNvbmZpZ3VyYXRpb25zOiB0aGVy ZSBjb3VsZCBiZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICBzaXR1YXRpb25z IHdoZW4gdGhlIHNldCBvZiBjb250cm9sIHBhcmFtZXRlcnMgdGhhdCBhZmZlY3QgYTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICBzaXR1YXRpb25zIHdoZW4gdGhlIHNldCBv ZiBjb250cm9sIHBhcmFtZXRlcnMgdGhhdCBhZmZlY3QgYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICBzcGVjaWZpYyBiZWhhdmlvciBoYXZlIGRpZmZlcmVudCBzZW1hbnRpY3Mg YmV0d2VlbiB0aGUgdHdvIEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICBzcGVjaWZpYyBiZWhhdmlvciBoYXZlIGRpZmZlcmVudCBzZW1hbnRpY3MgYmV0d2VlbiB0aGUg dHdvIEFRTTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICBzY2hlbWVzLiAgQXMg bWVudGlvbmVkIGFib3ZlLCBQSUUgaGFzIHR1bmluZyBwYXJhbWV0ZXJzIHRvPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIHNjaGVtZXMuICBBcyBtZW50aW9uZWQgYWJvdmUs IFBJRSBoYXMgdHVuaW5nIHBhcmFtZXRlcnMgdG88L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICAgICAgY29udHJvbCBxdWV1ZSBkZWxheSB0aGF0IGhhcyBhIGRpZmZlcmVudCBzZW1hbnRp Y3MgZnJvbSB0aG9zZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICBjb250 cm9sIHF1ZXVlIGRlbGF5IHRoYXQgaGFzIGEgZGlmZmVyZW50IHNlbWFudGljcyBmcm9tIHRob3Nl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgIHVzZWQgaW4gQ29EZWwuICBJbiBz dWNoIHNpdHVhdGlvbnMsIHRoZXNlIHNjaGVtZXMgbmVlZCB0byBiZTwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgICB1c2VkIGluIENvRGVsLiAgSW4gc3VjaCBzaXR1YXRpb25z LCB0aGVzZSBzY2hlbWVzIG5lZWQgdG8gYmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAgICAgY29tcGFyZWQgb3ZlciBhIHJhbmdlIG9mIGlucHV0IGNvbmZpZ3VyYXRpb25zLiAgRm9y IGV4YW1wbGUsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIGNvbXBhcmVk IG92ZXIgYSByYW5nZSBvZiBpbnB1dCBjb25maWd1cmF0aW9ucy4gIEZvciBleGFtcGxlLDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICBjb21wYXJlIFBJRSB2cy4gQ29EZWwgb3Zl ciB0aGUgcmFuZ2Ugb2YgdGFyZ2V0IGRlbGF5IGlucHV0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgIGNvbXBhcmUgUElFIHZzLiBDb0RlbCBvdmVyIHRoZSByYW5nZSBvZiB0 YXJnZXQgZGVsYXkgaW5wdXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgY29u ZmlndXJhdGlvbnMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIGNvbmZp Z3VyYXRpb25zLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjQuMy4yLiAgRGVw bG95bWVudCBjb21wYXJpc29uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+NC4zLjIu ICBEZXBsb3ltZW50IGNvbXBhcmlzb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDc1Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBBUU0gc2NoZW1l cyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBiZSBjb21wYXJlZCBhZ2FpbnN0IGRl cGxveW1lbnQgY3JpdGVyaWEgc3VjaCBhcyB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgQVFNIHNjaGVtZXMgPHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gYmUg Y29tcGFyZWQgYWdhaW5zdCBkZXBsb3ltZW50IGNyaXRlcmlhIHN1Y2ggYXMgdGhlPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcGFyYW1ldGVyIHNlbnNpdGl2aXR5IChTZWN0aW9uIDgu MyksIGF1dG8tdHVuaW5nIChTZWN0aW9uIDEyKSBvcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIHBhcmFtZXRlciBzZW5zaXRpdml0eSAoU2VjdGlvbiA4LjMpLCBhdXRvLXR1bmlu ZyAoU2VjdGlvbiAxMikgb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBpbXBsZW1l bnRhdGlvbiBjb3N0IChTZWN0aW9uIDExKS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBpbXBsZW1lbnRhdGlvbiBjb3N0IChTZWN0aW9uIDExKS48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij40LjQuICBQYWNrZXQgc2l6ZXMgYW5kIGNvbmdlc3Rpb24gbm90aWZp Y2F0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+NC40LiAgUGFja2V0IHNpemVz IGFuZCBjb25nZXN0aW9uIG5vdGlmaWNhdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIEFuIEFRTSBzY2hlbWUgbWF5IGJlIGNvbnNpZGVyaW5nIHBhY2tldCBzaXplcyB3 aGlsZSBnZW5lcmF0aW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQW4gQVFN IHNjaGVtZSBtYXkgYmUgY29uc2lkZXJpbmcgcGFja2V0IHNpemVzIHdoaWxlIGdlbmVyYXRpbmc8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDc2 Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj4gICBjb25nZXN0aW9uIDxzcGFuIGNsYXNzPSJkZWxldGUiPnNpZ25hbHMu ICBbUkZDNzE0MV0gZGlzY3Vzc2VzIHRoZSBtb3RpdmF0aW9ucyBiZWhpbmQgdGhpcy48L3NwYW4+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGNvbmdlc3Rpb24gPHNwYW4gY2xh c3M9Imluc2VydCI+c2lnbmFscyBbUkZDNzE0MV0uPC9zcGFuPiAgRm9yIGV4YW1wbGUsIGNvbnRy b2wgcGFja2V0cyBzdWNoIGFzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBGb3Ig ZXhhbXBsZSwgY29udHJvbCBwYWNrZXRzIHN1Y2ggYXMgRE5TIHJlcXVlc3RzL3Jlc3BvbnNlcywg VENQPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEROUyByZXF1ZXN0cy9yZXNw b25zZXMsIFRDUCBTWU5zL0FDS3MgYXJlIHNtYWxsLCBidXQgdGhlaXIgbG9zcyBjYW48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFNZTnMvQUNLcyBhcmUgc21hbGwsIGJ1dCB0aGVp ciBsb3NzIGNhbiBzZXZlcmVseSBpbXBhY3QgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+dGhlPC9zcGFu PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBzZXZlcmVseSBpbXBhY3QgYXBw bGljYXRpb24gcGVyZm9ybWFuY2UuICBBbiBBUU0gc2NoZW1lIG1heSB0aGVyZWZvcmU8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGFwcGxpY2F0aW9uIHBlcmZvcm1hbmNlLiAgQW4g QVFNIHNjaGVtZSBtYXkgdGhlcmVmb3JlIGJlIGJpYXNlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICBiZSBiaWFzZWQgdG93YXJkcyBzbWFsbCBwYWNrZXRzIGJ5IGRyb3BwaW5n IHRoZW0gd2l0aCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5sb3dlcjwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgIHRvd2FyZHMgc21hbGwgcGFja2V0cyBieSBkcm9wcGluZyB0 aGVtIHdpdGggPHNwYW4gY2xhc3M9ImRlbGV0ZSI+c21hbGxlcjwvc3Bhbj4gcHJvYmFiaWxpdHk8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgcHJvYmFiaWxpdHkgY29tcGFyZWQg dG8gbGFyZ2VyIHBhY2tldHMuICBIb3dldmVyLCBzdWNoIGFuIEFRTSBzY2hlbWU8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGNvbXBhcmVkIHRvIGxhcmdlciBwYWNrZXRzLiAgSG93 ZXZlciwgc3VjaCBhbiBBUU0gc2NoZW1lIGlzIHVuZmFpciB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBpcyB1bmZhaXIgdG8gZGF0YSBzZW5kZXJzIGdlbmVyYXRpbmcgbGFy Z2VyIHBhY2tldHMuICBEYXRhIHNlbmRlcnMsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICBkYXRhIHNlbmRlcnMgZ2VuZXJhdGluZyBsYXJnZXIgcGFja2V0cy4gIERhdGEgc2VuZGVy cywgbWFsaWNpb3VzIG9yPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIG1hbGlj aW91cyBvciBvdGhlcndpc2UsIGFyZSBtb3RpdmF0ZWQgdG8gdGFrZSBhZHZhbnRhZ2Ugb2Ygc3Vj aCBBUU08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIG90aGVyd2lzZSwgYXJlIG1v dGl2YXRlZCB0byB0YWtlIGFkdmFudGFnZSBvZiBzdWNoIEFRTSBzY2hlbWUgYnk8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgc2NoZW1lIGJ5IHRyYW5zbWl0dGluZyBzbWFsbGVy IHBhY2tldHMsIGFuZCBjb3VsZCByZXN1bHQgaW4gdW5zYWZlPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj4gICB0cmFuc21pdHRpbmcgc21hbGxlciBwYWNrZXRzLCBhbmQgY291bGQgcmVz dWx0IGluIHVuc2FmZSBkZXBsb3ltZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICBkZXBsb3ltZW50cyBhbmQgdW5oZWFsdGh5IHRyYW5zcG9ydCBhbmQvb3IgYXBwbGljYXRp b24gZGVzaWducy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGFuZCB1bmhlYWx0 aHkgdHJhbnNwb3J0IGFuZC9vciBhcHBsaWNhdGlvbiBkZXNpZ25zLjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHIgaWQ9ImRpZmYwMDc3Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBBbiBBUU0gc2NoZW1lIDxz cGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gYWRoZXJlIHRvIHRoZSByZWNvbW1lbmRh dGlvbnMgb3V0bGluZWQgaW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgQW4g QVFNIHNjaGVtZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+IGFkaGVyZSB0byB0 aGUgcmVjb21tZW5kYXRpb25zIG91dGxpbmVkIGluIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnRoZTwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFtSRkM3MTQxXSwgYW5kIDxz cGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRCBOT1Q8L3NwYW4+IHByb3ZpZGUgdW5kdWUgYWR2YW50 YWdlIHRvIGZsb3dzIHdpdGg8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4g Y2xhc3M9Imluc2VydCI+ICAgYmVzdCBjdXJyZW50IHByYWN0aXZlIGZvciBkcm9wcGluZyBhbmQg bWFya2luZyBwYWNrZXRzIGRvY3VtZW50PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgc21hbGxlciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5wYWNrZXRzPC9zcGFuPiBbUkZD NzU2N10uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFtSRkM3MTQxXSwgYW5k IDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3VsZCBub3Q8L3NwYW4+IHByb3ZpZGUgdW5kdWUgYWR2 YW50YWdlIHRvIGZsb3dzIHdpdGg8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBzbWFsbGVyIDxzcGFuIGNsYXNzPSJpbnNl cnQiPnBhY2tldHMsIHN1Y2ggYXMgZGlzY3Vzc2VkIGluIHRoZSBzZWN0aW9uIDQuNCBvZiB0aGUg QVFNPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIHJlY29tbWVuZGF0aW9u IGRvY3VtZW50PC9zcGFuPiBbUkZDNzU2N10uICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5JbiBvcmRl ciB0byBldmFsdWF0ZSBpZiBhbiBBUU08L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2Vy dCI+ICAgc2NoZW1lIGlzIGJpYXNlZCB0b3dhcmRzIGZsb3dzIHdpdGggc21hbGxlciBzaXplIHBh Y2tldHMsIHRyYWZmaWMgY2FuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAg IGJlIGdlbmVyYXRlZCwgc3VjaCBhcyBkZWZpbmVkIGluIFNlY3Rpb24gOC4yLjIsIHdoZXJlIGhh bGYgb2YgdGhlPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIGZsb3dzIGhh dmUgc21hbGxlciBwYWNrZXRzIChlLmcuIDUwMCBieXRlcyBwYWNrZXRzKSB0aGFuIHRoZSBvdGhl cjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBoYWxmIG9mIHRoZSBmbG93 IChlLmcuIDE1MDAgYnl0ZXMgcGFja2V0cykuICBJbiB0aGlzIGNhc2UsIHRoZTwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBtZXRyaWNzIHJlcG9ydGVkIGNvdWxkIGJlIHRo ZSBzYW1lIGFzIGluIFNlY3Rpb24gNi4zLCB3aGVyZSBDYXRlZ29yeTwvc3Bhbj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBJIGlzIHRoZSBzZXQgb2YgZmxvd3Mgd2l0aCBzbWFsbGVy IHBhY2tldHMgYW5kIENhdGVnb3J5IElJIHRoZSBvbmU8L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+ICAgd2l0aCBsYXJnZXIgcGFja2V0cy4gIFRoZSBiaWRpcmVjdGlvbmFsIHNj ZW5hcmlvIGNvdWxkIGFsc28gYmU8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ ICAgY29uc2lkZXJlZCAoU2VjdGlvbiA5LjIpLjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij40LjUuICBJbnRlcmFjdGlvbiB3aXRoIEVDTjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjQuNS4gIEludGVyYWN0aW9uIHdpdGggRUNOPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA3OCI+PHRkPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+RGVwbG95ZWQgQVFNIGFsZ29yaXRobXMgU0hP VUxEIGltcGxlbWVudCBFeHBsaWNpdCBDb25nZXN0aW9uPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICBFQ04gW1JGQzMxNjhdIGlzIGFuIGFsdGVybmF0aXZlIHRoYXQg YWxsb3dzIEFRTSBzY2hlbWVzIHRvIHNpZ25hbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgTm90aWZpY2F0aW9uIChFQ04pIGFzIHdlbGwgYXMg bG9zcyB0byBzaWduYWwgY29uZ2VzdGlvbiB0byBlbmRwb2ludHM8L3NwYW4+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHJlY2VpdmVycyBhYm91dCBuZXR3b3JrIGNvbmdlc3Rp b24gdGhhdCBkb2VzIG5vdCB1c2UgcGFja2V0IGRyb3AuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBbUkZDNzU2N10uPC9zcGFuPiAgRUNOIFtS RkMzMTY4XSBpcyBhbiBhbHRlcm5hdGl2ZSB0aGF0IGFsbG93cyBBUU0gc2NoZW1lczwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UaGVyZSBh cmU8L3NwYW4+IGJlbmVmaXRzIG9mIHByb3ZpZGluZyBFQ04gc3VwcG9ydCBmb3IgYW4gQVFNIHNj aGVtZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdG8gc2lnbmFsIHJlY2VpdmVy cyBhYm91dCBuZXR3b3JrIGNvbmdlc3Rpb24gdGhhdCBkb2VzIG5vdCB1c2UgcGFja2V0PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFtXRUxaMjAxNV0uPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj4gICBkcm9wLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+VGhlPC9zcGFu PiBiZW5lZml0cyBvZiBwcm92aWRpbmcgRUNOIHN1cHBvcnQgZm9yIGFuIEFRTSBzY2hlbWUgPHNw YW4gY2xhc3M9ImRlbGV0ZSI+YXJlPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUi PiAgIGRlc2NyaWJlZCBpbjwvc3Bhbj4gW1dFTFoyMDE1XS4gIDxzcGFuIGNsYXNzPSJkZWxldGUi PlNlY3Rpb24gMyBvZiBbV0VMWjIwMTVdIGRlc2NyaWJlcyBleHBlY3RlZDwvc3Bhbj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBvcGVyYXRpb24gb2Ygcm91dGVycyBlbmFibGluZyBF Q04uICBBUU0gc2NoZW1lcyBTSE9VTEQgTk9UIGRyb3Agb3I8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4g Y2xhc3M9ImRlbGV0ZSI+ICAgcmVtYXJrIHBhY2tldHMgc29sZWx5IGJlY2F1c2UgdGhlIEVDVCgw KSBvciBFQ1QoMSkgY29kZXBvaW50cyBhcmU8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRl bGV0ZSI+ICAgdXNlZCwgYW5kIHdoZW4gRUNOLWNhcGFibGUgU0hPVUxEIHNldCBhIENFLW1hcmsg b24gRUNOLWNhcGFibGU8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgcGFj a2V0cyBpbiB0aGUgcHJlc2VuY2Ugb2YgaW5jaXBpZW50IGNvbmdlc3Rpb24uPC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDc5Ij48dGQ+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBJZiB0 aGUgdGVzdGVkIEFRTSBzY2hlbWUgY2FuIHN1cHBvcnQgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+RUNO IFtSRkM3NTY3XSw8L3NwYW4+IHRoZSB0ZXN0ZXJzIDxzcGFuIGNsYXNzPSJkZWxldGUiPk1VU1Q8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIElmIHRoZSB0ZXN0ZWQg QVFNIHNjaGVtZSBjYW4gc3VwcG9ydCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5FQ04sPC9zcGFuPiB0 aGUgdGVzdGVycyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5tdXN0PC9zcGFuPiBkaXNjdXNzPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBkaXNjdXNzIGFuZCBkZXNjcmliZSB0aGUgc3Vw cG9ydCBvZiA8c3BhbiBjbGFzcz0iZGVsZXRlIj5FQ04uICBTaW5jZSB0aGVzZSBndWlkZWxpbmVz PC9zcGFuPiBjYW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgYW5kIGRlc2Ny aWJlIHRoZSBzdXBwb3J0IG9mIDxzcGFuIGNsYXNzPSJpbnNlcnQiPkVDTiwgc3VjaCBhcyBkaXNj dXNzZWQgaW4gdGhlIEFRTTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg IGJlIHVzZWQgdG8gZXZhbHVhdGUgdGhlIHBlcmZvcm1hbmNlIG9mIHRoZSB0ZXN0ZWQgQVFNIHdp dGggYW5kPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgIHJlY29tbWVuZGF0aW9uIFtSRkM3NTY3XS4gIEFsc28sIHRoZSBBUU0ncyBFQ04gc3Vw cG9ydCBjYW4gYmUgc3R1ZGllZDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIHdpdGhvdXQgRUNOIG1hcmtpbmdzLCA8c3BhbiBjbGFzcz0iZGVsZXRlIj50aGV5IGNvdWxk PC9zcGFuPiBhbHNvIDxzcGFuIGNsYXNzPSJkZWxldGUiPmJlIHVzZWQgdG88L3NwYW4+IHF1YW50 aWZ5IHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4gICBhbmQgdmVyaWZpZWQgYnkgcmVwbGljYXRpbmcgdGVzdHMgaW4gU2VjdGlvbiA4LjEg d2l0aCBFQ04gdHVybmVkIE9OPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgaW50ZXJlc3Qgb2YgZW5hYmxpbmcgRUNOLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBhdCB0aGUgVENQIHNlbmRlcnMuICBUaGUgcmVz dWx0czwvc3Bhbj4gY2FuIGJlIHVzZWQgdG8gPHNwYW4gY2xhc3M9Imluc2VydCI+bm90IG9ubHk8 L3NwYW4+IGV2YWx1YXRlIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHBlcmZvcm1hbmNlIG9mIHRoZSB0ZXN0ZWQg QVFNIHdpdGggYW5kIHdpdGhvdXQgRUNOIG1hcmtpbmdzLCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5i dXQ8L3NwYW4+IGFsc288L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBxdWFudGlmeSB0aGUgaW50ZXJlc3Qgb2YgZW5hYmxp bmcgRUNOLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjQuNi4gIEludGVyYWN0 aW9uIHdpdGggU2NoZWR1bGluZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjQuNi4g IEludGVyYWN0aW9uIHdpdGggU2NoZWR1bGluZzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIEEgbmV0d29yayBkZXZpY2UgbWF5IHVzZSBwZXItZmxvdyBvciBwZXItY2xhc3Mg cXVldWluZyB3aXRoIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBBIG5ldHdv cmsgZGV2aWNlIG1heSB1c2UgcGVyLWZsb3cgb3IgcGVyLWNsYXNzIHF1ZXVpbmcgd2l0aCBhPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc2NoZWR1bGluZyBhbGdvcml0aG0gdG8gZWl0 aGVyIHByaW9yaXRpemUgY2VydGFpbiBhcHBsaWNhdGlvbnMgb3I8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBzY2hlZHVsaW5nIGFsZ29yaXRobSB0byBlaXRoZXIgcHJpb3JpdGl6 ZSBjZXJ0YWluIGFwcGxpY2F0aW9ucyBvcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IGNsYXNzZXMgb2YgdHJhZmZpYywgbGltaXQgdGhlIHJhdGUgb2YgdHJhbnNtaXNzaW9uLCBvciB0 byBwcm92aWRlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY2xhc3NlcyBvZiB0 cmFmZmljLCBsaW1pdCB0aGUgcmF0ZSBvZiB0cmFuc21pc3Npb24sIG9yIHRvIHByb3ZpZGU8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDgwIj48 dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj4gICBpc29sYXRpb24gYmV0d2VlbiBkaWZmZXJlbnQgdHJhZmZpYyBmbG93cyB3 aXRoaW4gYSBjb21tb24gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+Y2xhc3M8L3NwYW4+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGlzb2xhdGlvbiBiZXR3ZWVuIGRpZmZlcmVudCB0 cmFmZmljIGZsb3dzIHdpdGhpbiBhIGNvbW1vbiA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5jbGFzcywg c3VjaDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBhcyBkaXNjdXNzZWQg aW4gdGhlIHNlY3Rpb24gMi4xIG9mIHRoZSBBUU0gcmVjb21tZW5kYXRpb24gZG9jdW1lbnQ8L3Nw YW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgW1JGQzc1NjddLjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtSRkM3NTY3XS48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBUaGUgc2NoZWR1bGluZyBhbmQgdGhlIEFRTSBjb25qb2ludGx5IGlt cGFjdCBvbiB0aGUgZW5kLXRvLWVuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IFRoZSBzY2hlZHVsaW5nIGFuZCB0aGUgQVFNIGNvbmpvaW50bHkgaW1wYWN0IG9uIHRoZSBlbmQt dG8tZW5kPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJk aWZmMDA4MSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcGVyZm9ybWFuY2UuICBUaGVyZWZvcmUsIHRoZSBBUU0g cHJvcG9zYWwgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TVVTVDwvc3Bhbj4gZGlzY3VzcyB0aGU8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgcGVyZm9ybWFuY2UuICBUaGVyZWZvcmUs IHRoZSBBUU0gcHJvcG9zYWwgPHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gZGlzY3Vz cyB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGZlYXNpYmlsaXR5IHRvIGFk ZCBzY2hlZHVsaW5nIGNvbWJpbmVkIHdpdGggdGhlIEFRTSBhbGdvcml0aG0uICA8c3BhbiBjbGFz cz0iZGVsZXRlIj5UaGlzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBmZWFzaWJpbGl0eSB0byBhZGQgc2NoZWR1bGluZyBjb21iaW5lZCB3aXRoIHRoZSBBUU0gYWxn b3JpdGhtLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+SXQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBkaXNjdXNzaW9uIGFzIGFuIGlu c3RhbmNlLCBNQVkgZXhwbGFpbjwvc3Bhbj4gd2hldGhlciB0aGUgZHJvcHBpbmcgcG9saWN5IGlz PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAg IGNhbiBiZSBleHBsYWluZWQ8L3NwYW4+IHdoZXRoZXIgdGhlIGRyb3BwaW5nIHBvbGljeSBpcyBh cHBsaWVkIHdoZW4gcGFja2V0czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgYXBw bGllZCB3aGVuIHBhY2tldHMgYXJlIGJlaW5nIGVucXVldWVkIG9yIGRlcXVldWVkLjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBhcmUgYmVpbmcgZW5xdWV1ZWQgb3IgZGVxdWV1 ZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlc2UgZ3VpZGVsaW5l cyBkbyBub3QgcHJvcG9zZSBndWlkZWxpbmVzIHRvIGFzc2VzcyB0aGUgcGVyZm9ybWFuY2U8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGVzZSBndWlkZWxpbmVzIGRvIG5vdCBw cm9wb3NlIGd1aWRlbGluZXMgdG8gYXNzZXNzIHRoZSBwZXJmb3JtYW5jZTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIG9mIHNjaGVkdWxpbmcgYWxnb3JpdGhtcy4gIEluZGVlZCwgYXMg b3Bwb3NlZCB0byBjaGFyYWN0ZXJpemluZyBBUU08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBvZiBzY2hlZHVsaW5nIGFsZ29yaXRobXMuICBJbmRlZWQsIGFzIG9wcG9zZWQgdG8g Y2hhcmFjdGVyaXppbmcgQVFNPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc2NoZW1l cyB0aGF0IGlzIHJlbGF0ZWQgdG8gdGhlaXIgY2FwYWNpdHkgdG8gY29udHJvbCB0aGUgcXVldWlu ZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNjaGVtZXMgdGhhdCBpcyByZWxh dGVkIHRvIHRoZWlyIGNhcGFjaXR5IHRvIGNvbnRyb2wgdGhlIHF1ZXVpbmc8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBkZWxheSBpbiBhIHF1ZXVlLCBjaGFyYWN0ZXJpemluZyBzY2hl ZHVsaW5nIHNjaGVtZXMgaXMgcmVsYXRlZCB0byB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBkZWxheSBpbiBhIHF1ZXVlLCBjaGFyYWN0ZXJpemluZyBzY2hlZHVsaW5nIHNj aGVtZXMgaXMgcmVsYXRlZCB0byB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBz Y2hlZHVsaW5nIGl0c2VsZiBhbmQgaXRzIGludGVyYWN0aW9uIHdpdGggdGhlIEFRTSBzY2hlbWUu ICBBcyBvbmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzY2hlZHVsaW5nIGl0 c2VsZiBhbmQgaXRzIGludGVyYWN0aW9uIHdpdGggdGhlIEFRTSBzY2hlbWUuICBBcyBvbmU8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBleGFtcGxlLCB0aGUgc2NoZWR1bGVyIG1heSBj cmVhdGUgc3ViLXF1ZXVlcyBhbmQgdGhlIEFRTSBzY2hlbWUgbWF5PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgZXhhbXBsZSwgdGhlIHNjaGVkdWxlciBtYXkgY3JlYXRlIHN1Yi1x dWV1ZXMgYW5kIHRoZSBBUU0gc2NoZW1lIG1heTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIGJlIGFwcGxpZWQgb24gZWFjaCBvZiB0aGUgc3ViLXF1ZXVlcywgYW5kL29yIHRoZSBBUU0g Y291bGQgYmUgYXBwbGllZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGJlIGFw cGxpZWQgb24gZWFjaCBvZiB0aGUgc3ViLXF1ZXVlcywgYW5kL29yIHRoZSBBUU0gY291bGQgYmUg YXBwbGllZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG9uIHRoZSB3aG9sZSBxdWV1 ZS4gIEFsc28sIHNjaGVkdWxlcnMgbWlnaHQsIHN1Y2ggYXMgRlEtQ29EZWw8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvbiB0aGUgd2hvbGUgcXVldWUuICBBbHNvLCBzY2hlZHVs ZXJzIG1pZ2h0LCBzdWNoIGFzIEZRLUNvRGVsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgW0hPRUkyMDE1XSBvciBGYXZvclF1ZXVlIFtBTkVMMjAxNF0sIGludHJvZHVjZSBmbG93IHBy aW9yaXRpemF0aW9uLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtIT0VJMjAx NV0gb3IgRmF2b3JRdWV1ZSBbQU5FTDIwMTRdLCBpbnRyb2R1Y2UgZmxvdyBwcmlvcml0aXphdGlv bi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9 InBhcnQtNCIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBj aGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTQiPjxlbT4gcGFnZSAxNywgbGluZSAxMzxz cGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+IDwvdGg+PHRoPjxz bWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTQiPjxlbT4g cGFnZSAxOCwgbGluZSAyNDxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90 aD48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgQ29udHJvbCBQcm90b2NvbCAoVENQKSBbUkZDMDc5M10gd2l0aCBhIGxp bWl0ZWQgbnVtYmVyIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQ29udHJv bCBQcm90b2NvbCAoVENQKSBbUkZDMDc5M10gd2l0aCBhIGxpbWl0ZWQgbnVtYmVyIG9mPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYXBwbGljYXRpb25zLiAgVENQIGlzIGEgd2lkZWx5 IGRlcGxveWVkIHRyYW5zcG9ydC4gIEl0IGZpbGxzIHVwPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgYXBwbGljYXRpb25zLiAgVENQIGlzIGEgd2lkZWx5IGRlcGxveWVkIHRyYW5z cG9ydC4gIEl0IGZpbGxzIHVwPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYXZhaWxh YmxlIGJ1ZmZlcnMgdW50aWwgYSBzZW5kZXIgdHJhbnNmZXJpbmcgYSBidWxrIGZsb3cgd2l0aCBU Q1A8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhdmFpbGFibGUgYnVmZmVycyB1 bnRpbCBhIHNlbmRlciB0cmFuc2ZlcmluZyBhIGJ1bGsgZmxvdyB3aXRoIFRDUDwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHJlY2VpdmVzIGEgc2lnbmFsIChwYWNrZXQgZHJvcCkgdGhh dCByZWR1Y2VzIHRoZSBzZW5kaW5nIHJhdGUuICBUaGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICByZWNlaXZlcyBhIHNpZ25hbCAocGFja2V0IGRyb3ApIHRoYXQgcmVkdWNlcyB0 aGUgc2VuZGluZyByYXRlLiAgVGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbGFy Z2VyIHRoZSBidWZmZXIsIHRoZSBoaWdoZXIgdGhlIGJ1ZmZlciBvY2N1cGFuY3ksIGFuZCB0aGVy ZWZvcmUgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbGFyZ2VyIHRoZSBi dWZmZXIsIHRoZSBoaWdoZXIgdGhlIGJ1ZmZlciBvY2N1cGFuY3ksIGFuZCB0aGVyZWZvcmUgdGhl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcXVldWluZyBkZWxheS4gIEFuIGVmZmlj aWVudCBBUU0gc2NoZW1lIHNlbmRzIG91dCBlYXJseSBjb25nZXN0aW9uPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgcXVldWluZyBkZWxheS4gIEFuIGVmZmljaWVudCBBUU0gc2No ZW1lIHNlbmRzIG91dCBlYXJseSBjb25nZXN0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgc2lnbmFscyB0byBUQ1AgdG8gYnJpbmcgdGhlIHF1ZXVpbmcgZGVsYXkgdW5kZXIgY29u dHJvbC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzaWduYWxzIHRvIFRDUCB0 byBicmluZyB0aGUgcXVldWluZyBkZWxheSB1bmRlciBjb250cm9sLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIE5vdCBhbGwgZW5kcG9pbnRzIChvciBhcHBsaWNhdGlvbnMp IHVzaW5nIFRDUCB1c2UgdGhlIHNhbWUgZmxhdm9yIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgTm90IGFsbCBlbmRwb2ludHMgKG9yIGFwcGxpY2F0aW9ucykgdXNpbmcgVENQ IHVzZSB0aGUgc2FtZSBmbGF2b3Igb2Y8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBU Q1AuICBWYXJpZXR5IG9mIHNlbmRlcnMgZ2VuZXJhdGUgZGlmZmVyZW50IGNsYXNzZXMgb2YgdHJh ZmZpYyB3aGljaDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRDUC4gIFZhcmll dHkgb2Ygc2VuZGVycyBnZW5lcmF0ZSBkaWZmZXJlbnQgY2xhc3NlcyBvZiB0cmFmZmljIHdoaWNo PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA4 MiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+ICAgbWF5IG5vdCByZWFjdCB0byBjb25nZXN0aW9uIHNpZ25hbHMgKGFr YSBub24tcmVzcG9uc2l2ZSBmbG93czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBtYXkgbm90IHJlYWN0IHRvIGNvbmdlc3Rpb24gc2lnbmFscyAoYWthIG5vbi1yZXNwb25zaXZl IGZsb3dzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmluIHRoZTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPiAgIFtSRkM3NTY3XSkgb3IgbWF5IG5vdCByZWR1Y2UgdGhlaXIgc2Vu ZGluZyByYXRlIGFzIGV4cGVjdGVkIChha2E8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgc2VjdGlvbiAzIG9mIHRoZSBBUU0gcmVjb21tZW5k YXRpb24gZG9jdW1lbnQ8L3NwYW4+IFtSRkM3NTY3XSkgb3IgbWF5IG5vdDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgVHJhbnNwb3J0IEZsb3dzIHRoYXQgYXJlIGxlc3MgcmVzcG9u c2l2ZSB0aGFuIDxzcGFuIGNsYXNzPSJkZWxldGUiPlRDUFtSRkM3NTY3XSw8L3NwYW4+IGFsc288 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgcmVkdWNlIHRoZWlyIHNlbmRpbmcg cmF0ZSBhcyBleHBlY3RlZCAoYWthIFRyYW5zcG9ydCBGbG93cyB0aGF0IGFyZTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgY2FsbGVkICJhZ2dyZXNzaXZlIGZsb3dzIikuICBJbiB0 aGVzZSBjYXNlcywgQVFNIHNjaGVtZXMgc2VlayB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj4gICBsZXNzIHJlc3BvbnNpdmUgdGhhbiA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UQ1As IHN1Y2ggYXMgcHJvcG9zZWQgaW4gdGhlIHNlY3Rpb24gMyBvZiB0aGU8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBjb250cm9sIHRoZSBxdWV1aW5nIGRlbGF5LjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBBUU0g cmVjb21tZW5kYXRpb24gZG9jdW1lbnQgW1JGQzc1NjddLDwvc3Bhbj4gYWxzbyBjYWxsZWQgImFn Z3Jlc3NpdmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICBmbG93cyIpLiAgSW4gdGhlc2UgY2FzZXMsIEFRTSBzY2hlbWVz IHNlZWsgdG8gY29udHJvbCB0aGUgcXVldWluZzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGRlbGF5LjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgc2VjdGlvbiBwcm92aWRlcyBndWlkZWxp bmVzIHRvIGFzc2VzcyB0aGUgcGVyZm9ybWFuY2Ugb2YgYW4gQVFNPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgVGhpcyBzZWN0aW9uIHByb3ZpZGVzIGd1aWRlbGluZXMgdG8gYXNz ZXNzIHRoZSBwZXJmb3JtYW5jZSBvZiBhbiBBUU08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBwcm9wb3NhbCBmb3IgdmFyaW91cyB0cmFmZmljIHByb2ZpbGVzIC0tIGRpZmZlcmVudCB0 eXBlcyBvZiBzZW5kZXJzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcHJvcG9z YWwgZm9yIHZhcmlvdXMgdHJhZmZpYyBwcm9maWxlcyAtLSBkaWZmZXJlbnQgdHlwZXMgb2Ygc2Vu ZGVyczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICh3aXRoIGRpZmZlcmVudCBUQ1Ag Y29uZ2VzdGlvbiBjb250cm9sIHZhcmlhbnRzLCB1bnJlc3BvbnNpdmUsPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgKHdpdGggZGlmZmVyZW50IFRDUCBjb25nZXN0aW9uIGNvbnRy b2wgdmFyaWFudHMsIHVucmVzcG9uc2l2ZSw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBhZ2dyZXNzaXZlKS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhZ2dyZXNz aXZlKS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij41LjEuICBUQ1AtZnJpZW5k bHkgc2VuZGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+NS4xLiAgVENQLWZyaWVu ZGx5IHNlbmRlcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjUuMS4xLiAgVENQ LWZyaWVuZGx5IHNlbmRlciB3aXRoIHRoZSBzYW1lIGluaXRpYWwgY29uZ2VzdGlvbiB3aW5kb3c8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij41LjEuMS4gIFRDUC1mcmllbmRseSBzZW5k ZXIgd2l0aCB0aGUgc2FtZSBpbml0aWFsIGNvbmdlc3Rpb24gd2luZG93PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhpcyBzY2VuYXJpbyBoZWxwcyB0byBldmFsdWF0ZSBo b3cgYW4gQVFNIHNjaGVtZSByZWFjdHMgdG8gYSBUQ1AtPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgVGhpcyBzY2VuYXJpbyBoZWxwcyB0byBldmFsdWF0ZSBob3cgYW4gQVFNIHNj aGVtZSByZWFjdHMgdG8gYSBUQ1AtPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZnJp ZW5kbHkgdHJhbnNwb3J0IHNlbmRlci4gIEEgc2luZ2xlIGxvbmctbGl2ZWQsIG5vbiBhcHBsaWNh dGlvbi08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBmcmllbmRseSB0cmFuc3Bv cnQgc2VuZGVyLiAgQSBzaW5nbGUgbG9uZy1saXZlZCwgbm9uIGFwcGxpY2F0aW9uLTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGxpbWl0ZWQsIFRDUCBOZXdSZW5vIGZsb3csIHdpdGgg YW4gSW5pdGlhbCBjb25nZXN0aW9uIFdpbmRvdyAoSVcpIHNldDwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIGxpbWl0ZWQsIFRDUCBOZXdSZW5vIGZsb3csIHdpdGggYW4gSW5pdGlh bCBjb25nZXN0aW9uIFdpbmRvdyAoSVcpIHNldDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHRvIDMgcGFja2V0cywgdHJhbnNmZXJzIGRhdGEgYmV0d2VlbiBzZW5kZXIgQSBhbmQgcmVj ZWl2ZXIgQi4gIE90aGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdG8gMyBw YWNrZXRzLCB0cmFuc2ZlcnMgZGF0YSBiZXR3ZWVuIHNlbmRlciBBIGFuZCByZWNlaXZlciBCLiAg T3RoZXI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUQ1AgZnJpZW5kbHkgY29uZ2Vz dGlvbiBjb250cm9sIHNjaGVtZXMgc3VjaCBhcyBUQ1AtZnJpZW5kbHkgcmF0ZTwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRDUCBmcmllbmRseSBjb25nZXN0aW9uIGNvbnRyb2wg c2NoZW1lcyBzdWNoIGFzIFRDUC1mcmllbmRseSByYXRlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA4MyI+PHRkPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgY29udHJv bCBbUkZDNTM0OF0gZXRjIDxzcGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj4gYWxzbyBiZSBj b25zaWRlcmVkLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBjb250cm9sIFtS RkM1MzQ4XSBldGMgPHNwYW4gY2xhc3M9Imluc2VydCI+bWF5PC9zcGFuPiBhbHNvIGJlIGNvbnNp ZGVyZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgRm9yIGVhY2ggVENQ LWZyaWVuZGx5IHRyYW5zcG9ydCBjb25zaWRlcmVkLCB0aGUgZ3JhcGggZGVzY3JpYmVkIGluPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgRm9yIGVhY2ggVENQLWZyaWVuZGx5IHRy YW5zcG9ydCBjb25zaWRlcmVkLCB0aGUgZ3JhcGggZGVzY3JpYmVkIGluPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgU2VjdGlvbiAyLjcgY291bGQgYmUgZ2VuZXJhdGVkLjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFNlY3Rpb24gMi43IGNvdWxkIGJlIGdlbmVyYXRl ZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij41LjEuMi4gIFRDUC1mcmllbmRs eSBzZW5kZXIgd2l0aCBkaWZmZXJlbnQgaW5pdGlhbCBjb25nZXN0aW9uIHdpbmRvd3M8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij41LjEuMi4gIFRDUC1mcmllbmRseSBzZW5kZXIgd2l0 aCBkaWZmZXJlbnQgaW5pdGlhbCBjb25nZXN0aW9uIHdpbmRvd3M8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIHNjZW5hcmlvIGNhbiBiZSB1c2VkIHRvIGV2YWx1YXRl IGhvdyBhbiBBUU0gc2NoZW1lIGFkYXB0cyB0byBhPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgVGhpcyBzY2VuYXJpbyBjYW4gYmUgdXNlZCB0byBldmFsdWF0ZSBob3cgYW4gQVFN IHNjaGVtZSBhZGFwdHMgdG8gYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRyYWZm aWMgbWl4IGNvbnNpc3Rpbmcgb2YgVENQIGZsb3dzIHdpdGggZGlmZmVyZW50IHZhbHVlcyBvZiB0 aGUgSVcuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdHJhZmZpYyBtaXggY29u c2lzdGluZyBvZiBUQ1AgZmxvd3Mgd2l0aCBkaWZmZXJlbnQgdmFsdWVzIG9mIHRoZSBJVy48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYw MDg0Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj4gICBGb3IgdGhpcyBzY2VuYXJpbywgdHdvIHR5cGVzIG9mIGZsb3dz IDxzcGFuIGNsYXNzPSJkZWxldGUiPk1VU1Q8L3NwYW4+IGJlIGdlbmVyYXRlZCBiZXR3ZWVuPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEZvciB0aGlzIHNjZW5hcmlvLCB0d28g dHlwZXMgb2YgZmxvd3MgPHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gYmUgZ2VuZXJh dGVkIGJldHdlZW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzZW5kZXIgQSBhbmQg cmVjZWl2ZXIgQjo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzZW5kZXIgQSBh bmQgcmVjZWl2ZXIgQjo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBB IHNpbmdsZSBsb25nLWxpdmVkIG5vbiBhcHBsaWNhdGlvbi1saW1pdGVkIFRDUCBOZXdSZW5vIGZs b3c7PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgQSBzaW5nbGUgbG9uZy1s aXZlZCBub24gYXBwbGljYXRpb24tbGltaXRlZCBUQ1AgTmV3UmVubyBmbG93OzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIEEgc2luZ2xlIGFwcGxpY2F0aW9uLWxpbWl0 ZWQgVENQIE5ld1Jlbm8gZmxvdywgd2l0aCBhbiBJVyBzZXQgdG8gMzwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIG8gIEEgc2luZ2xlIGFwcGxpY2F0aW9uLWxpbWl0ZWQgVENQIE5l d1Jlbm8gZmxvdywgd2l0aCBhbiBJVyBzZXQgdG8gMzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgIG9yIDEwIHBhY2tldHMuICBUaGUgc2l6ZSBvZiB0aGUgZGF0YSB0cmFuc2ZlcnJl ZCBtdXN0IGJlIHN0cmljdGx5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAg b3IgMTAgcGFja2V0cy4gIFRoZSBzaXplIG9mIHRoZSBkYXRhIHRyYW5zZmVycmVkIG11c3QgYmUg c3RyaWN0bHk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBoaWdoZXIgdGhhbiAx MCBwYWNrZXRzIGFuZCBzaG91bGQgYmUgbG93ZXIgdGhhbiAxMDAgcGFja2V0cy48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBoaWdoZXIgdGhhbiAxMCBwYWNrZXRzIGFuZCBz aG91bGQgYmUgbG93ZXIgdGhhbiAxMDAgcGFja2V0cy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDg1Ij48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBU aGUgdHJhbnNtaXNzaW9uIG9mIHRoZSBub24gYXBwbGljYXRpb24tbGltaXRlZCBmbG93IG11c3Qg c3RhcnQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgVGhlIHRyYW5zbWlzc2lv biBvZiB0aGUgbm9uIGFwcGxpY2F0aW9uLWxpbWl0ZWQgZmxvdyBtdXN0IHN0YXJ0IDxzcGFuIGNs YXNzPSJpbnNlcnQiPmZpcnN0PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+YmVmb3JlPC9zcGFuPiB0aGUgdHJhbnNtaXNzaW9uIG9m IHRoZSBhcHBsaWNhdGlvbi1saW1pdGVkIGZsb3cgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+YW5kIG9u bHk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJp bnNlcnQiPiAgIGFuZDwvc3Bhbj4gdGhlIHRyYW5zbWlzc2lvbiBvZiB0aGUgYXBwbGljYXRpb24t bGltaXRlZCBmbG93IDxzcGFuIGNsYXNzPSJpbnNlcnQiPnN0YXJ0czwvc3Bhbj4gYWZ0ZXIgdGhl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBhZnRlciB0aGUgPHNwYW4gY2xhc3M9 ImRlbGV0ZSI+c3RlYWR5IHN0YXRlIGhhcyBiZWVuIHJlYWNoZWQgYnk8L3NwYW4+IG5vbiBhcHBs aWNhdGlvbi1saW1pdGVkPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIG5vbiBh cHBsaWNhdGlvbi1saW1pdGVkIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmZsb3cgaGFzIHJlYWNoZWQg c3RlYWR5IHN0YXRlLiAgVGhlIHN0ZWFkeTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPmZsb3cuPC9zcGFuPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBzdGF0ZSBjYW4gYmUg YXNzdW1lZCB3aGVuIHRoZSBnb29kcHV0IGlzIHN0YWJsZS48L3NwYW4+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgRm9yIGVhY2ggb2YgdGhlc2Ugc2NlbmFyaW9zLCB0aGUg Z3JhcGggZGVzY3JpYmVkIGluIFNlY3Rpb24gMi43IGNvdWxkPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgRm9yIGVhY2ggb2YgdGhlc2Ugc2NlbmFyaW9zLCB0aGUgZ3JhcGggZGVz Y3JpYmVkIGluIFNlY3Rpb24gMi43IGNvdWxkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgYmUgZ2VuZXJhdGVkIGZvciBlYWNoIGNsYXNzIG9mIHRyYWZmaWMgKGFwcGxpY2F0aW9uLWxp bWl0ZWQgYW5kIG5vbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGJlIGdlbmVy YXRlZCBmb3IgZWFjaCBjbGFzcyBvZiB0cmFmZmljIChhcHBsaWNhdGlvbi1saW1pdGVkIGFuZCBu b248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhcHBsaWNhdGlvbi1saW1pdGVkKS4g IFRoZSBjb21wbGV0aW9uIHRpbWUgb2YgdGhlIGFwcGxpY2F0aW9uLWxpbWl0ZWQ8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhcHBsaWNhdGlvbi1saW1pdGVkKS4gIFRoZSBjb21w bGV0aW9uIHRpbWUgb2YgdGhlIGFwcGxpY2F0aW9uLWxpbWl0ZWQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBUQ1AgZmxvdyBjb3VsZCBiZSBtZWFzdXJlZC48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBUQ1AgZmxvdyBjb3VsZCBiZSBtZWFzdXJlZC48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij41LjIuICBBZ2dyZXNzaXZlIHRyYW5zcG9ydCBzZW5k ZXI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij41LjIuICBBZ2dyZXNzaXZlIHRyYW5z cG9ydCBzZW5kZXI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIHNj ZW5hcmlvIGhlbHBzIHRlc3RlcnMgdG8gZXZhbHVhdGUgaG93IGFuIEFRTSBzY2hlbWUgcmVhY3Rz IHRvIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGlzIHNjZW5hcmlvIGhl bHBzIHRlc3RlcnMgdG8gZXZhbHVhdGUgaG93IGFuIEFRTSBzY2hlbWUgcmVhY3RzIHRvIGE8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0cmFuc3BvcnQgc2VuZGVyIHRoYXQgaXMgbW9y ZSBhZ2dyZXNzaXZlIHRoYW4gYSBzaW5nbGUgVENQLWZyaWVuZGx5PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgdHJhbnNwb3J0IHNlbmRlciB0aGF0IGlzIG1vcmUgYWdncmVzc2l2 ZSB0aGFuIGEgc2luZ2xlIFRDUC1mcmllbmRseTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHNlbmRlci4gIFdlIGRlZmluZSAnYWdncmVzc2l2ZW5lc3MnIGFzIGEgaGlnaGVyIGluY3Jl YXNlIGZhY3RvciB0aGFuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgc2VuZGVy LiAgV2UgZGVmaW5lICdhZ2dyZXNzaXZlbmVzcycgYXMgYSBoaWdoZXIgaW5jcmVhc2UgZmFjdG9y IHRoYW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzdGFuZGFyZCB1cG9uIGEgc3Vj Y2Vzc2Z1bCB0cmFuc21pc3Npb24gYW5kL29yIGEgbG93ZXIgdGhhbiBzdGFuZGFyZDwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHN0YW5kYXJkIHVwb24gYSBzdWNjZXNzZnVsIHRy YW5zbWlzc2lvbiBhbmQvb3IgYSBsb3dlciB0aGFuIHN0YW5kYXJkPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgZGVjcmVhc2UgZmFjdG9yIHVwb24gYSB1bnN1Y2Nlc3NmdWwgdHJhbnNt aXNzaW9uIChlLmcuLCBpbiBjYXNlIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgZGVjcmVhc2UgZmFjdG9yIHVwb24gYSB1bnN1Y2Nlc3NmdWwgdHJhbnNtaXNzaW9uIChlLmcu LCBpbiBjYXNlIG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgY29uZ2VzdGlvbiBj b250cm9scyB3aXRoIEFkZGl0aXZlLUluY3JlYXNlIE11bHRpcGxpY2F0aXZlLURlY3JlYXNlPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY29uZ2VzdGlvbiBjb250cm9scyB3aXRo IEFkZGl0aXZlLUluY3JlYXNlIE11bHRpcGxpY2F0aXZlLURlY3JlYXNlPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgKEFJTUQpIHByaW5jaXBsZSwgYSBsYXJnZXIgQUkgYW5kL29yIE1E IGZhY3RvcnMpLiAgQSBzaW5nbGUgbG9uZy08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAoQUlNRCkgcHJpbmNpcGxlLCBhIGxhcmdlciBBSSBhbmQvb3IgTUQgZmFjdG9ycykuICBB IHNpbmdsZSBsb25nLTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGxpdmVkLCBub24g YXBwbGljYXRpb24tbGltaXRlZCwgVENQIEN1YmljIGZsb3cgdHJhbnNmZXJzIGRhdGEgYmV0d2Vl bjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGxpdmVkLCBub24gYXBwbGljYXRp b24tbGltaXRlZCwgVENQIEN1YmljIGZsb3cgdHJhbnNmZXJzIGRhdGEgYmV0d2VlbjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHNlbmRlciBBIGFuZCByZWNlaXZlciBCLiAgT3RoZXIg YWdncmVzc2l2ZSBjb25nZXN0aW9uIGNvbnRyb2wgc2NoZW1lczwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIHNlbmRlciBBIGFuZCByZWNlaXZlciBCLiAgT3RoZXIgYWdncmVzc2l2 ZSBjb25nZXN0aW9uIGNvbnRyb2wgc2NoZW1lczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwODYiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIDxzcGFuIGNsYXNz PSJkZWxldGUiPk1BWTwvc3Bhbj4gYWxzbyBiZSBjb25zaWRlcmVkLjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5tYXk8L3NwYW4+IGFsc28g YmUgY29uc2lkZXJlZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBGb3Ig ZWFjaCBmbGF2b3Igb2YgYWdncmVzc2l2ZSB0cmFuc3BvcnRzLCB0aGUgZ3JhcGggZGVzY3JpYmVk IGluPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgRm9yIGVhY2ggZmxhdm9yIG9m IGFnZ3Jlc3NpdmUgdHJhbnNwb3J0cywgdGhlIGdyYXBoIGRlc2NyaWJlZCBpbjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFNlY3Rpb24gMi43IGNvdWxkIGJlIGdlbmVyYXRlZC48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBTZWN0aW9uIDIuNyBjb3VsZCBiZSBnZW5l cmF0ZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+NS4zLiAgVW5yZXNwb25z aXZlIHRyYW5zcG9ydCBzZW5kZXI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij41LjMu ICBVbnJlc3BvbnNpdmUgdHJhbnNwb3J0IHNlbmRlcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIFRoaXMgc2NlbmFyaW8gaGVscHMgdGVzdGVycyB0byBldmFsdWF0ZSBob3cg YW4gQVFNIHNjaGVtZSByZWFjdHMgdG8gYTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIFRoaXMgc2NlbmFyaW8gaGVscHMgdGVzdGVycyB0byBldmFsdWF0ZSBob3cgYW4gQVFNIHNj aGVtZSByZWFjdHMgdG8gYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRyYW5zcG9y dCBzZW5kZXIgdGhhdCBpcyBsZXNzIHJlc3BvbnNpdmUgdGhhbiBUQ1AuICBOb3RlIHRoYXQgZmF1 bHR5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdHJhbnNwb3J0IHNlbmRlciB0 aGF0IGlzIGxlc3MgcmVzcG9uc2l2ZSB0aGFuIFRDUC4gIE5vdGUgdGhhdCBmYXVsdHk8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0cmFuc3BvcnQgaW1wbGVtZW50YXRpb25zIG9uIGFu IGVuZCBob3N0IGFuZC9vciBmYXVsdHkgbmV0d29yazwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIHRyYW5zcG9ydCBpbXBsZW1lbnRhdGlvbnMgb24gYW4gZW5kIGhvc3QgYW5kL29y IGZhdWx0eSBuZXR3b3JrPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZWxlbWVudHMg ZW4tcm91dGUgdGhhdCAiaGlkZSIgY29uZ2VzdGlvbiBzaWduYWxzIGluIHBhY2tldCBoZWFkZXJz PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZWxlbWVudHMgZW4tcm91dGUgdGhh dCAiaGlkZSIgY29uZ2VzdGlvbiBzaWduYWxzIGluIHBhY2tldCBoZWFkZXJzPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA4NyI+PHRkPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W1JGQzc1NjddPC9zcGFuPiBtYXkgYWxzbyBsZWFk IHRvIGEgc2ltaWxhciBzaXR1YXRpb24sIHN1Y2ggdGhhdCB0aGUgQVFNPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIG1heSBhbHNvIGxlYWQgdG8gYSBzaW1pbGFyIHNpdHVhdGlv biwgc3VjaCB0aGF0IHRoZSBBUU0gc2NoZW1lIG5lZWRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICBzY2hlbWUgbmVlZHMgdG8gYWRhcHQgdG8gdW5yZXNwb25zaXZlIDxzcGFuIGNs YXNzPSJkZWxldGUiPnRyYWZmaWMuPC9zcGFuPiAgVG8gdGhpcyBlbmQsIHRoZXNlPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHRvIGFkYXB0IHRvIHVucmVzcG9uc2l2ZSA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij50cmFmZmljIChzZWUgdGhlIHNlY3Rpb24gMyBvZiB0aGUgQVFNPC9z cGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgZ3VpZGVsaW5lcyBwcm9wb3Nl IHRoZSB0d28gZm9sbG93aW5nIHNjZW5hcmlvcy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgcmVjb21tZW5kYXRpb24gZG9jdW1lbnQgW1JG Qzc1NjddKS48L3NwYW4+ICBUbyB0aGlzIGVuZCwgdGhlc2UgZ3VpZGVsaW5lczwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IHByb3Bvc2UgdGhlIHR3byBmb2xsb3dpbmcgc2NlbmFyaW9zLjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBmaXJzdCBzY2VuYXJpbyBjYW4gYmUgdXNlZCB0byBldmFs dWF0ZSBxdWV1ZSBidWlsZCB1cC4gIEl0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgVGhlIGZpcnN0IHNjZW5hcmlvIGNhbiBiZSB1c2VkIHRvIGV2YWx1YXRlIHF1ZXVlIGJ1aWxk IHVwLiAgSXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb25zaWRlcnMgdW5yZXNw b25zaXZlIGZsb3cocykgd2hvc2Ugc2VuZGluZyByYXRlIGlzIGdyZWF0ZXIgdGhhbiB0aGU8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjb25zaWRlcnMgdW5yZXNwb25zaXZlIGZs b3cocykgd2hvc2Ugc2VuZGluZyByYXRlIGlzIGdyZWF0ZXIgdGhhbiB0aGU8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBib3R0bGVuZWNrIGxpbmsgY2FwYWNpdHkgYmV0d2VlbiByb3V0 ZXJzIEwgYW5kIFIuICBUaGlzIHNjZW5hcmlvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgYm90dGxlbmVjayBsaW5rIGNhcGFjaXR5IGJldHdlZW4gcm91dGVycyBMIGFuZCBSLiAg VGhpcyBzY2VuYXJpbzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGNvbnNpc3RzIG9m IGEgbG9uZy1saXZlZCBub24gYXBwbGljYXRpb24gbGltaXRlZCBVRFAgZmxvdyB0cmFuc21pdHM8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjb25zaXN0cyBvZiBhIGxvbmctbGl2 ZWQgbm9uIGFwcGxpY2F0aW9uIGxpbWl0ZWQgVURQIGZsb3cgdHJhbnNtaXRzPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgZGF0YSBiZXR3ZWVuIHNlbmRlciBBIGFuZCByZWNlaXZlciBC LiAgR3JhcGhzIGRlc2NyaWJlZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IGRhdGEgYmV0d2VlbiBzZW5kZXIgQSBhbmQgcmVjZWl2ZXIgQi4gIEdyYXBocyBkZXNjcmliZWQg aW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBTZWN0aW9uIDIuNyBjb3VsZCBiZSBn ZW5lcmF0ZWQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgU2VjdGlvbiAyLjcg Y291bGQgYmUgZ2VuZXJhdGVkLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IFRoZSBzZWNvbmQgc2NlbmFyaW8gY2FuIGJlIHVzZWQgdG8gZXZhbHVhdGUgaWYgdGhlIEFRTSBz Y2hlbWUgaXMgYWJsZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBzZWNv bmQgc2NlbmFyaW8gY2FuIGJlIHVzZWQgdG8gZXZhbHVhdGUgaWYgdGhlIEFRTSBzY2hlbWUgaXMg YWJsZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRvIGtlZXAgdGhlIHJlc3BvbnNp dmUgZnJhY3Rpb24gdW5kZXIgY29udHJvbC4gIFRoaXMgc2NlbmFyaW88L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICB0byBrZWVwIHRoZSByZXNwb25zaXZlIGZyYWN0aW9uIHVuZGVy IGNvbnRyb2wuICBUaGlzIHNjZW5hcmlvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyIGlkPSJwYXJ0LTUiIGNsYXNzPSJjaGFuZ2UiPjx0ZD48L3RkPjx0 aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSIjcGFydC01Ij48 ZW0+IHBhZ2UgMTksIGxpbmUgMTY8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9h PjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48 YSBocmVmPSIjcGFydC01Ij48ZW0+IHBhZ2UgMjAsIGxpbmUgMzE8c3BhbiBjbGFzcz0iaGlkZSI+ IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSBmaXJzdCBzY2VuYXJpbywg dGhlIHJhdGUgb2YgdGhlIFVEUCB0cmFmZmljIHNob3VsZCBub3QgYmUgZ3JlYXRlcjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBmaXJzdCBzY2VuYXJpbywgdGhlIHJhdGUg b2YgdGhlIFVEUCB0cmFmZmljIHNob3VsZCBub3QgYmUgZ3JlYXRlcjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHRoYW4gdGhlIGJvdHRsZW5lY2sgY2FwYWNpdHksIGFuZCBzaG91bGQg YmUgaGlnaGVyIHRoYW4gaGFsZiBvZiB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICB0aGFuIHRoZSBib3R0bGVuZWNrIGNhcGFjaXR5LCBhbmQgc2hvdWxkIGJlIGhpZ2hlciB0 aGFuIGhhbGYgb2YgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYm90dGxlbmVj ayBjYXBhY2l0eS4gIEZvciBlYWNoIHR5cGUgb2YgdHJhZmZpYywgdGhlIGdyYXBoIGRlc2NyaWJl ZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGJvdHRsZW5lY2sgY2FwYWNpdHku ICBGb3IgZWFjaCB0eXBlIG9mIHRyYWZmaWMsIHRoZSBncmFwaCBkZXNjcmliZWQ8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBpbiBTZWN0aW9uIDIuNyBjb3VsZCBiZSBnZW5lcmF0ZWQu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW4gU2VjdGlvbiAyLjcgY291bGQg YmUgZ2VuZXJhdGVkLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjUuNC4gIExl c3MtdGhhbiBCZXN0IEVmZm9ydCB0cmFuc3BvcnQgc2VuZGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+NS40LiAgTGVzcy10aGFuIEJlc3QgRWZmb3J0IHRyYW5zcG9ydCBzZW5kZXI8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIHNjZW5hcmlvIGhlbHBz IHRvIGV2YWx1YXRlIGhvdyBhbiBBUU0gc2NoZW1lIHJlYWN0cyB0byBMQkU8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGlzIHNjZW5hcmlvIGhlbHBzIHRvIGV2YWx1YXRlIGhv dyBhbiBBUU0gc2NoZW1lIHJlYWN0cyB0byBMQkU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBjb25nZXN0aW9uIGNvbnRyb2xzIHRoYXQgJ3Jlc3VsdHMgaW4gc21hbGxlciBiYW5kd2lk dGggYW5kL29yIGRlbGF5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY29uZ2Vz dGlvbiBjb250cm9scyB0aGF0ICdyZXN1bHRzIGluIHNtYWxsZXIgYmFuZHdpZHRoIGFuZC9vciBk ZWxheTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGltcGFjdCBvbiBzdGFuZGFyZCBU Q1AgdGhhbiBzdGFuZGFyZCBUQ1AgaXRzZWxmLCB3aGVuIHNoYXJpbmcgYTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIGltcGFjdCBvbiBzdGFuZGFyZCBUQ1AgdGhhbiBzdGFuZGFy ZCBUQ1AgaXRzZWxmLCB3aGVuIHNoYXJpbmcgYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwODgiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGJvdHRsZW5lY2sg d2l0aCBpdC4nICBbUkZDNjI5N10uICA8c3BhbiBjbGFzcz0iZGVsZXRlIj5UaGU8L3NwYW4+IHBv dGVudGlhbCBmYXRlZnVsIDxzcGFuIGNsYXNzPSJkZWxldGUiPmludGVyYWN0aW9uPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBib3R0bGVuZWNrIHdpdGggaXQuJyAg W1JGQzYyOTddLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+VGhlcmUgYXJlPC9zcGFuPiBwb3RlbnRp YWwgZmF0ZWZ1bDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgd2hlbiBBUU0gYW5k IExCRSB0ZWNobmlxdWVzIGFyZSBjb21iaW5lZCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5oYXMgYmVl biBzaG93biBpbjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNw YW4gY2xhc3M9Imluc2VydCI+aW50ZXJhY3Rpb25zPC9zcGFuPiB3aGVuIEFRTSBhbmQgTEJFIHRl Y2huaXF1ZXMgYXJlIGNvbWJpbmVkIFtHT05HMjAxNF07PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj4gICBbR09ORzIwMTRdOyB0aGlzIHNjZW5hcmlvIGhlbHBzIHRvIGV2YWx1YXRlIHdo ZXRoZXIgdGhlIGNvZXhpc3RlbmNlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IHRoaXMgc2NlbmFyaW8gaGVscHMgdG8gZXZhbHVhdGUgd2hldGhlciB0aGUgY29leGlzdGVuY2Ug b2YgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBvZiB0aGUgcHJvcG9zZWQg QVFNIGFuZCBMQkUgdGVjaG5pcXVlcyBtYXkgYmUgcG9zc2libGUuPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIHByb3Bvc2VkIEFRTSBhbmQgTEJFIHRlY2huaXF1ZXMgbWF5IGJl IHBvc3NpYmxlLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEEgc2luZ2xl IGxvbmctbGl2ZWQgbm9uIGFwcGxpY2F0aW9uLWxpbWl0ZWQgVENQIE5ld1Jlbm8gZmxvdzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEEgc2luZ2xlIGxvbmctbGl2ZWQgbm9uIGFw cGxpY2F0aW9uLWxpbWl0ZWQgVENQIE5ld1Jlbm8gZmxvdzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIHRyYW5zZmVycyBkYXRhIGJldHdlZW4gc2VuZGVyIEEgYW5kIHJlY2VpdmVyIEIu ICBPdGhlciBUQ1AtZnJpZW5kbHk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0 cmFuc2ZlcnMgZGF0YSBiZXR3ZWVuIHNlbmRlciBBIGFuZCByZWNlaXZlciBCLiAgT3RoZXIgVENQ LWZyaWVuZGx5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlk PSJkaWZmMDA4OSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgY29uZ2VzdGlvbiBjb250cm9sIHNjaGVtZXMgPHNw YW4gY2xhc3M9ImRlbGV0ZSI+TUFZPC9zcGFuPiBhbHNvIGJlIGNvbnNpZGVyZWQuICBTaW5nbGUg bG9uZy1saXZlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBjb25nZXN0aW9u IGNvbnRyb2wgc2NoZW1lcyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5tYXk8L3NwYW4+IGFsc28gYmUg Y29uc2lkZXJlZC4gIFNpbmdsZSBsb25nLWxpdmVkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgbm9uIGFwcGxpY2F0aW9uLWxpbWl0ZWQgTEVEQkFUIFtSRkM2ODE3XSBmbG93cyB0cmFu c2ZlciBkYXRhIGJldHdlZW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBub24g YXBwbGljYXRpb24tbGltaXRlZCBMRURCQVQgW1JGQzY4MTddIGZsb3dzIHRyYW5zZmVyIGRhdGEg YmV0d2VlbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHNlbmRlciBBIGFuZCByZWNl aXZlciBCLiAgV2UgcmVjb21tZW5kIHRvIHNldCB0aGUgdGFyZ2V0IGRlbGF5IGFuZDwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNlbmRlciBBIGFuZCByZWNlaXZlciBCLiAgV2Ug cmVjb21tZW5kIHRvIHNldCB0aGUgdGFyZ2V0IGRlbGF5IGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIGdhaW4gdmFsdWVzIG9mIExFREJBVCByZXNwZWN0aXZlbHkgdG8gNSBtcyBh bmQgMTAgW1RSQU4yMDE0XS4gIE90aGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgZ2FpbiB2YWx1ZXMgb2YgTEVEQkFUIHJlc3BlY3RpdmVseSB0byA1IG1zIGFuZCAxMCBbVFJB TjIwMTRdLiAgT3RoZXI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHIgaWQ9ImRpZmYwMDkwIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBMQkUgY29uZ2VzdGlvbiBjb250cm9sIDxz cGFuIGNsYXNzPSJkZWxldGUiPnNjaGVtZXMsIGFueSBvZiB0aG9zZSBsaXN0ZWQgaW4gW1JGQzYy OTddLCBNQVk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIExCRSBj b25nZXN0aW9uIGNvbnRyb2wgPHNwYW4gY2xhc3M9Imluc2VydCI+c2NoZW1lcyBtYXk8L3NwYW4+ IGFsc28gYmUgPHNwYW4gY2xhc3M9Imluc2VydCI+Y29uc2lkZXJlZCBhbmQgYXJlIGxpc3RlZDwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGFsc28gYmUgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+Y29uc2lkZXJlZC48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIGluIHRoZSBJRVRGIHN1cnZleSBvZiBMQkUg cHJvdG9jb2xzIFtSRkM2Mjk3XS48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgRm9yIGVhY2ggb2YgdGhlIFRDUC1mcmllbmRseSBhbmQgTEJFIHRyYW5zcG9ydHMs IHRoZSBncmFwaCBkZXNjcmliZWQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBG b3IgZWFjaCBvZiB0aGUgVENQLWZyaWVuZGx5IGFuZCBMQkUgdHJhbnNwb3J0cywgdGhlIGdyYXBo IGRlc2NyaWJlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGluIFNlY3Rpb24gMi43 IGNvdWxkIGJlIGdlbmVyYXRlZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBp biBTZWN0aW9uIDIuNyBjb3VsZCBiZSBnZW5lcmF0ZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+Ni4gIFJvdW5kIFRyaXAgVGltZSBGYWlybmVzczwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjYuICBSb3VuZCBUcmlwIFRpbWUgRmFpcm5lc3M8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij42LjEuICBNb3RpdmF0aW9uPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+Ni4xLiAgTW90aXZhdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIEFuIEFRTSBzY2hlbWUncyBjb25nZXN0aW9uIHNpZ25hbHMgKHZpYSBkcm9w cyBvciBFQ04gbWFya3MpIG11c3Q8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBB biBBUU0gc2NoZW1lJ3MgY29uZ2VzdGlvbiBzaWduYWxzICh2aWEgZHJvcHMgb3IgRUNOIG1hcmtz KSBtdXN0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcmVhY2ggdGhlIHRyYW5zcG9y dCBzZW5kZXIgc28gdGhhdCBhIHJlc3BvbnNpdmUgc2VuZGVyIGNhbiBpbml0aWF0ZTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHJlYWNoIHRoZSB0cmFuc3BvcnQgc2VuZGVyIHNv IHRoYXQgYSByZXNwb25zaXZlIHNlbmRlciBjYW4gaW5pdGlhdGU8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBpdHMgY29uZ2VzdGlvbiBjb250cm9sIG1lY2hhbmlzbSBhbmQgYWRqdXN0 IHRoZSBzZW5kaW5nIHJhdGUuICBUaGlzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgaXRzIGNvbmdlc3Rpb24gY29udHJvbCBtZWNoYW5pc20gYW5kIGFkanVzdCB0aGUgc2VuZGlu ZyByYXRlLiAgVGhpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb2NlZHVyZSBp cyB0aHVzIGRlcGVuZGVudCBvbiB0aGUgZW5kLXRvLWVuZCBwYXRoIFJUVC4gIFdoZW4gdGhlIFJU VDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHByb2NlZHVyZSBpcyB0aHVzIGRl cGVuZGVudCBvbiB0aGUgZW5kLXRvLWVuZCBwYXRoIFJUVC4gIFdoZW4gdGhlIFJUVDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHZhcmllcywgdGhlIG9uc2V0IG9mIGNvbmdlc3Rpb24g Y29udHJvbCBpcyBpbXBhY3RlZCwgYW5kIGluIHR1cm48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICB2YXJpZXMsIHRoZSBvbnNldCBvZiBjb25nZXN0aW9uIGNvbnRyb2wgaXMgaW1w YWN0ZWQsIGFuZCBpbiB0dXJuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW1wYWN0 cyB0aGUgYWJpbGl0eSBvZiBhbiBBUU0gc2NoZW1lIHRvIGNvbnRyb2wgdGhlIHF1ZXVlLiAgSXQg aXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBpbXBhY3RzIHRoZSBhYmlsaXR5 IG9mIGFuIEFRTSBzY2hlbWUgdG8gY29udHJvbCB0aGUgcXVldWUuICBJdCBpczwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZXJlZm9yZSBpbXBvcnRhbnQgdG8gYXNzZXNzIHRoZSBB UU0gc2NoZW1lcyBmb3IgYSBzZXQgb2YgUlRUczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIHRoZXJlZm9yZSBpbXBvcnRhbnQgdG8gYXNzZXNzIHRoZSBBUU0gc2NoZW1lcyBmb3Ig YSBzZXQgb2YgUlRUczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGJldHdlZW4gQSBh bmQgQiAoZS5nLiwgZnJvbSA1IG1zIHRvIDIwMCBtcykuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgYmV0d2VlbiBBIGFuZCBCIChlLmcuLCBmcm9tIDUgbXMgdG8gMjAwIG1zKS48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGUgYXN5bW1ldHJ5IGluIHRl cm1zIG9mIGRpZmZlcmVuY2UgaW4gaW50cmluc2ljIFJUVCBiZXR3ZWVuIHZhcmlvdXM8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgYXN5bW1ldHJ5IGluIHRlcm1zIG9mIGRp ZmZlcmVuY2UgaW4gaW50cmluc2ljIFJUVCBiZXR3ZWVuIHZhcmlvdXM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDkxIj48dGQ+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICBwYXRocyBzaGFyaW5nIHRoZSBzYW1lIGJvdHRsZW5lY2sgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+ U0hPVUxEPC9zcGFuPiBiZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5jb25zaWRlcmVkPC9zcGFuPiBz byB0aGF0IHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBwYXRocyBzaGFy aW5nIHRoZSBzYW1lIGJvdHRsZW5lY2sgPHNwYW4gY2xhc3M9Imluc2VydCI+c2hvdWxkPC9zcGFu PiBiZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5jb25zaWRlcmVkLDwvc3Bhbj4gc28gdGhhdCB0aGU8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGZhaXJuZXNzIGJldHdlZW4gdGhlIGZs b3dzIGNhbiBiZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5kaXNjdXNzZWQgc2luY2UgaW48L3NwYW4+ IHRoaXMgc2NlbmFyaW8sIGE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgZmFp cm5lc3MgYmV0d2VlbiB0aGUgZmxvd3MgY2FuIGJlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPmRpc2N1 c3NlZC4gIEluPC9zcGFuPiB0aGlzIHNjZW5hcmlvLCBhPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgZmxvdyB0cmF2ZXJzaW5nIG9uIHNob3J0ZXIgUlRUIHBhdGggbWF5IHJlYWN0IGZh c3RlciB0byBjb25nZXN0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZmxv dyB0cmF2ZXJzaW5nIG9uIHNob3J0ZXIgUlRUIHBhdGggbWF5IHJlYWN0IGZhc3RlciB0byBjb25n ZXN0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYW5kIHJlY292ZXIgZmFzdGVy IGZyb20gaXQgY29tcGFyZWQgdG8gYW5vdGhlciBmbG93IG9uIGEgbG9uZ2VyIFJUVDwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFuZCByZWNvdmVyIGZhc3RlciBmcm9tIGl0IGNv bXBhcmVkIHRvIGFub3RoZXIgZmxvdyBvbiBhIGxvbmdlciBSVFQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDkyIj48dGQ+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBw YXRoLiAgVGhlIGludHJvZHVjdGlvbiBvZiBBUU0gc2NoZW1lcyBtYXkgcG90ZW50aWFsbHkgaW1w cm92ZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj50aGlzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBwYXRoLiAgVGhlIGludHJvZHVjdGlvbiBvZiBBUU0gc2NoZW1lcyBt YXkgcG90ZW50aWFsbHkgaW1wcm92ZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij50aGU8L3NwYW4+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICB0eXBl IG9mPC9zcGFuPiBmYWlybmVzcy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNw YW4gY2xhc3M9Imluc2VydCI+ICAgUlRUPC9zcGFuPiBmYWlybmVzcy48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBJbnRyb2R1Y2luZyBhbiBBUU0gc2NoZW1lIG1heSBjYXVz ZSB0aGUgdW5mYWlybmVzcyBiZXR3ZWVuIHRoZSBmbG93cyw8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICBJbnRyb2R1Y2luZyBhbiBBUU0gc2NoZW1lIG1heSBjYXVzZSB0aGUgdW5m YWlybmVzcyBiZXR3ZWVuIHRoZSBmbG93cyw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDkzIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBldmVuIGlmIHRoZSBS VFRzIGFyZSBpZGVudGljYWwuICBUaGlzIHBvdGVudGlhbCB1bmZhaXJuZXNzIDxzcGFuIGNsYXNz PSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gYmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgZXZlbiBpZiB0aGUgUlRUcyBhcmUgaWRlbnRpY2FsLiAgVGhpcyBwb3RlbnRpYWwgdW5m YWlybmVzcyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zaG91bGQ8L3NwYW4+IGJlPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW52ZXN0aWdhdGVkIGFzIHdlbGwuPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgaW52ZXN0aWdhdGVkIGFzIHdlbGwuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Ni4yLiAgUmVjb21tZW5kZWQgdGVzdHM8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij42LjIuICBSZWNvbW1lbmRlZCB0ZXN0czwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAwOTQiPjx0ZD48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPiAgIFRoZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5SRUNPTU1FTkRFRDwvc3Bhbj4gdG9w b2xvZ3kgaXMgZGV0YWlsZWQgaW4gRmlndXJlIDEuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPiAgIFRoZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZWNvbW1lbmRlZDwvc3Bhbj4gdG9w b2xvZ3kgaXMgZGV0YWlsZWQgaW4gRmlndXJlIDEuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA5NSI+PHRkPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVG8g ZXZhbHVhdGUgdGhlIFJUVCBmYWlybmVzcywgZm9yIGVhY2ggcnVuLCB0d28gZmxvd3MgZGl2aWRl ZCBpbnRvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFRvIGV2YWx1YXRlIHRo ZSBSVFQgZmFpcm5lc3MsIGZvciBlYWNoIHJ1biwgdHdvIGZsb3dzIDxzcGFuIGNsYXNzPSJpbnNl cnQiPmFyZTwvc3Bhbj4gZGl2aWRlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAg dHdvIGNhdGVnb3JpZXMuICBDYXRlZ29yeSBJIHdob3NlIFJUVCBiZXR3ZWVuIHNlbmRlciBBIGFu ZCByZWNlaXZlciBCPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGludG8gdHdv IGNhdGVnb3JpZXMuICBDYXRlZ29yeSBJIHdob3NlIFJUVCBiZXR3ZWVuIHNlbmRlciBBIGFuZDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hP VUxEPC9zcGFuPiBiZSAxMDBtcy4gIENhdGVnb3J5IElJIHdoaWNoIFJUVCBiZXR3ZWVuIHNlbmRl ciBBIGFuZCByZWNlaXZlcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICByZWNl aXZlciBCIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3VsZDwvc3Bhbj4gYmUgMTAwbXMuICBDYXRl Z29yeSBJSSB3aGljaCBSVFQgYmV0d2VlbiBzZW5kZXIgQTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgQiBzaG91bGQgYmUgaW4gdGhlIHJhbmdlIFs1bXM7NTYwbXNdIGluY2x1c2l2 ZS4gIFRoZSBtYXhpbXVtIHZhbHVlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IGFuZCByZWNlaXZlciBCIHNob3VsZCBiZSBpbiB0aGUgcmFuZ2UgWzVtczs1NjBtc10gaW5jbHVz aXZlLiAgVGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBmb3IgdGhlIFJUVCBy ZXByZXNlbnRzIHRoZSBSVFQgb2YgYSBzYXRlbGxpdGUgbGluayA8c3BhbiBjbGFzcz0iZGVsZXRl Ij50aGF0LCBhY2NvcmRpbmcgdG88L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgIG1heGltdW0gdmFsdWUgZm9yIHRoZSBSVFQgcmVwcmVzZW50cyB0aGUgUlRUIG9mIGEg c2F0ZWxsaXRlIGxpbms8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNz PSJkZWxldGUiPiAgIHNlY3Rpb24gMiBvZiBbUkZDMjQ4OF0gc2hvdWxkIGJlIGF0IGxlYXN0IDU1 OG1zLjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xh c3M9Imluc2VydCI+W1JGQzI0ODhdLjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDk2Ij48dGQ+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBBIHNl dCBvZiBldmFsdWF0ZWQgZmxvd3MgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TVVTVDwvc3Bhbj4gdXNl IHRoZSBzYW1lIGNvbmdlc3Rpb24gY29udHJvbDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICBBIHNldCBvZiBldmFsdWF0ZWQgZmxvd3MgPHNwYW4gY2xhc3M9Imluc2VydCI+bXVz dDwvc3Bhbj4gdXNlIHRoZSBzYW1lIGNvbmdlc3Rpb24gY29udHJvbDwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIGFsZ29yaXRobTogYWxsIHRoZSBnZW5lcmF0ZWQgZmxvd3MgY291bGQg YmUgc2luZ2xlIGxvbmctbGl2ZWQgbm9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgYWxnb3JpdGhtOiBhbGwgdGhlIGdlbmVyYXRlZCBmbG93cyBjb3VsZCBiZSBzaW5nbGUgbG9u Zy1saXZlZCBub248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhcHBsaWNhdGlvbi1s aW1pdGVkIFRDUCBOZXdSZW5vIGZsb3dzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIGFwcGxpY2F0aW9uLWxpbWl0ZWQgVENQIE5ld1Jlbm8gZmxvd3MuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Ni4zLiAgTWV0cmljcyB0byBldmFsdWF0ZSB0aGUgUlRUIGZh aXJuZXNzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+Ni4zLiAgTWV0cmljcyB0byBl dmFsdWF0ZSB0aGUgUlRUIGZhaXJuZXNzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDA5NyI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgVGhlIG91dHB1 dHMgdGhhdCA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBiZSBtZWFzdXJlZCBhcmU6 ICgxKSB0aGUgY3VtdWxhdGl2ZSBhdmVyYWdlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgIFRoZSBvdXRwdXRzIHRoYXQgPHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4g YmUgbWVhc3VyZWQgYXJlOiAoMSkgdGhlIGN1bXVsYXRpdmUgYXZlcmFnZTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIGdvb2RwdXQgb2YgdGhlIGZsb3cgZnJvbSBDYXRlZ29yeSBJLCBn b29kcHV0X0NhdF9JIChTZWN0aW9uIDIuNSk7ICgyKTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIGdvb2RwdXQgb2YgdGhlIGZsb3cgZnJvbSBDYXRlZ29yeSBJLCBnb29kcHV0X0Nh dF9JIChTZWN0aW9uIDIuNSk7ICgyKTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRo ZSBjdW11bGF0aXZlIGF2ZXJhZ2UgZ29vZHB1dCBvZiB0aGUgZmxvdyBmcm9tIENhdGVnb3J5IElJ LDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBjdW11bGF0aXZlIGF2ZXJh Z2UgZ29vZHB1dCBvZiB0aGUgZmxvdyBmcm9tIENhdGVnb3J5IElJLDwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIGdvb2RwdXRfQ2F0X0lJIChTZWN0aW9uIDIuNSk7ICgzKSB0aGUgcmF0 aW8gZ29vZHB1dF9DYXRfSUkvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZ29v ZHB1dF9DYXRfSUkgKFNlY3Rpb24gMi41KTsgKDMpIHRoZSByYXRpbyBnb29kcHV0X0NhdF9JSS88 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBnb29kcHV0X0NhdF9JOyAoNCkgdGhlIGF2 ZXJhZ2UgcGFja2V0IGRyb3AgcmF0ZSBmb3IgZWFjaCBjYXRlZ29yeTwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGdvb2RwdXRfQ2F0X0k7ICg0KSB0aGUgYXZlcmFnZSBwYWNrZXQg ZHJvcCByYXRlIGZvciBlYWNoIGNhdGVnb3J5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgKFNlY3Rpb24gMi4zKS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAoU2Vj dGlvbiAyLjMpLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjcuICBCdXJzdCBB YnNvcnB0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+Ny4gIEJ1cnN0IEFic29y cHRpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAiQVFNIG1lY2hhbmlz bXMgbmVlZCB0byBjb250cm9sIHRoZSBvdmVyYWxsIHF1ZXVlIHNpemVzLCB0byBlbnN1cmU8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAiQVFNIG1lY2hhbmlzbXMgbmVlZCB0byBj b250cm9sIHRoZSBvdmVyYWxsIHF1ZXVlIHNpemVzLCB0byBlbnN1cmU8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICB0aGF0IGFycml2aW5nIGJ1cnN0cyBjYW4gYmUgYWNjb21tb2RhdGVk IHdpdGhvdXQgZHJvcHBpbmcgcGFja2V0cyI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICB0aGF0IGFycml2aW5nIGJ1cnN0cyBjYW4gYmUgYWNjb21tb2RhdGVkIHdpdGhvdXQgZHJv cHBpbmcgcGFja2V0cyI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHIgaWQ9InBhcnQtNiIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5z a2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTYiPjxlbT4gcGFnZSAy MSwgbGluZSAyMjxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+ IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNw YXJ0LTYiPjxlbT4gcGFnZSAyMiwgbGluZSA0MDxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+ PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW4gdGhlIGJ1ZmZlciBmb3IgYnVyc3RzIG9mIGFy cml2aW5nIHBhY2tldHMuICBUaGUgdG9sZXJhbmNlIHRvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgaW4gdGhlIGJ1ZmZlciBmb3IgYnVyc3RzIG9mIGFycml2aW5nIHBhY2tldHMu ICBUaGUgdG9sZXJhbmNlIHRvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYnVyc3Rz IG9mIHBhY2tldHMgZGVwZW5kcyB1cG9uIHRoZSBudW1iZXIgb2YgcGFja2V0cyBpbiB0aGUgcXVl dWUsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYnVyc3RzIG9mIHBhY2tldHMg ZGVwZW5kcyB1cG9uIHRoZSBudW1iZXIgb2YgcGFja2V0cyBpbiB0aGUgcXVldWUsPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgd2hpY2ggaXMgZGlyZWN0bHkgbGlua2VkIHRvIHRoZSBB UU0gYWxnb3JpdGhtLiAgTW9yZW92ZXIsIGFuIEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIHdoaWNoIGlzIGRpcmVjdGx5IGxpbmtlZCB0byB0aGUgQVFNIGFsZ29yaXRobS4g IE1vcmVvdmVyLCBhbiBBUU08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzY2hlbWUg bWF5IGltcGxlbWVudCBhIGZlYXR1cmUgY29udHJvbGxpbmcgdGhlIG1heGltdW0gc2l6ZSBvZjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNjaGVtZSBtYXkgaW1wbGVtZW50IGEg ZmVhdHVyZSBjb250cm9sbGluZyB0aGUgbWF4aW11bSBzaXplIG9mPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgYWNjZXB0ZWQgYnVyc3RzLCB0aGF0IGNhbiBkZXBlbmQgb24gdGhlIGJ1 ZmZlciBvY2N1cGFuY3kgb3IgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg YWNjZXB0ZWQgYnVyc3RzLCB0aGF0IGNhbiBkZXBlbmQgb24gdGhlIGJ1ZmZlciBvY2N1cGFuY3kg b3IgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgY3VycmVudGx5IGVzdGltYXRl ZCBxdWV1aW5nIGRlbGF5LiAgVGhlIGltcGFjdCBvZiB0aGUgYnVmZmVyIHNpemUgb248L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjdXJyZW50bHkgZXN0aW1hdGVkIHF1ZXVpbmcg ZGVsYXkuICBUaGUgaW1wYWN0IG9mIHRoZSBidWZmZXIgc2l6ZSBvbjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHRoZSBidXJzdCBhbGxvd2FuY2UgbWF5IGJlIGV2YWx1YXRlZC48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgYnVyc3QgYWxsb3dhbmNlIG1heSBi ZSBldmFsdWF0ZWQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Ny4yLiAgUmVj b21tZW5kZWQgdGVzdHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij43LjIuICBSZWNv bW1lbmRlZCB0ZXN0czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0ciBpZD0iZGlmZjAwOTgiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIEZvciB0aGlzIHNjZW5hcmlvLCB0 ZXN0ZXIgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TVVTVDwvc3Bhbj4gZXZhbHVhdGUgaG93IHRoZSBB UU0gcGVyZm9ybXMgd2l0aCA8c3BhbiBjbGFzcz0iZGVsZXRlIj50aGU8L3NwYW4+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEZvciB0aGlzIHNjZW5hcmlvLCB0ZXN0ZXIgPHNw YW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gZXZhbHVhdGUgaG93IHRoZSBBUU0gcGVyZm9y bXMgd2l0aCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5hPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgZm9sbG93aW5nPC9zcGFuPiB0cmFm ZmljIDxzcGFuIGNsYXNzPSJkZWxldGUiPmdlbmVyYXRlZCBmcm9tPC9zcGFuPiBzZW5kZXIgQSB0 byByZWNlaXZlciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5COjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+ICAgdHJhZmZpYyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5taXhlZCB0 aGF0IGNvdWxkIGJlIGNvbXBvc2VkIG9mIChmcm9tPC9zcGFuPiBzZW5kZXIgQSB0byByZWNlaXZl cjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+PC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij5CKTo8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFz cz0iZGVsZXRlIj4gICBvICBXZWIgdHJhZmZpYyB3aXRoIElXMTA7PC9zcGFuPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMDk5Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBvICA8c3BhbiBj bGFzcz0iZGVsZXRlIj5CdXJzdHkgdmlkZW8gZnJhbWVzOzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+ICAgbyAgPHNwYW4gY2xhc3M9Imluc2VydCI+QnVyc3Qgb2YgcGFj a2V0cyBhdCB0aGUgYmVnaW5uaW5nIG9mIGEgdHJhbnNtaXNzaW9uLCBzdWNoIGFzIHdlYjwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICB0cmFmZmljIHdpdGggSVcxMDs8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy IGlkPSJkaWZmMDEwMCI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgbyAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+Q29u c3RhbnQgQml0IFJhdGUgKENCUikgVURQIHRyYWZmaWMuPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICBvICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5BcHBsaWNhdGlvbnMg dGhhdCBzZW5kIGxhcmdlIGJ1cnN0cyBvZiBkYXRhLCBzdWNoIGFzIGJ1cnN0eSB2aWRlbzwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBmcmFtZXM7PC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAx MDEiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPiAgIG8gIEEgc2luZ2xlIG5vbiBhcHBsaWNhdGlvbi1saW1pdGVkIGJ1 bGsgVENQIGZsb3cgYXMgYmFja2dyb3VuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICBvICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5CYWNrZ3JvdW5kIHRyYWZmaWMsIHN1Y2ggYXMg Q29uc3RhbnQgQml0IFJhdGUgKENCUikgVURQIHRyYWZmaWM8L3NwYW4+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj4gICAgICB0cmFmZmljLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBhbmQvb3I8L3NwYW4+IEEgc2luZ2xl IG5vbiBhcHBsaWNhdGlvbi1saW1pdGVkIGJ1bGsgVENQIGZsb3cgYXM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICBi YWNrZ3JvdW5kIHRyYWZmaWMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyIGlkPSJkaWZmMDEwMiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgRmlndXJlIDIgcHJlc2Vu dHMgdGhlIHZhcmlvdXMgY2FzZXMgZm9yIHRoZSB0cmFmZmljIHRoYXQgPHNwYW4gY2xhc3M9ImRl bGV0ZSI+TVVTVDwvc3Bhbj4gYmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg RmlndXJlIDIgcHJlc2VudHMgdGhlIHZhcmlvdXMgY2FzZXMgZm9yIHRoZSB0cmFmZmljIHRoYXQg PHNwYW4gY2xhc3M9Imluc2VydCI+bXVzdDwvc3Bhbj4gYmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBnZW5lcmF0ZWQgYmV0d2VlbiBzZW5kZXIgQSBhbmQgcmVjZWl2ZXIgQi48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBnZW5lcmF0ZWQgYmV0d2VlbiBzZW5kZXIg QSBhbmQgcmVjZWl2ZXIgQi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAr LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8 Q2FzZXwgVHJhZmZpYyBUeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8Q2FzZXwgVHJhZmZpYyBUeXBlICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8 ICAgICstLS0tLSstLS0tLS0tLS0tLS0rLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8ICAgICstLS0tLSstLS0tLS0tLS0tLS0rLS0t LSstLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8 ICAgIHxWaWRlb3xXZWIgIChJVyAxMCl8IENCUnwgQnVsayBUQ1AgVHJhZmZpYyAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8ICAgIHxWaWRlb3xXZWIgIChJVyAxMCl8IENC UnwgQnVsayBUQ1AgVHJhZmZpYyAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAr LS0tLXwtLS0tLXwtLS0tLS0tLS0tLS18LS0tLXwtLS0tLS0tLS0tLS0tLS0tLS0tLXw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLXwtLS0tLXwtLS0tLS0tLS0tLS18LS0t LXwtLS0tLS0tLS0tLS0tLS0tLS0tLXw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8 SSAgIHwgIDAgIHwgICAgIDEgICAgICB8ICAxIHwgICAgICAgICAwICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8SSAgIHwgIDAgIHwgICAgIDEgICAgICB8ICAx IHwgICAgICAgICAwICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAr LS0tLXwtLS0tLXwtLS0tLS0tLS0tLS18LS0tLXwtLS0tLS0tLS0tLS0tLS0tLS0tLXw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLXwtLS0tLXwtLS0tLS0tLS0tLS18LS0t LXwtLS0tLS0tLS0tLS0tLS0tLS0tLXw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8 SUkgIHwgIDAgIHwgICAgIDEgICAgICB8ICAxIHwgICAgICAgICAxICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8SUkgIHwgIDAgIHwgICAgIDEgICAgICB8ICAx IHwgICAgICAgICAxICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHIgaWQ9InBhcnQtNyIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRo PjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTciPjxl bT4gcGFnZSAyMiwgbGluZSA4PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48 L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEg aHJlZj0iI3BhcnQtNyI+PGVtPiBwYWdlIDIzLCBsaW5lIDI3PHNwYW4gY2xhc3M9ImhpZGUiPiDC tjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8SUlJIHwgIDEgIHwgICAgIDEgICAg ICB8ICAxIHwgICAgICAgICAwICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICB8SUlJIHwgIDEgIHwgICAgIDEgICAgICB8ICAxIHwgICAgICAgICAwICAgICAgICAg IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0tLXwtLS0tLXwtLS0tLS0tLS0t LS18LS0tLXwtLS0tLS0tLS0tLS0tLS0tLS0tLXw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICArLS0tLXwtLS0tLXwtLS0tLS0tLS0tLS18LS0tLXwtLS0tLS0tLS0tLS0tLS0tLS0t LXw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8SVYgIHwgIDEgIHwgICAgIDEgICAg ICB8ICAxIHwgICAgICAgICAxICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICB8SVYgIHwgIDEgIHwgICAgIDEgICAgICB8ICAxIHwgICAgICAgICAxICAgICAgICAg IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0tLSstLS0tLSstLS0tLS0tLS0t LS0rLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICArLS0tLSstLS0tLSstLS0tLS0tLS0tLS0rLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0t LSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAg IEZpZ3VyZSAyOiBCdXJzdHkgdHJhZmZpYyBzY2VuYXJpb3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgIEZpZ3VyZSAyOiBCdXJzdHkgdHJhZmZpYyBz Y2VuYXJpb3M8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBBIG5ldyB3ZWIg cGFnZSBkb3dubG9hZCBjb3VsZCBzdGFydCBhZnRlciB0aGUgcHJldmlvdXMgd2ViIHBhZ2U8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBBIG5ldyB3ZWIgcGFnZSBkb3dubG9hZCBj b3VsZCBzdGFydCBhZnRlciB0aGUgcHJldmlvdXMgd2ViIHBhZ2U8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBkb3dubG9hZCBpcyBmaW5pc2hlZC4gIEVhY2ggd2ViIHBhZ2UgY291bGQg YmUgY29tcG9zZWQgYnkgYXQgbGVhc3QgNTA8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBkb3dubG9hZCBpcyBmaW5pc2hlZC4gIEVhY2ggd2ViIHBhZ2UgY291bGQgYmUgY29tcG9z ZWQgYnkgYXQgbGVhc3QgNTA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvYmplY3Rz IGFuZCB0aGUgc2l6ZSBvZiBlYWNoIG9iamVjdCBzaG91bGQgYmUgYXQgbGVhc3QgMWtCLiA2IFRD UDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG9iamVjdHMgYW5kIHRoZSBzaXpl IG9mIGVhY2ggb2JqZWN0IHNob3VsZCBiZSBhdCBsZWFzdCAxa0IuIDYgVENQPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEwMyI+PHRkPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgcGFyYWxsZWwgY29ubmVjdGlvbnMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEPC9z cGFuPiBiZSBnZW5lcmF0ZWQgdG8gZG93bmxvYWQgdGhlIG9iamVjdHMsPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgIHBhcmFsbGVsIGNvbm5lY3Rpb25zIDxzcGFuIGNsYXNzPSJp bnNlcnQiPnNob3VsZDwvc3Bhbj4gYmUgZ2VuZXJhdGVkIHRvIGRvd25sb2FkIHRoZSBvYmplY3Rz LDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGVhY2ggcGFyYWxsZWwgY29ubmVjdGlv bnMgaGF2aW5nIGFuIGluaXRpYWwgY29uZ2VzdGlvbiB3aW5kb3cgc2V0IHRvPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZWFjaCBwYXJhbGxlbCBjb25uZWN0aW9ucyBoYXZpbmcg YW4gaW5pdGlhbCBjb25nZXN0aW9uIHdpbmRvdyBzZXQgdG88L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICAxMCBwYWNrZXRzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IDEwIHBhY2tldHMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgRm9yIGVh Y2ggb2YgdGhlc2Ugc2NlbmFyaW9zLCB0aGUgZ3JhcGggZGVzY3JpYmVkIGluIFNlY3Rpb24gMi43 IGNvdWxkPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgRm9yIGVhY2ggb2YgdGhl c2Ugc2NlbmFyaW9zLCB0aGUgZ3JhcGggZGVzY3JpYmVkIGluIFNlY3Rpb24gMi43IGNvdWxkPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYmUgZ2VuZXJhdGVkIGZvciBlYWNoIGFwcGxp Y2F0aW9uLiAgTWV0cmljcyBzdWNoIGFzIGVuZC10by1lbmQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICBiZSBnZW5lcmF0ZWQgZm9yIGVhY2ggYXBwbGljYXRpb24uICBNZXRyaWNz IHN1Y2ggYXMgZW5kLXRvLWVuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0ciBpZD0iZGlmZjAxMDQiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGxhdGVuY3ksIGppdHRlciwgZmxv dyBjb21wbGV0aW9uIHRpbWUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TUFZPC9zcGFuPiBiZSBnZW5l cmF0ZWQuICBGb3IgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGxhdGVu Y3ksIGppdHRlciwgZmxvdyBjb21wbGV0aW9uIHRpbWUgPHNwYW4gY2xhc3M9Imluc2VydCI+bWF5 PC9zcGFuPiBiZSBnZW5lcmF0ZWQuICBGb3IgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgY2FzZXMgb2YgZnJhbWUgZ2VuZXJhdGlvbiBvZiBidXJzdHkgdmlkZW8gdHJhZmZpYyBh cyB3ZWxsIGFzIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNhc2VzIG9m IGZyYW1lIGdlbmVyYXRpb24gb2YgYnVyc3R5IHZpZGVvIHRyYWZmaWMgYXMgd2VsbCBhcyB0aGU8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjaG9pY2Ugb2Ygd2ViIHRyYWZmaWMgcGF0 dGVybiwgdGhlc2UgZGV0YWlscyBhbmQgdGhlaXIgcHJlc2VudGF0aW9uPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgY2hvaWNlIG9mIHdlYiB0cmFmZmljIHBhdHRlcm4sIHRoZXNl IGRldGFpbHMgYW5kIHRoZWlyIHByZXNlbnRhdGlvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIGFyZSBsZWZ0IHRvIHRoZSB0ZXN0ZXJzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIGFyZSBsZWZ0IHRvIHRoZSB0ZXN0ZXJzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjguICBTdGFiaWxpdHk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij44LiAgU3RhYmlsaXR5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+OC4xLiAg TW90aXZhdGlvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjguMS4gIE1vdGl2YXRp b248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGUgc2FmZXR5IG9mIGFu IEFRTSBzY2hlbWUgaXMgZGlyZWN0bHkgcmVsYXRlZCB0byBpdHMgc3RhYmlsaXR5PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhlIHNhZmV0eSBvZiBhbiBBUU0gc2NoZW1lIGlz IGRpcmVjdGx5IHJlbGF0ZWQgdG8gaXRzIHN0YWJpbGl0eTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIHVuZGVyIHZhcnlpbmcgb3BlcmF0aW5nIGNvbmRpdGlvbnMgc3VjaCBhcyB2YXJ5 aW5nIHRyYWZmaWMgcHJvZmlsZXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB1 bmRlciB2YXJ5aW5nIG9wZXJhdGluZyBjb25kaXRpb25zIHN1Y2ggYXMgdmFyeWluZyB0cmFmZmlj IHByb2ZpbGVzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyIGlkPSJwYXJ0LTgiIGNsYXNzPSJjaGFuZ2UiPjx0ZD48L3RkPjx0aD48c21hbGw+c2tpcHBp bmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSIjcGFydC04Ij48ZW0+IHBhZ2UgMjMsIGxp bmUgOTxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+IDwvdGg+ PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTgi PjxlbT4gcGFnZSAyNCwgbGluZSAyNjxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48 L2E+PC90aD48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgV2hldGhlciB0aGUgdGFyZ2V0IGNvbnRleHQgaXMgYSBub3Qg c3RhYmxlIGVudmlyb25tZW50LCB0aGUgYWJpbGl0eTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIFdoZXRoZXIgdGhlIHRhcmdldCBjb250ZXh0IGlzIGEgbm90IHN0YWJsZSBlbnZp cm9ubWVudCwgdGhlIGFiaWxpdHk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvZiBh biBBUU0gc2NoZW1lIHRvIG1haW50YWluIGl0cyBjb250cm9sIG92ZXIgdGhlIHF1ZXVpbmcgZGVs YXkgYW5kPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgb2YgYW4gQVFNIHNjaGVt ZSB0byBtYWludGFpbiBpdHMgY29udHJvbCBvdmVyIHRoZSBxdWV1aW5nIGRlbGF5IGFuZDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGJ1ZmZlciBvY2N1cGFuY3kgY2FuIGJlIGNoYWxs ZW5nZWQuICBUaGlzIGRvY3VtZW50IHByb3Bvc2VzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgYnVmZmVyIG9jY3VwYW5jeSBjYW4gYmUgY2hhbGxlbmdlZC4gIFRoaXMgZG9jdW1l bnQgcHJvcG9zZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBndWlkZWxpbmVzIHRv IGFzc2VzcyB0aGUgYmVoYXZpb3Igb2YgQVFNIHNjaGVtZXMgdW5kZXIgdmFyeWluZzwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGd1aWRlbGluZXMgdG8gYXNzZXNzIHRoZSBiZWhh dmlvciBvZiBBUU0gc2NoZW1lcyB1bmRlciB2YXJ5aW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgY29uZ2VzdGlvbiBsZXZlbHMgYW5kIHZhcnlpbmcgZHJhaW5pbmcgcmF0ZXMuPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgY29uZ2VzdGlvbiBsZXZlbHMgYW5kIHZh cnlpbmcgZHJhaW5pbmcgcmF0ZXMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ OC4yLiAgUmVjb21tZW5kZWQgdGVzdHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij44 LjIuICBSZWNvbW1lbmRlZCB0ZXN0czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIE5vdGUgdGhhdCB0aGUgdHJhZmZpYyBwcm9maWxlcyBleHBsYWluZWQgYmVsb3cgY29tcHJp c2VzIG5vbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIE5vdGUgdGhhdCB0aGUg dHJhZmZpYyBwcm9maWxlcyBleHBsYWluZWQgYmVsb3cgY29tcHJpc2VzIG5vbjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFwcGxpY2F0aW9uLWxpbWl0ZWQgVENQIGZsb3dzLiAgRm9y IGVhY2ggb2YgdGhlIGJlbG93IHNjZW5hcmlvcywgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgYXBwbGljYXRpb24tbGltaXRlZCBUQ1AgZmxvd3MuICBGb3IgZWFjaCBvZiB0 aGUgYmVsb3cgc2NlbmFyaW9zLCB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHIgaWQ9ImRpZmYwMTA1Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBncmFwaHMgZGVzY3JpYmVk IGluIFNlY3Rpb24gMi43IDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gYmUgZ2Vu ZXJhdGVkLCBhbmQgdGhlIGdvb2RwdXQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgZ3JhcGhzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDIuNyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5z aG91bGQ8L3NwYW4+IGJlIGdlbmVyYXRlZCwgYW5kIHRoZSBnb29kcHV0PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgb2YgdGhlIHZhcmlvdXMgZmxvd3Mgc2hvdWxkIGJlIGN1bXVsYXRl ZC4gIEZvciBTZWN0aW9uIDguMi41IGFuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIG9mIHRoZSB2YXJpb3VzIGZsb3dzIHNob3VsZCBiZSBjdW11bGF0ZWQuICBGb3IgU2VjdGlv biA4LjIuNSBhbmQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIg aWQ9ImRpZmYwMTA2Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBTZWN0aW9uIDguMi42IHRoZXkgPHNwYW4gY2xh c3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFuPiBpbmNvcnBvcmF0ZSB0aGUgcmVzdWx0cyBpbiBwZXIt cGhhc2UgYmFzaXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgU2VjdGlvbiA4 LjIuNiB0aGV5IDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3VsZDwvc3Bhbj4gaW5jb3Jwb3JhdGUg dGhlIHJlc3VsdHMgaW4gcGVyLXBoYXNlIGJhc2lzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgYXMgd2VsbC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhcyB3ZWxs LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFdoZXJldmVyIHRoZSBub3Rp b24gb2YgdGltZSBoYXMgZXhwbGljaXRseSBtZW50aW9uZWQgaW4gdGhpczwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIFdoZXJldmVyIHRoZSBub3Rpb24gb2YgdGltZSBoYXMgZXhw bGljaXRseSBtZW50aW9uZWQgaW4gdGhpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IHN1YnNlY3Rpb24sIHRpbWUgMCBzdGFydHMgZnJvbSB0aGUgbW9tZW50IGFsbCBUQ1AgZmxvd3Mg aGF2ZSBhbHJlYWR5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgc3Vic2VjdGlv biwgdGltZSAwIHN0YXJ0cyBmcm9tIHRoZSBtb21lbnQgYWxsIFRDUCBmbG93cyBoYXZlIGFscmVh ZHk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICByZWFjaGVkIHRoZWlyIGNvbmdlc3Rp b24gYXZvaWRhbmNlIHBoYXNlLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHJl YWNoZWQgdGhlaXIgY29uZ2VzdGlvbiBhdm9pZGFuY2UgcGhhc2UuPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+OC4yLjEuICBEZWZpbml0aW9uIG9mIHRoZSBjb25nZXN0aW9uIExl dmVsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+OC4yLjEuICBEZWZpbml0aW9uIG9m IHRoZSBjb25nZXN0aW9uIExldmVsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgSW4gdGhlc2UgZ3VpZGVsaW5lcywgdGhlIGNvbmdlc3Rpb24gbGV2ZWxzIGFyZSByZXByZXNl bnRlZCBieSB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJbiB0aGVzZSBn dWlkZWxpbmVzLCB0aGUgY29uZ2VzdGlvbiBsZXZlbHMgYXJlIHJlcHJlc2VudGVkIGJ5IHRoZTwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb2plY3RlZCBwYWNrZXQgZHJvcCByYXRl LCBoYWQgYSBkcm9wLXRhaWwgcXVldWUgd2FzIGNob3NlbiBpbnN0ZWFkPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgcHJvamVjdGVkIHBhY2tldCBkcm9wIHJhdGUsIGhhZCBhIGRy b3AtdGFpbCBxdWV1ZSB3YXMgY2hvc2VuIGluc3RlYWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9InBhcnQtOSIgY2xhc3M9ImNoYW5nZSI+PHRk PjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNw YXJ0LTkiPjxlbT4gcGFnZSAyNCwgbGluZSA0ODxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+ PC9lbT48L2E+PC90aD48dGg+IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8 L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTkiPjxlbT4gcGFnZSAyNiwgbGluZSAxNTxzcGFuIGNsYXNz PSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgRXhwZXJpbWVu dCAxOiB0aGUgY2FwYWNpdHkgdmFyaWVzIGJldHdlZW4gdHdvIHZhbHVlcyB3aXRoaW4gYTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIEV4cGVyaW1lbnQgMTogdGhlIGNhcGFj aXR5IHZhcmllcyBiZXR3ZWVuIHR3byB2YWx1ZXMgd2l0aGluIGE8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICBsYXJnZSB0aW1lLXNjYWxlLiAgQXMgYW4gZXhhbXBsZSwgdGhlIGZv bGxvd2luZyBwaGFzZXMgbWF5IGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgbGFyZ2UgdGltZS1zY2FsZS4gIEFzIGFuIGV4YW1wbGUsIHRoZSBmb2xsb3dpbmcgcGhhc2Vz IG1heSBiZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIGNvbnNpZGVyZWQ6IHBo YXNlIEkgLSAxMDBNYnBzIGR1cmluZyAwLTIwczsgcGhhc2UgSUkgLSAxME1icHM8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBjb25zaWRlcmVkOiBwaGFzZSBJIC0gMTAwTWJw cyBkdXJpbmcgMC0yMHM7IHBoYXNlIElJIC0gMTBNYnBzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgICAgZHVyaW5nIDIwLTQwczsgcGhhc2UgSSBhZ2FpbiwgYW5kIHNvIG9uLjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGR1cmluZyAyMC00MHM7IHBoYXNlIEkg YWdhaW4sIGFuZCBzbyBvbi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBv ICBFeHBlcmltZW50IDI6IHRoZSBjYXBhY2l0eSB2YXJpZXMgYmV0d2VlbiB0d28gdmFsdWVzIHdp dGhpbiBhPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgRXhwZXJpbWVudCAy OiB0aGUgY2FwYWNpdHkgdmFyaWVzIGJldHdlZW4gdHdvIHZhbHVlcyB3aXRoaW4gYTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHNob3J0IHRpbWUtc2NhbGUuICBBcyBhbiBleGFt cGxlLCB0aGUgZm9sbG93aW5nIHBoYXNlcyBtYXkgYmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgICBzaG9ydCB0aW1lLXNjYWxlLiAgQXMgYW4gZXhhbXBsZSwgdGhlIGZvbGxv d2luZyBwaGFzZXMgbWF5IGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgY29u c2lkZXJlZDogcGhhc2UgSSAtIDEwME1icHMgZHVyaW5nIDAtMTAwbXM7IHBoYXNlIElJIC0gMTBN YnBzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgY29uc2lkZXJlZDogcGhh c2UgSSAtIDEwME1icHMgZHVyaW5nIDAtMTAwbXM7IHBoYXNlIElJIC0gMTBNYnBzPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgZHVyaW5nIDEwMC0yMDBtczsgcGhhc2UgSSBhZ2Fp biwgYW5kIHNvIG9uLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGR1cmlu ZyAxMDAtMjAwbXM7IHBoYXNlIEkgYWdhaW4sIGFuZCBzbyBvbi48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTA3Ij48dGQ+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICBUaGUgdGVzdGVyIDxzcGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj4gY2hvb3NlIGEg cGhhc2UgdGltZS1pbnRlcnZhbCB2YWx1ZSBkaWZmZXJlbnQgdGhhbiB3aGF0PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFRoZSB0ZXN0ZXIgPHNwYW4gY2xhc3M9Imluc2VydCI+ bWF5PC9zcGFuPiBjaG9vc2UgYSBwaGFzZSB0aW1lLWludGVydmFsIHZhbHVlIGRpZmZlcmVudCB0 aGFuIHdoYXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBpcyBzdGF0ZWQgYWJvdmUs IGlmIHRoZSBuZXR3b3JrJ3MgcGF0aCBjb25kaXRpb25zIChzdWNoIGFzIGJhbmR3aWR0aC08L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBpcyBzdGF0ZWQgYWJvdmUsIGlmIHRoZSBu ZXR3b3JrJ3MgcGF0aCBjb25kaXRpb25zIChzdWNoIGFzIGJhbmR3aWR0aC08L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBkZWxheSBwcm9kdWN0KSBuZWNlc3NpdGF0ZS4gIEluIHRoaXMg Y2FzZSB0aGUgY2hvaWNlIG9mIHN1Y2ggdGltZS08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBkZWxheSBwcm9kdWN0KSBuZWNlc3NpdGF0ZS4gIEluIHRoaXMgY2FzZSB0aGUgY2hv aWNlIG9mIHN1Y2ggdGltZS08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHIgaWQ9ImRpZmYwMTA4Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBpbnRlcnZhbCB2YWx1ZSA8c3BhbiBj bGFzcz0iZGVsZXRlIj5TSE9VTEQ8L3NwYW4+IGJlIHN0YXRlZCBhbmQgZWxhYm9yYXRlZC48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgaW50ZXJ2YWwgdmFsdWUgPHNwYW4gY2xh c3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPiBiZSBzdGF0ZWQgYW5kIGVsYWJvcmF0ZWQuPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEw OSI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+ICAgVGhlIHRlc3RlciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NQVk8L3Nw YW4+IGFkZGl0aW9uYWxseSBldmFsdWF0ZSB0aGUgdHdvIG1lbnRpb25lZCBzY2VuYXJpb3M8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgVGhlIHRlc3RlciA8c3BhbiBjbGFzcz0i aW5zZXJ0Ij5tYXk8L3NwYW4+IGFkZGl0aW9uYWxseSBldmFsdWF0ZSB0aGUgdHdvIG1lbnRpb25l ZCBzY2VuYXJpb3M8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAoc2hvcnQtdGVybSBh bmQgbG9uZy10ZXJtIGNhcGFjaXR5IHZhcmlhdGlvbnMpLCBkdXJpbmcgYW5kL29yPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgKHNob3J0LXRlcm0gYW5kIGxvbmctdGVybSBjYXBh Y2l0eSB2YXJpYXRpb25zKSwgZHVyaW5nIGFuZC9vcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIGluY2x1ZGluZyBUQ1Agc2xvdy1zdGFydCBwaGFzZS48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBpbmNsdWRpbmcgVENQIHNsb3ctc3RhcnQgcGhhc2UuPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDExMCI+ PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+ICAgTW9yZSByZWFsaXN0aWMgZmx1Y3R1YXRpbmcgY2FwYWNpdHkgcGF0dGVy bnMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TUFZPC9zcGFuPiBiZSBjb25zaWRlcmVkLiAgVGhlPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIE1vcmUgcmVhbGlzdGljIGZsdWN0dWF0 aW5nIGNhcGFjaXR5IHBhdHRlcm5zIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm1heTwvc3Bhbj4gYmUg Y29uc2lkZXJlZC4gIFRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgdGVzdGVy IDxzcGFuIGNsYXNzPSJkZWxldGUiPk1BWTwvc3Bhbj4gY2hvb3NlIHRvIGluY29ycG9yYXRlIHJl YWxpc3RpYyBzY2VuYXJpb3Mgd2l0aCByZWdhcmRzIHRvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgIHRlc3RlciA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5tYXk8L3NwYW4+IGNob29z ZSB0byBpbmNvcnBvcmF0ZSByZWFsaXN0aWMgc2NlbmFyaW9zIHdpdGggcmVnYXJkcyB0bzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGNvbW1vbiBmbHVjdHVhdGlvbiBvZiBiYW5kd2lk dGggaW4gc3RhdGUtb2YtdGhlLWFydCB0ZWNobm9sb2dpZXMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgY29tbW9uIGZsdWN0dWF0aW9uIG9mIGJhbmR3aWR0aCBpbiBzdGF0ZS1v Zi10aGUtYXJ0IHRlY2hub2xvZ2llcy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBUaGUgc2NlbmFyaW8gY29uc2lzdHMgb2YgVENQIE5ld1Jlbm8gZmxvd3MgYmV0d2VlbiBz ZW5kZXIgQSBhbmQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgc2NlbmFy aW8gY29uc2lzdHMgb2YgVENQIE5ld1Jlbm8gZmxvd3MgYmV0d2VlbiBzZW5kZXIgQSBhbmQ8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICByZWNlaXZlciBCLiAgVG8gYmV0dGVyIGFzc2Vz cyB0aGUgaW1wYWN0IG9mIGRyYWluaW5nIHJhdGVzIG9uIHRoZSBBUU08L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICByZWNlaXZlciBCLiAgVG8gYmV0dGVyIGFzc2VzcyB0aGUgaW1w YWN0IG9mIGRyYWluaW5nIHJhdGVzIG9uIHRoZSBBUU08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTExIj48dGQ+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBiZWhhdmlv ciwgdGhlIHRlc3RlciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBjb21wYXJlIGl0 cyBwZXJmb3JtYW5jZSB3aXRoIHRob3NlIG9mIGRyb3AtPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgIGJlaGF2aW9yLCB0aGUgdGVzdGVyIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm11 c3Q8L3NwYW4+IGNvbXBhcmUgaXRzIHBlcmZvcm1hbmNlIHdpdGggdGhvc2Ugb2YgZHJvcC08L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHRhaWwgYW5kIDxzcGFuIGNsYXNzPSJkZWxl dGUiPlNIT1VMRDwvc3Bhbj4gcHJvdmlkZSBhIHJlZmVyZW5jZSBkb2N1bWVudCBmb3IgdGhlaXIg cHJvcG9zYWw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgdGFpbCBhbmQgPHNw YW4gY2xhc3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPiBwcm92aWRlIGEgcmVmZXJlbmNlIGRvY3Vt ZW50IGZvciB0aGVpciBwcm9wb3NhbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRp c2N1c3NpbmcgcGVyZm9ybWFuY2UgYW5kIGRlcGxveW1lbnQgY29tcGFyZWQgdG8gdGhvc2Ugb2Yg ZHJvcC10YWlsLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRpc2N1c3Npbmcg cGVyZm9ybWFuY2UgYW5kIGRlcGxveW1lbnQgY29tcGFyZWQgdG8gdGhvc2Ugb2YgZHJvcC10YWls LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEJ1cnN0IHRyYWZmaWMsIHN1Y2ggYXMg cHJlc2VudGVkIGluIFNlY3Rpb24gNy4yLCBjb3VsZCBhbHNvIGJlPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgQnVyc3QgdHJhZmZpYywgc3VjaCBhcyBwcmVzZW50ZWQgaW4gU2Vj dGlvbiA3LjIsIGNvdWxkIGFsc28gYmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBj b25zaWRlcmVkIHRvIGFzc2VzcyB0aGUgaW1wYWN0IG9mIHZhcnlpbmcgYXZhaWxhYmxlIGNhcGFj aXR5IG9uIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvbnNpZGVyZWQg dG8gYXNzZXNzIHRoZSBpbXBhY3Qgb2YgdmFyeWluZyBhdmFpbGFibGUgY2FwYWNpdHkgb24gdGhl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYnVyc3QgYWJzb3JwdGlvbiBvZiB0aGUg QVFNLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGJ1cnN0IGFic29ycHRpb24g b2YgdGhlIEFRTS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij44LjMuICBQYXJh bWV0ZXIgc2Vuc2l0aXZpdHkgYW5kIHN0YWJpbGl0eSBhbmFseXNpczwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjguMy4gIFBhcmFtZXRlciBzZW5zaXRpdml0eSBhbmQgc3RhYmlsaXR5 IGFuYWx5c2lzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIGNvbnRy b2wgbGF3IHVzZWQgYnkgYW4gQVFNIGlzIHRoZSBwcmltYXJ5IG1lYW5zIGJ5IHdoaWNoIHRoZTwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBjb250cm9sIGxhdyB1c2VkIGJ5 IGFuIEFRTSBpcyB0aGUgcHJpbWFyeSBtZWFucyBieSB3aGljaCB0aGU8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBxdWV1aW5nIGRlbGF5IGlzIGNvbnRyb2xsZWQuICBIZW5jZSB1bmRl cnN0YW5kaW5nIHRoZSBjb250cm9sIGxhdyBpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIHF1ZXVpbmcgZGVsYXkgaXMgY29udHJvbGxlZC4gIEhlbmNlIHVuZGVyc3RhbmRpbmcg dGhlIGNvbnRyb2wgbGF3IGlzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgY3JpdGlj YWwgdG8gdW5kZXJzdGFuZGluZyB0aGUgYmVoYXZpb3Igb2YgdGhlIEFRTSBzY2hlbWUuICBUaGU8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjcml0aWNhbCB0byB1bmRlcnN0YW5k aW5nIHRoZSBiZWhhdmlvciBvZiB0aGUgQVFNIHNjaGVtZS4gIFRoZTwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0icGFydC0xMCIgY2xhc3M9ImNo YW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxh IGhyZWY9IiNwYXJ0LTEwIj48ZW0+IHBhZ2UgMjUsIGxpbmUgNDQ8c3BhbiBjbGFzcz0iaGlkZSI+ IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8g Y2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSIjcGFydC0xMCI+PGVtPiBwYWdlIDI3LCBsaW5lIDEw PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBUcmFuc3BvcnRzIG9wZXJhdGluZyB1bmRlciB0aGUgY29udHJvbCBvZiBBUU0gZXhwZXJp ZW5jZSB0aGUgZWZmZWN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVHJhbnNw b3J0cyBvcGVyYXRpbmcgdW5kZXIgdGhlIGNvbnRyb2wgb2YgQVFNIGV4cGVyaWVuY2UgdGhlIGVm ZmVjdDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG9mIG11bHRpcGxlIGNvbnRyb2wg bG9vcHMgdGhhdCByZWFjdCBvdmVyIGRpZmZlcmVudCB0aW1lc2NhbGVzLiAgSXQ8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvZiBtdWx0aXBsZSBjb250cm9sIGxvb3BzIHRoYXQg cmVhY3Qgb3ZlciBkaWZmZXJlbnQgdGltZXNjYWxlcy4gIEl0PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgaXMgdGhlcmVmb3JlIGltcG9ydGFudCB0aGF0IHByb3Bvc2VkIEFRTSBzY2hl bWVzIGFyZSBzZWVuIHRvIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaXMg dGhlcmVmb3JlIGltcG9ydGFudCB0aGF0IHByb3Bvc2VkIEFRTSBzY2hlbWVzIGFyZSBzZWVuIHRv IGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc3RhYmxlIHdoZW4gdGhleSBhcmUg ZGVwbG95ZWQgYXQgbXVsdGlwbGUgcG9pbnRzIG9mIHBvdGVudGlhbDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIHN0YWJsZSB3aGVuIHRoZXkgYXJlIGRlcGxveWVkIGF0IG11bHRp cGxlIHBvaW50cyBvZiBwb3RlbnRpYWw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBj b25nZXN0aW9uIGFsb25nIGFuIEludGVybmV0IHBhdGguICBUaGUgcGF0dGVybiBvZiBjb25nZXN0 aW9uIHNpZ25hbHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjb25nZXN0aW9u IGFsb25nIGFuIEludGVybmV0IHBhdGguICBUaGUgcGF0dGVybiBvZiBjb25nZXN0aW9uIHNpZ25h bHM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAobG9zcyBvciBFQ04tbWFya2luZykg YXJpc2luZyBmcm9tIEFRTSBtZXRob2RzIGFsc28gbmVlZCB0byBub3Q8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAobG9zcyBvciBFQ04tbWFya2luZykgYXJpc2luZyBmcm9tIEFR TSBtZXRob2RzIGFsc28gbmVlZCB0byBub3Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBhZHZlcnNlbHkgaW50ZXJhY3Qgd2l0aCB0aGUgZHluYW1pY3Mgb2YgdGhlIHRyYW5zcG9ydCBw cm90b2NvbHMgdGhhdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFkdmVyc2Vs eSBpbnRlcmFjdCB3aXRoIHRoZSBkeW5hbWljcyBvZiB0aGUgdHJhbnNwb3J0IHByb3RvY29scyB0 aGF0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGhleSBjb250cm9sLjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZXkgY29udHJvbC48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTEyIj48dGQ+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICBBUU0gcHJvcG9zYWxzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4g cHJvdmlkZSBiYWNrZ3JvdW5kIG1hdGVyaWFsIHNob3dpbmcgY29udHJvbDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBBUU0gcHJvcG9zYWxzIDxzcGFuIGNsYXNzPSJpbnNlcnQi PnNob3VsZDwvc3Bhbj4gcHJvdmlkZSBiYWNrZ3JvdW5kIG1hdGVyaWFsIHNob3dpbmcgY29udHJv bDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZW9yZXRpYyBhbmFseXNpcyBvZiB0 aGUgQVFNIGNvbnRyb2wgbGF3IGFuZCB0aGUgaW5wdXQgcGFyYW1ldGVyPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgdGhlb3JldGljIGFuYWx5c2lzIG9mIHRoZSBBUU0gY29udHJv bCBsYXcgYW5kIHRoZSBpbnB1dCBwYXJhbWV0ZXI8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBzcGFjZSB3aXRoaW4gd2hpY2ggdGhlIGNvbnRyb2wgbGF3IG9wZXJhdGVzIGFzIGV4cGVj dGVkOyBvciBjb3VsZCB1c2U8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzcGFj ZSB3aXRoaW4gd2hpY2ggdGhlIGNvbnRyb2wgbGF3IG9wZXJhdGVzIGFzIGV4cGVjdGVkOyBvciBj b3VsZCB1c2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhbm90aGVyIHdheSB0byBk aXNjdXNzIHRoZSBzdGFiaWxpdHkgb2YgdGhlIGNvbnRyb2wgbGF3LiAgRm9yPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYW5vdGhlciB3YXkgdG8gZGlzY3VzcyB0aGUgc3RhYmls aXR5IG9mIHRoZSBjb250cm9sIGxhdy4gIEZvcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMTMiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHBhcmFtZXRlcnMg dGhhdCBhcmUgYXV0by10dW5lZCwgdGhlIG1hdGVyaWFsIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNI T1VMRDwvc3Bhbj4gaW5jbHVkZSBzdGFiaWxpdHk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgcGFyYW1ldGVycyB0aGF0IGFyZSBhdXRvLXR1bmVkLCB0aGUgbWF0ZXJpYWwgPHNw YW4gY2xhc3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPiBpbmNsdWRlIHN0YWJpbGl0eTwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFuYWx5c2lzIG9mIHRoZSBhdXRvLXR1bmluZyBtZWNo YW5pc20ocykgYXMgd2VsbC4gIFN1Y2ggYW5hbHlzaXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBhbmFseXNpcyBvZiB0aGUgYXV0by10dW5pbmcgbWVjaGFuaXNtKHMpIGFzIHdl bGwuICBTdWNoIGFuYWx5c2lzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaGVscHMg dG8gdW5kZXJzdGFuZCBhbiBBUU0gY29udHJvbCBsYXcgYmV0dGVyIGFuZCB0aGUgbmV0d29yazwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGhlbHBzIHRvIHVuZGVyc3RhbmQgYW4g QVFNIGNvbnRyb2wgbGF3IGJldHRlciBhbmQgdGhlIG5ldHdvcms8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBjb25kaXRpb25zL2RlcGxveW1lbnRzIHVuZGVyIHdoaWNoIHRoZSBBUU0g aXMgc3RhYmxlLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvbmRpdGlvbnMv ZGVwbG95bWVudHMgdW5kZXIgd2hpY2ggdGhlIEFRTSBpcyBzdGFibGUuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+OS4gIFZhcmlvdXMgVHJhZmZpYyBQcm9maWxlczwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjkuICBWYXJpb3VzIFRyYWZmaWMgUHJvZmlsZXM8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIHNlY3Rpb24gcHJvdmlkZXMg Z3VpZGVsaW5lcyB0byBhc3Nlc3MgdGhlIHBlcmZvcm1hbmNlIG9mIGFuIEFRTTwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoaXMgc2VjdGlvbiBwcm92aWRlcyBndWlkZWxpbmVz IHRvIGFzc2VzcyB0aGUgcGVyZm9ybWFuY2Ugb2YgYW4gQVFNPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgcHJvcG9zYWwgZm9yIHZhcmlvdXMgdHJhZmZpYyBwcm9maWxlcyBzdWNoIGFz IHRyYWZmaWMgd2l0aCBkaWZmZXJlbnQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBwcm9wb3NhbCBmb3IgdmFyaW91cyB0cmFmZmljIHByb2ZpbGVzIHN1Y2ggYXMgdHJhZmZpYyB3 aXRoIGRpZmZlcmVudDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFwcGxpY2F0aW9u cyBvciBiaS1kaXJlY3Rpb25hbCB0cmFmZmljLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGFwcGxpY2F0aW9ucyBvciBiaS1kaXJlY3Rpb25hbCB0cmFmZmljLjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0icGFydC0x MSIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2Ug YXQ8L3NtYWxsPjxhIGhyZWY9IiNwYXJ0LTExIj48ZW0+IHBhZ2UgMjYsIGxpbmUgMjQ8c3BhbiBj bGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+ c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSIjcGFydC0xMSI+PGVtPiBwYWdl IDI3LCBsaW5lIDM4PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0 ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICB0cmFmZmljIG1peCBjb25zaXN0aW5nIG9mIGRpZmZlcmVudCBhcHBsaWNhdGlv bnMgc3VjaCBhczo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0cmFmZmljIG1p eCBjb25zaXN0aW5nIG9mIGRpZmZlcmVudCBhcHBsaWNhdGlvbnMgc3VjaCBhczo8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBCdWxrIFRDUCB0cmFuc2ZlcjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIEJ1bGsgVENQIHRyYW5zZmVyPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgV2ViIHRyYWZmaWM8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBXZWIgdHJhZmZpYzwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIG8gIFZvSVA8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBWb0lQPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgQ29u c3RhbnQgQml0IFJhdGUgKENCUikgVURQIHRyYWZmaWM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBvICBDb25zdGFudCBCaXQgUmF0ZSAoQ0JSKSBVRFAgdHJhZmZpYzwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMTQi Pjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgIG8gIEFkYXB0aXZlIHZpZGVvIHN0cmVhbWluZzwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBvICBBZGFwdGl2ZSB2aWRlbyBzdHJlYW1pbmc8c3BhbiBj bGFzcz0iaW5zZXJ0Ij4gKGVpdGhlciB1bmlkaXJlY3Rpb25hbCBvciBiaWRpcmVjdGlvbmFsKTwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIg aWQ9ImRpZmYwMTE1Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBWYXJpb3VzIHRyYWZmaWMgbWl4ZXMgY2FuIGJl IGNvbnNpZGVyZWQuICBUaGVzZSBndWlkZWxpbmVzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlJFQ09N TUVORDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgVmFyaW91cyB0 cmFmZmljIG1peGVzIGNhbiBiZSBjb25zaWRlcmVkLiAgVGhlc2UgZ3VpZGVsaW5lcyA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5yZWNvbW1lbmQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgdG8gZXhhbWluZSBhdCBsZWFzdCB0aGUgZm9sbG93aW5nIGV4YW1wbGU6IDEgYmktZGly ZWN0aW9uYWwgVm9JUDsgNjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRvIGV4 YW1pbmUgYXQgbGVhc3QgdGhlIGZvbGxvd2luZyBleGFtcGxlOiAxIGJpLWRpcmVjdGlvbmFsIFZv SVA7IDY8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBXZWIgcGFnZXMgZG93bmxvYWQg KHN1Y2ggYXMgZGV0YWlsZWQgaW4gU2VjdGlvbiA3LjIpOyAxIENCUjsgMTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIFdlYiBwYWdlcyBkb3dubG9hZCAoc3VjaCBhcyBkZXRhaWxl ZCBpbiBTZWN0aW9uIDcuMik7IDEgQ0JSOyAxPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgQWRhcHRpdmUgVmlkZW87IDUgYnVsayBUQ1AuICBBbnkgb3RoZXIgY29tYmluYXRpb25zIGNv dWxkIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQWRhcHRpdmUgVmlkZW87 IDUgYnVsayBUQ1AuICBBbnkgb3RoZXIgY29tYmluYXRpb25zIGNvdWxkIGJlPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgY29uc2lkZXJlZCBhbmQgc2hvdWxkIGJlIGNhcmVmdWxseSBk b2N1bWVudGVkLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNvbnNpZGVyZWQg YW5kIHNob3VsZCBiZSBjYXJlZnVsbHkgZG9jdW1lbnRlZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBGb3IgZWFjaCBzY2VuYXJpbywgdGhlIGdyYXBoIGRlc2NyaWJlZCBp biBTZWN0aW9uIDIuNyBjb3VsZCBiZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IEZvciBlYWNoIHNjZW5hcmlvLCB0aGUgZ3JhcGggZGVzY3JpYmVkIGluIFNlY3Rpb24gMi43IGNv dWxkIGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZ2VuZXJhdGVkIGZvciBlYWNo IGNsYXNzIG9mIHRyYWZmaWMuICBNZXRyaWNzIHN1Y2ggYXMgZW5kLXRvLWVuZDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGdlbmVyYXRlZCBmb3IgZWFjaCBjbGFzcyBvZiB0cmFm ZmljLiAgTWV0cmljcyBzdWNoIGFzIGVuZC10by1lbmQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTE2Ij48dGQ+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBsYXRlbmN5 LCBqaXR0ZXIgYW5kIGZsb3cgY29tcGxldGlvbiB0aW1lIDxzcGFuIGNsYXNzPSJkZWxldGUiPk1B WTwvc3Bhbj4gYmUgcmVwb3J0ZWQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IGxhdGVuY3ksIGppdHRlciBhbmQgZmxvdyBjb21wbGV0aW9uIHRpbWUgPHNwYW4gY2xhc3M9Imlu c2VydCI+bWF5PC9zcGFuPiBiZSByZXBvcnRlZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij45LjIuICBCaS1kaXJlY3Rpb25hbCB0cmFmZmljPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+OS4yLiAgQmktZGlyZWN0aW9uYWwgdHJhZmZpYzwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIENvbnRyb2wgcGFja2V0cyBzdWNoIGFzIEROUyByZXF1ZXN0 cy9yZXNwb25zZXMsIFRDUCBTWU5zL0FDS3MgYXJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgQ29udHJvbCBwYWNrZXRzIHN1Y2ggYXMgRE5TIHJlcXVlc3RzL3Jlc3BvbnNlcywg VENQIFNZTnMvQUNLcyBhcmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzbWFsbCwg YnV0IHRoZWlyIGxvc3MgY2FuIHNldmVyZWx5IGltcGFjdCB0aGUgYXBwbGljYXRpb248L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzbWFsbCwgYnV0IHRoZWlyIGxvc3MgY2FuIHNl dmVyZWx5IGltcGFjdCB0aGUgYXBwbGljYXRpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBwZXJmb3JtYW5jZS4gIFRoZSBzY2VuYXJpbyBwcm9wb3NlZCBpbiB0aGlzIHNlY3Rpb24g d2lsbCBoZWxwIGluPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcGVyZm9ybWFu Y2UuICBUaGUgc2NlbmFyaW8gcHJvcG9zZWQgaW4gdGhpcyBzZWN0aW9uIHdpbGwgaGVscCBpbjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFzc2Vzc2luZyB3aGV0aGVyIHRoZSBpbnRy b2R1Y3Rpb24gb2YgYW4gQVFNIHNjaGVtZSBpbmNyZWFzZXMgdGhlPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgYXNzZXNzaW5nIHdoZXRoZXIgdGhlIGludHJvZHVjdGlvbiBvZiBh biBBUU0gc2NoZW1lIGluY3JlYXNlcyB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBsb3NzIHByb2JhYmlsaXR5IG9mIHRoZXNlIGltcG9ydGFudCBwYWNrZXRzLjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGxvc3MgcHJvYmFiaWxpdHkgb2YgdGhlc2UgaW1wb3J0 YW50IHBhY2tldHMuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyIGlkPSJkaWZmMDExNyI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgRm9yIHRoaXMgc2NlbmFyaW8sIHRy YWZmaWMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TVVTVDwvc3Bhbj4gYmUgZ2VuZXJhdGVkIGluIGJv dGggZG93bmxpbmsgYW5kPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEZvciB0 aGlzIHNjZW5hcmlvLCB0cmFmZmljIDxzcGFuIGNsYXNzPSJpbnNlcnQiPm11c3Q8L3NwYW4+IGJl IGdlbmVyYXRlZCBpbiBib3RoIGRvd25saW5rIGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgdXBsaW5rLCBzdWNoIGFzIGRlZmluZWQgaW4gU2VjdGlvbiAzLjEuICBUaGVzZSBn dWlkZWxpbmVzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlJFQ09NTUVORDwvc3Bhbj48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgdXBsaW5rLCBzdWNoIGFzIGRlZmluZWQgaW4gU2Vj dGlvbiAzLjEuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UaGUgYW1vdW50IG9mIGFzeW1tZXRyeTwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHRvIGNvbnNpZGVyIGEgbWls ZCBjb25nZXN0aW9uIGxldmVsIGFuZCB0aGUgdHJhZmZpYyBwcmVzZW50ZWQgaW48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgYmV0d2VlbiB0 aGUgdXBsaW5rIGFuZCB0aGUgZG93bmxpbmsgZGVwZW5kcyBvbiB0aGUgY29udGV4dC48L3NwYW4+ ICBUaGVzZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgU2VjdGlvbiA4LjIuMiBp biBib3RoIGRpcmVjdGlvbnMuICBJbiB0aGlzIGNhc2UsIHRoZSBtZXRyaWNzIHJlcG9ydGVkPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGd1aWRlbGluZXMgPHNwYW4gY2xhc3M9 Imluc2VydCI+cmVjb21tZW5kPC9zcGFuPiB0byBjb25zaWRlciBhIG1pbGQgY29uZ2VzdGlvbiBs ZXZlbCBhbmQgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA8c3BhbiBjbGFz cz0iZGVsZXRlIj5NVVNUPC9zcGFuPiBiZSB0aGUgc2FtZSBhcyBpbiBTZWN0aW9uIDguMiBmb3Ig ZWFjaCBkaXJlY3Rpb24uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIHRyYWZm aWMgcHJlc2VudGVkIGluIFNlY3Rpb24gOC4yLjIgaW4gYm90aCBkaXJlY3Rpb25zLiAgSW4gdGhp cyBjYXNlLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIHRoZSBtZXRyaWNzIHJlcG9ydGVkIDxzcGFuIGNsYXNzPSJpbnNl cnQiPm11c3Q8L3NwYW4+IGJlIHRoZSBzYW1lIGFzIGluIFNlY3Rpb24gOC4yIGZvciBlYWNoPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgZGlyZWN0aW9uLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMTgiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFRoZSB0cmFmZmljIG1p eCBwcmVzZW50ZWQgaW4gU2VjdGlvbiA5LjEgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TUFZPC9zcGFu PiBhbHNvIGJlIGdlbmVyYXRlZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICBUaGUgdHJhZmZpYyBtaXggcHJlc2VudGVkIGluIFNlY3Rpb24gOS4xIDxzcGFuIGNsYXNzPSJp bnNlcnQiPm1heTwvc3Bhbj4gYWxzbyBiZSBnZW5lcmF0ZWQgaW48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBib3RoIGRpcmVjdGlvbnMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgYm90aCBkaXJlY3Rpb25zLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMTkiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjEwLiAgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+TXVsdGktQVFNIFM8L3NwYW4+Y2VuYXJpbzwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4xMC4gIDxzcGFuIGNsYXNzPSJpbnNlcnQiPkV4YW1wbGUgb2YgbXVs dGktQVFNIHM8L3NwYW4+Y2VuYXJpbzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjEwLjEuICBNb3RpdmF0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+MTAuMS4g IE1vdGl2YXRpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUcmFuc3Bv cnRzIG9wZXJhdGluZyB1bmRlciB0aGUgY29udHJvbCBvZiBBUU0gZXhwZXJpZW5jZSB0aGUgZWZm ZWN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVHJhbnNwb3J0cyBvcGVyYXRp bmcgdW5kZXIgdGhlIGNvbnRyb2wgb2YgQVFNIGV4cGVyaWVuY2UgdGhlIGVmZmVjdDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG9mIG11bHRpcGxlIGNvbnRyb2wgbG9vcHMgdGhhdCBy ZWFjdCBvdmVyIGRpZmZlcmVudCB0aW1lc2NhbGVzLiAgSXQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICBvZiBtdWx0aXBsZSBjb250cm9sIGxvb3BzIHRoYXQgcmVhY3Qgb3ZlciBk aWZmZXJlbnQgdGltZXNjYWxlcy4gIEl0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg aXMgdGhlcmVmb3JlIGltcG9ydGFudCB0aGF0IHByb3Bvc2VkIEFRTSBzY2hlbWVzIGFyZSBzZWVu IHRvIGJlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaXMgdGhlcmVmb3JlIGlt cG9ydGFudCB0aGF0IHByb3Bvc2VkIEFRTSBzY2hlbWVzIGFyZSBzZWVuIHRvIGJlPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc3RhYmxlIHdoZW4gdGhleSBhcmUgZGVwbG95ZWQgYXQg bXVsdGlwbGUgcG9pbnRzIG9mIHBvdGVudGlhbDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIHN0YWJsZSB3aGVuIHRoZXkgYXJlIGRlcGxveWVkIGF0IG11bHRpcGxlIHBvaW50cyBv ZiBwb3RlbnRpYWw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBjb25nZXN0aW9uIGFs b25nIGFuIEludGVybmV0IHBhdGguICBUaGUgcGF0dGVybiBvZiBjb25nZXN0aW9uIHNpZ25hbHM8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjb25nZXN0aW9uIGFsb25nIGFuIElu dGVybmV0IHBhdGguICBUaGUgcGF0dGVybiBvZiBjb25nZXN0aW9uIHNpZ25hbHM8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAobG9zcyBvciBFQ04tbWFya2luZykgYXJpc2luZyBmcm9t IEFRTSBtZXRob2RzIGFsc28gbmVlZCB0byBub3Q8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAobG9zcyBvciBFQ04tbWFya2luZykgYXJpc2luZyBmcm9tIEFRTSBtZXRob2RzIGFs c28gbmVlZCB0byBub3Q8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhZHZlcnNlbHkg aW50ZXJhY3Qgd2l0aCB0aGUgZHluYW1pY3Mgb2YgdGhlIHRyYW5zcG9ydCBwcm90b2NvbHMgdGhh dDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFkdmVyc2VseSBpbnRlcmFjdCB3 aXRoIHRoZSBkeW5hbWljcyBvZiB0aGUgdHJhbnNwb3J0IHByb3RvY29scyB0aGF0PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGhleSBjb250cm9sLjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIHRoZXkgY29udHJvbC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4xMC4yLiAgRGV0YWlscyBvbiB0aGUgZXZhbHVhdGlvbiBzY2VuYXJpbzwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjEwLjIuICBEZXRhaWxzIG9uIHRoZSBldmFsdWF0aW9u IHNjZW5hcmlvPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0t LSsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICArLS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgKy0tLS0tLS0tLSsgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICArLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfHNl bmRlcnMgQXwtLS0rICAgICAgICAgICAgICAgICAgICAgICstLS18cmVjZWl2ZXJzIEF8PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfHNlbmRlcnMgQXwtLS0rICAgICAgICAgICAg ICAgICAgICAgICstLS18cmVjZWl2ZXJzIEF8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgKy0tLS0tLS0tLSsgICB8ICAgICAgICAgICAgICAgICAgICAgIHwgICArLS0tLS0tLS0tLS0r PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgKy0tLS0tLS0tLSsgICB8ICAgICAg ICAgICAgICAgICAgICAgIHwgICArLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgICAgICAgICArLS0tLS0rLS0tKyAgKy0tLS0tLS0tLSsgICstLSstLS0tLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICstLS0tLSstLS0rICArLS0t LS0tLS0tKyAgKy0tKy0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAg ICAgfFJvdXRlciBMIHwtLXxSb3V0ZXIgTSB8LS18Um91dGVyIFJ8PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgICAgICB8Um91dGVyIEwgfC0tfFJvdXRlciBNIHwtLXxSb3V0 ZXIgUnw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRp ZmYwMTIwIj48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgIHxBUU0gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+ ICAgICB8ICB8QVFNICA8L3NwYW4+ICAgIHwgIHxObyBBUU0gIHw8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+ICAgICAgICAgICB8QVFNIDxzcGFuIGNsYXNzPSJpbnNlcnQiPkEgICAg fCAgfEFRTSBNPC9zcGFuPiAgICB8ICB8Tm8gQVFNICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgICAgICAgICArLS0tLS0tLS0tKyAgKy0tKy0tLS0tLSsgICstLSstLS0tLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICstLS0tLS0tLS0rICArLS0r LS0tLS0tKyAgKy0tKy0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICstLS0t LS0tLS0rICAgICAgICAgICAgIHwgICAgICAgICAgICB8ICAgKy0tLS0tLS0tLS0tKzwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0rICAgICAgICAgICAgIHwgICAg ICAgICAgICB8ICAgKy0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IHxzZW5kZXJzIEJ8LS0tLS0tLS0tLS0tLSsgICAgICAgICAgICArLS0tfHJlY2VpdmVycyBCfDwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHxzZW5kZXJzIEJ8LS0tLS0tLS0tLS0t LSsgICAgICAgICAgICArLS0tfHJlY2VpdmVycyBCfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICstLS0tLS0tLS0rICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKy0tLS0tLS0t LS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0rICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgIEZpZ3VyZSAzOiBUb3BvbG9neSBmb3IgdGhl IE11bHRpLUFRTSBzY2VuYXJpbzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICAgICAgICAgIEZpZ3VyZSAzOiBUb3BvbG9neSBmb3IgdGhlIE11bHRpLUFRTSBzY2VuYXJpbzwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlm ZjAxMjEiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPlRoaXMgc2NlbmFyaW8g Y2FuIGJlIHVzZWQgdG8gZXZhbHVhdGUgaG93IGhhdmluZzwvc3Bhbj4gQVFNIHNjaGVtZXMgaW48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xhc3M9Imluc2VydCI+ RmlndXJlIEZpZ3VyZSAzIGRlc2NyaWJlcyB0b3BvbG9neSBvcHRpb25zIGZvciBldmFsdWF0aW5n IG11bHRpLUFRTTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHNlcXVl bmNlIGltcGFjdCB0aGUgaW5kdWNlZCBsYXRlbmN5IHJlZHVjdGlvbiwgdGhlIGluZHVjZWQgZ29v ZHB1dDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0 Ij4gICBzY2VuYXJpb3MuICBUaGU8L3NwYW4+IEFRTSBzY2hlbWVzIDxzcGFuIGNsYXNzPSJpbnNl cnQiPmFyZSBhcHBsaWVkPC9zcGFuPiBpbiBzZXF1ZW5jZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5h bmQ8L3NwYW4+IGltcGFjdCB0aGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIG1h eGltaXphdGlvbiBhbmQgdGhlIHRyYWRlLW9mZiBiZXR3ZWVuIHRoZXNlIHR3by4gIDxzcGFuIGNs YXNzPSJkZWxldGUiPlRoZSB0b3BvbG9neTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgaW5kdWNlZCBsYXRlbmN5IHJlZHVjdGlvbiwgdGhlIGluZHVjZWQgZ29vZHB1 dCBtYXhpbWl6YXRpb24gYW5kIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNw YW4gY2xhc3M9ImRlbGV0ZSI+ICAgcHJlc2VudGVkIGluIEZpZ3VyZSAzIGNvdWxkIGJlIHVzZWQu PC9zcGFuPiAgQVFNIHNjaGVtZXMgaW50cm9kdWNlZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICB0cmFkZS1vZmYgYmV0d2VlbiB0aGVzZSB0d28uICA8c3BhbiBjbGFzcz0i aW5zZXJ0Ij5Ob3RlIHRoYXQ8L3NwYW4+IEFRTSBzY2hlbWVzIDxzcGFuIGNsYXNzPSJpbnNlcnQi PkEgYW5kIEI8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA8c3BhbiBj bGFzcz0iZGVsZXRlIj5Sb3V0ZXI8L3NwYW4+IEwgYW5kIDxzcGFuIGNsYXNzPSJkZWxldGUiPlJv dXRlcjwvc3Bhbj4gTSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5zaG91bGQgYmUgdGhlIHNhbWU7IGFu eSBvdGhlciBjb25maWd1cmF0aW9uczwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgaW50cm9kdWNlZCBpbiA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5Sb3V0ZXJzPC9zcGFu PiBMIGFuZCBNIGNvdWxkIGJlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPihJKSBzYW1lIHNjaGVtZSB3 aXRoIGlkZW50aWNhbDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGNv dWxkIGJlIDxzcGFuIGNsYXNzPSJkZWxldGUiPmNvbnNpZGVyZWQuICBGb3IgdGhpcyBzY2VuYXJp bywgaXQgaXMgcmVjb21tZW5kZWQgdG88L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgIHBhcmFtZXRlciB2YWx1ZXMsIChpaSkgc2Ft ZSBzY2hlbWUgd2l0aCBkaWZmZXJlbnQgcGFyYW1ldGVyIHZhbHVlcyw8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBjb25zaWRlciBh PC9zcGFuPiBtaWxkIGNvbmdlc3Rpb24gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+bGV2ZWwsPC9zcGFu PiB0aGUgbnVtYmVyIG9mIGZsb3dzIDxzcGFuIGNsYXNzPSJkZWxldGUiPnNwZWNpZmllZCBpbjwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2Vy dCI+ICAgb3IgKGlpaSkgdHdvIGRpZmZlcmVudCBzY2hlbWVkLiAgVG8gYmVzdCB1bmRlcnN0YW5k IHRoZSBpbnRlcmFjdGlvbnM8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBTZWN0aW9uIDguMi4yIGJlaW5nPC9zcGFuPiBlcXVhbGx5 IHNoYXJlZCBhbW9uZyBzZW5kZXJzIEEgYW5kIEIuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj5Bbnkg b3RoZXI8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNz PSJpbnNlcnQiPiAgIGFuZCBpbXBsaWNhdGlvbnMsIHRoZTwvc3Bhbj4gbWlsZCBjb25nZXN0aW9u IDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNjZW5hcmlvIGFzIGRlc2NyaWJlZCBpbjwvc3Bhbj48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHJlbGV2YW50IGNvbWJpbmF0aW9uIG9mIGNv bmdlc3Rpb24gbGV2ZWxzIGNvdWxkIGJlIGNvbnNpZGVyZWQuICBXZTwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBTZWN0aW9uIDguMi4yIGlz IHJlY29tbWVuZGVkIHN1Y2ggdGhhdDwvc3Bhbj4gdGhlIG51bWJlciBvZiBmbG93cyA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5pczwvc3Bhbj4gZXF1YWxseTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgcmVjb21tZW5kIHRvIG1lYXN1cmUgdGhlIG1ldHJpY3MgcHJlc2VudGVkIGluIFNl Y3Rpb24gOC4yLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBzaGFyZWQgYW1v bmcgc2VuZGVycyBBIGFuZCBCLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+T3RoZXI8L3NwYW4+IHJl bGV2YW50IGNvbWJpbmF0aW9uIG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgY29uZ2VzdGlvbiBsZXZlbHMgY291bGQg PHNwYW4gY2xhc3M9Imluc2VydCI+YWxzbzwvc3Bhbj4gYmUgY29uc2lkZXJlZC4gIFdlIHJlY29t bWVuZCB0byBtZWFzdXJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgdGhlIG1ldHJpY3MgcHJlc2VudGVkIGluIFNlY3Rp b24gOC4yLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjExLiAgSW1wbGVtZW50 YXRpb24gY29zdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjExLiAgSW1wbGVtZW50 YXRpb24gY29zdDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjExLjEuICBNb3Rp dmF0aW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+MTEuMS4gIE1vdGl2YXRpb248 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBTdWNjZXNzZnVsIGRlcGxveW1l bnQgb2YgQVFNIGlzIGRpcmVjdGx5IHJlbGF0ZWQgdG8gaXRzIGNvc3Qgb2Y8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBTdWNjZXNzZnVsIGRlcGxveW1lbnQgb2YgQVFNIGlzIGRp cmVjdGx5IHJlbGF0ZWQgdG8gaXRzIGNvc3Qgb2Y8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBpbXBsZW1lbnRhdGlvbi4gIE5ldHdvcmsgZGV2aWNlcyBjYW4gbmVlZCBoYXJkd2FyZSBv ciBzb2Z0d2FyZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGltcGxlbWVudGF0 aW9uLiAgTmV0d29yayBkZXZpY2VzIGNhbiBuZWVkIGhhcmR3YXJlIG9yIHNvZnR3YXJlPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW1wbGVtZW50YXRpb25zIG9mIHRoZSBBUU0gbWVj aGFuaXNtLiAgRGVwZW5kaW5nIG9uIGEgZGV2aWNlJ3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBpbXBsZW1lbnRhdGlvbnMgb2YgdGhlIEFRTSBtZWNoYW5pc20uICBEZXBlbmRp bmcgb24gYSBkZXZpY2UnczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGNhcGFiaWxp dGllcyBhbmQgbGltaXRhdGlvbnMsIHRoZSBkZXZpY2UgbWF5IG9yIG1heSBub3QgYmUgYWJsZSB0 bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGNhcGFiaWxpdGllcyBhbmQgbGlt aXRhdGlvbnMsIHRoZSBkZXZpY2UgbWF5IG9yIG1heSBub3QgYmUgYWJsZSB0bzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGltcGxlbWVudCBzb21lIG9yIGFsbCBwYXJ0cyBvZiB0aGVp ciBBUU0gbG9naWMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW1wbGVtZW50 IHNvbWUgb3IgYWxsIHBhcnRzIG9mIHRoZWlyIEFRTSBsb2dpYy48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTIyIj48dGQ+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICBBUU0gcHJvcG9zYWxzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gcHJv dmlkZSBwc2V1ZG8tY29kZSBmb3IgdGhlIGNvbXBsZXRlIEFRTSBzY2hlbWUsPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIEFRTSBwcm9wb3NhbHMgPHNwYW4gY2xhc3M9Imluc2Vy dCI+c2hvdWxkPC9zcGFuPiBwcm92aWRlIHBzZXVkby1jb2RlIGZvciB0aGUgY29tcGxldGUgQVFN IHNjaGVtZSw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBoaWdobGlnaHRpbmcgZ2Vu ZXJpYyBpbXBsZW1lbnRhdGlvbi1zcGVjaWZpYyBhc3BlY3RzIG9mIHRoZSBzY2hlbWU8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBoaWdobGlnaHRpbmcgZ2VuZXJpYyBpbXBsZW1l bnRhdGlvbi1zcGVjaWZpYyBhc3BlY3RzIG9mIHRoZSBzY2hlbWU8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBzdWNoIGFzICJkcm9wLXRhaWwiIHZzLiAiZHJvcC1oZWFkIiwgaW5wdXRz IChlLmcuLCBjdXJyZW50IHF1ZXVpbmc8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBzdWNoIGFzICJkcm9wLXRhaWwiIHZzLiAiZHJvcC1oZWFkIiwgaW5wdXRzIChlLmcuLCBjdXJy ZW50IHF1ZXVpbmc8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkZWxheSwgcXVldWUg bGVuZ3RoKSwgY29tcHV0YXRpb25zIGludm9sdmVkLCBuZWVkIGZvciB0aW1lcnMsIGV0Yy48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBkZWxheSwgcXVldWUgbGVuZ3RoKSwgY29t cHV0YXRpb25zIGludm9sdmVkLCBuZWVkIGZvciB0aW1lcnMsIGV0Yy48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBUaGlzIGhlbHBzIHRvIGlkZW50aWZ5IGNvc3RzIGFzc29jaWF0ZWQg d2l0aCBpbXBsZW1lbnRpbmcgdGhlIEFRTTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIFRoaXMgaGVscHMgdG8gaWRlbnRpZnkgY29zdHMgYXNzb2NpYXRlZCB3aXRoIGltcGxlbWVu dGluZyB0aGUgQVFNPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc2NoZW1lIG9uIGEg cGFydGljdWxhciBoYXJkd2FyZSBvciBzb2Z0d2FyZSBkZXZpY2UuICBUaGlzIGFsc288L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzY2hlbWUgb24gYSBwYXJ0aWN1bGFyIGhhcmR3 YXJlIG9yIHNvZnR3YXJlIGRldmljZS4gIFRoaXMgYWxzbzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIGZhY2lsaXRhdGVzIGRpc2NzdXNpb25zIGFyb3VuZCB3aGljaCBraW5kIG9mIGRl dmljZXMgY2FuIGVhc2lseTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGZhY2ls aXRhdGVzIGRpc2NzdXNpb25zIGFyb3VuZCB3aGljaCBraW5kIG9mIGRldmljZXMgY2FuIGVhc2ls eTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHN1cHBvcnQgdGhlIEFRTSBhbmQgd2hp Y2ggY2Fubm90LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHN1cHBvcnQgdGhl IEFRTSBhbmQgd2hpY2ggY2Fubm90LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjExLjIuICBSZWNvbW1lbmRlZCBkaXNjdXNzaW9uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+MTEuMi4gIFJlY29tbWVuZGVkIGRpc2N1c3Npb248L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTIzIj48dGQ+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICBBUU0gcHJvcG9zYWxzIDxzcGFuIGNsYXNzPSJkZWxldGUiPlNIT1VMRDwvc3Bhbj4gaGlnaGxp Z2h0IHBhcnRzIG9mIHRoZWlyIEFRTSBsb2dpYyB0aGF0IGFyZTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBBUU0gcHJvcG9zYWxzIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnNob3Vs ZDwvc3Bhbj4gaGlnaGxpZ2h0IHBhcnRzIG9mIHRoZWlyIEFRTSBsb2dpYyB0aGF0IGFyZTwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRldmljZSBkZXBlbmRlbnQgYW5kIGRpc2N1c3Mg aWYgYW5kIGhvdyBBUU0gYmVoYXZpb3IgY291bGQgYmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBkZXZpY2UgZGVwZW5kZW50IGFuZCBkaXNjdXNzIGlmIGFuZCBob3cgQVFNIGJl aGF2aW9yIGNvdWxkIGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW1wYWN0ZWQg YnkgdGhlIGRldmljZS4gIEZvciBleGFtcGxlLCBhIHF1ZXVlaW5nLWRlbGF5IGJhc2VkIEFRTTwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGltcGFjdGVkIGJ5IHRoZSBkZXZpY2Uu ICBGb3IgZXhhbXBsZSwgYSBxdWV1ZWluZy1kZWxheSBiYXNlZCBBUU08L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBzY2hlbWUgcmVxdWlyZXMgY3VycmVudCBxdWV1aW5nIGRlbGF5IGFz IGlucHV0IGZyb20gdGhlIGRldmljZS4gIElmPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgc2NoZW1lIHJlcXVpcmVzIGN1cnJlbnQgcXVldWluZyBkZWxheSBhcyBpbnB1dCBmcm9t IHRoZSBkZXZpY2UuICBJZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSBkZXZp Y2UgYWxyZWFkeSBtYWludGFpbnMgdGhpcyB2YWx1ZSwgdGhlbiBpdCBjYW4gYmUgdHJpdmlhbCB0 bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBkZXZpY2UgYWxyZWFkeSBt YWludGFpbnMgdGhpcyB2YWx1ZSwgdGhlbiBpdCBjYW4gYmUgdHJpdmlhbCB0bzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGltcGxlbWVudCB0aGUgdGhlaXIgQVFNIGxvZ2ljIG9uIHRo ZSBkZXZpY2UuICBJZiB0aGUgZGV2aWNlIHByb3ZpZGVzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgaW1wbGVtZW50IHRoZSB0aGVpciBBUU0gbG9naWMgb24gdGhlIGRldmljZS4g IElmIHRoZSBkZXZpY2UgcHJvdmlkZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBp bmRpcmVjdCBtZWFucyB0byBlc3RpbWF0ZSB0aGUgcXVldWluZyBkZWxheSAoZm9yIGV4YW1wbGU6 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW5kaXJlY3QgbWVhbnMgdG8gZXN0 aW1hdGUgdGhlIHF1ZXVpbmcgZGVsYXkgKGZvciBleGFtcGxlOjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIHRpbWVzdGFtcHMsIGRlcXVldWluZyByYXRlKSwgdGhlbiB0aGUgQVFNIGJl aGF2aW9yIGlzIHNlbnNpdGl2ZSB0bzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IHRpbWVzdGFtcHMsIGRlcXVldWluZyByYXRlKSwgdGhlbiB0aGUgQVFNIGJlaGF2aW9yIGlzIHNl bnNpdGl2ZSB0bzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSBwcmVjaXNpb24g b2YgdGhlIHF1ZXVpbmcgZGVsYXkgZXN0aW1hdGlvbnMgYXJlIGZvciB0aGF0IGRldmljZS48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgcHJlY2lzaW9uIG9mIHRoZSBxdWV1 aW5nIGRlbGF5IGVzdGltYXRpb25zIGFyZSBmb3IgdGhhdCBkZXZpY2UuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgSGlnaGxpZ2h0aW5nIHRoZSBzZW5zaXRpdml0eSBvZiBhbiBBUU0g c2NoZW1lIHRvIHF1ZXVpbmcgZGVsYXk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBIaWdobGlnaHRpbmcgdGhlIHNlbnNpdGl2aXR5IG9mIGFuIEFRTSBzY2hlbWUgdG8gcXVldWlu ZyBkZWxheTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGVzdGltYXRpb25zIGhlbHBz IGltcGxlbWVudGVycyB0byBpZGVudGlmeSBhcHByb3ByaWF0ZSBtZWFucyBvZjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGVzdGltYXRpb25zIGhlbHBzIGltcGxlbWVudGVycyB0 byBpZGVudGlmeSBhcHByb3ByaWF0ZSBtZWFucyBvZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0icGFydC0xMiIgY2xhc3M9ImNoYW5nZSI+PHRk PjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNw YXJ0LTEyIj48ZW0+IHBhZ2UgMjgsIGxpbmUgNTA8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFu PjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0 PC9zbWFsbD48YSBocmVmPSIjcGFydC0xMiI+PGVtPiBwYWdlIDMwLCBsaW5lIDI2PHNwYW4gY2xh c3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBBbnkgQVFNIHNj aGVtZSBpcyBsaWtlbHkgdG8gaGF2ZSBwYXJhbWV0ZXJzIHdob3NlIHZhbHVlcyBhZmZlY3QgdGhl PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQW55IEFRTSBzY2hlbWUgaXMgbGlr ZWx5IHRvIGhhdmUgcGFyYW1ldGVycyB3aG9zZSB2YWx1ZXMgYWZmZWN0IHRoZTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGNvbnRyb2wgbGF3IGFuZCBiZWhhdmlvdXIgb2YgYW4gQVFN LiAgRXhwb3NpbmcgYWxsIHRoZXNlIHBhcmFtZXRlcnM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBjb250cm9sIGxhdyBhbmQgYmVoYXZpb3VyIG9mIGFuIEFRTS4gIEV4cG9zaW5n IGFsbCB0aGVzZSBwYXJhbWV0ZXJzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgYXMg Y29udHJvbCBwYXJhbWV0ZXJzIHRvIGEgbmV0d29yayBvcGVyYXRvciAob3IgdXNlcikgY2FuIGVh c2lseTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFzIGNvbnRyb2wgcGFyYW1l dGVycyB0byBhIG5ldHdvcmsgb3BlcmF0b3IgKG9yIHVzZXIpIGNhbiBlYXNpbHk8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICByZXN1bHQgaW4gYSB1bnNhZmUgQVFNIGRlcGxveW1lbnQu ICBVbmV4cGVjdGVkIEFRTSBiZWhhdmlvciBlbnN1ZXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICByZXN1bHQgaW4gYSB1bnNhZmUgQVFNIGRlcGxveW1lbnQuICBVbmV4cGVjdGVk IEFRTSBiZWhhdmlvciBlbnN1ZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB3aGVu IHBhcmFtZXRlciB2YWx1ZXMgYXJlIHNldCBpbXByb3Blcmx5LiAgQSBtaW5pbWFsIG51bWJlciBv ZjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHdoZW4gcGFyYW1ldGVyIHZhbHVl cyBhcmUgc2V0IGltcHJvcGVybHkuICBBIG1pbmltYWwgbnVtYmVyIG9mPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgY29udHJvbCBwYXJhbWV0ZXJzIG1pbmltaXplcyB0aGUgbnVtYmVy IG9mIHdheXMgYSB1c2VyIGNhbiBicmVhayBhPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgY29udHJvbCBwYXJhbWV0ZXJzIG1pbmltaXplcyB0aGUgbnVtYmVyIG9mIHdheXMgYSB1 c2VyIGNhbiBicmVhayBhPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc3lzdGVtIHdo ZXJlIGFuIEFRTSBzY2hlbWUgaXMgZGVwbG95ZWQgYXQuICBGZXdlciBjb250cm9sIHBhcmFtZXRl cnM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBzeXN0ZW0gd2hlcmUgYW4gQVFN IHNjaGVtZSBpcyBkZXBsb3llZCBhdC4gIEZld2VyIGNvbnRyb2wgcGFyYW1ldGVyczwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG1ha2UgdGhlIEFRTSBzY2hlbWUgbW9yZSB1c2VyLWZy aWVuZGx5IGFuZCBlYXNpZXIgdG8gZGVwbG95IGFuZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIG1ha2UgdGhlIEFRTSBzY2hlbWUgbW9yZSB1c2VyLWZyaWVuZGx5IGFuZCBlYXNp ZXIgdG8gZGVwbG95IGFuZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGRlYnVnLjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRlYnVnLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMjQiPjx0ZD48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPltSRkM3NTY3XSBzdGF0ZXM8L3NwYW4+ICJBUU0g YWxnb3JpdGhtcyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5TSE9VTEQgTk9UPC9zcGFuPiByZXF1aXJl IHR1bmluZyBvZiBpbml0aWFsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICJB UU0gYWxnb3JpdGhtcyA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5zaG91bGQgbm90PC9zcGFuPiByZXF1 aXJlIHR1bmluZyBvZiBpbml0aWFsIG9yIGNvbmZpZ3VyYXRpb248L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgIG9yIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBpbiBjb21tb24gdXNl IGNhc2VzLiIgIEEgc2NoZW1lIG91Z2h0IHRvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgIHBhcmFtZXRlcnMgaW4gY29tbW9uIHVzZSBjYXNlcy4iIDxzcGFuIGNsYXNzPSJpbnNl cnQiPnN1Y2ggYXMgc3RhdGVkIGluIHRoZSBzZWN0aW9uIDQuMyBvZjwvc3Bhbj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIGV4cG9zZSBvbmx5IHRob3NlIHBhcmFtZXRlcnMgdGhh dCBjb250cm9sIHRoZSBtYWNyb3Njb3BpYyBBUU08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgdGhlIEFRTSByZWNvbW1lbmRhdGlvbiBkb2N1 bWVudCBbUkZDNzU2N10uPC9zcGFuPiAgQSBzY2hlbWUgb3VnaHQgdG8gZXhwb3NlPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBiZWhhdmlvciBzdWNoIGFzIHF1ZXVlIGRlbGF5IHRo cmVzaG9sZCwgcXVldWUgbGVuZ3RoIHRocmVzaG9sZCwgZXRjLjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICBvbmx5IHRob3NlIHBhcmFtZXRlcnMgdGhhdCBjb250cm9sIHRoZSBt YWNyb3Njb3BpYyBBUU0gYmVoYXZpb3Igc3VjaDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIGFzIHF1ZXVlIGRlbGF5IHRo cmVzaG9sZCwgcXVldWUgbGVuZ3RoIHRocmVzaG9sZCwgZXRjLjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIEFkZGl0aW9uYWxseSwgdGhlIHNhZmV0eSBvZiBhbiBBUU0gc2No ZW1lIGlzIGRpcmVjdGx5IHJlbGF0ZWQgdG8gaXRzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgQWRkaXRpb25hbGx5LCB0aGUgc2FmZXR5IG9mIGFuIEFRTSBzY2hlbWUgaXMgZGly ZWN0bHkgcmVsYXRlZCB0byBpdHM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBzdGFi aWxpdHkgdW5kZXIgdmFyeWluZyBvcGVyYXRpbmcgY29uZGl0aW9ucyBzdWNoIGFzIHZhcnlpbmcg dHJhZmZpYzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHN0YWJpbGl0eSB1bmRl ciB2YXJ5aW5nIG9wZXJhdGluZyBjb25kaXRpb25zIHN1Y2ggYXMgdmFyeWluZyB0cmFmZmljPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcHJvZmlsZXMgYW5kIGZsdWN0dWF0aW5nIG5l dHdvcmsgY29uZGl0aW9ucywgYXMgZGVzY3JpYmVkIGluPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgcHJvZmlsZXMgYW5kIGZsdWN0dWF0aW5nIG5ldHdvcmsgY29uZGl0aW9ucywg YXMgZGVzY3JpYmVkIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgU2VjdGlvbiA4 LiAgT3BlcmF0aW5nIGNvbmRpdGlvbnMgdmFyeSBvZnRlbiBhbmQgaGVuY2UgdGhlIEFRTSBuZWVk czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFNlY3Rpb24gOC4gIE9wZXJhdGlu ZyBjb25kaXRpb25zIHZhcnkgb2Z0ZW4gYW5kIGhlbmNlIHRoZSBBUU0gbmVlZHM8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0byByZW1haW4gc3RhYmxlIHVuZGVyIHRoZXNlIGNvbmRp dGlvbnMgd2l0aG91dCB0aGUgbmVlZCBmb3I8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICB0byByZW1haW4gc3RhYmxlIHVuZGVyIHRoZXNlIGNvbmRpdGlvbnMgd2l0aG91dCB0aGUg bmVlZCBmb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhZGRpdGlvbmFsIGV4dGVy bmFsIHR1bmluZy4gIElmIEFRTSBwYXJhbWV0ZXJzIHJlcXVpcmUgdHVuaW5nIHVuZGVyPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYWRkaXRpb25hbCBleHRlcm5hbCB0dW5pbmcu ICBJZiBBUU0gcGFyYW1ldGVycyByZXF1aXJlIHR1bmluZyB1bmRlcjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHRoZXNlIGNvbmRpdGlvbnMsIHRoZW4gdGhlIEFRTSBtdXN0IHNlbGYt YWRhcHQgbmVjZXNzYXJ5IHBhcmFtZXRlcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIHRoZXNlIGNvbmRpdGlvbnMsIHRoZW4gdGhlIEFRTSBtdXN0IHNlbGYtYWRhcHQgbmVjZXNz YXJ5IHBhcmFtZXRlcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHZhbHVlcyBieSBl bXBsb3lpbmcgYXV0by10dW5pbmcgdGVjaG5pcXVlcy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICB2YWx1ZXMgYnkgZW1wbG95aW5nIGF1dG8tdHVuaW5nIHRlY2huaXF1ZXMuPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+MTIuMi4gIFJlY29tbWVuZGVkIGRpc2N1 c3Npb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4xMi4yLiAgUmVjb21tZW5kZWQg ZGlzY3Vzc2lvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEluIG9yZGVy IHRvIHVuZGVyc3RhbmQgYW4gQVFNJ3MgZGVwbG95bWVudCBjb25zaWRlcmF0aW9ucyBhbmQ8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJbiBvcmRlciB0byB1bmRlcnN0YW5kIGFu IEFRTSdzIGRlcGxveW1lbnQgY29uc2lkZXJhdGlvbnMgYW5kPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEyNSI+PHRkPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgcGVy Zm9ybWFuY2UgdW5kZXIgYSBzcGVjaWZpYyBlbnZpcm9ubWVudCwgQVFNIHByb3Bvc2FscyA8c3Bh biBjbGFzcz0iZGVsZXRlIj5TSE9VTEQ8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPiAgIHBlcmZvcm1hbmNlIHVuZGVyIGEgc3BlY2lmaWMgZW52aXJvbm1lbnQsIEFRTSBw cm9wb3NhbHMgPHNwYW4gY2xhc3M9Imluc2VydCI+c2hvdWxkPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIGRlc2NyaWJlIHRoZSBwYXJhbWV0ZXJzIHRoYXQgY29udHJvbCB0 aGUgbWFjcm9zY29waWMgQVFNIGJlaGF2aW9yLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGRlc2NyaWJlIHRoZSBwYXJhbWV0ZXJzIHRoYXQgY29udHJvbCB0aGUgbWFjcm9zY29w aWMgQVFNIGJlaGF2aW9yLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGFuZCBpZGVu dGlmeSBhbnkgcGFyYW1ldGVycyB0aGF0IHJlcXVpcmUgdHVuaW5nIHRvIG9wZXJhdGlvbmFsPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgYW5kIGlkZW50aWZ5IGFueSBwYXJhbWV0 ZXJzIHRoYXQgcmVxdWlyZSB0dW5pbmcgdG8gb3BlcmF0aW9uYWw8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBjb25kaXRpb25zLiAgSXQgY291bGQgYmUgaW50ZXJlc3RpbmcgdG8gYWxz byBkaXNjdXNzIHRoYXQgZXZlbiBpZiBhbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIGNvbmRpdGlvbnMuICBJdCBjb3VsZCBiZSBpbnRlcmVzdGluZyB0byBhbHNvIGRpc2N1c3Mg dGhhdCBldmVuIGlmIGFuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgQVFNIHNjaGVt ZSBtYXkgbm90IGFkZXF1YXRlbHkgYXV0by10dW5lIGl0cyBwYXJhbWV0ZXJzLCB0aGUgcmVzdWx0 aW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQVFNIHNjaGVtZSBtYXkgbm90 IGFkZXF1YXRlbHkgYXV0by10dW5lIGl0cyBwYXJhbWV0ZXJzLCB0aGUgcmVzdWx0aW5nPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcGVyZm9ybWFuY2UgbWF5IG5vdCBiZSBvcHRpbWFs LCBidXQgY2xvc2UgdG8gc29tZXRoaW5nIHJlYXNvbmFibGUuPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgcGVyZm9ybWFuY2UgbWF5IG5vdCBiZSBvcHRpbWFsLCBidXQgY2xvc2Ug dG8gc29tZXRoaW5nIHJlYXNvbmFibGUuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgSWYgdGhlcmUgYXJlIGFueSBmaXhlZCBwYXJhbWV0ZXJzIHdpdGhpbiB0aGUgQVFNLCB0 aGVpciBzZXR0aW5nPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgSWYgdGhlcmUg YXJlIGFueSBmaXhlZCBwYXJhbWV0ZXJzIHdpdGhpbiB0aGUgQVFNLCB0aGVpciBzZXR0aW5nPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEyNiI+ PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U0hPVUxEPC9zcGFuPiBiZSBkaXNj dXNzZWQgYW5kIGp1c3RpZmllZCwgdG8gaGVscCB1bmRlcnN0YW5kIHdoZXRoZXIgYSBmaXhlZDwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5z aG91bGQ8L3NwYW4+IGJlIGRpc2N1c3NlZCBhbmQganVzdGlmaWVkLCB0byBoZWxwIHVuZGVyc3Rh bmQgd2hldGhlciBhIGZpeGVkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcGFyYW1l dGVyIHZhbHVlIGlzIGFwcGxpY2FibGUgZm9yIGEgcGFydGljdWxhciBlbnZpcm9ubWVudC48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBwYXJhbWV0ZXIgdmFsdWUgaXMgYXBwbGlj YWJsZSBmb3IgYSBwYXJ0aWN1bGFyIGVudmlyb25tZW50LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIElmIGFuIEFRTSBzY2hlbWUgaXMgZXZhbHVhdGVkIHdpdGggcGFyYW1l dGVyKHMpIHRoYXQgd2VyZSBleHRlcm5hbGx5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgSWYgYW4gQVFNIHNjaGVtZSBpcyBldmFsdWF0ZWQgd2l0aCBwYXJhbWV0ZXIocykgdGhh dCB3ZXJlIGV4dGVybmFsbHk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHIgaWQ9ImRpZmYwMTI3Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICB0dW5lZCBmb3Igb3B0aW1pemF0aW9u IG9yIG90aGVyIHB1cnBvc2VzLCB0aGVzZSB2YWx1ZXMgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+TVVT VDwvc3Bhbj4gYmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgdHVuZWQgZm9y IG9wdGltaXphdGlvbiBvciBvdGhlciBwdXJwb3NlcywgdGhlc2UgdmFsdWVzIDxzcGFuIGNsYXNz PSJpbnNlcnQiPm11c3Q8L3NwYW4+IGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ZGlzY2xvc2VkLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRpc2Nsb3NlZC48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9ImRp ZmYwMTI4Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4xMy4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPkNvbmNsdXNpb248 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjEzLiAgPHNwYW4gY2xhc3M9 Imluc2VydCI+U3VtbWFyeTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHIgaWQ9ImRpZmYwMTI5Ij48dGQ+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICBGaWd1cmUgNCBs aXN0cyB0aGUgc2NlbmFyaW9zIGFuZCB0aGVpciA8c3BhbiBjbGFzcz0iZGVsZXRlIj5yZXF1aXJl bWVudHMuPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBGaWd1cmUg NCBsaXN0cyB0aGUgc2NlbmFyaW9zIGFuZCB0aGVpciA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZXF1 aXJlbWVudHMgZm9yIGFuIGV4dGVuZGVkPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgIGNoYXJhY3Rlcml6YXRpb24gb2YgYW4gQVFNIHNjaGVtZS48L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIHxTY2VuYXJpbyAgICAgICAgICAgICAgICAgICB8U2VjLiAgfFJlcXVpcmVtZW50ICAg ICAgICAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfFNj ZW5hcmlvICAgICAgICAgICAgICAgICAgIHxTZWMuICB8UmVxdWlyZW1lbnQgICAgICAgICAgICAg ICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0ciBpZD0iZGlmZjAxMzAiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIHxJbnRlcmFjdGlvbiB3aXRoIEVD TiAgICAgICB8IDQuNSB8TVVTVCBiZSBkaXNjdXNzZWQgaWYgc3VwcG9ydGVkIHw8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgfEludGVyYWN0aW9uIHdpdGggRUNOICAgICAgIHwg NC41IDxzcGFuIGNsYXNzPSJpbnNlcnQiPiA8L3NwYW4+fE1VU1QgYmUgZGlzY3Vzc2VkIGlmIHN1 cHBvcnRlZCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMzEiPjx0ZD48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIHxJbnRlcmFjdGlvbiB3aXRoIFNjaGVkdWxpbmd8IDQuNiB8RmVhc2liaWxpdHkgTVVTVCBi ZSBkaXNjdXNzZWQgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgfEludGVy YWN0aW9uIHdpdGggU2NoZWR1bGluZ3wgNC42IDxzcGFuIGNsYXNzPSJpbnNlcnQiPiA8L3NwYW4+ fEZlYXNpYmlsaXR5IE1VU1QgYmUgZGlzY3Vzc2VkICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAr LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHxUcmFuc3BvcnQgUHJv dG9jb2xzICAgICAgICB8NS4gICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfFRyYW5zcG9ydCBQcm90b2NvbHMgICAg ICAgIHw1LiAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICB8IFRDUC1mcmllbmRseSBzZW5kZXIgICAgICAgfCA1LjEgIHxT Y2VuYXJpbyBNVVNUIGJlIGNvbnNpZGVyZWQgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIHwgVENQLWZyaWVuZGx5IHNlbmRlciAgICAgICB8IDUuMSAgfFNjZW5hcmlvIE1V U1QgYmUgY29uc2lkZXJlZCAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfCBB Z2dyZXNzaXZlIHNlbmRlciAgICAgICAgIHwgNS4yICB8U2NlbmFyaW8gTVVTVCBiZSBjb25zaWRl cmVkICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB8IEFnZ3Jlc3NpdmUg c2VuZGVyICAgICAgICAgfCA1LjIgIHxTY2VuYXJpbyBNVVNUIGJlIGNvbnNpZGVyZWQgICAgfDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHwgVW5yZXNwb25zaXZlIHNlbmRlciAgICAg ICB8IDUuMyAgfFNjZW5hcmlvIE1VU1QgYmUgY29uc2lkZXJlZCAgICB8PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgfCBVbnJlc3BvbnNpdmUgc2VuZGVyICAgICAgIHwgNS4zICB8 U2NlbmFyaW8gTVVTVCBiZSBjb25zaWRlcmVkICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICB8IExCRSBzZW5kZXIgICAgICAgICAgICAgICAgfCA1LjQgIHxTY2VuYXJpbyBNQVkg YmUgY29uc2lkZXJlZCAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHwg TEJFIHNlbmRlciAgICAgICAgICAgICAgICB8IDUuNCAgfFNjZW5hcmlvIE1BWSBiZSBjb25zaWRl cmVkICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIHxSb3VuZCBUcmlwIFRpbWUgRmFpcm5lc3MgICB8IDYuMiAgfFNj ZW5hcmlvIE1VU1QgYmUgY29uc2lkZXJlZCAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgfFJvdW5kIFRyaXAgVGltZSBGYWlybmVzcyAgIHwgNi4yICB8U2NlbmFyaW8gTVVT VCBiZSBjb25zaWRlcmVkICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfEJ1cnN0IEFic29ycHRpb24gICAgICAgICAg IHwgNy4yICB8U2NlbmFyaW8gTVVTVCBiZSBjb25zaWRlcmVkICAgIHw8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICB8QnVyc3QgQWJzb3JwdGlvbiAgICAgICAgICAgfCA3LjIgIHxT Y2VuYXJpbyBNVVNUIGJlIGNvbnNpZGVyZWQgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0icGFydC0xMyIgY2xhc3M9ImNoYW5nZSI+PHRk PjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9IiNw YXJ0LTEzIj48ZW0+IHBhZ2UgMzAsIGxpbmUgMzQ8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFu PjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0 PC9zbWFsbD48YSBocmVmPSIjcGFydC0xMyI+PGVtPiBwYWdlIDMxLCBsaW5lIDQ3PHNwYW4gY2xh c3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8IFZhcnlpbmcg Y29uZ2VzdGlvbiBsZXZlbHMgfCA4LjIuNXxTY2VuYXJpbyBNVVNUIGJlIGNvbnNpZGVyZWQgICAg fDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHwgVmFyeWluZyBjb25nZXN0aW9u IGxldmVscyB8IDguMi41fFNjZW5hcmlvIE1VU1QgYmUgY29uc2lkZXJlZCAgICB8PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgfCBWYXJ5aW5nIGF2YWlsYWJsZSBjYXBhY2l0eXwgOC4y LjZ8U2NlbmFyaW8gTVVTVCBiZSBjb25zaWRlcmVkICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICB8IFZhcnlpbmcgYXZhaWxhYmxlIGNhcGFjaXR5fCA4LjIuNnxTY2VuYXJp byBNVVNUIGJlIGNvbnNpZGVyZWQgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IHwgUGFyYW1ldGVycyBhbmQgc3RhYmlsaXR5ICB8IDguMyAgfFRoaXMgU0hPVUxEIGJlIGRpc2N1 c3NlZCAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfCBQYXJhbWV0 ZXJzIGFuZCBzdGFiaWxpdHkgIHwgOC4zICB8VGhpcyBTSE9VTEQgYmUgZGlzY3Vzc2VkICAgICAg IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgfFZhcmlvdXMgVHJhZmZpYyBQcm9maWxlcyAgIHw5LiAgICB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICB8VmFyaW91cyBUcmFmZmljIFByb2ZpbGVzICAgfDkuICAgIHwgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHwgVHJhZmZpYyBt aXggICAgICAgICAgICAgICB8IDkuMSAgfFNjZW5hcmlvIGlzIFJFQ09NTUVOREVEICAgICAgICB8 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfCBUcmFmZmljIG1peCAgICAgICAg ICAgICAgIHwgOS4xICB8U2NlbmFyaW8gaXMgUkVDT01NRU5ERUQgICAgICAgIHw8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB8IEJpLWRpcmVjdGlvbmFsIHRyYWZmaWMgICAgfCA5LjIg IHxTY2VuYXJpbyBNQVkgYmUgY29uc2lkZXJlZCAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHwgQmktZGlyZWN0aW9uYWwgdHJhZmZpYyAgICB8IDkuMiAgfFNjZW5hcmlv IE1BWSBiZSBjb25zaWRlcmVkICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg Ky0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICArLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t KzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHxNdWx0aS1BUU0gICAgICAgICAgICAg ICAgICB8IDEwLjIgfFNjZW5hcmlvIE1BWSBiZSBjb25zaWRlcmVkICAgICB8PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgfE11bHRpLUFRTSAgICAgICAgICAgICAgICAgIHwgMTAu MiB8U2NlbmFyaW8gTUFZIGJlIGNvbnNpZGVyZWQgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy IGlkPSJkaWZmMDEzMiI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+fEltcGxl bWVudGF0aW9uIENvc3QgICAgICAgIHwgMTEuMiB8UHNldWRvLWNvZGUgU0hPVUxEIGJlIHByb3Zp ZGVkIHw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgKy0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgfE9wZXJhdG9yIENvbnRyb2wg ICAgICAgICAgIHwgMTIuMiB8VHVuaW5nIFNIT1VMRCBOT1QgYmUgcmVxdWlyZWQgIHw8L3NwYW4+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgIEZpZ3VyZSA0OiBTdW1tYXJ5IG9mIHRoZSBzY2VuYXJpb3MgYW5kIHRo ZWlyIHJlcXVpcmVtZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAg IEZpZ3VyZSA0OiBTdW1tYXJ5IG9mIHRoZSBzY2VuYXJpb3MgYW5kIHRoZWlyIHJlcXVpcmVtZW50 czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjE0LiAgQWNrbm93bGVkZ2VtZW50 czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjE0LiAgQWNrbm93bGVkZ2VtZW50czwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgd29yayBoYXMgYmVlbiBw YXJ0aWFsbHkgc3VwcG9ydGVkIGJ5IHRoZSBFdXJvcGVhbiBDb21tdW5pdHk8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGlzIHdvcmsgaGFzIGJlZW4gcGFydGlhbGx5IHN1cHBv cnRlZCBieSB0aGUgRXVyb3BlYW4gQ29tbXVuaXR5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgdW5kZXIgaXRzIFNldmVudGggRnJhbWV3b3JrIFByb2dyYW1tZSB0aHJvdWdoIHRoZSBS ZWR1Y2luZyBJbnRlcm5ldDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHVuZGVy IGl0cyBTZXZlbnRoIEZyYW1ld29yayBQcm9ncmFtbWUgdGhyb3VnaCB0aGUgUmVkdWNpbmcgSW50 ZXJuZXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUcmFuc3BvcnQgTGF0ZW5jeSAo UklURSkgcHJvamVjdCAoSUNULTMxNzcwMCkuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgVHJhbnNwb3J0IExhdGVuY3kgKFJJVEUpIHByb2plY3QgKElDVC0zMTc3MDApLjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjE1LiAgQ29udHJpYnV0b3JzPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+MTUuICBDb250cmlidXRvcnM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHIgaWQ9InBhcnQtMTQiIGNsYXNzPSJj aGFuZ2UiPjx0ZD48L3RkPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48 YSBocmVmPSIjcGFydC0xNCI+PGVtPiBwYWdlIDMxLCBsaW5lIDIxPHNwYW4gY2xhc3M9ImhpZGUi PiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRv IGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iI3BhcnQtMTQiPjxlbT4gcGFnZSAzMiwgbGluZSAz MjxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+MTcuICBTZWN1cml0eSBDb25zaWRlcmF0aW9uczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjE3LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnM8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBTb21lIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGZvciBBUU0gYXJl IGlkZW50aWZpZWQgaW4gW1JGQzc1NjddLlRoaXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBTb21lIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGZvciBBUU0gYXJlIGlkZW50aWZp ZWQgaW4gW1JGQzc1NjddLlRoaXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkb2N1 bWVudCwgYnkgaXRzZWxmLCBwcmVzZW50cyBubyBuZXcgcHJpdmFjeSBub3Igc2VjdXJpdHkgaXNz dWVzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGRvY3VtZW50LCBieSBpdHNl bGYsIHByZXNlbnRzIG5vIG5ldyBwcml2YWN5IG5vciBzZWN1cml0eSBpc3N1ZXMuPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+MTguICBSZWZlcmVuY2VzPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+MTguICBSZWZlcmVuY2VzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+MTguMS4gIE5vcm1hdGl2ZSBSZWZlcmVuY2VzPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+MTguMS4gIE5vcm1hdGl2ZSBSZWZlcmVuY2VzPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEzMyI+PHRkPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W0ktRC5pZXRmLXRjcG0tY3ViaWNdPC9zcGFu PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgUmhlZSwgSS4sIFh1 LCBMLiwgSGEsIFMuLCBaaW1tZXJtYW5uLCBBLiwgRWdnZXJ0LCBMLiwgYW5kPC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgUi4gU2NoZWZmZW5lZ2dlciwg IkNVQklDIGZvciBGYXN0IExvbmctRGlzdGFuY2UgTmV0d29ya3MiLDwvc3Bhbj48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgIGRyYWZ0LWlldGYtdGNwbS1jdWJpYy0w MSAod29yayBpbiBwcm9ncmVzcyksIEphbnVhcnkgMjAxNi48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4g Y2xhc3M9ImRlbGV0ZSI+PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIFtJ LUQuaXJ0Zi1pY2NyZy10Y3BldmFsXTwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRl Ij4gICAgICAgICAgICAgIEhheWVzLCBELiwgUm9zLCBELiwgQW5kcmV3LCBMLiwgYW5kIFMuIEZs b3lkLCAiQ29tbW9uIFRDUDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAg ICAgICAgICAgIEV2YWx1YXRpb24gU3VpdGUiLCBkcmFmdC1pcnRmLWljY3JnLXRjcGV2YWwtMDEg KHdvcmsgaW48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAgICAg ICBwcm9ncmVzcyksIEp1bHkgMjAxNC48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0 ZSI+PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIFtSRkMwNzkzXSAgUG9z dGVsLCBKLiwgIlRyYW5zbWlzc2lvbiBDb250cm9sIFByb3RvY29sIiwgU1REIDcsPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgUkZDIDc5MywgRE9JIDEw LjE3NDg3L1JGQzA3OTMsIFNlcHRlbWJlciAxOTgxLDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFz cz0iZGVsZXRlIj4gICAgICAgICAgICAgICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2lu Zm8vcmZjNzkzJmd0Oy48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBb UkZDMjExOV0gIEJyYWRuZXIsIFMuLCAiS2V5IHdvcmRzIGZvciB1c2UgaW4gUkZDcyB0byBJbmRp Y2F0ZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtSRkMyMTE5XSAgQnJhZG5l ciwgUy4sICJLZXkgd29yZHMgZm9yIHVzZSBpbiBSRkNzIHRvIEluZGljYXRlPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBSZXF1aXJlbWVudCBMZXZlbHMiLCBSRkMg MjExOSwgMTk5Ny48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAg IFJlcXVpcmVtZW50IExldmVscyIsIFJGQyAyMTE5LCAxOTk3LjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0iZGlmZjAxMzQiPjx0ZD48L3RkPjwv dHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPltSRkMyNDg4XSAgQWxsbWFuLCBNLiwgR2xvdmVyLCBE LiwgYW5kIEwuIFNhbmNoZXosICJFbmhhbmNpbmcgVENQPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNs YXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgT3ZlciBTYXRlbGxpdGUgQ2hhbm5lbHMgdXNpbmcg U3RhbmRhcmQgTWVjaGFuaXNtcyIsPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUi PiAgICAgICAgICAgICAgQkNQIDI4LCBSRkMgMjQ4OCwgRE9JIDEwLjE3NDg3L1JGQzI0ODgsIEph bnVhcnkgMTk5OSw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAg ICAgICAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzI0ODgmZ3Q7Ljwvc3Bh bj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFtSRkMyNTQ0XSAgQnJhZG5lciwg Uy4gYW5kIEouIE1jUXVhaWQsICJCZW5jaG1hcmtpbmcgTWV0aG9kb2xvZ3kgZm9yPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgW1JGQzI1NDRdICBCcmFkbmVyLCBTLiBhbmQgSi4g TWNRdWFpZCwgIkJlbmNobWFya2luZyBNZXRob2RvbG9neSBmb3I8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIE5ldHdvcmsgSW50ZXJjb25uZWN0IERldmljZXMiLCBS RkMgMjU0NCw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIE5l dHdvcmsgSW50ZXJjb25uZWN0IERldmljZXMiLCBSRkMgMjU0NCw8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkMyNTQ0LCBNYXJjaCAxOTk5 LDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgRE9JIDEwLjE3 NDg3L1JGQzI1NDQsIE1hcmNoIDE5OTksPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ICAgICAgICAgICAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzI1NDQmZ3Q7 LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgJmx0O2h0dHA6 Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmMyNTQ0Jmd0Oy48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBbUkZDMjY0N10gIE5ld21hbiwgRC4sICJCZW5jaG1hcmtpbmcg VGVybWlub2xvZ3kgZm9yIEZpcmV3YWxsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgW1JGQzI2NDddICBOZXdtYW4sIEQuLCAiQmVuY2htYXJraW5nIFRlcm1pbm9sb2d5IGZvciBG aXJld2FsbDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgUGVyZm9y bWFuY2UiLCBSRkMgMjY0NywgRE9JIDEwLjE3NDg3L1JGQzI2NDcsIEF1Z3VzdCAxOTk5LDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgUGVyZm9ybWFuY2UiLCBS RkMgMjY0NywgRE9JIDEwLjE3NDg3L1JGQzI2NDcsIEF1Z3VzdCAxOTk5LDwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5v cmcvaW5mby9yZmMyNjQ3Jmd0Oy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAg ICAgICAgICAgICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMjY0NyZndDsu PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgW1JGQzI2NzldICBBbG1lcywg Ry4sIEthbGlkaW5kaSwgUy4sIGFuZCBNLiBaZWthdXNrYXMsICJBIE9uZS13YXk8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBbUkZDMjY3OV0gIEFsbWVzLCBHLiwgS2FsaWRpbmRp LCBTLiwgYW5kIE0uIFpla2F1c2thcywgIkEgT25lLXdheTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICAgICAgRGVsYXkgTWV0cmljIGZvciBJUFBNIiwgUkZDIDI2NzksIERP SSAxMC4xNzQ4Ny9SRkMyNjc5LDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICAgICAgICAgRGVsYXkgTWV0cmljIGZvciBJUFBNIiwgUkZDIDI2NzksIERPSSAxMC4xNzQ4Ny9S RkMyNjc5LDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgU2VwdGVt YmVyIDE5OTksICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMjY3OSZndDsu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBTZXB0ZW1iZXIg MTk5OSwgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmMyNjc5Jmd0Oy48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBbUkZDMjY4MF0gIEFsbWVzLCBHLiwg S2FsaWRpbmRpLCBTLiwgYW5kIE0uIFpla2F1c2thcywgIkEgT25lLXdheTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtSRkMyNjgwXSAgQWxtZXMsIEcuLCBLYWxpZGluZGksIFMu LCBhbmQgTS4gWmVrYXVza2FzLCAiQSBPbmUtd2F5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgICAgICAgICBQYWNrZXQgTG9zcyBNZXRyaWMgZm9yIElQUE0iLCBSRkMgMjY4MCw8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIFBhY2tldCBMb3Nz IE1ldHJpYyBmb3IgSVBQTSIsIFJGQyAyNjgwLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgICAgICAgICAgICAgRE9JIDEwLjE3NDg3L1JGQzI2ODAsIFNlcHRlbWJlciAxOTk5LDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgRE9JIDEwLjE3NDg3L1JG QzI2ODAsIFNlcHRlbWJlciAxOTk5LDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAg ICAgICAgICAgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmMyNjgwJmd0Oy48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICZsdDtodHRwOi8v d3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMjY4MCZndDsuPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEzNSI+PHRkPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W1JGQzMxNjhdICBSYW1ha3Jpc2huYW4sIEsuLCBGbG95 ZCwgUy4sIGFuZCBELiBCbGFjaywgIlRoZSBBZGRpdGlvbjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBj bGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgIG9mIEV4cGxpY2l0IENvbmdlc3Rpb24gTm90aWZp Y2F0aW9uIChFQ04pIHRvIElQIiw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ ICAgICAgICAgICAgICBSRkMgMzE2OCwgRE9JIDEwLjE3NDg3L1JGQzMxNjgsIFNlcHRlbWJlciAy MDAxLDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgICZs dDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMzE2OCZndDsuPC9zcGFuPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVs ZXRlIj4gICBbUkZDMzYxMV0gIEZyaWVkbWFuLCBULiwgRWQuLCBDYWNlcmVzLCBSLiwgRWQuLCBh bmQgQS4gQ2xhcmssIEVkLiw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAg ICAgICAgICAgICAiUlRQIENvbnRyb2wgUHJvdG9jb2wgRXh0ZW5kZWQgUmVwb3J0cyAoUlRDUCBY UikiLDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgIFJG QyAzNjExLCBET0kgMTAuMTc0ODcvUkZDMzYxMSwgTm92ZW1iZXIgMjAwMyw8L3NwYW4+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAgICAgICAmbHQ7aHR0cDovL3d3dy5yZmMt ZWRpdG9yLm9yZy9pbmZvL3JmYzM2MTEmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0i ZGVsZXRlIj48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgW1JGQzUzNDhd ICBGbG95ZCwgUy4sIEhhbmRsZXksIE0uLCBQYWRoeWUsIEouLCBhbmQgSi4gV2lkbWVyLCAiVENQ PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgRnJpZW5k bHkgUmF0ZSBDb250cm9sIChURlJDKTogUHJvdG9jb2wgU3BlY2lmaWNhdGlvbiIsPC9zcGFuPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgUkZDIDUzNDgsIERPSSAx MC4xNzQ4Ny9SRkM1MzQ4LCBTZXB0ZW1iZXIgMjAwOCw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xh c3M9ImRlbGV0ZSI+ICAgICAgICAgICAgICAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9p bmZvL3JmYzUzNDgmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IFtSRkM1NDgxXSAgTW9ydG9uLCBBLiBhbmQgQi4gQ2xhaXNlLCAiUGFja2V0IERlbGF5IFZhcmlh dGlvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtSRkM1NDgxXSAgTW9ydG9u LCBBLiBhbmQgQi4gQ2xhaXNlLCAiUGFja2V0IERlbGF5IFZhcmlhdGlvbjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgQXBwbGljYWJpbGl0eSBTdGF0ZW1lbnQiLCBS RkMgNTQ4MSwgRE9JIDEwLjE3NDg3L1JGQzU0ODEsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgICAgICAgICAgICBBcHBsaWNhYmlsaXR5IFN0YXRlbWVudCIsIFJGQyA1NDgxLCBE T0kgMTAuMTc0ODcvUkZDNTQ4MSw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAg ICAgICAgIE1hcmNoIDIwMDksICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZj NTQ4MSZndDsuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBN YXJjaCAyMDA5LCAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzU0ODEmZ3Q7 LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0ciBpZD0i ZGlmZjAxMzYiPjx0ZD48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPltSRkM1NjgxXSAg QWxsbWFuLCBNLiwgUGF4c29uLCBWLiwgYW5kIEUuIEJsYW50b24sICJUQ1AgQ29uZ2VzdGlvbjwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgIENvbnRyb2wi LCBSRkMgNTY4MSwgRE9JIDEwLjE3NDg3L1JGQzU2ODEsIFNlcHRlbWJlciAyMDA5LDwvc3Bhbj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgICZsdDtodHRwOi8vd3d3 LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNTY4MSZndDsuPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNs YXNzPSJkZWxldGUiPjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBbUkZD NjI5N10gIFdlbHpsLCBNLiBhbmQgRC4gUm9zLCAiQSBTdXJ2ZXkgb2YgTG93ZXItdGhhbi1CZXN0 LUVmZm9ydDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAg IFRyYW5zcG9ydCBQcm90b2NvbHMiLCBSRkMgNjI5NywgRE9JIDEwLjE3NDg3L1JGQzYyOTcsIEp1 bmU8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAgICAgICAyMDEx LCAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzYyOTcmZ3Q7Ljwvc3Bhbj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9 ImRlbGV0ZSI+ICAgW1JGQzY4MTddICBTaGFsdW5vdiwgUy4sIEhhemVsLCBHLiwgSXllbmdhciwg Si4sIGFuZCBNLiBLdWVobGV3aW5kLDwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRl Ij4gICAgICAgICAgICAgICJMb3cgRXh0cmEgRGVsYXkgQmFja2dyb3VuZCBUcmFuc3BvcnQgKExF REJBVCkiLCBSRkMgNjgxNyw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAg ICAgICAgICAgICBET0kgMTAuMTc0ODcvUkZDNjgxNywgRGVjZW1iZXIgMjAxMiw8L3NwYW4+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAgICAgICAmbHQ7aHR0cDovL3d3dy5y ZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzY4MTcmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFz cz0iZGVsZXRlIj48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgW1JGQzcx NDFdICBCcmlzY29lLCBCLiBhbmQgSi4gTWFubmVyLCAiQnl0ZSBhbmQgUGFja2V0IENvbmdlc3Rp b248L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgICAgICAgICBOb3Rp ZmljYXRpb24iLCBSRkMgNzE0MSwgMjAxNC48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBbUkZDNzU2N10gIEJha2VyLCBGLiwgRWQuIGFuZCBHLiBGYWlyaHVyc3QsIEVk LiwgIklFVEY8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBbUkZDNzU2N10gIEJh a2VyLCBGLiwgRWQuIGFuZCBHLiBGYWlyaHVyc3QsIEVkLiwgIklFVEY8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIFJlY29tbWVuZGF0aW9ucyBSZWdhcmRpbmcgQWN0 aXZlIFF1ZXVlIE1hbmFnZW1lbnQiLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgICAgICAgICAgUmVjb21tZW5kYXRpb25zIFJlZ2FyZGluZyBBY3RpdmUgUXVldWUgTWFuYWdl bWVudCIsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBCQ1AgMTk3 LCBSRkMgNzU2NywgRE9JIDEwLjE3NDg3L1JGQzc1NjcsIEp1bHkgMjAxNSw8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIEJDUCAxOTcsIFJGQyA3NTY3LCBET0kg MTAuMTc0ODcvUkZDNzU2NywgSnVseSAyMDE1LDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgICAgICAgICAgICAgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM3NTY3 Jmd0Oy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICZsdDto dHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNzU2NyZndDsuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+MTguMi4gIEluZm9ybWF0aXZlIFJlZmVyZW5jZXM8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4xOC4yLiAgSW5mb3JtYXRpdmUgUmVmZXJlbmNlczwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFtBTkVMMjAxNF08L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBbQU5FTDIwMTRdPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgICAgICAgICAgICBBbmVsbGksIFAuLCBEaWFuYSwgUi4sIGFuZCBFLiBMb2No aW4sICJGYXZvclF1ZXVlOiBhPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAg ICAgICAgICBBbmVsbGksIFAuLCBEaWFuYSwgUi4sIGFuZCBFLiBMb2NoaW4sICJGYXZvclF1ZXVl OiBhPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBQYXJhbWV0ZXJs ZXNzIEFjdGl2ZSBRdWV1ZSBNYW5hZ2VtZW50IHRvIEltcHJvdmUgVENQPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBQYXJhbWV0ZXJsZXNzIEFjdGl2ZSBRdWV1 ZSBNYW5hZ2VtZW50IHRvIEltcHJvdmUgVENQPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJwYXJ0LTE1IiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90 ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iI3BhcnQt MTUiPjxlbT4gcGFnZSAzMywgbGluZSAzMTxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9l bT48L2E+PC90aD48dGg+IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3Nt YWxsPjxhIGhyZWY9IiNwYXJ0LTE1Ij48ZW0+IHBhZ2UgMzMsIGxpbmUgNDA8c3BhbiBjbGFzcz0i aGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFtIQVNTMjAwOF08L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBbSEFTUzIwMDhdPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBIYXNzYXlvdW4sIFMuIGFuZCBELiBSb3MsICJM b3NzIFN5bmNocm9uaXphdGlvbiBhbmQgUm91dGVyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgICAgICAgICAgICBIYXNzYXlvdW4sIFMuIGFuZCBELiBSb3MsICJMb3NzIFN5bmNo cm9uaXphdGlvbiBhbmQgUm91dGVyPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg ICAgICAgICBCdWZmZXIgU2l6aW5nIHdpdGggSGlnaC1TcGVlZCBWZXJzaW9ucyBvZiBUQ1AiLCBJ RUVFPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBCdWZmZXIg U2l6aW5nIHdpdGggSGlnaC1TcGVlZCBWZXJzaW9ucyBvZiBUQ1AiLCBJRUVFPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBJTkZPQ09NIFdvcmtzaG9wcyAsIDIwMDgu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBJTkZPQ09NIFdv cmtzaG9wcyAsIDIwMDguPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgW0hP RUkyMDE1XTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtIT0VJMjAxNV08L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIEhvZWlsYW5kLUpvZXJnZW5z ZW4sIFQuLCBNY0tlbm5leSwgUC4sIFRhaHQsIEQuLCBHZXR0eXMsPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBIb2VpbGFuZC1Kb2VyZ2Vuc2VuLCBULiwgTWNL ZW5uZXksIFAuLCBUYWh0LCBELiwgR2V0dHlzLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgICAgICAgICAgICAgSi4sIGFuZCBFLiBEdW1hemV0LCAiRmxvd1F1ZXVlLUNvZGVsIiwgSUVU RiAoV29yay1pbi08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAg IEouLCBhbmQgRS4gRHVtYXpldCwgIkZsb3dRdWV1ZS1Db2RlbCIsIElFVEYgKFdvcmstaW4tPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBQcm9ncmVzcykgLCBKYW51 YXJ5IDIwMTUuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBQ cm9ncmVzcykgLCBKYW51YXJ5IDIwMTUuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEzNyI+PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPltJLUQuaWV0Zi1h cW0tY29kZWxdPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAg ICAgTmljaG9scywgSy4sIEphY29ic29uLCBWLiwgTWNHcmVnb3IsIEEuLCBhbmQgSi4gSXllbmdh ciw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICAiQ29u dHJvbGxlZCBEZWxheSBBY3RpdmUgUXVldWUgTWFuYWdlbWVudCIsIGRyYWZ0LWlldGYtPC9zcGFu PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgYXFtLWNvZGVsLTA0 ICh3b3JrIGluIHByb2dyZXNzKSwgSnVuZSAyMDE2Ljwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFz cz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgW0ktRC5p ZXRmLWFxbS1waWVdPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAg ICAgICAgUGFuLCBSLiwgTmF0YXJhamFuLCBQLiwgQmFrZXIsIEYuLCBhbmQgRy4gV2hpdGUsICJQ SUU6IEE8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICBM aWdodHdlaWdodCBDb250cm9sIFNjaGVtZSBUbyBBZGRyZXNzIHRoZSBCdWZmZXJibG9hdDwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgICAgICAgIFByb2JsZW0iLCBk cmFmdC1pZXRmLWFxbS1waWUtMDggKHdvcmsgaW4gcHJvZ3Jlc3MpLCBKdW5lPC9zcGFuPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgMjAxNi48L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgIFtJLUQuaWV0Zi10Y3BtLWN1YmljXTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0i aW5zZXJ0Ij4gICAgICAgICAgICAgIFJoZWUsIEkuLCBYdSwgTC4sIEhhLCBTLiwgWmltbWVybWFu biwgQS4sIEVnZ2VydCwgTC4sIGFuZDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0 Ij4gICAgICAgICAgICAgIFIuIFNjaGVmZmVuZWdnZXIsICJDVUJJQyBmb3IgRmFzdCBMb25nLURp c3RhbmNlIE5ldHdvcmtzIiw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry Pg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAg ICAgICAgICAgICBkcmFmdC1pZXRmLXRjcG0tY3ViaWMtMDEgKHdvcmsgaW4gcHJvZ3Jlc3MpLCBK YW51YXJ5IDIwMTYuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwvc3Bhbj48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBbSS1ELmlydGYtaWNjcmctdGNwZXZhbF08 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICBIYXllcywg RC4sIFJvcywgRC4sIEFuZHJldywgTC4sIGFuZCBTLiBGbG95ZCwgIkNvbW1vbiBUQ1A8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICBFdmFsdWF0aW9uIFN1 aXRlIiwgZHJhZnQtaXJ0Zi1pY2NyZy10Y3BldmFsLTAxICh3b3JrIGluPC9zcGFuPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgcHJvZ3Jlc3MpLCBKdWx5IDIwMTQu PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBbSkFZMjAwNl0gIEpheSwgUC4sIEZ1LCBRLiwgYW5kIEcuIEFybWl0YWdlLCAiQSBw cmVsaW1pbmFyeSBhbmFseXNpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtK QVkyMDA2XSAgSmF5LCBQLiwgRnUsIFEuLCBhbmQgRy4gQXJtaXRhZ2UsICJBIHByZWxpbWluYXJ5 IGFuYWx5c2lzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBvZiBs b3NzIHN5bmNocm9uaXNhdGlvbiBiZXR3ZWVuIGNvbmN1cnJlbnQgVENQIGZsb3dzIiw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIG9mIGxvc3Mgc3luY2hyb25p c2F0aW9uIGJldHdlZW4gY29uY3VycmVudCBUQ1AgZmxvd3MiLDwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgICAgICAgICAgQXVzdHJhbGlhbiBUZWxlY29tbXVuaWNhdGlvbiBOZXR3 b3JrcyBhbmQgQXBwbGljYXRpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAg ICAgICAgICAgIEF1c3RyYWxpYW4gVGVsZWNvbW11bmljYXRpb24gTmV0d29ya3MgYW5kIEFwcGxp Y2F0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBDb25mZXJl bmNlIChBVE5BQykgLCAyMDA2LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICAgICAgICAgQ29uZmVyZW5jZSAoQVROQUMpICwgMjAwNi48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBbTU9SUjIwMDBdPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgW01PUlIyMDAwXTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAg ICAgTW9ycmlzLCBSLiwgIlNjYWxhYmxlIFRDUCBjb25nZXN0aW9uIGNvbnRyb2wiLCBJRUVFPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBNb3JyaXMsIFIuLCAi U2NhbGFibGUgVENQIGNvbmdlc3Rpb24gY29udHJvbCIsIElFRUU8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIElORk9DT00gLCAyMDAwLjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgSU5GT0NPTSAsIDIwMDAuPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEzOCI+PHRk PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+W05JQ0gyMDEyXTwvc3Bhbj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgPHNwYW4gY2xhc3M9Imluc2VydCI+W1JGQzA3 OTNdICBQb3N0ZWwsIEouLCAiVHJhbnNtaXNzaW9uIENvbnRyb2wgUHJvdG9jb2wiLCBTVEQgNyw8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRl Ij4gICAgICAgICAgICAgIE5pY2hvbHMsIEsuIGFuZCBWLiBKYWNvYnNvbiwgIkNvbnRyb2xsaW5n IFF1ZXVlIERlbGF5Iiw8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxz cGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgUkZDIDc5MywgRE9JIDEwLjE3NDg3L1JG QzA3OTMsIFNlcHRlbWJlciAxOTgxLDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgQUNNIFF1ZXVlICwgMjAxMi48 L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgICAgICAgICAgICAgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM3 OTMmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNz PSJkZWxldGUiPjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICBbUEFOMjAx M10gIFBhbiwgUi4sIE5hdGFyYWphbiwgUC4sIFBpZ2xpb25lLCBDLiwgUHJhYmh1LCBNUy4sPC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgU3VicmFtYW5p YW4sIFYuLCBCYWtlciwgRi4sIGFuZCBCLiBWZXJTdGVlZywgIlBJRTogQTwvc3Bhbj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICAgICAgICAgIGxpZ2h0d2VpZ2h0IGNvbnRyb2wg c2NoZW1lIHRvIGFkZHJlc3MgdGhlIGJ1ZmZlcmJsb2F0PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNs YXNzPSJkZWxldGUiPiAgICAgICAgICAgICAgcHJvYmxlbSIsIElFRUUgSFBTUiAsIDIwMTMuPC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBbUkZDMjMwOV0gIEJyYWRlbiwgQi4sIENsYXJrLCBELiwgQ3Jv d2Nyb2Z0LCBKLiwgRGF2aWUsIEIuLCBEZWVyaW5nLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIFtSRkMyMzA5XSAgQnJhZGVuLCBCLiwgQ2xhcmssIEQuLCBDcm93Y3JvZnQsIEou LCBEYXZpZSwgQi4sIERlZXJpbmcsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg ICAgICAgICBTLiwgRXN0cmluLCBELiwgRmxveWQsIFMuLCBKYWNvYnNvbiwgVi4sIE1pbnNoYWxs LCBHLiw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIFMuLCBF c3RyaW4sIEQuLCBGbG95ZCwgUy4sIEphY29ic29uLCBWLiwgTWluc2hhbGwsIEcuLDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgUGFydHJpZGdlLCBDLiwgUGV0ZXJz b24sIEwuLCBSYW1ha3Jpc2huYW4sIEsuLCBTaGVua2VyLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICAgICAgICAgICAgUGFydHJpZGdlLCBDLiwgUGV0ZXJzb24sIEwuLCBSYW1h a3Jpc2huYW4sIEsuLCBTaGVua2VyLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4N CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAg ICAgICAgICAgUy4sIFdyb2NsYXdza2ksIEouLCBhbmQgTC4gWmhhbmcsICJSZWNvbW1lbmRhdGlv bnMgb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIFMuLCBX cm9jbGF3c2tpLCBKLiwgYW5kIEwuIFpoYW5nLCAiUmVjb21tZW5kYXRpb25zIG9uPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICBRdWV1ZSBNYW5hZ2VtZW50IGFuZCBD b25nZXN0aW9uIEF2b2lkYW5jZSBpbiB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICAgICAgICAgIFF1ZXVlIE1hbmFnZW1lbnQgYW5kIENvbmdlc3Rpb24gQXZvaWRhbmNl IGluIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgSW50ZXJu ZXQiLCBSRkMgMjMwOSwgQXByaWwgMTk5OC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICAgICAgICAgIEludGVybmV0IiwgUkZDIDIzMDksIEFwcmlsIDE5OTguPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyIGlkPSJkaWZmMDEzOSI+ PHRkPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDxzcGFuIGNs YXNzPSJpbnNlcnQiPltSRkMyNDg4XSAgQWxsbWFuLCBNLiwgR2xvdmVyLCBELiwgYW5kIEwuIFNh bmNoZXosICJFbmhhbmNpbmcgVENQPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQi PiAgICAgICAgICAgICAgT3ZlciBTYXRlbGxpdGUgQ2hhbm5lbHMgdXNpbmcgU3RhbmRhcmQgTWVj aGFuaXNtcyIsPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAg ICAgQkNQIDI4LCBSRkMgMjQ4OCwgRE9JIDEwLjE3NDg3L1JGQzI0ODgsIEphbnVhcnkgMTk5OSw8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICAmbHQ7aHR0 cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzI0ODgmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ ICAgW1JGQzMxNjhdICBSYW1ha3Jpc2huYW4sIEsuLCBGbG95ZCwgUy4sIGFuZCBELiBCbGFjaywg IlRoZSBBZGRpdGlvbjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAg ICAgICAgIG9mIEV4cGxpY2l0IENvbmdlc3Rpb24gTm90aWZpY2F0aW9uIChFQ04pIHRvIElQIiw8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICBSRkMgMzE2 OCwgRE9JIDEwLjE3NDg3L1JGQzMxNjgsIFNlcHRlbWJlciAyMDAxLDwvc3Bhbj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgICAgICAgICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0 b3Iub3JnL2luZm8vcmZjMzE2OCZndDsuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBbUkZDMzYxMV0gIEZy aWVkbWFuLCBULiwgRWQuLCBDYWNlcmVzLCBSLiwgRWQuLCBhbmQgQS4gQ2xhcmssIEVkLiw8L3Nw YW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAgICAgICAiUlRQIENvbnRy b2wgUHJvdG9jb2wgRXh0ZW5kZWQgUmVwb3J0cyAoUlRDUCBYUikiLDwvc3Bhbj48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgICAgICAgIFJGQyAzNjExLCBET0kgMTAuMTc0ODcv UkZDMzYxMSwgTm92ZW1iZXIgMjAwMyw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2Vy dCI+ICAgICAgICAgICAgICAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzM2 MTEmZ3Q7Ljwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgW1JGQzUzNDhdICBGbG95ZCwgUy4sIEhhbmRsZXks IE0uLCBQYWRoeWUsIEouLCBhbmQgSi4gV2lkbWVyLCAiVENQPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFu IGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgRnJpZW5kbHkgUmF0ZSBDb250cm9sIChURlJD KTogUHJvdG9jb2wgU3BlY2lmaWNhdGlvbiIsPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJp bnNlcnQiPiAgICAgICAgICAgICAgUkZDIDUzNDgsIERPSSAxMC4xNzQ4Ny9SRkM1MzQ4LCBTZXB0 ZW1iZXIgMjAwOCw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICAg ICAgICAmbHQ7aHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzUzNDgmZ3Q7Ljwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+ICAgW1JGQzU2ODFdICBBbGxtYW4sIE0uLCBQYXhzb24sIFYuLCBhbmQgRS4g QmxhbnRvbiwgIlRDUCBDb25nZXN0aW9uPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNl cnQiPiAgICAgICAgICAgICAgQ29udHJvbCIsIFJGQyA1NjgxLCBET0kgMTAuMTc0ODcvUkZDNTY4 MSwgU2VwdGVtYmVyIDIwMDksPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAg ICAgICAgICAgICAgJmx0O2h0dHA6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM1NjgxJmd0 Oy48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxz cGFuIGNsYXNzPSJpbnNlcnQiPiAgIFtSRkM2Mjk3XSAgV2VsemwsIE0uIGFuZCBELiBSb3MsICJB IFN1cnZleSBvZiBMb3dlci10aGFuLUJlc3QtRWZmb3J0PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNs YXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgVHJhbnNwb3J0IFByb3RvY29scyIsIFJGQyA2Mjk3 LCBET0kgMTAuMTc0ODcvUkZDNjI5NywgSnVuZTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0i aW5zZXJ0Ij4gICAgICAgICAgICAgIDIwMTEsICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3Jn L2luZm8vcmZjNjI5NyZndDsuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBbUkZDNjgxN10gIFNoYWx1bm92 LCBTLiwgSGF6ZWwsIEcuLCBJeWVuZ2FyLCBKLiwgYW5kIE0uIEt1ZWhsZXdpbmQsPC9zcGFuPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgIkxvdyBFeHRyYSBEZWxh eSBCYWNrZ3JvdW5kIFRyYW5zcG9ydCAoTEVEQkFUKSIsIFJGQyA2ODE3LDwvc3Bhbj48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkM2ODE3 LCBEZWNlbWJlciAyMDEyLDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAg ICAgICAgICAgICZsdDtodHRwOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNjgxNyZndDsu PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3Bh biBjbGFzcz0iaW5zZXJ0Ij4gICBbUkZDNzE0MV0gIEJyaXNjb2UsIEIuIGFuZCBKLiBNYW5uZXIs ICJCeXRlIGFuZCBQYWNrZXQgQ29uZ2VzdGlvbjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0i aW5zZXJ0Ij4gICAgICAgICAgICAgIE5vdGlmaWNhdGlvbiIsIFJGQyA3MTQxLCAyMDE0Ljwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgW1RSQU4yMDE0XTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFtUUkFOMjAx NF08L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIFRyYW5nLCBTLiwg S3VobiwgTi4sIExvY2hpbiwgRS4sIEJhdWRvaW4sIEMuLCBEdWJvaXMsIEUuLDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgVHJhbmcsIFMuLCBLdWhuLCBOLiwg TG9jaGluLCBFLiwgQmF1ZG9pbiwgQy4sIER1Ym9pcywgRS4sPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgICAgICAgICAgICBhbmQgUC4gR2VsYXJkLCAiT24gVGhlIEV4aXN0ZW5jZSBP ZiBPcHRpbWFsIExFREJBVDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAg ICAgICAgYW5kIFAuIEdlbGFyZCwgIk9uIFRoZSBFeGlzdGVuY2UgT2YgT3B0aW1hbCBMRURCQVQ8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIFBhcmFtZXRlcnMiLCBJ RUVFIElDQyAyMDE0IC0gQ29tbXVuaWNhdGlvbiBRb1MsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgICAgICAgICBQYXJhbWV0ZXJzIiwgSUVFRSBJQ0MgMjAxNCAtIENvbW11 bmljYXRpb24gUW9TLDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAg UmVsaWFiaWxpdHkgYW5kIE1vZGVsaW5nIFN5bXBvc2l1bSAsIDIwMTQuPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBSZWxpYWJpbGl0eSBhbmQgTW9kZWxpbmcg U3ltcG9zaXVtICwgMjAxNC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+DQogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBb V0VMWjIwMTVdPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgW1dFTFoyMDE1XTwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4NCiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgV2VsemwsIE0uIGFuZCBH LiBGYWlyaHVyc3QsICJUaGUgQmVuZWZpdHMgdG8gQXBwbGljYXRpb25zPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICBXZWx6bCwgTS4gYW5kIEcuIEZhaXJodXJz dCwgIlRoZSBCZW5lZml0cyB0byBBcHBsaWNhdGlvbnM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+DQogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgICAgIG9mIHVzaW5nIEV4cGxpY2l0IENvbmdlc3Rpb24gTm90aWZpY2F0 aW9uIChFQ04pIiwgSUVURjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAg ICAgICAgb2YgdXNpbmcgRXhwbGljaXQgQ29uZ2VzdGlvbiBOb3RpZmljYXRpb24gKEVDTikiLCBJ RVRGPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPg0KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICAoV29yay1pbi1Q cm9ncmVzcykgLCBKdW5lIDIwMTUuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgICAgICAgICAoV29yay1pbi1Qcm9ncmVzcykgLCBKdW5lIDIwMTUuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPg0KDQogICAgIDx0cj48dGQ+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkPjwvdGQ+PC90cj4NCiAg ICAgPHRyIGlkPSJlbmQiIGJnY29sb3I9ImdyYXkiPjx0aCBjb2xzcGFuPSI1IiBhbGlnbj0iY2Vu dGVyIj4mbmJzcDtFbmQgb2YgY2hhbmdlcy4gMTM5IGNoYW5nZSBibG9ja3MuJm5ic3A7PC90aD48 L3RyPg0KICAgICA8dHIgY2xhc3M9InN0YXRzIj48dGQ+PC90ZD48dGg+PGk+NDEzIGxpbmVzIGNo YW5nZWQgb3IgZGVsZXRlZDwvaT48L3RoPjx0aD48aT4gPC9pPjwvdGg+PHRoPjxpPjQ1OSBsaW5l cyBjaGFuZ2VkIG9yIGFkZGVkPC9pPjwvdGg+PHRkPjwvdGQ+PC90cj4NCiAgICAgPHRyPjx0ZCBj b2xzcGFuPSI1IiBjbGFzcz0ic21hbGwiIGFsaWduPSJjZW50ZXIiPjxicj5UaGlzIGh0bWwgZGlm ZiB3YXMgcHJvZHVjZWQgYnkgcmZjZGlmZiAxLjQ1LiBUaGUgbGF0ZXN0IHZlcnNpb24gaXMgYXZh aWxhYmxlIGZyb20gPGEgaHJlZj0iaHR0cDovL3d3dy50b29scy5pZXRmLm9yZy90b29scy9yZmNk aWZmLyI+aHR0cDovL3Rvb2xzLmlldGYub3JnL3Rvb2xzL3JmY2RpZmYvPC9hPiA8L3RkPjwvdHI+ DQogICA8L3Rib2R5PjwvdGFibGU+DQogICANCiAgIA0KPC9ib2R5PjwvaHRtbD4= --_002_F3B0A07CFD358240926B78A680E166FF8FD63ATWMBXP03cnesnetad_-- From nobody Fri Jun 10 15:36:09 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5538012D9AE; Fri, 10 Jun 2016 15:36:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IcACrCPqOgEl; Fri, 10 Jun 2016 15:36:01 -0700 (PDT) Received: from mail.netability.ie (mail.netability.ie [IPv6:2a03:8900:0:100::5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 243FD12D575; Fri, 10 Jun 2016 15:36:00 -0700 (PDT) X-Envelope-To: draft-ietf-idr-ix-bgp-route-server.all@ietf.org Received: from cupcake.local (089-101-070074.ntlworld.ie [89.101.70.74] (may be forged)) (authenticated bits=0) by mail.netability.ie (8.15.2/8.15.2) with ESMTPSA id u5AMZwHH008396 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 10 Jun 2016 23:35:58 +0100 (IST) (envelope-from nick@foobar.org) X-Authentication-Warning: cheesecake.ibn.ie: Host 089-101-070074.ntlworld.ie [89.101.70.74] (may be forged) claimed to be cupcake.local Message-ID: <575B40CD.2030404@foobar.org> Date: Fri, 10 Jun 2016 23:35:57 +0100 From: Nick Hilliard User-Agent: Postbox 4.0.8 (Macintosh/20151105) MIME-Version: 1.0 To: "Waltermire, David A. (Fed)" References: In-Reply-To: X-Enigmail-Version: 1.2.3 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: Cc: "iesg@ietf.org" , "draft-ietf-idr-ix-bgp-route-server.all@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review of draft-ietf-idr-ix-bgp-route-server-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2016 22:36:04 -0000 Hi Dave, thank you for your review. Waltermire, David A. (Fed) wrote: > The following is a minor nit on the organization of the text: > > In general the security considerations section covers the issues > fairly well. In the first paragraph, the last sentence suggests that > steps should be taken to address path hiding, but the text does not > point to the text in section 2.3.2 on this topic. One way to improve > this consideration would be to move the text in 2.3.3 to the end of > this paragraph. Section 2.3.3 is adjacent to the security > consideration section, so I don't see this as a significant change. I see what you're saying here, but we wanted to have a specific recommendations section in the main body of the draft. The security considerations section is clear about what needs to be done and the reference is given a couple of lines previously. We've also added some more text to the Implementation Suggestions section (after a suggestion from Alvaro), so in the current version, it would probably look a bit peculiar to move the path hiding recommendation into the security considerations section. > Some (potentially) minor issues: > > A number of the requirements in section 2.2 and the subsections > define requirements that differ and often conflict with requirements > in RFC 4271. It would be good to indicate this at the start of 2.2. yes, good point. [commit #8c113b3] > Should this relationship also be called out in the abstract? Mmm, it's already in the introduction and now in section 2.0. Having it in three places would be repetitive. > I am not an expert in BGP security, so please consider this issue in > that context: > > The statement at the end of the security considerations section > points the reader to RFC7454. I was left wondering if this draft > changes any of considerations in RFC7454. It would be beneficial if > some text was added to this draft speaking to this point. Again not > being an expert in BGP security, I am not certain what the new text > should say on this matter. The short answer is that it mostly doesn't. The longer answer is that this ID is a draft about RS implementations rather than RS operations. There is a parallel draft (ietf-grow-ix-bgp-route-server-operations), where this reference and comment are more appropriate instead. RFC7454 didn't make it into the -operations draft because it was published after the last update was done. I've just made a note to add this into the operations draft during AUTH48, along with a side note to say that care needs to be taken with section 11 of RFC7454. I've just posted draft -11. Can you check if this deals with your comments? Nick From nobody Fri Jun 10 15:49:07 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50B6D12D6B9; Fri, 10 Jun 2016 15:49:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ebl5YPWG7sq2; Fri, 10 Jun 2016 15:49:00 -0700 (PDT) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0113.outbound.protection.outlook.com [23.103.200.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 063BF12B00B; Fri, 10 Jun 2016 15:48:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=welABHQt3IuupHIM6CFzpbTYIJlPiXWn9JA6iU2o3eU=; b=uMUHY+rmL2XyzLTWC8Rt1mF1jGdqgb3KQK+rq+sjf8RPwW7wPv1Yt/FUfRWBwtzDCRjOQkP1A1GP3CUC4wJCB3Yp6aXaLAncy0XG/x2vg+2ph67GAPmLBYzvVB3GK4cLZ6mx6KAsOPphrrUnfO4dObqDejssi7MY4Myurl4Bxrg= Received: from DM2PR09MB0365.namprd09.prod.outlook.com (10.160.247.18) by DM2PR09MB0366.namprd09.prod.outlook.com (10.160.247.20) with Microsoft SMTP Server (TLS) id 15.1.517.8; Fri, 10 Jun 2016 22:48:58 +0000 Received: from DM2PR09MB0365.namprd09.prod.outlook.com ([10.160.247.18]) by DM2PR09MB0365.namprd09.prod.outlook.com ([10.160.247.18]) with mapi id 15.01.0517.005; Fri, 10 Jun 2016 22:48:58 +0000 From: "Waltermire, David A. (Fed)" To: Nick Hilliard Thread-Topic: Secdir review of draft-ietf-idr-ix-bgp-route-server-10 Thread-Index: AdG/hLlPQmwDmXgkRK61Q8ZB5wAFgwD47tCAAAAgKOA= Date: Fri, 10 Jun 2016 22:48:57 +0000 Message-ID: References: <575B40CD.2030404@foobar.org> In-Reply-To: <575B40CD.2030404@foobar.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=david.waltermire@nist.gov; x-originating-ip: [129.6.230.3] x-ms-office365-filtering-correlation-id: 3075da9e-e9f8-4eb7-a442-08d3918168d0 x-microsoft-exchange-diagnostics: 1; DM2PR09MB0366; 6:WMSTjBrcVFAWGL8FrOl4kLYuCn7LA1t8kbJzM1ioX7uujp2TnFiVgssbFM39DYjHrW3n+M/N3qJUj3XqejSzRNKK/Ncw+q9uRv8padkyhE0W+BiI4h4J2eP7qgDa5K5RpYvBVu9l4g2rn68UMdzndR/0ylC4gfWDo6IsCS1IW/Sc0oNVcZiznxbGehiAbw5YcC8mZAd/FecevGekZO26cv0KwaCBiE8unA1gv9GDdeedqkvcrpmKuN6vGkQFrWkvwHPCv9hH8wnzwA7SvrmJkcaL9GF2CEVxfNTBsMreVOQzi57fgw/b/SkMVP51bgf9; 5:WnuMkYmhgD8AHi3MqOQyDN3J6rFV5A7OtVTVwtR9aDcs/K07Lo1TkQG3lr3C7vY4MeVMij2UICvd8M5YF1roZIoFXiv/aP+INFsnueGP/WLWiJENxGKnmOjKQSSrCXXHemF1NFeL1pIUe95hmvDjug==; 24:F8sOtz7KxeHmoAaxGP+ggs8bRlEGIjvmsOHT5hfB5o5aaLe1YVr62+M2E/IX9vq1xM1OXZ0XJVmQ7mY4sCFyA9lurqmnmyrY2gn6zJVYPOc=; 7:NENdFFOp5VJPXtRQ9gV/JtfQFx/B0r9GpQmcQTk1oid6f9HLn4+6ORZWOJUQshFnYWhABh+e/OP0/CCWX4WdYC/e/3yLVEhhdP7OyqsFYd688Nzq1eTvT0WzsNMoX7Dv4ASUgr7G2boseIJTK20xktQBketzjQ2kmoFm0hjPbc5mVmNK89U+owmVpp8Dk+1vLvESO2v4OOQY5KS8C0d25w== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0366; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637)(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026); SRVR:DM2PR09MB0366; BCL:0; PCL:0; RULEID:; SRVR:DM2PR09MB0366; x-forefront-prvs: 096943F07A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(51914003)(24454002)(13464003)(189002)(377454003)(199003)(5003600100002)(2900100001)(99286002)(101416001)(9686002)(86362001)(4326007)(345774005)(66066001)(230783001)(11100500001)(92566002)(97736004)(2950100001)(189998001)(2906002)(5004730100002)(110136002)(5008740100001)(19580405001)(19580395003)(3846002)(10400500002)(105586002)(77096005)(54356999)(8936002)(76176999)(50986999)(122556002)(102836003)(81156014)(87936001)(81166006)(3660700001)(8676002)(6116002)(586003)(3280700002)(106356001)(68736007)(5002640100001)(33656002)(76576001)(74316001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0366; H:DM2PR09MB0365.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; CAT:NONE; LANG:en; CAT:NONE; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jun 2016 22:48:58.0153 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR09MB0366 Archived-At: Cc: "iesg@ietf.org" , "draft-ietf-idr-ix-bgp-route-server.all@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review of draft-ietf-idr-ix-bgp-route-server-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2016 22:49:02 -0000 Nick, Thank you for following up on my review. > -----Original Message----- > From: Nick Hilliard [mailto:nick@foobar.org] > Sent: Friday, June 10, 2016 6:36 PM > To: Waltermire, David A. (Fed) > Cc: secdir@ietf.org; iesg@ietf.org; draft-ietf-idr-ix-bgp-route- > server.all@ietf.org > Subject: Re: Secdir review of draft-ietf-idr-ix-bgp-route-server-10 >=20 > Hi Dave, >=20 > thank you for your review. >=20 > Waltermire, David A. (Fed) wrote: > > The following is a minor nit on the organization of the text: > > > > In general the security considerations section covers the issues > > fairly well. In the first paragraph, the last sentence suggests that > > steps should be taken to address path hiding, but the text does not > > point to the text in section 2.3.2 on this topic. One way to improve > > this consideration would be to move the text in 2.3.3 to the end of > > this paragraph. Section 2.3.3 is adjacent to the security > > consideration section, so I don't see this as a significant change. >=20 > I see what you're saying here, but we wanted to have a specific > recommendations section in the main body of the draft. The security > considerations section is clear about what needs to be done and the > reference is given a couple of lines previously. We've also added some m= ore > text to the Implementation Suggestions section (after a suggestion from > Alvaro), so in the current version, it would probably look a bit peculiar= to > move the path hiding recommendation into the security considerations > section. I am ok with this. > > Some (potentially) minor issues: > > > > A number of the requirements in section 2.2 and the subsections define > > requirements that differ and often conflict with requirements in RFC > > 4271. It would be good to indicate this at the start of 2.2. >=20 > yes, good point. [commit #8c113b3] Thanks. > > Should this relationship also be called out in the abstract? >=20 > Mmm, it's already in the introduction and now in section 2.0. Having it = in > three places would be repetitive. Agreed. > > I am not an expert in BGP security, so please consider this issue in > > that context: > > > > The statement at the end of the security considerations section points > > the reader to RFC7454. I was left wondering if this draft changes any > > of considerations in RFC7454. It would be beneficial if some text was > > added to this draft speaking to this point. Again not being an expert > > in BGP security, I am not certain what the new text should say on this > > matter. >=20 > The short answer is that it mostly doesn't. >=20 > The longer answer is that this ID is a draft about RS implementations rat= her > than RS operations. There is a parallel draft (ietf-grow-ix-bgp-route-se= rver- > operations), where this reference and comment are more appropriate > instead. RFC7454 didn't make it into the -operations draft because it wa= s > published after the last update was done. I've just made a note to add t= his > into the operations draft during AUTH48, along with a side note to say th= at > care needs to be taken with section 11 of RFC7454. Thanks for the clarification. What you are suggestion sounds reasonable. >=20 > I've just posted draft -11. Can you check if this deals with your commen= ts? >=20 > Nick Draft -11 looks good. Thanks, Dave From nobody Fri Jun 10 16:05:25 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AB1612D9E6; Fri, 10 Jun 2016 16:05:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DQBz0ZhDGAWq; Fri, 10 Jun 2016 16:05:22 -0700 (PDT) Received: from mail.netability.ie (mail.netability.ie [IPv6:2a03:8900:0:100::5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7779512D9E5; Fri, 10 Jun 2016 16:05:22 -0700 (PDT) X-Envelope-To: iesg@ietf.org Received: from [10.230.100.86] (089-101-070074.ntlworld.ie [89.101.70.74] (may be forged)) (authenticated bits=0) by mail.netability.ie (8.15.2/8.15.2) with ESMTPSA id u5AN5JgK009095 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 11 Jun 2016 00:05:20 +0100 (IST) (envelope-from nick@foobar.org) X-Authentication-Warning: cheesecake.ibn.ie: Host 089-101-070074.ntlworld.ie [89.101.70.74] (may be forged) claimed to be [10.230.100.86] Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Nick Hilliard X-Mailer: iPhone Mail (13F69) In-Reply-To: Date: Sat, 11 Jun 2016 00:05:19 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <575B40CD.2030404@foobar.org> To: "Waltermire, David A. (Fed)" Archived-At: Cc: "iesg@ietf.org" , "draft-ietf-idr-ix-bgp-route-server.all@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review of draft-ietf-idr-ix-bgp-route-server-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2016 23:05:24 -0000 On 10 Jun 2016, at 23:48, Waltermire, David A. (Fed) wrote: > Draft -11 looks good Yay, thanks! Nick From nobody Sun Jun 12 20:36:55 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95ADF12B03A; Sun, 12 Jun 2016 20:36:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.449 X-Spam-Level: X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x8mXfPjKca9J; Sun, 12 Jun 2016 20:36:47 -0700 (PDT) Received: from mail-oi0-x235.google.com (mail-oi0-x235.google.com [IPv6:2607:f8b0:4003:c06::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5308812B034; Sun, 12 Jun 2016 20:36:47 -0700 (PDT) Received: by mail-oi0-x235.google.com with SMTP id w5so110788820oib.2; Sun, 12 Jun 2016 20:36:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mvztX6GyjdyJmUvr4crlNm6thofzJoWveiZWF77c8RQ=; b=BLFQzXsTEbeHpjJNlSX7F6C7ne3RHBDcI3TnZ0urvXFzpmSxtM4KJktUT7UBwk/aa8 4RrGf8334ETrUJDReolpjLbJvWPAdEsUOcJZ3Xr21ol2Em02XeFVoyo7YtH3qW+DU4hd hspnFW+u92WaOveDP+fYbsRRduLkcv4O09ildz64f0jm7sMnrvpO0Z5XfxKL4/yC7Kku mO1ZyNQN/3ixLAdl+qo6BmcvCKiqaLYSUQiXWwi3pDponP8cpFMIIiHUjdqtNO2ZQ6BR vNzAbQcgR0U2Yhr3hWPDzRjugoyBYEPwmsxDwyS4ya0woCcMr9XBwNQvEtgcksRAi0fQ 6y1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mvztX6GyjdyJmUvr4crlNm6thofzJoWveiZWF77c8RQ=; b=ei9b4dkZlOSPkx6gNdYsvLt32+se8j6U5edk72USGgOSmbIl6TZONyEE9LKDO72dBu vOaO7Q4gXjgwumfK0ibs6F5tJmJY3nVcVAlBq+qtMFe1G6cpcc9zVdl/Ry7/1bYzZG/6 wl5EhmUHG1RSBCKPKaZfnR9TTRoyNsPlhodFapED7DiS5EYMm3hh1M7EJJxpnTAiNMoJ ADzzyCW2/JyQ1Y/kB0gEF/wwOaATjeR7fPsmRDtFCVQHns+S9GCWVodvFzkQGvCb1pBm oMmvXqpqPJS/42jKeR7FC3qtjG3wUJlPebUxQpqltcRvmY18LABr0OuF3jTEEoPS0HqF 0e4g== X-Gm-Message-State: ALyK8tJk+GJsnQvC+qdnQKyHL4kvU8s094S/J4NuIowldEBx3OZgEMo+teDt8Dk8bvlyWQXGLHbYjqs8UdFnOA== X-Received: by 10.202.65.133 with SMTP id o127mr6481651oia.43.1465789006660; Sun, 12 Jun 2016 20:36:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.38.66 with HTTP; Sun, 12 Jun 2016 20:36:32 -0700 (PDT) In-Reply-To: References: <55E36EFC.6000508@gmail.com> From: Donald Eastlake Date: Sun, 12 Jun 2016 23:36:32 -0400 Message-ID: To: Yaron Sheffer Content-Type: multipart/alternative; boundary=001a113dc8620ecb8605352099b8 Archived-At: Cc: draft-ietf-trill-channel-tunnel.all@tools.ietf.org, "trill@ietf.org" , IETF Security Directorate Subject: Re: [secdir] Early SecDir review of draft-ietf-trill-channel-tunnel-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jun 2016 03:36:51 -0000 --001a113dc8620ecb8605352099b8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Yaron, draft-ietf-trill-channel-tunnel-09 has been posted. I believe the security aspects are much improved and would appreciate it if you could take a look. Thanks, Donald =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D Donald E. Eastlake 3rd +1-508-333-2270 (cell) 155 Beaver Street, Milford, MA 01757 USA d3e3e3@gmail.com On Fri, Apr 22, 2016 at 2:01 PM, Donald Eastlake wrote: > Hi Yaron, > > As we discussed in Buenos Aires, here is a revised response to your > SECDIR review of draft-ietf-trill-channel-tunnel based on the -08 > reversion of that draft. This version of the draft has the group > keying material removed as per > http://www.ietf.org/mail-archive/web/trill/current/msg07215.html > > On Sun, Aug 30, 2015 at 5:00 PM, Yaron Sheffer > wrote: > > > >... > > > > Summary > > > > I believe the draft is not ready for IETF LC in its current form. I > > assume the original intention was to use DTLS, but the use of DTLS > > is not well specified and the alternative that's proposed for > > multicast comes with inferior security. > > See below. > > > Details > > > > =E2=80=A2 In general, I don't understand why it makes sense to define a= whole new > > security protocol, just for control-plane traffic of one specific > protocol, > > important as it may be. At the very least I would expect an analysis of > > potential alternatives (IPsec? MACsec?) and why they do not fit this us= e > > case. > > Version -08 of the draft has been significant modified as below. I > believe the use of DTLS is better specified and group keying is > no longer in the draft, being deferred to subsequent documents. The > draft specifies the use of serial unicast for multicast / broadcast / > unknown unicast. > > > =E2=80=A2 As a result of the home-brew transport protocol, we also don'= t get > > a standard key management protocol. > > In this revised draft, although an authentication only option is > provided, which leverages IS-IS key management, when DTLS is used its > key management facilities are available. > > > =E2=80=A2 And from a process POV, the TRILL WG may not be the best plac= e, as > > far as participants' expertise, to develop a security protocol. An > > early SecDir review certainly helps, but I'm not sure the current > > reviewer is capable of detecting every last issue that might be > > lurking in the protocol. > > At this point, the Channel Tunnel protocol is being used to tunnel > DTLS so I don't think there is that much risk. > > > =E2=80=A2 4.1: the A and E bits are not guaranteed to be correct? Then = why > > are they here? They describe critical security properties, and > > therefore someone is bound to use them to make critical policy > > decisions. If the bits' semantics are not guaranteed, we'd better > > drop them. > > =E2=80=A2 A bit: I think we are confusing authentication with integrity > > protection. With opportunistic security, you usually don't have > > authentication, but integrity protection is still worthwhile. > > These bits have been eliminated. > > > =E2=80=A2 4.2: Coverage - it would be nice if Fig. 2.1 showed the cover= age > > of authentication (integrity protection!) and encryption. Why is an > > Ethernet frame's FCS not covered by integrity protection? Is there > > any non-malicious reason someone would want to modify the FCS in > > transit? > > Figures showing coverage have been added to Section 4.2. > > The only time there is an FCS is if the link between two RBridge ports > is Ethernet. If, for example, the link is PPP or pseudowire, there is > no FCS; In particular, the inner Ethernet-like payload of a TRILL Data > packet does not have an FCS. So providing integrity protection of an > FCS does not make sense. An RBridge Channel packet looks like a TRILL > Data packet and can go multiple RBridge hops some of which are > Ethernet and have an FCS and some of which are not Ethernet and do not > have an FCS. Even if all were Ethernet, the FCS can change due to > changes in presences/absence of an outer VLAN tag or other tags or the > like. > > > =E2=80=A2 4.3: "in some cases" - why not simply say, "When SType is 1 o= r 3"? > > While this is always done for SType 1, it might or might not be used > for SType 2 or future STypes. (The SType numbering has changed a bit > and there is no STyp3 in the revised draft.) > > > =E2=80=A2 4.3: why deconstruct HKDF and use HKDF-Expand instead of simp= ly > > using the whole thing, including HKDF-Extract? > > Because the draft follows the advice in RFC 5869 that specifies HKDF: > > In some applications, the input may already be a > good pseudorandom key; in these cases, the "extract" stage is not > necessary, and the "expand" part can be used alone. > > Version -08 of the draft says, "It is assumed that the IS-IS keying > material is of high quality." > > > =E2=80=A2 I am confused about 4.1 vs. 4.5, and specifically, what does = the > > Size byte cover. I think this is incorrect in 4.5. > > Maybe I am missing something but they look compatible with me. Section > 4.1 is more general, and now says that when security information is > present it consists of four reserved bits followed by 12 bits of size > information followed by zero to 2**12-1 bytes of "More Info". Section 4.5 > is more specific and says that for a particular SType, this "More > Info" consists of the two byte RFC 5310 Key ID followed by a variable > amount of "Authentication Data". > > > =E2=80=A2 4.6: this section starts with certificates (presumably, both > > client and server should authenticate with a cert) and then moves on > > to PSK. Are both allowed? > > The current draft provides that if DTLS is in use, then PSK MUST be > supported and certificates MAY be supported. Perhaps that MAY should > be turned back into a SHOULD. > > > =E2=80=A2 4.6: TLS is rapidly moving toward perfect-forward secrecy. Wh= y > > require a cipher suite that's being deprecated across all of > > industry (TLS_RSA_WITH_AES_128_CBC_SHA256)? > > The draft no longer specifies cipher suites and is intended to just > defer to whatever the DTLS implementation requirements are. > > I am not sure how much the following comments apply to the current draft.= .. > > =E2=80=A2 4.6.: I am still unclear on how CT keys are derived from DTLS= . > > =E2=80=A2 4.6: Why have a TRILL-level key ID with DTLS-PSK has the noti= on of > > key ID? > > =E2=80=A2 4.6: with certificates the frames may be very large. Does the= protocol > > support such sizes? > > =E2=80=A2 4.6: there should be a lot more text about how DTLS is used t= o wrap L2 > > frames. > DTLS is not used to wrap L2 frames but rather to wrap Channel Tunnel > payloads. The type of the payload is give by the PType. True, there is > a PType that says the payload is an Ethernet frame. Figure 3.4 show > what it would look like without security or with just authentication. > Possibly a figure should be added for the DTLS security case. > > > =E2=80=A2 4.7: if this mode is assumed for multicast, what is the > > assumed/recommended mode for unicast? > > =E2=80=A2 Obviously integrity protection where the MAC key is shared wi= th all > peers > > is very weak. There are various ways to deal with that, starting with R= SA > > signatures but including more efficient methods (TESLA comes to mind). > Have > > you considered any of them? > > Group security for multi-destination Channel Tunnel messages is being > deferred to another document. The revised draft only covers use of > serial unicast with pairwise security. > > > =E2=80=A2 4.7.1: if the authentication data is variable length, you mus= t ensure > that > > the field that indicates its size is integrity-protected as well. > > =E2=80=A2 Actually, I'm not sure where this size is indicated. > > Its size would be indicated in the Channel Tunnel Header (which > includes the Security Information field) that is shown as > authenticated in Figure 4.2. > > > =E2=80=A2 It seems to me that a fully random 128-bit nonce would be bot= h > > simpler to implement and more secure than the scheme proposed here. > > =E2=80=A2 Typo: designed -> designated. > > =E2=80=A2 5: assuming we will have DTLS handshakes nested within CT, ho= w are > > errors indicated? > > If DTLS is not supported at the destination, then you get a Channel > Tunnel (actually RBridge Channel) error saying SType not supported. > > If DTLS is supported at the destination, you get a DTLS error Alert > back as a Channel Tunnel message. > > > =E2=80=A2 General: is there any facility for replay protection? If no, = why > > not? > > When DTLS is used, the DTLS replay protection is available. There is > no replay protection if no security is used or if RFC 5310 > authentication is used. > > > =E2=80=A2 7: The more normative parts of the Security Considerations wo= uld > > probably fit nicely into a separate Applicability section. > > =E2=80=A2 7: I think the document should be much more clear (normative) > > about what message types are allowed within the tunnel, or not. And > > possibly about required filtering by address. > > I disagree. The whole idea is to be a general, extensible messaging > facility. I don't think it is possible to anticipate in advance what > people might want to use it for and the tests they should > make. I'm not sure how much more can generally and validly be said > other than to be conservative in what you accept and, as it states in > the draft "only process payload types required and then only with > adequate authentication for the particular circumstances". > > Thanks, > Donald > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D > Donald E. Eastlake 3rd +1-508-333-2270 (cell) > 155 Beaver Street, Milford, MA 01757 USA > d3e3e3@gmail.com > --001a113dc8620ecb8605352099b8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Yaron,

draft-ietf-trill-channel-tunn= el-09 has been posted. I believe the security aspects are much improved and= would appreciate it if you could take a look.

Thanks,
Donald
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. E= astlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2=A0155 Beaver Street, Milfo= rd, MA 01757 USA
=C2=A0d3e3e3@gmail.com

On Fri, Apr 22, 2016 at 2:01 PM, Donald East= lake <d3e3e3@gmail.com> wrote:
Hi Yaron,

As we discussed in Buenos Aires, here is a revised response to your
SECDIR review of draft-ietf-trill-channel-tunnel based on the -08
reversion of that draft. This version of the draft has the group
keying material removed as per
http://www.ietf.org/mail-archive/web= /trill/current/msg07215.html

On Sun, Aug 30, 2015 at 5:00 PM, Yaron Sheffer <yaronf.ietf@gmail.com>
wrote:
>
>...
>
> Summary
>
> I believe the draft is not ready for IETF LC in its current form. I > assume the original intention was to use DTLS, but the use of DTLS
> is not well specified and the alternative that's proposed for
> multicast comes with inferior security.

See below.

> Details
>
> =E2=80=A2 In general, I don't understand why it makes sense to def= ine a whole new
> security protocol, just for control-plane traffic of one specific prot= ocol,
> important as it may be. At the very least I would expect an analysis o= f
> potential alternatives (IPsec? MACsec?) and why they do not fit this u= se
> case.

Version -08 of the draft has been significant modified as below. I believe the use of DTLS is better specified and group keying is
no longer in the draft, being deferred to subsequent documents. The
draft specifies the use of serial unicast for multicast / broadcast /
unknown unicast.

> =E2=80=A2 As a result of the home-brew transport protocol, we also don= 't get
> a standard key management protocol.

In this revised draft, although an authentication only option is
provided, which leverages IS-IS key management, when DTLS is used its
key management facilities are available.

> =E2=80=A2 And from a process POV, the TRILL WG may not be the best pla= ce, as
> far as participants' expertise, to develop a security protocol. An=
> early SecDir review certainly helps, but I'm not sure the current<= br> > reviewer is capable of detecting every last issue that might be
> lurking in the protocol.

At this point, the Channel Tunnel protocol is being used to tunnel DTLS so I don't think there is that much risk.

> =E2=80=A2 4.1: the A and E bits are not guaranteed to be correct? Then= why
> are they here? They describe critical security properties, and
> therefore someone is bound to use them to make critical policy
> decisions. If the bits' semantics are not guaranteed, we'd bet= ter
> drop them.
> =E2=80=A2 A bit: I think we are confusing auth= entication with integrity
> protection.=C2=A0 With opportunistic security, you usually don't h= ave
> authentication, but integrity protection is still worthwhile.

These bits have been eliminated.

> =E2=80=A2 4.2: Coverage - it would be nice if Fig. 2.1 showed the cove= rage
> of authentication (integrity protection!) and encryption. Why is an > Ethernet frame's FCS not covered by integrity protection? Is there=
> any non-malicious reason someone would want to modify the FCS in
> transit?

Figures showing coverage have been added to Section 4.2.

The only time there is an FCS is if the link between two RBridge ports
is Ethernet. If, for example, the link is PPP or pseudowire, there is
no FCS; In particular, the inner Ethernet-like payload of a TRILL Data
packet does not have an FCS. So providing integrity protection of an
FCS does not make sense. An RBridge Channel packet looks like a TRILL
Data packet and can go multiple RBridge hops some of which are
Ethernet and have an FCS and some of which are not Ethernet and do not
have an FCS. Even if all were Ethernet, the FCS can change due to
changes in presences/absence of an outer VLAN tag or other tags or the
like.

> =E2=80=A2 4.3: "in some cases" - why not simply say, "W= hen SType is 1 or 3"?

While this is always done for SType 1, it might or might not be used=
for SType 2 or future STypes. (The SType numbering has changed a bit
and there is no STyp3 in the revised draft.)

> =E2=80=A2 4.3: why deconstruct HKDF and use HKDF-Expand instead of sim= ply
> using the whole thing, including HKDF-Extract?

Because the draft follows the advice in RFC 5869 that specifies HKDF:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In som= e applications, the input may already be a
=C2=A0 =C2=A0good pseudorandom key; in these cases, the "extract"= stage is not
=C2=A0 =C2=A0necessary, and the "expand" part can be used alone.<= br>
Version -08 of the draft says, "It is assumed that the IS-IS ke= ying
material is of high quality."

> =E2=80=A2 I am confused about 4.1 vs. 4.5, and specifically, what does= the
> Size byte cover. I think this is incorrect in 4.5.

Maybe I am missing something but they look compatible with me. Section
4.1 is more general, and now says that when security information is<= br> present it consists of four reserved bits followed by 12 bits of size
information followed by zero to 2**12-1 bytes of "More Info". Sec= tion 4.5
is more specific and says that for a particular SType, thi= s "More
Info" consists of the two byte RFC 5310 Key ID followed by a variable<= br> amount of "Authentication Data".

> =E2=80=A2 4.6: this section starts with certificates (presumably, both=
> client and server should authenticate with a cert) and then moves on > to PSK. Are both allowed?

The current draft provides that if DTLS is in use, then PSK MUST be<= br> supported and certificates MAY be supported. Perhaps that MAY should
be turned back into a SHOULD.

> =E2=80=A2 4.6: TLS is rapidly moving toward perfect-forward secrecy. W= hy
> require a cipher suite that's being deprecated across all of
> industry (TLS_RSA_WITH_AES_128_CBC_SHA256)?

The draft no longer specifies cipher suites and is intended to just<= br> defer to whatever the DTLS implementation requirements are.

I am not sure how much the following comments apply to the current draft...=
> =E2=80=A2 4.6.: I am still unclear on how CT keys are= derived from DTLS.
> =E2=80=A2 4.6: Why have a TRILL-level key ID with DTLS-PSK has the not= ion of
> key ID?
> =E2=80=A2 4.6: with certificates the frames may be very large. Does th= e protocol
> support such sizes?
> =E2=80=A2 4.6: there should be a lot more text about how DTLS is used = to wrap L2
> frames.
DTLS is not used to wrap L2 frames but rather to wrap Channel Tunnel=
payloads. The type of the payload is give by the PType. True, there is
a PType that says the payload is an Ethernet frame. Figure 3.4 show
what it would look like without security or with just authentication.
Possibly a figure should be added for the DTLS security case.

> =E2=80=A2 4.7: if this mode is assumed for multicast, what is the
> assumed/recommended mode for unicast?
> =E2=80=A2 Obviously integrity protection where= the MAC key is shared with all peers
> is very weak. There are various ways to deal with that, starting with = RSA
> signatures but including more efficient methods (TESLA comes to mind).= Have
> you considered any of them?

Group security for multi-destination Channel Tunnel messages is bein= g
deferred to another document. The revised draft only covers use of
serial unicast with pairwise security.

> =E2=80=A2 4.7.1: if the authentication data is variable length, you mu= st ensure that
> the field that indicates its size is integrity-protected as well.
> =E2=80=A2 Actually, I'm not sure where thi= s size is indicated.

Its size would be indicated in the Channel Tunnel Header (which
includes the Security Information field) that is shown as
authenticated in Figure 4.2.

> =E2=80=A2 It seems to me that a fully random 128-bit nonce would be bo= th
> simpler to implement and more secure than the scheme proposed here. > =E2=80=A2 Typo: designed -> designated.
> =E2=80=A2 5: assuming we will have DTLS handshakes ne= sted within CT, how are
> errors indicated?

If DTLS is not supported at the destination, then you get a Channel<= br> Tunnel (actually RBridge Channel) error saying SType not supported.

If DTLS is supported at the destination, you get a DTLS error Alert
back as a Channel Tunnel message.

> =E2=80=A2 General: is there any facility for replay protection? If no,= why
> not?

When DTLS is used, the DTLS replay protection is available. There is=
no replay protection if no security is used or if RFC 5310
authentication is used.

> =E2=80=A2 7: The more normative parts of the Security Considerations w= ould
> probably fit nicely into a separate Applicability section.
> =E2=80=A2 7: I think the document should be much more clear (normative= )
> about what message types are allowed within the tunnel, or not. And > possibly about required filtering by address.

I disagree. The whole idea is to be a general, extensible messaging
facility.=C2=A0 I don't think it is possible to anticipate in advance w= hat
people might want to use it for and the tests they should
make. I'm not sure how much more can generally and val= idly be said
other than to be conservative in what you accept and, as it states i= n
the draft "only process payload types required and then only with
adequate authentication for the particular circumstances".

Thanks,
Donald
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D
=C2=A0Donald E. Eastlake 3rd=C2=A0 =C2=A0+1-508-333-2270 (cell)
=C2=A0155 Beaver Street, Milford, MA 01757 USA
=C2=A0d3e3e3@gmail.com

--001a113dc8620ecb8605352099b8-- From nobody Tue Jun 14 06:40:54 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8446B12DB6C; Tue, 14 Jun 2016 00:50:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1465890603; bh=vkVdY0cQbjOYVuH8zkHO8mJmP3EyeRGs7P08wnhVAaA=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ZPEiMtK7KlquFwzi3Ou1SAc/TcI2YyT3Nei/5XamNueXNjh7XOr2XqMhberl3ZH/+ cfs/JOlXPCyYMICP98GMn+KPJehd11uDNxeUtMx27EiBt1BR1rSY5nMC0gmxH6Z36b VuW8oIDcZjM2u/LVyKm7qvVZjQzlM7/j8Cz9KL3U= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60AEF12DB68 for ; Tue, 14 Jun 2016 00:50:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.426 X-Spam-Level: X-Spam-Status: No, score=-1.426 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.001, RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aRYf0nA9c1Fg for ; Tue, 14 Jun 2016 00:49:59 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [IPv6:2001:470:8b2d:804:52:12:128:0]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C021F12DB6C for ; Tue, 14 Jun 2016 00:49:59 -0700 (PDT) Received: from [2001:da8:203:80:480a:bc61:4657:842c] by raoul.w3.org with esmtpsa (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1bCj6j-000EG1-UV for new-work@ietf.org; Tue, 14 Jun 2016 07:49:58 +0000 To: new-work@ietf.org From: Xueyuan Jia Message-ID: Date: Tue, 14 Jun 2016 15:49:56 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Tue, 14 Jun 2016 06:40:52 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Web of Things Interest Group (until 2016-07-15) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jun 2016 07:50:03 -0000 Hello, Today W3C Advisory Committee Representatives received a Proposal to review a draft charter for the Web of Things Interest Group: https://w3c.github.io/wot/charters/wot-ig-2016.html As part of ensuring that the community is aware of proposed work at W3C, this draft charter is public during the Advisory Committee review period. W3C invites public comments through 2016-07-15 on the proposed charter. Please send comments to public-new-work@w3.org, which has a public archive: http://lists.w3.org/Archives/Public/public-new-work/ Other than comments sent in formal responses by W3C Advisory Committee Representatives, W3C cannot guarantee a response to comments. If you work for a W3C Member [1], please coordinate your comments with your Advisory Committee Representative. For example, you may wish to make public comments via this list and have your Advisory Committee Representative refer to it from his or her formal review comments. If you should have any questions or need further information, please contact Web of Things Interest Group Staff Contacts, Dave Raggett , Kazuyuki Ashimura , and Yingying Chen . Thank you, Xueyuan Jia, W3C Marketing & Communications [1] http://www.w3.org/Consortium/Member/List _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Tue Jun 14 13:42:58 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B76A12D8CE for ; Tue, 14 Jun 2016 13:42:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V6saXDQ00Zrf for ; Tue, 14 Jun 2016 13:42:51 -0700 (PDT) Received: from mail-vk0-x22e.google.com (mail-vk0-x22e.google.com [IPv6:2607:f8b0:400c:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB0C612D9AC for ; Tue, 14 Jun 2016 13:42:15 -0700 (PDT) Received: by mail-vk0-x22e.google.com with SMTP id j2so2746925vkg.2 for ; Tue, 14 Jun 2016 13:42:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=1qA4SUoAy0KnjUVjaW0/Gfr1A9Dp6tYrblNe+DPiaDM=; b=CITsni01SNCQCExxbftIY8AMSB+QgZ+Zgof9N7HBiPVLuODUuvEutV18MOk97QI7w5 DfaiHPYn0561ptr5fhCWVAcVLiy/9OOvQ0J88rZjDb0zlsOS6y3hSdfCite10vcS7Qfq Ev8qmKA8KgmGQGklUj2HvfkwktemQHajdSWsI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=1qA4SUoAy0KnjUVjaW0/Gfr1A9Dp6tYrblNe+DPiaDM=; b=TfDSKwi2k7deV8M52vzKM7WY1H7u6wI2M0nONlS9zq4UIyDA7UXhK0m61IY9UnLxkG gnk0eGqYLmRIFOoW6LrJaeLa4SkW4LklrD2mR0QvHVohMQPJsZO+aaPFXsMLa/mOXJsj 5mmE7ouPPDu7UELrLDKjAGCYdG/aRytFFI3iUW2pfCayKJJo8EXold5UYFIEYryTaTQ8 mO+ctSmvxt11Gi0r5YdMOmdeifXo1xSeHAnbtECDemeK+SS8z6M9srexYRoj/5r6q0c1 YJ6z7aq9t6cJtq4b7bQq3ZWc/qpxal070uDVwAccO4s/KmIEAiIEh43b9Zd2DU45HCdA SYmQ== X-Gm-Message-State: ALyK8tJ7b5z+g+bUHR4Wsv+2vsW8HuymMhDcWZW/Qs+KnF3Lp+81WVmNzVWb79VqgOYo+Q== X-Received: by 10.176.3.146 with SMTP id 18mr10336108uau.10.1465936934841; Tue, 14 Jun 2016 13:42:14 -0700 (PDT) Received: from ?IPv6:2620::ce0:101:adcd:b2df:6f5e:d6b0? ([2620:0:ce0:101:adcd:b2df:6f5e:d6b0]) by smtp.gmail.com with ESMTPSA id d131sm4921142vka.24.2016.06.14.13.42.13 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 14 Jun 2016 13:42:14 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: <6C363094-12B7-4AB4-8E14-DFBC69A1335A@sn3rd.com> Date: Tue, 14 Jun 2016 15:42:12 -0500 To: draft-ietf-dmarc-interoperability.all@ietf.org, The IESG , secdir@ietf.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [secdir] SecDir review of draft-ietf-dmarc-interoperability X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jun 2016 20:42:52 -0000 I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written primarily for the benefit of the security = area directors. Document editors and WG chairs should treat these = comments just like any other last call comments. This informational draft describes interoperability issues between DMARC = and indirect email flows as well as possible methods for addressing = these interoperability issues. Indirect email flows are messages that = do not flow directly from the author's administrative domain to the = final recipient(s). Summary: I think it=E2=80=99s ready, but just wanted to check on one = thing. The difference between the following sentences in s1 and s4: s1: Note that some practices which are in use at the time of this = document may or may not be "best practices", especially as future = standards evolve. s4: Note that these particular mechanisms may not be considered "best = practices" and may, in some cases, violate various conventions or = expectations. made me wonder whether the two identified sections in the security = considerations are the only sections that contain text that "violates = various conventions or exceptions". I don=E2=80=99t want wanting to = grind the security axe on eMail, DKIM, SPF only on what=E2=80=99s = changed. Ramblings follow: Rave: Appreciate that this wasn=E2=80=99t trying to be passed off as a BCP and = that there=E2=80=99s no 2119-language. Appreciate your examples using TLS1.2 and at-this-time-known-to-be-good = algorithms. Rant: s1 2nd para could probably be deleted. It sounds a lot like marketing = to me :) Nits: I found some. Peter found way more so look for his GenArt review. spt From nobody Wed Jun 15 11:59:35 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B75BD12D881 for ; Wed, 15 Jun 2016 11:59:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.747 X-Spam-Level: X-Spam-Status: No, score=-5.747 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=linkedin.com header.b=cYSyJaao; dkim=pass (1024-bit key) header.d=linkedin.com header.b=DWyywjXM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29m71dbpYrw8 for ; Wed, 15 Jun 2016 11:59:33 -0700 (PDT) Received: from mail522.linkedin.com (mail522.linkedin.com [108.174.6.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 085D312D65F for ; Wed, 15 Jun 2016 11:59:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linkedin.com; s=proddkim1024; t=1466017171; bh=OlFoiZebGgtlI3KaNRT56dI2kMTQKv+G5B9ClV13x9I=; h=MIME-Version:Date:Subject:From:To:Content-Type; b=cYSyJaaomnqpQDpZcgLyKUSwlC9VCTQHCFxDgeK5Q8GUUGn7hSnOTgqaZYXROjV1X 4FY7dEaX8Co3+y/EHNq6v8eGOMBtZ5pEcQGC+w6UPI8j6/kbw3TbYrvXZoydZNnYJi 43f/swutMaJDzfgiXTSgnZEv+CwxQ2x0nLef3D9w= Authentication-Results: mail522.prod.linkedin.com x-tls.subject="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com"; auth=pass (cipher=ECDHE-RSA-AES128-GCM-SHA256) Authentication-Results: mail522.prod.linkedin.com; iprev=pass policy.iprev="2607:f8b0:4001:c06::247"; spf=softfail smtp.mailfrom="kandersen@linkedin.com" smtp.helo="mail-io0-x247.google.com"; dkim=pass header.d=linkedin.com; tls=pass (verified) key.ciphersuite="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" key.length="128" tls.v="tlsv1.2" cert.client="C=US,ST=California,L=Mountain View,O=Google Inc,CN=smtp.gmail.com" cert.clientissuer="C=US,O=Google Inc,CN=Google Internet Authority G2" Received: from [2607:f8b0:4001:c06::247] ([2607:f8b0:4001:c06::247.32998] helo=mail-io0-x247.google.com) by mail522.prod.linkedin.com (envelope-from ) (ecelerity 3.6.21.53563 r(Core:3.6.21.0)) with ESMTPS (cipher=ECDHE-RSA-AES128-GCM-SHA256 subject="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com") id 26/4D-10544-395A1675; Wed, 15 Jun 2016 18:59:31 +0000 Received: by mail-io0-x247.google.com with SMTP id l5so62213758ioa.0 for ; Wed, 15 Jun 2016 11:59:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linkedin.com; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=OlFoiZebGgtlI3KaNRT56dI2kMTQKv+G5B9ClV13x9I=; b=DWyywjXMKVzBK/asNFCDqy7K4I3bZn+MKyLHz4Tr1nhj13dV/VoGpa/ebbq6+XqKvM MkF+PAm2Wo8YTALLAD7zPn0YoJx92NU8k+enIKXBHM6rNLSQ5rdmQx9bbl01/4tjy2a2 5qJmf2p8NWMckkVULovq3heGrcxmU2nN0uyHg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=OlFoiZebGgtlI3KaNRT56dI2kMTQKv+G5B9ClV13x9I=; b=ca+I0jzD5rG2IDagRlXmx9VDl399bjSuiMhNG/dOhpClHilzBxnO7jVR8VMaokeEtQ DgiVsWEwy+eJE1GO9+gn7HyeAVL1Qo/rTNiqceZNR+Tl8X1M+izNp0was4eLCRHvWRTO 5pfg3TdZIY5YzI5D6iuiEGComntBumYf7UfYzTdVmhTJTavzTKk0TmW2iMK2Y8QMqicL oOWRc3io5jhzyDkiDddNHbN2xeVKId3g4LAteIZ/+yXyIcKDSPwLruDgvyH/ukfMk7IU /jzDcSO+C5KElNJZ6tb+0lJTgAv0WoqWdHKkkcD2sXx7vDFH5ZBY8hj0sqPhwdn4lzK/ Ax8A== X-Gm-Message-State: ALyK8tILHoGhk5jdWteJcsCqUWPFjaGDOy3gPRLHyZZShnEmtXAKXNE8i4eyhVxQbc7jKjgOkiIp8HAyZn0itGPf1CL9KrnKZV4PwXiB2fQG5pgtTvii0pmpzjQZg91efaoXogoYmFhEouMHCvPnPqE59StH2g== X-Received: by 10.107.22.130 with SMTP id 124mr1537268iow.89.1466017170492; Wed, 15 Jun 2016 11:59:30 -0700 (PDT) MIME-Version: 1.0 X-Received: by 10.107.22.130 with SMTP id 124mr1537249iow.89.1466017170281; Wed, 15 Jun 2016 11:59:30 -0700 (PDT) Received: by 10.36.86.213 with HTTP; Wed, 15 Jun 2016 11:59:30 -0700 (PDT) In-Reply-To: <6C363094-12B7-4AB4-8E14-DFBC69A1335A@sn3rd.com> References: <6C363094-12B7-4AB4-8E14-DFBC69A1335A@sn3rd.com> Date: Wed, 15 Jun 2016 14:59:30 -0400 Message-ID: From: Kurt Andersen To: Sean Turner Content-Type: multipart/alternative; boundary=94eb2c060248ab7a19053555b879 Archived-At: Cc: The IESG , draft-ietf-dmarc-interoperability.all@ietf.org, secdir@ietf.org Subject: Re: [secdir] SecDir review of draft-ietf-dmarc-interoperability X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jun 2016 18:59:34 -0000 --94eb2c060248ab7a19053555b879 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Jun 14, 2016 at 4:42 PM, Sean Turner wrote: > Summary: I think it=E2=80=99s ready, but just wanted to check on one thin= g. The > difference between the following sentences in s1 and s4: > > s1: Note that some practices which are in use at the time of this > document may or may not be "best practices", especially as future standar= ds > evolve. > > s4: Note that these particular mechanisms may not be considered "best > practices" and may, in some cases, violate various conventions or > expectations. > > made me wonder whether the two identified sections in the security > considerations are the only sections that contain text that "violates > various conventions or exceptions". I don=E2=80=99t want wanting to grin= d the > security axe on eMail, DKIM, SPF only on what=E2=80=99s changed. > The intent in s1 is to warn that, in general, some of the approaches have various degrees of controversy associated with them at this time. s4 is more oriented toward the "experimental" nature of some of the mitigation strategies which are mentioned - without wanting to call out particular approaches as being more or less controversial. s4 falls into the scope of the explicit "possible mitigations" section of the document, so we thought it important to re-iterate the caution which was initially raised in s1. --Kurt --94eb2c060248ab7a19053555b879 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= ue, Jun 14, 2016 at 4:42 PM, Sean Turner <sean@sn3rd.com> wrote= :
Summary: I think it=E2=80=99s ready, but just wanted to che= ck on one thing.=C2=A0 The difference between the following sentences in s1= and s4:

s1:=C2=A0 Note that some practices which are in use at the time of this doc= ument may or may not be "best practices", especially as future st= andards evolve.

s4: Note that these particular mechanisms may not be considered "best = practices" and may, in some cases, violate various conventions or expe= ctations.

made me wonder whether the two identified sections in the security consider= ations are the only sections that contain text that "violates various = conventions or exceptions".=C2=A0 I don=E2=80=99t want wanting to grin= d the security axe on eMail, DKIM, SPF only on what=E2=80=99s changed.
<= /div>

The intent in s1 is to warn that, in general, s= ome of the approaches have various degrees of controversy associated with t= hem at this time.

s4 is more oriented toward the "experimental" nature = of some of the mitigation strategies which are mentioned - without wanting = to call out particular approaches as being more or less controversial. s4 f= alls into the scope of the explicit "possible mitigations" sectio= n of the document, so we thought it important to re-iterate the caution whi= ch was initially raised in s1.

--Kurt
--94eb2c060248ab7a19053555b879-- From nobody Wed Jun 15 15:03:09 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9C2012D660; Wed, 15 Jun 2016 15:03:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.326 X-Spam-Level: X-Spam-Status: No, score=-3.326 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R4WPE-epJjrg; Wed, 15 Jun 2016 15:03:00 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id C42D512D0A9; Wed, 15 Jun 2016 15:02:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 14D1F2CED2; Thu, 16 Jun 2016 01:02:59 +0300 (EEST) (envelope-from jari.arkko@piuha.net) X-Virus-Scanned: amavisd-new at piuha.net Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W2nJU5pUzW-a; Thu, 16 Jun 2016 01:02:58 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2a00:1d50:2::130]) by p130.piuha.net (Postfix) with ESMTP id 5EFB12CC9C; Thu, 16 Jun 2016 01:02:58 +0300 (EEST) (envelope-from jari.arkko@piuha.net) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_3446620F-3878-4A9D-935F-66C975AAD180"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.2 From: Jari Arkko In-Reply-To: Date: Thu, 16 Jun 2016 01:02:59 +0300 Message-Id: <01F18301-E22E-4ED3-AB01-DC807510A2CE@piuha.net> References: <850F2C19-92CD-48AC-B88B-6C89E136786C@cisco.com> To: Ben Campbell X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "gen-art@ietf.org" , "secdir@ietf.org" , "draft-ietf-avtext-splicing-notification.all@ietf.org" , "iesg@ietf.org" Subject: Re: [secdir] [Gen-art] Gen-ART / SecDir Review of draft-ietf-avtext-splicing-notification-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jun 2016 22:03:02 -0000 --Apple-Mail=_3446620F-3878-4A9D-935F-66C975AAD180 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks Mat & Ben. Jari On 02 Jun 2016, at 17:56, Ben Campbell wrote: >=20 >=20 > On 2 Jun 2016, at 10:23, Matt Miller (mamille2) wrote: >=20 >> I am the coincidentally-assigned Gen-ART and SecDir reviewer >> for this draft. The General Area Review Team (Gen-ART) reviews all = IETF >> documents being processed by the IESG for the IETF Chair. The = Security >> Directorate reviews all IETF documents being processed by the IESG = for >> the security area directors. Please treat these comments just like = any >> other last call comments that arrived on time. >>=20 >> For more information on Gen-Art, please see the FAQ at >>=20 >> < http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq >. >>=20 >> Document: draft-ietf-avtext-splicing-notification-07 >> Reviewer: Matthew A. Miller >> Review Date: 2016-06-02 >> IETF LC End Date: 2016-06-01 >> IESG Telechat date: N/A >>=20 >> Summary: >>=20 >> This document is ready to be published as a Proposed Standard >> once the nit is taken care of. >>=20 >> I reviewed a previous revision of this document (-04), and all of my >> concerns from the earlier review are addressed herein. >>=20 >> I note this document includes normative references to two = Informational >> documents (RFCs 7201 and 7667). The references are important to >> properly understand some of the security considerations of this >> document, but it appears the responsible AD is to add them to the >> approved downrefs registry. >=20 > Just an observation: we did do a second IETF last call for to the = normative downrefs. >=20 > [...] >=20 > Thanks! >=20 > Ben. >=20 > _______________________________________________ > Gen-art mailing list > Gen-art@ietf.org > https://www.ietf.org/mailman/listinfo/gen-art --Apple-Mail=_3446620F-3878-4A9D-935F-66C975AAD180 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXYdCUAAoJEM80gCTQU46qjXgP/jaCR2qOCstKIDTBchKy8uo1 QgD7Naf3UnqchX0fCXcKxji7oxgOOXvZYQKH1owQCTiIFKycUhPnLJtJlFm6Wb7W l2v8f+flLd4mICOeFHdTk3MV5w3lUwcGJK71nb0Q0/QOzxHe31aPO2pYd1uSSTZR rMJwf2ueVDdPl8PJY3CbK4fOLqCHYnPAYgqg+f04rLVHRtNES0r/7eJ4Q52IpH1u M3sM7wqEVf1W3rBqJlIRpE1LvtoI4xJjD232qKnBQnEI3z2xkvpmiP4K+4lwmUtp f2JDO7jhBzmxJOJBtasA2yl8RCTA4cKbTCbFwQx2mrbsNvgFnPlr2WTrA23a8g8w H8vPoueaY2ucecYQl1M36yfBjAyum9H88k2dufNM9M68hG3TcwrcotpaFJa70xx5 FsGDWATLn2njGlafNu/lFP82K1GTDNFr4JjjZ25yPPPpEwZaSq/ek8XjeRCKvXrO Ht+6smfZRRq7Uqy+qAtcli1KhIanhVW+sRJFVIPwEBGSptHPyr0K8mFtDhBqYTss BhmH4vksSdMbnoZaLhYCm/rQOoqJdsrngXyspoIcwyL1g0oiFd93UtozOcBBRiRj RVB6Amrcom8gJ6LO0dtx+fd0KBiW17THBpmb0uaW+pyULvHODX3Ow5R/YB4axkSn Df0C7u0Bm9BEF3BbnJD6 =LkZr -----END PGP SIGNATURE----- --Apple-Mail=_3446620F-3878-4A9D-935F-66C975AAD180-- From nobody Fri Jun 17 03:52:21 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03F1312D0E3 for ; Fri, 17 Jun 2016 03:52:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lMQgv4q6_eky for ; Fri, 17 Jun 2016 03:52:19 -0700 (PDT) Received: from mail.kivinen.iki.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E719A12D0B3 for ; Fri, 17 Jun 2016 03:52:18 -0700 (PDT) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id u5HAqEDN013782 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Fri, 17 Jun 2016 13:52:14 +0300 (EEST) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id u5HAqEoS017061; Fri, 17 Jun 2016 13:52:14 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <22371.54878.481037.354555@fireball.acr.fi> Date: Fri, 17 Jun 2016 13:52:14 +0300 From: Tero Kivinen To: secdir@ietf.org X-Edit-Time: 1 min X-Total-Time: 0 min Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 10:52:21 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Phillip Hallam-Baker is next in the rotation. For telechat 2016-06-30 Reviewer LC end Draft John Bradley T 2016-06-23 draft-ietf-ospf-transition-to-ospfv3-08 Shawn Emery T 2016-06-24 draft-ietf-trill-irb-13 Carl Wallace T 2016-06-22 draft-ietf-forces-interfelfb-04 Klaas Wierenga T 2016-06-21 draft-ietf-alto-deployments-15 Tom Yu T 2016-07-01 draft-pal-eidr-urn-2016-01 For telechat 2016-07-07 Shaun Cooley T 2016-06-28 draft-ietf-trill-ia-appsubtlv-08 Liang Xia T 2016-06-22 draft-ietf-calext-extensions-03 Dacheng Zhang T 2016-06-27 draft-ietf-cdni-metadata-18 Last calls and special requests: Alan DeKok 2016-04-30 draft-bradner-rfc3979bis-08 Donald Eastlake 2016-07-08 draft-pd-dispatch-msrp-websocket-12 Daniel Kahn Gillmor E 2016-02-01 draft-ietf-rtcweb-security-08 Tobias Gondrom 2016-07-11 draft-sweet-rfc2910bis-08 Hannes Tschofenig 2015-12-28 draft-ietf-hip-rfc5204-bis-07 Hannes Tschofenig E None draft-ietf-ntp-network-time-security-14 Hannes Tschofenig E None draft-ietf-ntp-cms-for-nts-message-06 Hannes Tschofenig E None draft-ietf-ntp-using-nts-for-ntp-05 Brian Weis E 2016-02-01 draft-ietf-cdni-uri-signing-07 Brian Weis 2016-06-21 draft-ietf-mile-implementreport-09 Paul Wouters 2016-06-17 draft-ietf-dnsop-dnssec-roadblock-avoidance-04 -- kivinen@iki.fi From nobody Fri Jun 17 05:09:11 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2B2912D1EA for ; Fri, 17 Jun 2016 05:09:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.027 X-Spam-Level: X-Spam-Status: No, score=-3.027 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jyNuF1um6pUv for ; Fri, 17 Jun 2016 05:09:08 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE49912D13D for ; Fri, 17 Jun 2016 05:09:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B41B5BDF9 for ; Fri, 17 Jun 2016 13:09:05 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d2Xk-r39T884 for ; Fri, 17 Jun 2016 13:09:05 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2C16ABDCF for ; Fri, 17 Jun 2016 13:09:05 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1466165345; bh=996h30F+8fxYED6Fs4/slh0J7387QwViliL8WlQI7to=; h=To:From:Subject:Date:From; b=Rk1viKazOnhVgWlBFk86D9qpGGmocK6fKRR9cnDziSaGI8XWkHxW19H4pDemzkqlv WmwdZTX9Tr5E8e/sQdO0nFhniliupEDU8ciKMugdwWfV0VGWqGxUhcstxNuyipGHE1 z1DMA+Lvzd2QZQeiJ5Dt4K6NBE6kfm3eIs4pXgts= To: "secdir@ietf.org" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <5763E860.5010203@cs.tcd.ie> Date: Fri, 17 Jun 2016 13:09:04 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms070509050407040704070204" Archived-At: Subject: [secdir] Berlin secdir lunch location X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 12:09:10 -0000 This is a cryptographically signed message in MIME format. --------------ms070509050407040704070204 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I'll try remember to send a reminder but here's where we'll do the usual secdir lunch at IETF96: Assigned Room: Tegel Assigned Date: 07/19/2016 Assigned Start Time: 12:30:00 Cheers, S. --------------ms070509050407040704070204 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA2MTcx MjA5MDRaMC8GCSqGSIb3DQEJBDEiBCAr7QNGZ3oBCDH9ZJ5T5/0s2/nUIs8Y/X/43PwLjXyF XDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAAHGcPl3Jkpweulq90QuYptKeYeyAlrYJcSyB2ZKGz8glH2IYwjfxb 9IoFlrM6CE9xjl30MjrRCjW4Uh3kAaZhAFoGbi6LMAautxhhX6AulWlPGBzZwWEDA/rE0why l6e1HYccgBqvX0jfHwhEewcYMgWAWMwk9IN9C+wQYGcFoPAxt3fozK4Vzu3UDE/8JzVlXKNU QHFkJSUWD24QDsWVeXQaQuFJSzdPD52VAKhpjHCCv8N7A0CZDjTYXjq91CsBZ3JgLzqTyDE/ 8Y7dkXs9UmeXi2xMwa8vHGsGLB+8SzDpFglTHM3IME7qheqLeb5nFVlthtXHsLQ8XNgahiMM AAAAAAAA --------------ms070509050407040704070204-- From nobody Fri Jun 17 05:44:38 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A84F112D0CC; Fri, 17 Jun 2016 05:44:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.327 X-Spam-Level: X-Spam-Status: No, score=-8.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lYmuOpPp-Igl; Fri, 17 Jun 2016 05:44:36 -0700 (PDT) Received: from mx143.netapp.com (mx143.netapp.com [216.240.21.24]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A5E412D532; Fri, 17 Jun 2016 05:44:27 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.26,483,1459839600"; d="asc'?scan'208";a="121286875" Received: from hioexcmbx05-prd.hq.netapp.com ([10.122.105.38]) by mx143-out.netapp.com with ESMTP; 17 Jun 2016 05:39:24 -0700 Received: from HIOEXCMBX07-PRD.hq.netapp.com (10.122.105.40) by hioexcmbx05-prd.hq.netapp.com (10.122.105.38) with Microsoft SMTP Server (TLS) id 15.0.1156.6; Fri, 17 Jun 2016 05:39:21 -0700 Received: from HIOEXCMBX07-PRD.hq.netapp.com ([::1]) by hioexcmbx07-prd.hq.netapp.com ([fe80::837:3f3:c8b1:8d6f%21]) with mapi id 15.00.1156.000; Fri, 17 Jun 2016 05:39:21 -0700 From: "Eggert, Lars" To: Takeshi Takahashi Thread-Topic: Secdir review of draft-ietf-tsvwg-rfc5405bis-13 Thread-Index: AdG7IyLdVBROrcWPQpmXcgE5pcjURQNrNASA Date: Fri, 17 Jun 2016 12:39:21 +0000 Message-ID: <73CCA28B-9857-46E0-A338-A19F2EE4EEDB@netapp.com> References: <009201d1bb24$1563e4e0$402baea0$@nict.go.jp> In-Reply-To: <009201d1bb24$1563e4e0$402baea0$@nict.go.jp> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3124) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.120.60.36] Content-Type: multipart/signed; boundary="Apple-Mail=_9606CB93-2407-4047-80A6-4F489318439C"; protocol="application/pgp-signature"; micalg=pgp-sha256 MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-tsvwg-rfc5405bis.all@ietf.org" , "tsvwg@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review of draft-ietf-tsvwg-rfc5405bis-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 12:44:38 -0000 --Apple-Mail=_9606CB93-2407-4047-80A6-4F489318439C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, thanks for the review! I'll incorporate respective changes into -14. On 2016-05-31, at 12:06, Takeshi Takahashi = wrote: > In Table 1 "Summary of recommendations", I wonder if the corresponding > section numbers are correct. >=20 > [Now] > "SHOULD avoid using multiple ports" corresponds to Section 5.1 > and > "SHOULD use a randomized source port or equivalent technique" = corresponds to > Section 5.2 >=20 > [New] > "SHOULD avoid using multiple ports" corresponds to Section 5.1.1 > and > "SHOULD use a randomized source port or equivalent technique" = corresponds to > Section 5.1.2 >=20 > I might be wrong, so please check. You were right that what we had was wrong (copy/paste bug, I think), but = they pointers should be to Sections 5.1.2 and 6, respectively. > Also I have seen several typos (especially, missing parentheses around > referenced section numbers) on this document, so please revise the = texts > before the publication of this document. No typos come up when using "idnits --spellcheck". I also don't quite = understand what you mean by "missing parentheses around referenced = section numbers" - could you please clarify? Thanks, Lars --Apple-Mail=_9606CB93-2407-4047-80A6-4F489318439C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="signature.asc" Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJXY+98AAoJEFS1wwm/cMFXZC8QAK6SVMLO4dB5WFegxnzPD89L brl5Wf9G/xyMNbxWJOHa/BSYs+xwrmjP9htKTxxKCQH7LYKf7qW0q+SaVsv3TyrW hpgiYC0sbNau6Mt6hWTVHOQUjQEM4uBRc9c0S/9OpMbfEKZ/gnE0HoCuabHBlx6b 5G8ZD7i5B6Xil4yp4QCEtTOfKKSQsoKaG+ThLoZ3iaY8HvjTapjJOlYUhkWZt44f NLaXe2gbQGN88llbcVW1HdoXjAwFFrofd0iXrvB2J2eHjSl+XR2iM6+r7+emdTqu ENvTQ+hKBjYA0zDD3XmVYtjIVdNfM1xjkAz9Vy7euim0c0lSGyMI/X4x6D3mDRM7 9XdMsFMVUWk7XMaiBlwK2QnxxnWXEbxTh3K6NIHepagYiMwSc67+k/MOhP/3Nhv8 88g+vzrABGTelPQ63kOVaRAvhZliYOeYGJrCSUH4L2/N1lpPhId44Pz4khjydYgi MRcsZeYrEMD9TrqLowyK8AD8M7Wna9n9jH+E2/9/6zWrk5pHXFlyfPyomPrN/uZU AutROpTPYn8rbmcCD8S9HyIJzXZJMmdF4iRrkVauj9Pwk4wAzvsLkbPt8uqIwuNW O9ScGOTp/4ioDg+SRhC1peireDPazyGD1Wd9P1skLt/cdyk9b4s01ITY4WvJUnZU My7yw8+z7T0qZ+bOYZaH =iOIx -----END PGP SIGNATURE----- --Apple-Mail=_9606CB93-2407-4047-80A6-4F489318439C-- From nobody Fri Jun 17 14:32:44 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B26012DB50; Fri, 17 Jun 2016 14:32:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.947 X-Spam-Level: X-Spam-Status: No, score=-15.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HvSyJClrlC92; Fri, 17 Jun 2016 14:32:41 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB29E12DB39; Fri, 17 Jun 2016 14:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1012; q=dns/txt; s=iport; t=1466199160; x=1467408760; h=from:to:cc:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=Z06EVqGO/IT1tdvMVxBJZV1NonYCf/zGlfhLix+MglM=; b=ilHWDvBeKHbmzBvLQaGRnC5lgfLMAhAxPoFOonPyGISx8fjyTcdTL/7j QLobdbLQ+4g6ZwGBZUo44dlLs+frAtJ1I28Rf9LT/Qobo4RXvwAR+I4uN 3zMto05vAtPKD9oXux2z0urOZ+CPxlnO1/lmtMFebYlUswuXOyFmTzDHn 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0COBQAlbGRX/4UNJK1dgz6BWbsZgXqGF?= =?us-ascii?q?4EnOhIBAQEBAQEBZSeEUjo/EgE+QicEAQ2INcB5AQEBAQEBAQEBAQEBAQEBAQE?= =?us-ascii?q?BAR6IHopCgi8FmHUBgTCMeY8ij3YBJQEug3CKN38BAQE?= X-IronPort-AV: E=Sophos;i="5.26,485,1459814400"; d="scan'208";a="114169947" Received: from alln-core-11.cisco.com ([173.36.13.133]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 17 Jun 2016 21:32:39 +0000 Received: from XCH-RTP-004.cisco.com (xch-rtp-004.cisco.com [64.101.220.144]) by alln-core-11.cisco.com (8.14.5/8.14.5) with ESMTP id u5HLWdI4011985 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 17 Jun 2016 21:32:39 GMT Received: from xch-rtp-001.cisco.com (64.101.220.141) by XCH-RTP-004.cisco.com (64.101.220.144) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Fri, 17 Jun 2016 17:32:38 -0400 Received: from xch-rtp-001.cisco.com ([64.101.220.141]) by XCH-RTP-001.cisco.com ([64.101.220.141]) with mapi id 15.00.1104.009; Fri, 17 Jun 2016 17:32:38 -0400 From: "Brian Weis (bew)" To: The IESG , "secdir@ietf.org" Thread-Topic: Secdir review of draft-ietf-mile-implementreport-09 Thread-Index: AQHRyN/FSjlY5rBOrki9mgn+ezADWw== Date: Fri, 17 Jun 2016 21:32:38 +0000 Message-ID: <060C987D-B171-479E-9A60-A37E2DF63759@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.154.210.8] Content-Type: text/plain; charset="us-ascii" Content-ID: <1FA7DDFFCA79A745821134DBC9FC0F19@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-mile-implementreport.all@tools.ietf.org" Subject: [secdir] Secdir review of draft-ietf-mile-implementreport-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 21:32:42 -0000 I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These com= ments were written primarily for the benefit of the security area directors= . Document editors and WG chairs should treat these comments just like any = other last call comments. This draft is a collection of implementation reports of several RFCs in the= IETF INCident Handling (INCH) and Management Incident Lightweight Exchange= (MILE) working groups. The reports include implementation of tools to crea= te and consume security incident reports and security incident objects. It = includes a summary of each implementation, and an Implementation Guide. The= document does not define any new protocols, or make any new requirements o= n the incident report and incident objects. The Security Considerations section states that there are no security consi= derations, and I concur. I consider the document Ready to publish. Brian= From nobody Mon Jun 20 05:50:28 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 673C012D0EF; Mon, 20 Jun 2016 05:50:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.627 X-Spam-Level: X-Spam-Status: No, score=-5.627 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3c5LU81jeVM; Mon, 20 Jun 2016 05:50:18 -0700 (PDT) Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id 57BEB12B05C; Mon, 20 Jun 2016 05:50:18 -0700 (PDT) Received: from gw1.nict.go.jp (gw1.nict.go.jp [133.243.18.250]) by ns1.nict.go.jp with ESMTP id u5KCoGQR041050; Mon, 20 Jun 2016 21:50:16 +0900 (JST) Received: from mail1.nict.go.jp (mail1.nict.go.jp [133.243.18.14]) by gw1.nict.go.jp with ESMTP id u5KCoGpo040929; Mon, 20 Jun 2016 21:50:16 +0900 (JST) Received: from VAIO (unknown [133.243.30.107]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail1.nict.go.jp (NICT Mail Spool Server1) with ESMTPS id 992C26197; Mon, 20 Jun 2016 21:50:15 +0900 (JST) From: "Takeshi Takahashi" To: "'Eggert, Lars'" References: <009201d1bb24$1563e4e0$402baea0$@nict.go.jp> <73CCA28B-9857-46E0-A338-A19F2EE4EEDB@netapp.com> In-Reply-To: <73CCA28B-9857-46E0-A338-A19F2EE4EEDB@netapp.com> Date: Mon, 20 Jun 2016 21:50:32 +0900 Message-ID: <001601d1caf2$54b61310$fe223930$@nict.go.jp> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQIqTpcD9HVvR9EqZoraa3UouOrYpgHy36zmnzGqVrA= Content-Language: ja X-Virus-Scanned: clamav-milter 0.98.7 at zenith1 X-Virus-Status: Clean Archived-At: Cc: draft-ietf-tsvwg-rfc5405bis.all@ietf.org, tsvwg@ietf.org, iesg@ietf.org, secdir@ietf.org Subject: Re: [secdir] Secdir review of draft-ietf-tsvwg-rfc5405bis-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 12:50:20 -0000 Hi, > > Also I have seen several typos (especially, missing parentheses around > > referenced section numbers) on this document, so please revise the > > texts before the publication of this document. > > No typos come up when using "idnits --spellcheck". I also don't quite > understand what you mean by "missing parentheses around referenced section > numbers" - could you please clarify? These typos are very trivial, but let me list them here. Since I'm not a native speaker (writer) of English, so I might be wrong, but I hope you could take a look at them. I was reading version 13 of the draft, and version 14 (that was published a couple of days ago) already have fixed most of the typo I found. 1. in Section 3.1.7, Old) "requires for" New) "required for" (already fixed in version 14) 2. in Section 3.1.7, Old) "... by the UDP congestion control method Section 3.1 that is not less than the reaction of TCP..." It could be helpful if you could use parentheses, e.g., "...control method (see Section 3.1) that..." or "...control method described in Section 3.1) that..." 3. in Section 3.1.8 Old) "across multiple networks the between ..." New) "across multiple networks between ..." (already fixed in version 14) 4. in Section 3.1.9 Old) "into unprovisioned Internet paths (e.g., [RFC7510]) To protect" The sentence might need a period in between; i.e., "into unprovisioned Internet paths (e.g., [RFC7510]). To protect" 5. in Section 7 Old) "for tunnels carrying IP Traffic," It could be a non-capital letter; i.e., "for tunnels carrying IP traffic," I like the summary table inserted in Section 7. Thank you for preparing the summary table. Kind regards, Take > -----Original Message----- > From: Eggert, Lars [mailto:lars@netapp.com] > Sent: Friday, June 17, 2016 9:39 PM > To: Takeshi Takahashi > Cc: iesg@ietf.org; secdir@ietf.org; > draft-ietf-tsvwg-rfc5405bis.all@ietf.org; tsvwg@ietf.org > Subject: Re: Secdir review of draft-ietf-tsvwg-rfc5405bis-13 > > Hi, > > thanks for the review! I'll incorporate respective changes into -14. > > On 2016-05-31, at 12:06, Takeshi Takahashi > wrote: > > In Table 1 "Summary of recommendations", I wonder if the corresponding > > section numbers are correct. > > > > [Now] > > "SHOULD avoid using multiple ports" corresponds to Section 5.1 and > > "SHOULD use a randomized source port or equivalent technique" > > corresponds to Section 5.2 > > > > [New] > > "SHOULD avoid using multiple ports" corresponds to Section 5.1.1 and > > "SHOULD use a randomized source port or equivalent technique" > > corresponds to Section 5.1.2 > > > > I might be wrong, so please check. > > You were right that what we had was wrong (copy/paste bug, I think), but > they pointers should be to Sections 5.1.2 and 6, respectively. > > > Also I have seen several typos (especially, missing parentheses around > > referenced section numbers) on this document, so please revise the > > texts before the publication of this document. > > No typos come up when using "idnits --spellcheck". I also don't quite > understand what you mean by "missing parentheses around referenced section > numbers" - could you please clarify? > > Thanks, > Lars From nobody Mon Jun 20 06:01:09 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3999512D09D; Mon, 20 Jun 2016 06:01:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.946 X-Spam-Level: X-Spam-Status: No, score=-15.946 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mi3Z2D8XhdKK; Mon, 20 Jun 2016 06:01:06 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 794CD12B05C; Mon, 20 Jun 2016 06:01:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10920; q=dns/txt; s=iport; t=1466427666; x=1467637266; h=from:to:cc:subject:date:message-id:mime-version; bh=EGy9vmWbpQ3cOv4f+RKBNGw6x0lG2DCg4NAI+wCCIlc=; b=G/Oql8nUKNLlCuDGmgN0IRl+IyxRMvjlmQLUECxjZk8rCdZOkG5i0Rii g1qC1ISgn5RBsT9Zh0YqaeEKgYdg9/a/j6nwvTKKSWrs+InPAT4L+uZpU yJav/5D1N+SQ3sBONRx8W8IJNHWRx5zZZ3nwPCBHkuEnnbPtDFzLmJJ50 U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CTJgAp6GdX/4UNJK1VCYJwToFZi06qE?= =?us-ascii?q?IZ7hhcegRQ7EQEBAQEBAQFlJ4RSI1YSAUoCBDAnBAENiDWwDJAaAQEBAQEBAQE?= =?us-ascii?q?CAQEBAQEBAQEBHoYniGYRgxeCWgWYdgGBMJwbj3YBNCCDcIl0Kxh/AQEB?= X-IronPort-AV: E=Sophos;i="5.26,498,1459814400"; d="scan'208,217";a="287625842" Received: from alln-core-11.cisco.com ([173.36.13.133]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 20 Jun 2016 13:01:05 +0000 Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by alln-core-11.cisco.com (8.14.5/8.14.5) with ESMTP id u5KD152N007733 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 20 Jun 2016 13:01:05 GMT Received: from xch-aln-004.cisco.com (173.36.7.14) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 20 Jun 2016 08:01:04 -0500 Received: from xch-aln-004.cisco.com ([173.36.7.14]) by XCH-ALN-004.cisco.com ([173.36.7.14]) with mapi id 15.00.1104.009; Mon, 20 Jun 2016 08:01:04 -0500 From: "Klaas Wierenga (kwiereng)" To: The IESG , "secdir@ietf.org" Thread-Topic: Sector review of draft-ietf-alto-deployments-15 Thread-Index: AQHRyvPNnxFha3RvI0Cb/MKm5WKEeQ== Date: Mon, 20 Jun 2016 13:01:04 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.61.67.153] Content-Type: multipart/alternative; boundary="_000_etPan5767e90e4c847566f16fKWIERENGMH01C_" MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-alto-deployments.all@tools.ietf.org" Subject: [secdir] Sector review of draft-ietf-alto-deployments-15 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 13:01:08 -0000 --_000_etPan5767e90e4c847566f16fKWIERENGMH01C_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCiBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJp dHkgZGlyZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1l bnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gVGhlc2UgY29tbWVudHMgd2VyZSB3cml0 dGVuIHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlIHNlY3VyaXR5IGFyZWEgZGlyZWN0 b3JzLiBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNv bW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLg0KDQpUaGlzIGRv Y3VtZW50IGRlc2NyaWJlcyB1c2UgY2FzZXMgd2hlbiBkZXBsb3lpbmcgQUxUTyAoQXBwbGljYXRp b24gTGF5ZXIgVHJhZmZpYyBPcHRpbWl6YXRpb24pLiBJdCBwcm92aWRlcyBndWlkYW5jZSBmb3Ig dXNpbmcgYW5kIGRlcGxveWluZyBBTFRPIHNlcnZpY2VzLg0KDQpUaGUgZG9jdW1lbnQgcmVhZHMg d2VsbCBhbmQgaXMgYXMgZmFyIGFzIEkgY2FuIHRlbGwgcHJldHR5IGV4aGF1c3RpdmUgKGlmIGFu eXRoaW5nIHRoZSBlbXBoYXNpcyBzZWVtcyBzbGlnaHRseSBvbiBQMlAgcmF0aGVyIHRoYW4gQ0RO LCBidXQgdGhhdCBzZWVtcyBqdXN0aWZpZWQgYnkgdGhlIG51bWJlciBvZiBkaWZmZXJlbnQgUDJQ IGRlcGxveW1lbnRzIGFzIG9wcG9zZWQgdG8gQ0ROKS4NCkkgcGFydGljdWxhcmx5IGxpa2UgdGhl IGV4dGVuc2l2ZSBjb3ZlcmFnZSBvZiBwcml2YWN5IGFuZCBzZWN1cml0eSBpc3N1ZXMgdGhyb3Vn aG91dCB0aGUgZG9jdW1lbnQsIHRoaXMgd2FzIGNsZWFybHkgbm90IGJvbHRlZCBvbiBsYXRlIGlu IHRoZSBwcm9jZXNzLiBJIGhhdmUgb25seSBhIGZldyBjb21tZW50cyBhbmQgdGhlcmVmb3JlIGJl bGlldmUgdGhlIGRvY3VtZW50IGlzOg0KDQpyZWFkeSB3aXRoIG5pdHMNCg0KLSBBIG51bWJlciBv ZiB0aGUgY29tbWVudHMgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQgcGVydGFpbiB0byBwcml2YWN5 LCBJIHRoaW5rIHRoZSBkb2N1bWVudCB3b3VsZCBoYXZlIGJlbmVmaXRlZCBmcm9tIGEgc2VwYXJh dGUgcHJpdmFjeSBjb25zaWRlcmF0aW9ucyBwYXJhZ3JhcGgsIGluIGFkZGl0aW9uIHRvIHRoZSBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucy4NCg0KLSBOb3QgZGlyZWN0bHkgc2VjdXJpdHkgcmVsYXRl ZCAoYXBhcnQgZnJvbSBEb1MpLCBidXQgSSB3b25kZXIgaW4gaG93IGZhciBpdCBpcyBhIHJpc2sg dGhhdCBjbGllbnRzIGhhdmUgYSByZWxhdGl2ZWx5IHN0YXRpYyB2aWV3IG9mIHRoZSB3b3JsZCAo My40LjQpLCBpLmUuIGl0IGlzIGFzc3VtZWQgdGhhdCB0aGUgbmV0d29yayBjaGFyYWN0ZXJpc3Rp Y3MgZG9u4oCZdCBjaGFuZ2UgcmFwaWRseS4gVG8gdXNlIGFuIGFuYWxvZ3ksIGlzIHRoZXJlIGEg cmlzayB0aGF0IHdoZW4gdGhlcmUgaXMgc29tZSBob2xkdXAgb24gdGhlIGhpZ2h3YXksIHRoYXQg YWxsIGNhcnMgd2lsbCB0YWtlIHRoZSBzYW5kIHBhdGggZm9yIHNvbWUgZXh0ZW5kZWQgcGVyaW9k IG9mIHRpbWUsIHRodXMgY2xvZ2dpbmcgdGhlIHNhbmQgcGF0aD8gSWYgdGhpcyBpcyBjb3ZlcmVk IGluIG90aGVyIGRvY3VtZW50cyBJIGFwb2xvZ2lzZSwgYnV0IGluIHRoZSByZXZpZXdlZCBkb2N1 bWVudCB0aGF0IGFwcGVhcnMgdG8gYmUgYSByaXNrLg0KDQotIFRoZXJlIGlzIHRleHQgYXJvdW5k IHZhbGlkYXRpb24gb2YgdGhlIGNsaWVudHMgKDcuMyBBTFRPIHNlcnZlciBhY2Nlc3MpLCBidXQg dG8gbXkgc3VycHJpc2UgdGhlcmUgaXMgbm8gd29yZGluZyB0byBhdXRoZW50aWNhdGlvbiBvZiB0 aGUgc2VydmVyLiBBcyBhIGNsaWVudCBvcGVyYXRvciBJIHdvdWxkIGV4cGVjdCB0byBiZSBhYmxl IHRvIHZhbGlkYXRlIHRoZSBzZXJ2ZXIsIGFmdGVyIGFsbCB0aGUgc2VydmVyIGlzIHRlbGxpbmcg bWUgd2hlcmUgdG8gZ28gZm9yIHRoZSByZXNvdXJjZXMgSSBuZWVkLiBUaGUgdGV4dCBleHBsYWlu cyB3aGF0IHRoZSByaXNrIG9mIGluamVjdGluZyB3cm9uZyBpbmZvcm1hdGlvbiBpcyAoNy40KSwg YnV0IHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIHNlcnZlciBpdHNlbGYgaXMgbm90IGRpc2N1c3Nl ZC4gQSBzaW1wbGUgc2VydmVyIGF1dGhlbnRpY2F0aW9uIHNlZW1zIHRvIGdvIGEgbG9uZyB3YXkg aW4gcHJldmVudGluZyByb2d1ZSBBTFRPIHNlcnZlcnMuDQoNCktsYWFzDQoNCg0KLS0NCktsYWFz IFdpZXJlbmdhDQpJZGVudGl0eSBBcmNoaXRlY3QNCkNpc2NvIENsb3VkIFNlcnZpY2VzDQo= --_000_etPan5767e90e4c847566f16fKWIERENGMH01C_ Content-Type: text/html; charset="utf-8" Content-ID: <682D1D1543CCD84BAB1FC36215450AFC@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZT5ib2R5e2ZvbnQtZmFtaWx5OkhlbHZl dGljYSxBcmlhbDtmb250LXNpemU6MTNweH08L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgc3R5bGU9 IndvcmQtd3JhcDogYnJlYWstd29yZDsgLXdlYmtpdC1uYnNwLW1vZGU6IHNwYWNlOyAtd2Via2l0 LWxpbmUtYnJlYWs6IGFmdGVyLXdoaXRlLXNwYWNlOyI+DQo8ZGl2IGlkPSJibG9vcF9jdXN0b21m b250IiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhLEFyaWFsO2ZvbnQtc2l6ZToxM3B4OyBj b2xvcjogcmdiYSgwLDAsMCwxLjApOyBtYXJnaW46IDBweDsgbGluZS1oZWlnaHQ6IGF1dG87Ij4N CkhpLDwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9ImZvbnQtZmFtaWx5 OkhlbHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweDsgY29sb3I6IHJnYmEoMCwwLDAsMS4wKTsg bWFyZ2luOiAwcHg7IGxpbmUtaGVpZ2h0OiBhdXRvOyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgaWQ9 ImJsb29wX2N1c3RvbWZvbnQiIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EsQXJpYWw7Zm9u dC1zaXplOjEzcHg7IGNvbG9yOiByZ2JhKDAsMCwwLDEuMCk7IG1hcmdpbjogMHB4OyBsaW5lLWhl aWdodDogYXV0bzsiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiAnaGVsdmV0aWNhIE5ldWUn LCBoZWx2ZXRpY2E7Ij4mbmJzcDtoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBv ZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxs IElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gVGhlc2UgY29tbWVu dHMgd2VyZSB3cml0dGVuIHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlDQogc2VjdXJp dHkgYXJlYSBkaXJlY3RvcnMuIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQg dHJlYXQgdGhlc2UgY29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVu dHMuJm5ic3A7PC9zcGFuPjxiciBzdHlsZT0iZm9udC1mYW1pbHk6ICdoZWx2ZXRpY2EgTmV1ZScs IGhlbHZldGljYTsiPg0KPC9kaXY+DQo8ZGl2IGlkPSJibG9vcF9jdXN0b21mb250IiBzdHlsZT0i Zm9udC1mYW1pbHk6SGVsdmV0aWNhLEFyaWFsO2ZvbnQtc2l6ZToxM3B4OyBjb2xvcjogcmdiYSgw LDAsMCwxLjApOyBtYXJnaW46IDBweDsgbGluZS1oZWlnaHQ6IGF1dG87Ij4NCjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTogJ2hlbHZldGljYSBOZXVlJywgaGVsdmV0aWNhOyI+PGJyPg0KPC9zcGFu PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9ImZvbnQtZmFtaWx5Okhl bHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweDsgY29sb3I6IHJnYmEoMCwwLDAsMS4wKTsgbWFy Z2luOiAwcHg7IGxpbmUtaGVpZ2h0OiBhdXRvOyI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 ICdoZWx2ZXRpY2EgTmV1ZScsIGhlbHZldGljYTsiPlRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIHVz ZSBjYXNlcyB3aGVuIGRlcGxveWluZyBBTFRPIChBcHBsaWNhdGlvbiBMYXllciBUcmFmZmljIE9w dGltaXphdGlvbikuIEl0IHByb3ZpZGVzIGd1aWRhbmNlIGZvciB1c2luZyBhbmQgZGVwbG95aW5n IEFMVE8gc2VydmljZXMuPC9zcGFuPjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIg c3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweDsgY29sb3I6 IHJnYmEoMCwwLDAsMS4wKTsgbWFyZ2luOiAwcHg7IGxpbmUtaGVpZ2h0OiBhdXRvOyI+DQo8c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6ICdoZWx2ZXRpY2EgTmV1ZScsIGhlbHZldGljYTsiPjxicj4N Cjwvc3Bhbj48L2Rpdj4NCjxkaXYgaWQ9ImJsb29wX2N1c3RvbWZvbnQiIHN0eWxlPSJtYXJnaW46 IDBweDsiPjxzcGFuIHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogJ2hl bHZldGljYSBOZXVlJywgaGVsdmV0aWNhOyBmb250LXNpemU6IDEzcHg7Ij5UaGUgZG9jdW1lbnQg cmVhZHMgd2VsbCBhbmQgaXMgYXMgZmFyIGFzIEkgY2FuIHRlbGwgcHJldHR5IGV4aGF1c3RpdmUg KGlmIGFueXRoaW5nIHRoZSZuYnNwOzwvc3Bhbj48Zm9udCBmYWNlPSJoZWx2ZXRpY2EgTmV1ZSwg aGVsdmV0aWNhIj5lbXBoYXNpcw0KIHNlZW1zIHNsaWdodGx5IG9uIFAyUCByYXRoZXIgdGhhbiBD RE4sIGJ1dCB0aGF0IHNlZW1zIGp1c3RpZmllZCBieSB0aGUgbnVtYmVyIG9mIGRpZmZlcmVudCBQ MlAgZGVwbG95bWVudHMgYXMgb3Bwb3NlZCB0byBDRE4pLiZuYnNwOzwvZm9udD48L2Rpdj4NCjxk aXYgaWQ9ImJsb29wX2N1c3RvbWZvbnQiIHN0eWxlPSJtYXJnaW46IDBweDsiPjxmb250IGZhY2U9 ImhlbHZldGljYSBOZXVlLCBoZWx2ZXRpY2EiPkkgcGFydGljdWxhcmx5IGxpa2UgdGhlIGV4dGVu c2l2ZSBjb3ZlcmFnZSBvZiBwcml2YWN5IGFuZCBzZWN1cml0eSBpc3N1ZXMgdGhyb3VnaG91dCB0 aGUgZG9jdW1lbnQsIHRoaXMgd2FzIGNsZWFybHkgbm90IGJvbHRlZCBvbiBsYXRlIGluIHRoZSBw cm9jZXNzLiBJIGhhdmUgb25seSBhIGZldyBjb21tZW50cw0KIGFuZCB0aGVyZWZvcmUgYmVsaWV2 ZSB0aGUgZG9jdW1lbnQgaXM6PC9mb250PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9u dCIgc3R5bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZl dGljYSI+PGJyPg0KPC9mb250PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5 bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZldGljYSI+ cmVhZHkgd2l0aCBuaXRzJm5ic3A7PC9mb250PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9t Zm9udCIgc3R5bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhl bHZldGljYSI+PGJyPg0KPC9mb250PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIg c3R5bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZldGlj YSI+LSBBIG51bWJlciBvZiB0aGUgY29tbWVudHMgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQgcGVy dGFpbiB0byBwcml2YWN5LCBJIHRoaW5rIHRoZSBkb2N1bWVudCB3b3VsZCBoYXZlIGJlbmVmaXRl ZCBmcm9tIGEgc2VwYXJhdGUmbmJzcDtwcml2YWN5IGNvbnNpZGVyYXRpb25zIHBhcmFncmFwaCwg aW4gYWRkaXRpb24NCiB0byB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMuPC9mb250PjwvZGl2 Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQg ZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZldGljYSI+PGJyPg0KPC9mb250PjwvZGl2Pg0KPGRp diBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9Im1hcmdpbjogMHB4OyI+PGZvbnQgZmFjZT0i aGVsdmV0aWNhIE5ldWUsIGhlbHZldGljYSI+LSBOb3QgZGlyZWN0bHkgc2VjdXJpdHkgcmVsYXRl ZCAoYXBhcnQgZnJvbSBEb1MpLCBidXQgSSB3b25kZXIgaW4gaG93IGZhciBpdCBpcyBhIHJpc2sg dGhhdCBjbGllbnRzIGhhdmUgYSByZWxhdGl2ZWx5IHN0YXRpYyB2aWV3IG9mIHRoZSB3b3JsZCAo My40LjQpLCBpLmUuIGl0IGlzIGFzc3VtZWQNCiB0aGF0IHRoZSBuZXR3b3JrIGNoYXJhY3Rlcmlz dGljcyBkb27igJl0IGNoYW5nZSByYXBpZGx5LiBUbyB1c2UgYW4gYW5hbG9neSwgaXMgdGhlcmUg YSByaXNrIHRoYXQgd2hlbiB0aGVyZSBpcyBzb21lIGhvbGR1cCBvbiB0aGUgaGlnaHdheSwgdGhh dCBhbGwgY2FycyB3aWxsIHRha2UgdGhlJm5ic3A7c2FuZCBwYXRoIGZvciBzb21lIGV4dGVuZGVk IHBlcmlvZCBvZiB0aW1lLCB0aHVzIGNsb2dnaW5nIHRoZSBzYW5kIHBhdGg/IElmIHRoaXMgaXMg Y292ZXJlZA0KIGluIG90aGVyIGRvY3VtZW50cyBJJm5ic3A7YXBvbG9naXNlLCBidXQgaW4gdGhl IHJldmlld2VkJm5ic3A7ZG9jdW1lbnQgdGhhdCBhcHBlYXJzIHRvIGJlIGEgcmlzay48L2ZvbnQ+ PC9kaXY+DQo8ZGl2IGlkPSJibG9vcF9jdXN0b21mb250IiBzdHlsZT0ibWFyZ2luOiAwcHg7Ij48 Zm9udCBmYWNlPSJoZWx2ZXRpY2EgTmV1ZSwgaGVsdmV0aWNhIj48YnI+DQo8L2ZvbnQ+PC9kaXY+ DQo8ZGl2IGlkPSJibG9vcF9jdXN0b21mb250IiBzdHlsZT0ibWFyZ2luOiAwcHg7Ij48Zm9udCBm YWNlPSJoZWx2ZXRpY2EgTmV1ZSwgaGVsdmV0aWNhIj4tIFRoZXJlIGlzIHRleHQgYXJvdW5kJm5i c3A7dmFsaWRhdGlvbiBvZiB0aGUgY2xpZW50cyAoNy4zIEFMVE8gc2VydmVyIGFjY2VzcyksIGJ1 dCB0byBteSBzdXJwcmlzZSB0aGVyZSBpcyBubyB3b3JkaW5nIHRvIGF1dGhlbnRpY2F0aW9uIG9m IHRoZSBzZXJ2ZXIuIEFzIGEgY2xpZW50IG9wZXJhdG9yIEkNCiB3b3VsZCBleHBlY3QgdG8gYmUg YWJsZSB0byB2YWxpZGF0ZSB0aGUgc2VydmVyLCBhZnRlciBhbGwgdGhlIHNlcnZlciBpcyZuYnNw O3RlbGxpbmcgbWUgd2hlcmUgdG8gZ28gZm9yIHRoZSByZXNvdXJjZXMgSSBuZWVkLiBUaGUgdGV4 dCBleHBsYWlucyB3aGF0IHRoZSByaXNrIG9mIGluamVjdGluZyB3cm9uZyBpbmZvcm1hdGlvbiBp cyAoNy40KSwgYnV0IHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIHNlcnZlciBpdHNlbGYgaXMgbm90 IGRpc2N1c3NlZC4gQQ0KIHNpbXBsZSBzZXJ2ZXIgYXV0aGVudGljYXRpb24gc2VlbXMgdG8gZ28g YSBsb25nIHdheSBpbiZuYnNwO3ByZXZlbnRpbmcgcm9ndWUgQUxUTyZuYnNwO3NlcnZlcnMuPC9m b250PjwvZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9Im1hcmdpbjogMHB4 OyI+PGZvbnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZldGljYSI+PGJyPg0KPC9mb250Pjwv ZGl2Pg0KPGRpdiBpZD0iYmxvb3BfY3VzdG9tZm9udCIgc3R5bGU9Im1hcmdpbjogMHB4OyI+PGZv bnQgZmFjZT0iaGVsdmV0aWNhIE5ldWUsIGhlbHZldGljYSI+S2xhYXM8L2ZvbnQ+PC9kaXY+DQo8 ZGl2IGlkPSJibG9vcF9jdXN0b21mb250IiBzdHlsZT0ibWFyZ2luOiAwcHg7Ij48YnI+DQo8L2Rp dj4NCjxicj4NCjxkaXYgaWQ9ImJsb29wX3NpZ25fMTQ2NjQyNTE3Mzc4MTE4OTg4OCIgY2xhc3M9 ImJsb29wX3NpZ24iPg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6aGVsdmV0aWNhLGFyaWFsO2Zv bnQtc2l6ZToxM3B4Ij4tLSZuYnNwOzxicj4NCktsYWFzIFdpZXJlbmdhPGJyPg0KSWRlbnRpdHkg QXJjaGl0ZWN0PC9kaXY+DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpoZWx2ZXRpY2EsYXJpYWw7 Zm9udC1zaXplOjEzcHgiPkNpc2NvIENsb3VkIFNlcnZpY2VzPC9kaXY+DQo8L2Rpdj4NCjwvYm9k eT4NCjwvaHRtbD4NCg== --_000_etPan5767e90e4c847566f16fKWIERENGMH01C_-- From nobody Mon Jun 20 07:08:26 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C54A12D113; Mon, 20 Jun 2016 07:08:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QTk3ch-Aispl; Mon, 20 Jun 2016 07:08:18 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 802B512B04A; Mon, 20 Jun 2016 07:08:18 -0700 (PDT) Received: from pawpaw.sei.cmu.edu (pawpaw.sei.cmu.edu [10.64.21.22]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KE8HvB013703; Mon, 20 Jun 2016 10:08:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1466431697; bh=rZWzytZuhszCPfaApZzAxGPdqsGGlA/J73o2EgaKt3E=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=BtZccMCi43TGc1QnbfLn06PaF07HLUcSMTnH1J+iBET819d8wwVvUwbP+lKvEi+2d xyKNlwnWM3SQm5v7ZmXHXS8gFVPaMxx0X2AJ+hikftpVLR7hKeE1SGCg22BHjVOsz9 qsi66Uh1IQgi9bEWnU+naDaN+RNBcKtFIqFKTL1I= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by pawpaw.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KE8DPd024194; Mon, 20 Jun 2016 10:08:13 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0279.002; Mon, 20 Jun 2016 10:08:12 -0400 From: "Roman D. Danyliw" To: "Roman D. Danyliw" , Robert Sparks Thread-Topic: Secdir review: draft-ietf-mile-5070-bis-22 Thread-Index: AQHRuqVpyhJwvFfMKk6M7OkSPkYlWZ/VizoAgBz3tpA= Date: Mon, 20 Jun 2016 14:08:12 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD97667E5@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "mile@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 14:08:20 -0000 SGVsbG8gUm9iZXJ0IQ0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IFJv bWFuIEQuIERhbnlsaXcgW21haWx0bzpyZGRAY2VydC5vcmddDQo+IFNlbnQ6IFRodXJzZGF5LCBK dW5lIDAyLCAyMDE2IDE6MDMgQU0NCj4gVG86IFJvYmVydCBTcGFya3MgPHJqc3BhcmtzQG5vc3Ry dW0uY29tPg0KPiBDYzogc2VjZGlyQGlldGYub3JnOyBpZXNnQGlldGYub3JnOyBkcmFmdC1pZXRm LW1pbGUtcmZjNTA3MC1iaXMuYWxsQGlldGYub3JnOw0KPiBtaWxlQGlldGYub3JnDQo+IFN1Ympl Y3Q6IFJFOiBTZWNkaXIgcmV2aWV3OiBkcmFmdC1pZXRmLW1pbGUtNTA3MC1iaXMtMjINCj4gDQo+ IEhlbGxvIFJvYmVydCENCj4gDQo+IFRoYW5rcyBhZ2FpbiBmb3IgdGhpcyByZXZpZXcuICBDb21t ZW50cyBhcmUgaW5saW5lIC4uLg0KPiANCj4gPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0K PiA+IEZyb206IFJvYmVydCBTcGFya3MgW21haWx0bzpyanNwYXJrc0Bub3N0cnVtLmNvbV0NCj4g PiBTZW50OiBNb25kYXksIE1heSAzMCwgMjAxNiAyOjQ0IFBNDQo+ID4gVG86IHNlY2RpckBpZXRm Lm9yZzsgaWVzZ0BpZXRmLm9yZzsNCj4gPiBkcmFmdC1pZXRmLW1pbGUtcmZjNTA3MC1iaXMuYWxs QGlldGYub3JnDQo+ID4gU3ViamVjdDogU2VjZGlyIHJldmlldzogZHJhZnQtaWV0Zi1taWxlLTUw NzAtYmlzLTIyDQo+ID4NCj4gPiBJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0 IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdzDQo+ID4gb25nb2luZyBlZmZvcnQgdG8gcmV2 aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlDQo+ID4gSUVTRy4g IFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9m IHRoZQ0KPiA+IHNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiAgRG9jdW1lbnQgZWRpdG9ycyBhbmQg V0cgY2hhaXJzIHNob3VsZCB0cmVhdA0KPiA+IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkg b3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLg0KPiA+DQo+ID4gRG9jdW1lbnQgOiBkcmFmdC1pZXRm LW1pbGUtcmZjNTA3MGJpcy0yMg0KPiA+DQo+ID4gU3VtbWFyeTogVGhpcyBkb2N1bWVudCBoYXMg bWlub3IgaXNzdWVzIHRoYXQgc2hvdWxkIGJlIGFkZHJlc3NlZA0KPiA+IGJlZm9yZSBwdWJsaWNh dGlvbiBhcyBQcm9wb3NlZCBTdGFuZGFyZA0KPiA+DQo+ID4gVGhpcyBkb2N1bWVudCBkZWZpbmVz IGEgZG9jdW1lbnQgZm9ybWF0IGZvciBleGNoYW5naW5nIGluZm9ybWF0aW9uDQo+ID4gYmV0d2Vl biBvcGVyYXRpb25hbCBzZWN1cml0eSB0ZWFtcy4gSXQgcG9pbnRzIG91dCBzdGFuZGFyZGl6ZWQN Cj4gPiBtZWNoYW5pc21zIGZvciB0cmFuc3BvcnRpbmcgdGhlIGRvY3VtZW50cyAoUkZDNjU0NSBh bmQgUkZDNjU0NiksIHRvDQo+ID4gcHJvdmlkZSBjb25maWRlbnRpYWxpdHksIGludGVncml0eSwg YW5kIGF1dGhlbnRpY2l0eSwgYnV0IGRvZXMgbm90DQo+ID4gcmVzdHJpY3QgdGhlIHVzZSBvZiB0 aGUgZm9ybWF0IHRvIHdpdGhpbiB0aG9zZSBwcm90b2NvbHMuICBJbnN0ZWFkLCBpdA0KPiA+IHBy b3ZpZGVzIGEgZ2VuZXJpYyBzZXQgb2YgIlByb2Nlc3NpbmcgQ29uc2lkZXJhdGlvbnMiIGluIHNl Y3Rpb24gNCwNCj4gPiB3aGljaCBhcmUgYXVnbWVudGVkIGJ5IHRoZSBTZWN1cml0eSBDb25zaWRl cmF0aW9ucyBpbiBzZWN0aW9uIDkuDQo+ID4NCj4gPiBUaGVyZSBhcmUgc29tZSBtaW5vciBpc3N1 ZXMgd2l0aCB0aGlzIGFwcHJvYWNoIHRoYXQgc2hvdWxkIGJlDQo+ID4gYWRkcmVzc2VkIGJlZm9y ZSBwdWJsaWNhdGlvbi4NCg0KW3NuaXBdDQogDQo+ID4gMikgVGhlIGRvY3VtZW50IG5vdGVzIChp biBTZWN0aW9uIDkuMSkgdGhhdCBzb21lIGZpZWxkcyBpbiB0aGUNCj4gPiBkb2N1bWVudCBmb3Jt YXQgbWF5IGNvbnRhaW4gZXhlY3V0YWJsZSBjb250ZW50LiBJdCBpcyBub3QgY2xlYXIgd2hpY2gN Cj4gPiBmaWVsZHMgYXJlIGJlaW5nIG1lbnRpb25lZCwgb3Igd2hhdCBfa2luZF8gb2YgZXhlY3V0 YWJsZSBjb250ZW50IGlzDQo+ID4gYmVpbmcgY2FycmllZC4gRXhwbGljaXRseSBjYWxsaW5nIG91 dCB0aGUgZmllbGRzIHRoYXQgdGhpcyBkb2N1bWVudA0KPiA+IGRlZmluZXMgYXQgdGhpcyBwb2lu dCwgYW5kIGNoYXJhY3Rlcml6aW5nIHRoZWlyIGNvbnRlbnQgd291bGQgaGVscC4NCj4gPiBUaGUg cHJlY2F1dGlvbnMgeW91IG1pZ2h0IG5lZWQgdG8gdGFrZSBhZ2FpbnN0IGEgcmVnZXggYXJlIGRp ZmZlcmVudA0KPiA+IGZyb20gdGhvc2UgeW91IHdvdWxkIHRha2UgYWdhaW5zdCBhcmJpdHJhcnkg Ynl0ZWNvZGUgdGhlIHJlY2lwaWVudCBtaWdodA0KPiBiZSBhc2tlZCB0byBleGVjdXRlLg0KPiAN Cj4gVGhlIGFyZWFzIG9mIGNvbmNlcm4gd291bGQgYmU6DQo+IA0KPiAoMSkgYW55IGNsYXNzZXMg dGhhdCBjYW4gaGF2ZSAiYmluYXJ5IHN0cmluZ3MiIHBlciBTZWN0aW9uIDIuNSBzaW5jZSB0aGlz IHdvdWxkDQo+IGFsbG93IGJpbmFyeSBjb2RlIHRvIGJlIGVtYmVkZGVkIGluIHRoZSBkb2N1bWVu dC4gIFRoZSBhZmZlY3RlZCBjbGFzc2VzDQo+IGFyZSB0aG9zZSBvZiB0eXBlIGlvZGVmOkV4dGVu c2lvblR5cGUgYW5kIFJlY29yZFBhdHRlcm47DQo+ICgyKSB0aGUgRW1haWxNZXNzYWdlIGFuZCBF bWFpbEJvZHkgY2xhc3Nlcw0KPiAoMykgdGhlIERldGVjdGlvblBhdHRlcm4gY2xhc3MsIGFzIGl0 IGNvdWxkIHNwZWNpZnkgYSBtYWNoaW5lIHJlYWRhYmxlDQo+IGNvbmZpZ3VyYXRpb24gZm9yIGEg ZGV2aWNlIG9yIGFwcGxpY2F0aW9uDQo+ICg0KSB0aGUgVVJMIGNsYXNzIHRoYXQgY291bGQgcmVm ZXJlbmNlIGEgbG9jYXRpb24gY29udGFpbmluZyBleGVjdXRhYmxlDQo+IGNvbnRlbnQNCj4gKDUp IHRoZSBBZGRpdGlvbmFsRGF0YSBjbGFzcyB3aGljaCBjb250YWluIHByZXR0eSBtdWNoIGFueXRo aW5nDQo+IA0KPiAoMSkgLSAoNCkgYXJlIHBsYWNlcyBpbiB0aGUgZGF0YSBtb2RlbCB3aGVyZSBi aW5hcnkgYmxvYnMgb3IgdGV4dCBzY3JpcHRzIGNvdWxkDQo+IGJlIGluc2VydGVkIGJ5IGRlc2ln bi4gIFdpdGggKDUpLCB0aGlzIGlzIGEgYW4gZXh0ZW5zaW9uIG9uIHdoaWNoIHRoZXJlIGFyZSBu bw0KPiBjb25zdHJhaW50cy4gIFRlY2huaWNhbGx5LCBleGVjdXRhYmxlIGNvbnRlbnQgYWxzbyBi ZSBwdXQgaW50byBhbnkgb2YgdGhlDQo+IGNsYXNzZXMgYnV0IHRoZSBwYXJzZXIgaXMgdW5saWtl bHkgdG8gcmVhZCB0aGVtIGFzIHN1Y2guDQo+IA0KPiBDbGFyaWZ5aW5nIGxhbmd1YWdlIHJlZmVy ZW5jaW5nIHRoZXNlIGNsYXNzZXMgY2FuIGJlIGFkZGVkIHRvIHRoZSBzZWN1cml0eQ0KPiBjb25z aWRlcmF0aW9ucy4NCg0KVGhlIHVwZGF0ZWQgdGV4dCBpbiAtMjMgcmVhZHMgYXMgZm9sbG93czoN Cg0KOS4xLiAgU2VjdXJpdHkNCltzbmlwXQ0KICAgRXhlY3V0YWJsZSBjb250ZW50IG9mIHZhcmlv dXMgZm9ybXMgY291bGQgYmUgZW1iZWRkZWQgaW50byB0aGUgSU9ERUYNCiAgIGRvY3VtZW50IGRp cmVjdGx5IG9yIHRocm91Z2ggYW4gZXh0ZW5zaW9uLiAgSW1wbGVtZW50YXRpb24gTVVTVA0KICAg aGFuZGxlIHRoaXMgY29udGVudCB3aXRoIGNhcmUgdG8gcHJldmVudCB1bmludGVudGlvbmFsIGF1 dG9tYXRlZA0KICAgZXhlY3V0aW9uLiAgVGhlIGZvbGxvd2luZyBjbGFzc2VzIGFyZSBleHBsaWNp dGx5IGludGVuZGVkIHRvDQogICByZXByZXNlbnQgY29udGVudCB0aGF0IG1pZ2h0IGJlIGV4ZWN1 dGFibGU6DQoNCiAgIG8gIEFsbCBjbGFzc2VzIG9mIHR5cGUgaW9kZWY6RXh0ZW5zaW9uVHlwZSBh bmQgdGhlIFJlY29yZFBhdHRlcm4NCiAgICAgIGNsYXNzIGNhbiByZXByZXNlbnQgYXJiaXRyYXJ5 IGJpbmFyeSBzdHJpbmdzIHN1Y2ggYXMgbGVnaXRpbWF0ZQ0KICAgICAgc29mdHdhcmUgcHJvZ3Jh bXMgb3IgbWFsd2FyZS4NCg0KICAgbyAgVGhlIEVtYWlsTWVzc2FnZSBhbmQgRW1haWxCb2R5IGNs YXNzZXMgY2FuIHJlcHJlc2VudCBlbWFpbA0KICAgICAgYXR0YWNobWVudHMgdGhhdCBjYW4gY29u dGFpbiBhcmJpdHJhcnkgY29udGVudC4NCg0KICAgbyAgVGhlIERldGVjdGlvblBhdHRlcm4gY2xh c3MgY291bGQgc3BlY2lmeSBhIG1hY2hpbmUtcmVhZGFibGUNCiAgICAgIGNvbmZpZ3VyYXRpb24g dGhhdCBkaXJlY3RzIHRoZSBleGVjdXRpb24gb2YgdGhlIGNvcnJlc3BvbmRpbmcNCiAgICAgIHRv b2wuDQoNCj4gPiAzKSBUaGVyZSBhcmUgc2V2ZXJhbCBmaWVsZHMgdGhhdCBhcmUgY2hhcmFjdGVy aXplZCBhcyAibWVhbmluZ2Z1bCB0bw0KPiA+IHRoZSBzZW5kZXIgYW5kIHJlY2lwaWVudCIuIFRo aXMgaW1wbGllcyB0aGF0IHRoZSBkb2N1bWVudCBjYW5ub3QgYmUNCj4gPiBpbnRlcnByZXRlZCBv dXRzaWRlIHNvbWUgb3V0LW9mLWJhbmQgcHJpb3IgYXJyYW5nZW1lbnQgZGVmaW5pbmcgdGhlDQo+ ID4gY29udGV4dCBpbiB3aGljaCB0aG9zZSBmaWVsZHMgYXJlIG1lYW5pbmdmdWwuIFRoZSBkb2N1 bWVudCBzaG91bGQNCj4gPiBleHBsaWNpdGx5IG1lbnRpb24gdGhlIG5lZWQgZm9yIHN1Y2ggcHJp b3IgYXJyYW5nZW1lbnRzIGluIHRoZQ0KPiA+IFNlY3VyaXR5IENvbnNpZGVyYXRpb24gc2VjdGlv biwgYW5kIG5vdGUgdGhlIGRhbmdlciBvZiBhdHRlbXB0aW5nIHRvDQo+ID4gaW50ZXJwcmV0IHRo b3NlIGZpZWxkcyBpZiB0aGUgYWJpbGl0eSB0byBlbnN1cmUgdGhlIG1lc3NhZ2UgZmFsbHMNCj4g PiB3aXRoaW4gdGhhdCBwcmUtYXJyYW5nZWQgY29udGV4dCBpcyBzdXNwZWN0LiBUaGUgZXhpc3Rp bmcgdGV4dCBhcm91bmQNCj4gPiBlbnN1cmluZyBwcm9wZXIgYXV0aGVudGljYXRpb24gb2YgdGhl IHNlbmRlciBhbmQgcmVjaXBpZW50IGlzIGEgc3RhcnQsDQo+ID4gYnV0IGlzIG5vdCBzdWZmaWNp ZW50LiBXaGlsZSBjb25zaWRlcmluZyB0aGUgcHJvYmxlbXMgd2l0aA0KPiA+IGludGVycHJldGlu ZyB0aGVzZSBmaWVsZHMgaW4gdGhlIHdyb25nIGNvbnRleHQsIHRoZSBkb2N1bWVudCBzaG91bGQN Cj4gPiByZWNvZ25pemUgdGhlIHBvc3NpYmlsaXR5IHRoYXQgYSBnaXZlbiBzZW5kZXIvcmVjaXBp ZW50IHBhaXIgbWlnaHQNCj4gPiBoYXZlIF90d28gZGlmZmVyZW50XyBhcnJhbmdlbWVudHMgYWJv dXQgd2hhdCB0aGVzZSBmaWVsZHMgbWVhbiwNCj4gZXNwZWNpYWxseSBnaXZlbiB0aGUgcGFzc2Fn ZSBvZiBzdWZmaWNpZW50IHRpbWUuDQo+IA0KPiBBZ3JlZWQuICBUaGVyZSBuZWVkcyB0byBiZSBs YW5ndWFnZSBhZGRlZCB0byB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgdG8NCj4gZGlzY3Vz cyBwcm9maWxpbmcgYW5kIG91dC1vZi1iYW5kIGFycmFuZ2VtZW50cy4gIEluIHNjYW5uaW5nIHRo cm91Z2ggdGhlDQo+IGRvY3VtZW50LCBEZWZpbmVkQ09BLCBpcyBvbmUgb2YgdGhvc2UuICBXaGF0 IGFyZSB0aGUgb3RoZXIgZmllbGRzIHlvdQ0KPiBjYXVnaHQ/DQoNClRoZSB1cGRhdGVkIHRleHQg aW4gLTIzIHJlYWRzIGFzIGZvbGxvd3M6DQoNCjkuMS4gIFNlY3VyaXR5DQpbc25pcF0NCiAgIENl cnRhaW4gY2xhc3NlcyBtYXkgcmVxdWlyZSBvdXQtb2YtYmFuZCBjb29yZGluYXRpb24gdG8gYWdy ZWUgdXBvbg0KICAgdGhlaXIgc2VtYW50aWNzIChlLmcuLCBDb25maWRlbmNlQHJhdGluZz0ibG93 IiBvciBEZWZpbmVkQ09BKS4gIFRoaXMNCiAgIGNvb3JkaW5hdGlvbiBNVVNUIG9jY3VyIHByaW9y IHRvIG9wZXJhdGlvbmFsIGRhdGEgZXhjaGFuZ2UgdG8gcHJldmVudA0KICAgdGhlIGluY29ycmVj dCBpbnRlcnByZXRhdGlvbiBvZiB0aGVzZSBzZWxlY3QgZGF0YSBlbGVtZW50cy4gIFdoZW4NCiAg IHBhcnNpbmcgdGhlc2UgZGF0YSBlbGVtZW50cywgaW1wbGVtZW50YXRpb25zIHNob3VsZCB2YWxp ZGF0ZSwgd2hlbg0KICAgcG9zc2libGUsIHRoYXQgdGhleSBjb25mb3JtIHRvIHRoZSBhZ3JlZWQg dXBvbiBzZW1hbnRpY3MuICBUaGVzZQ0KICAgc2VtYW50aWNzIG1heSBuZWVkIHRvIGJlIHBlcmlv ZGljYWxseSByZWV2YWx1YXRlZC4NCg0KPiA+IE5pdHM6DQo+ID4NCj4gPiBBKSBTZWN0aW9uIDIu MTEgY2FsbHMgb3V0IHRvIFJGQzQ1MTkgdG8gZGVmaW5lZCB0aGUgc3ludGF4IG9mDQo+ID4gdGVs ZXBob25lIG51bWJlcnMuICBUaGUgZG9jdW1lbnQgY2FsbHMgb3V0IHRvIEUuMTIzLCB3aGljaCBw cm92aWRlcw0KPiA+IGd1aWRlbGluZXMgZm9yIHJlcHJlc2VudGluZyBwaG9uZSBudW1iZXJzIGJ1 dCBkb2VzIG5vdCBkZWZpbmUgYQ0KPiA+IHJpZ29yb3VzIGZvcm1hdCB1c2VmdWwgZm9yIGEgcHJv dG9jb2wgZmllbGQuICBJZiBpdCdzIGltcG9ydGFudCB0bw0KPiA+IGV4Y2hhbmdlIHBob25lIG51 bWJlcnMgaW4gYW4gaW50ZXJvcGVyYWJsZSB3YXksIGNvbnNpZGVyIHBvaW50aW5nIHRvDQo+IHNv bWV0aGluZyB3aXRoIG1vcmUgc3RydWN0dXJlLg0KPiA+IERvIHlvdQ0KPiA+IHdhbnQgdGhlIHN0 cmluZyB0byBjb25mb3JtIHRvIEUuMTY0PyAgV291bGQgaXQgYmUgdXNlZnVsIHRvIGhhdmUNCj4g PiBzb21ldGhpbmcgYXMgc3RydWN0dXJlZCBhcyBhIHRlbDogVVJJPw0KDQpUaGUgdXBkYXRlZCB0 ZXh0IGluIC0yMyByZWFkcyBhcyBmb2xsb3dzOg0KDQoyLjExLiAgVGVsZXBob25lIE51bWJlcg0K DQogICBBIHRlbGVwaG9uZSBudW1iZXIgaXMgcmVwcmVzZW50ZWQgaW4gdGhlIGluZm9ybWF0aW9u IG1vZGVsIGJ5IHRoZQ0KICAgUEhPTkUgZGF0YSB0eXBlLiAgVGhlIGZvcm1hdCBvZiB0aGUgUEhP TkUgZGF0YSB0eXBlIGlzIGRvY3VtZW50ZWQgaW4NCiAgIFtFLjE2NF0uDQoNCiAgIFtFLjE2NF0g ICAgSVRVIFRlbGVjb21tdW5pY2F0aW9uIFN0YW5kYXJkaXphdGlvbiBTZWN0b3IsICJUaGUNCiAg ICAgICAgICAgICAgSW50ZXJuYXRpb25hbCBQdWJsaWMgVGVsZWNvbW11bmljYXRpb24gTnVtYmVy aW5nIFBsYW4iLA0KICAgICAgICAgICAgICBJVFUtVCBSZWNvbW1lbmRhdGlvbiBFLjE2NCAoMDIv MDUpLCBGZWJydWFyeSAyMDA1Lg0KDQo+ID4gQikgU2VjdGlvbiA0LjEgc2F5cyBhIGNoYXJhY3Rl ciBlbmNvZGluZyBNVVNUIGJlIGV4cGxpY2l0bHkgc3BlY2lmaWVkLA0KPiA+IGJ1dCB0aGVuIGlt bWVkaWF0ZWx5IHNob3dzIGFuIGV4YW1wbGUgb2YgYSBkb2N1bWVudCB3aXRoIG5vIGNoYXJhY3Rl cg0KPiA+IGVuY29kaW5nLi4uDQo+IA0KPiBHb29kIHBvaW50LiAgVGhhdCB3aWxsIGJlIGZpeGVk LiAgVXBvbiBmdXJ0aGVyIHJldmlldywgdGhlIGV4YW1wbGUgd2l0aCBubw0KPiBlbmNvZGluZyBh bHNvIGRvZXNuJ3QgbWFrZSBzZW5zZSBnaXZlbiB0aGUgTVVTVCBhYm92ZSBpbiB0aGUgdGV4dCBz YXlpbmcgaXQNCj4gYWx3YXlzIG5lZWRzIHRvIGJlIHNwZWNpZmllZC4gIFRoZSB0d28gZXhhbXBs ZXMgaW4gdGhpcyBzZWN0aW9uIGFyZSBmcm9tDQo+IFJGQzUwNzAgYnV0IHRoZXkgZG9uJ3QgYWxp Z24gd2l0aCB0aGUgdGV4dCB1cGRhdGVkIGluIHRoaXMgZHJhZnQuDQoNClRoZSB1cGRhdGVkIHRl eHQgaW4gLTIzIHJlYWRzIGFzIGZvbGxvd3M6DQoNCjQuMS4gIEVuY29kaW5nDQoNCiAgIEV2ZXJ5 IElPREVGIGRvY3VtZW50IE1VU1QgYmVnaW4gd2l0aCBhbiBYTUwgZGVjbGFyYXRpb24gYW5kIE1V U1QNCiAgIHNwZWNpZnkgdGhlIFhNTCB2ZXJzaW9uIHVzZWQuICBUaGUgY2hhcmFjdGVyIGVuY29k aW5nIE1VU1QgYWxzbyBiZQ0KICAgZXhwbGljaXRseSBzcGVjaWZpZWQuICBVVEYtOCBbUkZDMzYy OV0gU0hPVUxEIGJlIHVzZWQgdW5sZXNzIFVURi0xNg0KICAgW1JGQzI3ODFdIGlzIG5lY2Vzc2Fy eS4gIEVuY29kaW5ncyBvdGhlciB0aGFuIFVURi04IGFuZCBVVEYtMTYgU0hPVUxEDQogICBOT1Qg YmUgdXNlZC4gIFRoZSBJT0RFRiBjb25mb3JtcyB0byBhbGwgWE1MIGRhdGEgZW5jb2RpbmcgY29u dmVudGlvbnMNCiAgIGFuZCBjb25zdHJhaW50cy4NCg0KICAgVGhlIFhNTCBkZWNsYXJhdGlvbiB3 aXRoIFVURi04IGNoYXJhY3RlciBlbmNvZGluZyB3aWxsIHJlYWQgYXMNCiAgIGZvbGxvd3M6DQoN CiAgIDw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiA/Pg0KDQo+ID4gQykgKG1p Y3Jvbml0KSBUaGUgdXNlIG9mIFtSRkMtRU5VTV0gYXMgYSByZWZlcmVuY2UgbnVtYmVyIGlzIGRp c3RyYWN0aW5nLg0KPiA+IFBsZWFzZSBjaGFuZ2UgdGhlIHJlZmVyZW5jZSB0YWcgdG8gW1JGQzc0 OTVdLg0KDQpUaGUgdXBkYXRlZCB0ZXh0IGluIC0yMyByZWFkcyBhcyBmb2xsb3dzOg0KDQogICBb UkZDNzQ5NV0gIE1vbnR2aWxsZSwgQS4gYW5kIEQuIEJsYWNrLCAiSU9ERUYgRW51bWVyYXRpb24g UmVmZXJlbmNlDQogICAgICAgICAgICAgIEZvcm1hdCIsIFJGQyA3NDk1LCBKYW51YXJ5IDIwMTUu DQoNClRoYW5rcyBhZ2FpbiBmb3IgeW91ciBkZXRhaWxlZCByZXZpZXcuDQoNClJvbWFuDQo= From nobody Mon Jun 20 07:21:56 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D4A612D0DD; Mon, 20 Jun 2016 07:21:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pUgqFkV4KocG; Mon, 20 Jun 2016 07:21:38 -0700 (PDT) Received: from shetland.sei.cmu.edu (shetland.sei.cmu.edu [192.58.107.44]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B62E12D113; Mon, 20 Jun 2016 07:21:38 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by shetland.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KELb88025354; Mon, 20 Jun 2016 10:21:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1466432497; bh=TCrX4etbnuGhSdLa0Cxm3g/aNAsefcAxGXcIW1XKa1Y=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=YuQ8uuht4GPpc+qqZnJpuu9vWowxBOP0NV+MRjRZSi73bnrI6LNQBZ1I74D3BkTUv 5KfuMmUH8NSyPuPQ2cf5+M1zuME5KNweEN65sbYUsZeZu0WCB5PS0T54YHjAaHljw8 pgpGhwlnxLfKdfKrJ2RJ1eNrFxqNjSk7KriaqrUo= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KELbeB004373; Mon, 20 Jun 2016 10:21:37 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0279.002; Mon, 20 Jun 2016 10:21:36 -0400 From: "Roman D. Danyliw" To: Alexey Melnikov , Robert Sparks Thread-Topic: [mile] Secdir review: draft-ietf-mile-5070-bis-22 Thread-Index: AQHRuqVpyhJwvFfMKk6M7OkSPkYlWZ/VizoAgACacYD///tLAIAAWNWAgBwMt4A= Date: Mon, 20 Jun 2016 14:21:36 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD976680D@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> <574FF391.6000806@isode.com> <359EC4B99E040048A7131E0F4E113AFCD9750115@marathon> <1464875555.1299466.625917257.2D46286E@webmail.messagingengine.com> In-Reply-To: <1464875555.1299466.625917257.2D46286E@webmail.messagingengine.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "mile@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 14:21:40 -0000 Hello! > -----Original Message----- > From: Alexey Melnikov [mailto:alexey.melnikov@isode.com] > Sent: Thursday, June 02, 2016 9:53 AM > To: Roman D. Danyliw ; Robert Sparks > > Cc: mile@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf.org; iesg@ietf.or= g; > secdir@ietf.org > Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22 >=20 > Hi, >=20 > On Thu, Jun 2, 2016, at 01:49 PM, Roman D. Danyliw wrote: > > Hi Alexey! > > > > > -----Original Message----- > > > From: Alexey Melnikov [mailto:alexey.melnikov@isode.com] > > > Sent: Thursday, June 02, 2016 4:51 AM > > > To: Roman D. Danyliw ; Robert Sparks > > > > > > Cc: mile@ietf.org; draft-ietf-mile-rfc5070-bis.all@ietf.org; > > > iesg@ietf.org; secdir@ietf.org > > > Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22 > > > > > > Hi Roman, > > > > > > On 02/06/2016 06:03, Roman D. Danyliw wrote: > > > > Hello Robert! > > > > > > > > Thanks again for this review. Comments are inline ... > > > > > > > >> -----Original Message----- > > > >> From: Robert Sparks [mailto:rjsparks@nostrum.com] > > > >> Sent: Monday, May 30, 2016 2:44 PM > > > >> To: secdir@ietf.org; iesg@ietf.org; > > > >> draft-ietf-mile-rfc5070-bis.all@ietf.org > > > >> Subject: Secdir review: draft-ietf-mile-5070-bis-22 > > > > [snip] > > > > > > Consideration #3 > > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > > > > > > As Robert suggests, minimally, there needs to be a discussion in > > > > the > > > security considerations on how these new enum values will securely > > > be added to the schema/parser. However, the question remains, what > > > guidance do we provide about how often the IANA registry should be > > > checked. > > > > > > > > ---[ begin Section 4.3]--- > > > > Furthermore, the > > > > enumerated values present in this document are a static list th= at > > > > will be incomplete over time as select attributes can be extend= ed by > > > > a corresponding IANA registry per Section 10.2. Therefore, the > > > > schema to validate a given document MUST be dynamically > generated > > > > from these registry values. > > > > ---[ end Section 4.3 ]--- > > > > > > > > ** Should we modify the last sentence as follows: > > > > > > > > "Therefore, the schema to validate a given document MUST be > > > > periodically > > > regenerated from these registry values. It is RECOMMENDED that this > > > SHOULD NOT occur more frequently than xxx" > > > > > > > > Kathleen/Alexey/or any reader of this note: do you have a pointer > > > > to the > > > prior discussion on dynamically generating a schema from an IANA > > > registry referenced by Robert so that "xxx" can be populated? > > > I have no idea about reasonable "xxx" values. This was never done > before. > > > (When it was suggested before IESG persuaded authors to change their > > > documents.) > > > > Understood. Thanks for channeling the historical wisdom. > > > > > While talking to www.iana.org directly from devices/programs is > > > tempting, it might be better if vendors periodically download new > > > values from IANA and then devices/programs talk to vendor's websites > > > (or use vendor's update mechanisms). > > > > What about language like the following in Section 4.3: > > > > ---[ begin Section 4.3]--- > > > > -- Therefore, the schema to validate a given document MUST > > -- be dynamically generated from these registry values. > > ++ Therefore, IODEF implementations MUST periodically update their > > ++ schema and MAY need to update their parsing algorithms to > > ++ incorporate newly registered values added to the IANA registries > > ++ specified in Section xx. >=20 > I think this is an improvement. But also see Kathleen's reply. The following is the updated text in -23: 4.3. Validation IODEF documents MUST be well-formed XML. It is RECOMMENDED that recipients validate the document against the schema described in Section 8. ... These MUST also be considered by an IODEF implementation. Furthermore, the enumerated values present in this document are a static list that will be incomplete over time as select attributes can be extended by a corresponding IANA registry per Section 10.2. Therefore, IODEF implementations MUST periodically update their schema and MAY need to update their parsing algorithms to incorporate newly registered values. > > ---[ end Section 4.3 ]--- > > > > In addition, add text to the security considerations that this > > updating needs to be done securely. The following text was added in -23: 9.1. Security [snip] Per Section 4.3, IODEF implementations will need to periodically consult the IANA registries specified in Section 10.2 to discover newly registered enumerated attribute values. These implementations MUST communicate with IANA in a way that ensures the integrity of the values and the authenticity of the source. HTTPS over TLS [RFC2818][RFC5246] provides such security. From nobody Mon Jun 20 07:24:33 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6F1912D0DD; Mon, 20 Jun 2016 07:24:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mL2E09oY3Os8; Mon, 20 Jun 2016 07:24:20 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCC35127058; Mon, 20 Jun 2016 07:24:19 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KEOIvi014132; Mon, 20 Jun 2016 10:24:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1466432658; bh=2qbThVtKUK8d5Keh1X/VlEQedH7bMRQJAvlPfpQBTJ8=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=k8x3TkmQNBpTCQKnS8sMcg6e6CrAlV51KjKCbl73/m1FRrt8CmUEkWd6n86DRiGAa G9Kfp0ZOqi1HiBmHPVsKDKCi7wLeyhwUbzjVWMBOF8WmdwVuTv9ltsVzxNbuZ9FoT/ wP85irIVQVfc4n0yUDdM2DXQw585jGrxTuhTp/m0= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by timber.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u5KEOHu2004688; Mon, 20 Jun 2016 10:24:17 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0279.002; Mon, 20 Jun 2016 10:24:16 -0400 From: "Roman D. Danyliw" To: "kathleen.moriarty.ietf@gmail.com" , Alexey Melnikov Thread-Topic: [mile] Secdir review: draft-ietf-mile-5070-bis-22 Thread-Index: AQHRuqVpyhJwvFfMKk6M7OkSPkYlWZ/VizoAgACacYCAADhPgIAcKwUg Date: Mon, 20 Jun 2016 14:24:16 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD9766828@marathon> References: <15b7d5f0-63e9-15b9-b7d5-47a6be10c760@nostrum.com> <359EC4B99E040048A7131E0F4E113AFCD974F81A@marathon> <574FF391.6000806@isode.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "mile@ietf.org" , "secdir@ietf.org" , "draft-ietf-mile-rfc5070-bis.all@ietf.org" , "iesg@ietf.org" Subject: Re: [secdir] [mile] Secdir review: draft-ietf-mile-5070-bis-22 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 14:24:23 -0000 Hello! > -----Original Message----- > From: kathleen.moriarty.ietf@gmail.com > [mailto:kathleen.moriarty.ietf@gmail.com] > Sent: Thursday, June 02, 2016 8:13 AM > To: Alexey Melnikov > Cc: Roman D. Danyliw ; Robert Sparks > ; mile@ietf.org; draft-ietf-mile-rfc5070- > bis.all@ietf.org; iesg@ietf.org; secdir@ietf.org > Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22 >=20 > Hello, >=20 > Thanks Robert for the detailed and helpful review. Inline >=20 > Sent from my iPhone >=20 > > On Jun 2, 2016, at 4:51 AM, Alexey Melnikov > wrote: > > > > Hi Roman, > > > >> On 02/06/2016 06:03, Roman D. Danyliw wrote: > >> Hello Robert! > >> > >> Thanks again for this review. Comments are inline ... > >> > >>> -----Original Message----- > >>> From: Robert Sparks [mailto:rjsparks@nostrum.com] > >>> Sent: Monday, May 30, 2016 2:44 PM > >>> To: secdir@ietf.org; iesg@ietf.org; > >>> draft-ietf-mile-rfc5070-bis.all@ietf.org > >>> Subject: Secdir review: draft-ietf-mile-5070-bis-22 > >>> > >>> I have reviewed this document as part of the security directorate's > >>> ongoing effort to review all IETF documents being processed by the > >>> IESG. These comments were written primarily for the benefit of the > >>> security area directors. Document editors and WG chairs should > >>> treat these comments just like any other last call comments. > >>> > >>> Document : draft-ietf-mile-rfc5070bis-22 > >>> > >>> Summary: This document has minor issues that should be addressed > >>> before publication as Proposed Standard > >>> > >>> This document defines a document format for exchanging information > >>> between operational security teams. It points out standardized > >>> mechanisms for transporting the documents (RFC6545 and RFC6546), to > >>> provide confidentiality, integrity, and authenticity, but does not > >>> restrict the use of the format to within those protocols. Instead, > >>> it provides a generic set of "Processing Considerations" in section > >>> 4, which are augmented by the Security Considerations in section 9. > >>> > >>> There are some minor issues with this approach that should be > >>> addressed before publication. > >>> > >>> 1) The document requires that implementations validate documents > >>> against the schema, and reject any documents that fail validation. > >>> In particular, Section > >>> 5.2 Item 4 requires rejecting documents with an unrecognized element > >>> in a supported namespace as a syntax error. Section 4.3 requires > >>> implementations to > >>> ->dynamically generate the schema used for validation from IANA > >>> registries<-. > >>> Section 5.2 Item 5 calls out that this dynamic generation has > >>> security and performance implications, but does not describe them, > >>> and has a very vague "SHOULD NOT download schemas at runtime" to > >>> guard against them. I seem to recall significant discussion in > >>> other contexts of the issues with generating schema from IANA > >>> registries at runtime. Perhaps the ADs can provide pointers to > >>> material generated from those discussions that the group can referenc= e. > >>> Otherwise, the threats need to be described in more detail, and the > >>> operational complexity of exercising these extension points > >>> (particularly given the requirement to reject documents that do not > >>> validate against the content of the > >>> registries) needs to be spelled out. > >> To this analysis, I'll also add Stephen Farrell's COMMENT > (https://www.ietf.org/mail-archive/web/mile/current/msg01885.html) > against using validation and the security issues when checking the IANA > registry; and that Alexey Melnikov has marked this issue as a DISCUSS > (https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/ballot/). > >> > >> To the WG: > >> > >> Consideration #1 > >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >> > >> ---[ begin Item #4 of Section 5.2 ]--- > >> 4. Implementations that encounter an unrecognized element in a > >> supported namespace MUST reject the document as a syntax error. > >> ---[ end Item #4 of Section 5.2 ]--- > >> > >> ** Do we want to weaken the validation requirement in Item #4 of > Section 5.2 from MUST to MAY? > >> > >> IMO, this is a straightforward change that will provide more flexibili= ty for > implementations to process even non-conforming documents. > > I don't mind, but I can also live with SHOULD here. >=20 > Agreed, SHOULD is a bit stronger. >=20 > >> One minor concern here is that this may now lead to non-standard > extensions. > >> The text in -23 was updated as follows: 5.2. Extending Classes [snip] 4. Implementations that encounter an unrecognized element, attribute or attribute value in a supported namespace SHOULD reject the document as a syntax error. > >> Consideration #2 > >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >> Item #5 of Section 5.2 cautions against dynamically regenerating the > schema from registry values at run-time; but also from downloading the ba= se > schema then too. > >> > >> ---[ begin Item #5 of Section 5.2 ]--- > >> 5. There are security and performance implications in requiring > >> implementations to dynamically download schemas at run time. > >> Therefore, implementations SHOULD NOT download schemas at > runtime > >> unless the appropriate precautions are taken. Implementations > >> also need to contend with the potential of significant network > >> and processing issues. > >> ---[ end Item #5 of Section 5.2 ]--- > >> > >> ** Do we want to strengthen the caution of not downloading the schema > in real-time in Item #5 of Section 5.2 from SHOULD NOT to MUST NOT? > >> > >> IMO, yes. > > Yes. >=20 > Yes The text in -23 was updated as follows: 5. There are security and performance implications in requiring implementations to dynamically download schemas at run time. Therefore, implementations MUST NOT download schemas at runtime unless the appropriate precautions are taken. Implementations also need to contend with the potential of significant network and processing issues. Roman From nobody Mon Jun 20 08:01:32 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BEB9F12D86D; Fri, 17 Jun 2016 09:26:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1466180772; bh=dOGaclj1lk45Rr+okefZCuwz4WoL1Z8hdPtdZIlJQYs=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=omDHpvyJnOIiEAqDqz53jy8GSsBcAL4AF7+yYOroOt649Qi45Zm25n9a8oKEJvz7h NQWfE0tKEOXVlZZ8270xY89J2FyJdIWRE9Jz7HbnbfQbiwu3u9VEMvvYbfEzIgIk9v 0RdFDQASc+87WcbEhy/MRRDR2IY7m6AvFoKO+En4= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A89D12D84A for ; Fri, 17 Jun 2016 09:26:07 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.23.0 Auto-Submitted: auto-generated Precedence: bulk Reply_to: Message-ID: <20160617162607.9770.52383.idtracker@ietfa.amsl.com> Date: Fri, 17 Jun 2016 09:26:07 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 20 Jun 2016 08:01:30 -0700 Subject: [secdir] [new-work] WG Review: Meeting Venue (mtgvenue) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 16:26:13 -0000 A new IETF WG has been proposed in the General Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2016-06-27. Meeting Venue (mtgvenue) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: TBD Assigned Area Director: Jari Arkko General Area Directors: Jari Arkko Mailing list: Address: mtgvenue@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/mtgvenue Archive: https://mailarchive.ietf.org/arch/search/?email_list=mtgvenue Charter: https://datatracker.ietf.org/doc/charter-ietf-mtgvenue/ The selection of meeting venues for our physical meetings is a common area of discussion at the IETF and feedback for the IAOC and its meeting committee. A specification of the venue selection process and criteria would be useful. With community discussion and agreement such a specification will be very helpful in improving the process and ensuring that the relevant criteria are properly identified. The discussion itself may also be helpful. For instance, due to recent discussions, potential future destinations are announced to the community to help identify potential issues early. These processes and criteria support the overall IETF meeting strategy. The IETF complements its mostly online work with three physical meetings each year, obviously for the purpose of the standards development work but also for the opportunities for high-bandwidth collaboration, cross-pollination of ideas, and focusing on running code. Existing geographic distribution policy explicitly calls for rotating meeting locations equally among the largest sources of IETF attendees, previously defined as North America, Europe, and Asia, while reserving a possibility for exceptions. The exceptions are, for instance, meetings outside those regions. The rationale is to meet in different geographic regions in order to spread the difficulty and cost of travel among the attendees. The rotation policy, known as the 1-1-1-* model -- with the asterisk denoting the exceptions -- was set by the IESG, documented in https://iaoc.ietf.org/minutes/2010-11-10-iaoc-minutes.txt. The MTGVENUE working group is the forum where the IETF community can discuss and agree on what should go into the policies, the selection process, and the detailed criteria going forward. All criteria and all other aspects of the process are open for discussion. The purpose of the working group is to produce a community consensus document(s) that help drive the meeting selection process in a manner that the community is comfortable with. The working group shall produce guidance on two areas: 1. A specification of the geographic IETF meeting policy, currently described as the "1-1-1-*" policy. The policy going forward is up to the working group. 2. A specification that describes the detailed meeting venue selection process and criteria, the contents of which are also up to the working group. The specification(s) are expected to be Best Current Practice (BCP) documents. The specifications are expected to provide clear guidance to meeting selections, be implementable in our operating environment, and take into account the needs of the highly diverse IETF community. Milestones: Mar 2016 - Initial individual draft on venue selection process and criteria Jul 2016 - Initial individual draft on IETF meeting geographic distribution policy Nov 2016 - Submission of the final working group draft on IETF meeting geographic distribution policy to the IESG Feb 2017 - Submission of the final working group draft on venue selection process and criteria to the IESG _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Mon Jun 20 08:01:35 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5225412D880; Fri, 17 Jun 2016 09:33:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1466181224; bh=N3kE1FxvgcfngDID7zbdo6z4CvpsorEHcnEXIG0kB5o=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=R6bK0p4IZGMZ/jUFpd2FMWBbKuf4V7YR5UK4tWVX4zpib6spE6/1ubsnRZURnQUl+ 89DchSSGHLaUJTtkJ5WtbR3fayZLTl3I4gKIu7nQe+tVN+JjIXfXF63fNyueXaZcID WJTyiPcGwbs4cXdAe5sFQksF7NeBJFujKjUaLyhY= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E790112D85E for ; Fri, 17 Jun 2016 09:33:37 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.23.0 Auto-Submitted: auto-generated Precedence: bulk Reply_to: Message-ID: <20160617163337.9633.39753.idtracker@ietfa.amsl.com> Date: Fri, 17 Jun 2016 09:33:37 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 20 Jun 2016 08:01:30 -0700 Subject: [secdir] [new-work] WG Review: Some PKIX and SMIME (spasm) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 16:33:44 -0000 A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2016-06-27. Some PKIX and SMIME (spasm) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: TBD Assigned Area Director: Stephen Farrell Security Area Directors: Stephen Farrell Kathleen Moriarty Mailing list: Address: spasm@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/spasm Archive: https://www.ietf.org/mail-archive/web/spasm/ Charter: https://datatracker.ietf.org/doc/charter-ietf-spasm/ The PKIX and S/MIME Working Groups have been closed for some time. Some updates have been proposed to the X.509 certificate documents produced by the PKIX Working Group and the electronic mail security documents produced by the S/MIME Working Group. The SPASM (Some PKIX and S/MIME) Working Group is chartered to make updates where there is a known constituency interested in real deployment and there is at least one sufficiently well specified approach to the update so that the working group can sensibly evaluate whether to adopt a proposal. The current charter encompasses updates to satisfy the following needs: 1. Specify the way to include an i18n email address as a subject alternative name and an issuer alternative name. draft-melnikov-spasm-eai-addresses is a proposal in this space. 2. Specify the way to use authenticated encryption in S/MIME. draft-schaad-rfc5751-bis is a proposal in this space. In addition, the SPASM Working Group may investigate other updates to the documents produced by the PKIX and S/MIME Working Groups, but the SPASM Working Group shall not adopt any of these potential work items without rechartering. No such re-chartering is envisaged until one or more of the above work items have been successfully delivered to the RFC editor queue. Milestones: TBD _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Mon Jun 20 08:01:39 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CE8F12D966; Fri, 17 Jun 2016 11:16:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1466187383; bh=35M0y5tP+Dtve28Q6JJNPvBlsB/sKA6LAMGWEz5RzsQ=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=x0DP0tnP1vags4HlvMyoE9lH5v5Im6BOfW6FUCEc4dtILrqLIF+FSXF8cOJRAFhWo y8+uUtkjCsgOkjvD89XxvWPcJaUKj+I1z0cGk5PO+2z/0u8YDG1jWLTBIqsqGMS0Dk xRrpwVHvbrX89Y3eIEdEx8gfOIw4n/loOaiHUE40= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C8F712D95F for ; Fri, 17 Jun 2016 11:16:17 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.23.0 Auto-Submitted: auto-generated Precedence: bulk Reply_to: Message-ID: <20160617181617.9703.28986.idtracker@ietfa.amsl.com> Date: Fri, 17 Jun 2016 11:16:17 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 20 Jun 2016 08:01:30 -0700 Subject: [secdir] [new-work] WG Review: SIP Best-practice Recommendations Against Network Dangers to privacY (sipbrandy) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jun 2016 18:16:23 -0000 A new IETF WG has been proposed in the Applications and Real-Time Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2016-06-27. SIP Best-practice Recommendations Against Network Dangers to privacY (sipbrandy) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Gonzalo Camarillo Assigned Area Director: Ben Campbell Applications and Real-Time Area Directors: Ben Campbell Alissa Cooper Alexey Melnikov Mailing list: TBD Charter: https://datatracker.ietf.org/doc/charter-ietf-sipbrandy/ SIP with the SDP Offer/Answer model, along with RTP are widely used in modern communications networks. But while secure RTP (SRTP) is available to provide integrity and privacy protection to such communication, it is rarely used end-to-end. This lack is due to several factors, notably the pervasive use of signaling and media intermediaries in such networks and the difficulties involved in deployment of strong identity mechanisms for SIP. These factors are complicated by the fact that there are several incompatible approaches to SRTP key exchange. The current situation is unacceptable in the face of pervasive monitoring, which RFC 7258 describes as "an attack on privacy". In addition, the STIR working group is, at the time of this writing, revising RFC 4744 to make strong identity attestations for SIP easier to deploy. This gives the IETF an opportunity to define best practices to improve privacy protections for users of SIP based communication, in ways that improve upon the status-quo. Objectives: The SIPBRANDY working group will define best practices for establishing two-party, SIP-signaled SRTP sessions with end-to-end security associations, including a single, preferred SRTP key exchange mechanism. These practices are expected to be deployable across typical SIP networks, without the sharing of SRTP keying material with intermediaries or third parties. These practices should protect against man-in-the-middle attacks. While confidentiality is the first priority of the working group, it may work on aligning these practices with WebRTC, for example by defining best practices for ensuring recipients of media flows have indicated the desire to receive them, in order to prevent or mitigate the denial-of-service attack described in RFC 5245, section 18.5.1. Likewise, the WG may consider compatibility with aspects of PERC. The working group will additionally coordinate with the MMUSIC working group to define opportunistic security [RFC 7435] for SIP-signaled media sessions for situations where strong protections are not necessary or not feasible. Non-Goals: The working group is not expected to define practices for multi-party session topologies, especially those involving media distribution devices. The working group is not expected to define new protocols or modify existing ones; rather it will define practices for using existing protocols. If the working group discovers gaps that require creation or modification protocols, it will forward those gaps to the appropriate working groups. Inputs and Collaboration: The WG will consider draft-peterson-dispatch-rtpsec and draft-johnston-dispatch-osrtp as input to the work. The WG is expected to collaborate closely with SIPCORE, AVTCORE, STIR, MMUSIC, RTCWEB, PERC, and possibly DISPATCH. Milestones: Aug 2016 - Draft Adoption - Best Practices for end-to-end SRTP Nov 2016 - Draft Adoption - Best Practices for Opportunistic SRTP Mar 2017 - Submit End-to-End SRTP draft to the IESG for consideration as BGP Mar 2017 - Inform MMUSIC or other appropriate WGs of any changes needed to support Opportunistic SRTP (Not expected to be published as an RFC) Nov 2017 - Submit Opportunistic SRTP draft to IESG for consideration as BGP _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Mon Jun 20 09:26:31 2016 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EC91212D74A; Mon, 20 Jun 2016 09:21:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1466439689; bh=AnOq4vF2xbzUyjofx7k1T2/YaRBPc7N6Wthaoz7K6Qw=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=e/Q7djhgrJ6UyPfrf0ir4eGNw8xuwUFE952VIMXMGwb+kXjvkUmWPOrIv9Dmp7b0R wKZUzul4I94C+Bk+tXVLvMpJP6VDjORyQ/Ek4OvJ9Jq3/Rqw01TKd5hU+QdVXiXVva cJ2Cd9j9E7K6wLVeeUZTk16OHV4lr2SFwnDwZwcc= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 40CCD12D62F for ; Mon, 20 Jun 2016 09:21:21 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.23.0 Auto-Submitted: auto-generated Precedence: bulk Reply_to: Message-ID: <20160620162121.30135.40835.idtracker@ietfa.amsl.com> Date: Mon, 20 Jun 2016 09:21:21 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.17 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 20 Jun 2016 09:26:31 -0700 Subject: [secdir] [new-work] WG Review: Mobile Ad-hoc Networks (manet) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jun 2016 16:21:29 -0000 The Mobile Ad-hoc Networks (manet) WG in the Routing Area of the IETF is undergoing rechartering. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2016-06-30. Mobile Ad-hoc Networks (manet) ----------------------------------------------------------------------- Current status: Active WG Chairs: Stan Ratliff Justin Dean Secretaries: Ulrich Herberg Assigned Area Director: Alvaro Retana Routing Area Directors: Alia Atlas Alvaro Retana Deborah Brungard Mailing list: Address: manet@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/manet Archive: https://mailarchive.ietf.org/arch/browse/manet/ Charter: https://datatracker.ietf.org/doc/charter-ietf-manet/ The purpose of the MANET working group is to standardize IP routing protocol functionality suitable for wireless routing applications within both static and dynamic topologies with increased dynamics due to node motion or other factors. Approaches are intended to be relatively lightweight in nature, suitable for multiple hardware and wireless environments, and address scenarios where MANETs are deployed at the edges of an IP infrastructure. Hybrid mesh infrastructures (e.g., a mixture of fixed and mobile routers) should also be supported by MANET specifications and management features. When routing devices rely on modems to effect communications over wireless links, they need timely and accurate knowledge of the characteristics of the link (speed, state, etc.) in order to make routing decisions. In mobile or other environments where these characteristics change frequently, manual configurations or the inference of state through routing or transport protocols does not allow the router to make the best decisions. The WG will put special attention on the standardization of a bidirectional, dynamic link exchange protocol (DLEP) between the router and the modem. The MANET WG will coordinate with other Working Groups, such as the pim WG for multicast support, and the Routing Area WG (rtgwg), OSPF WG and Babel WG on the general use of DLEP. The MANET WG is responsible for the maintenance of OLSRv2 [RFC 7181], NHDP [RFC 6130] and the Generalized MANET Packet/Message Format [RFC5444], and their extensions. Work Items: - Develop a dynamic link exchange protocol (DLEP). - DLEP extension to provide a credit-windowing scheme for destination-specific flow control. - DLEP extensions for reporting statistics by traffic classification. - Multicast MANET protocol framework based on Simplified Multicast Forwarding [RFC 6621] for scoped forwarding within MANET networks. As part of this framework the WG will produce a well defined MANET multicast forwarding information base (FIB). - Document outlining challenges and best practices for deploying and managing MANET networks. Milestones: Nov 2016 - MANET Management Document (Informational) Nov 2016 - DLEP Credit Windowing Extensions (Standards Track) Nov 2016 - DLEP (Standards Track) Jul 2017 - DLEP traffic extensions (Standards Track) Nov 2017 - Multicast FIB (Standards Track) _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Tue Jun 21 14:54:37 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60CB512DE46 for ; Tue, 21 Jun 2016 14:54:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.325 X-Spam-Level: X-Spam-Status: No, score=-3.325 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 383EM-LFr-Fs for ; Tue, 21 Jun 2016 14:54:34 -0700 (PDT) Received: from gw01.ehlo.wurstkaes.de (gw01.ehlo.wurstkaes.de [IPv6:2a02:a00:e000:116::41]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F67012DA49 for ; Tue, 21 Jun 2016 14:54:33 -0700 (PDT) Received: from sebi by gw01.ehlo.wurstkaes.de with local (Exim 4.80) (envelope-from ) id 1bFTcq-0001OC-5z; Tue, 21 Jun 2016 23:54:28 +0200 Date: Tue, 21 Jun 2016 23:54:28 +0200 From: Sebastian Kiesel To: "Klaas Wierenga (kwiereng)" Message-ID: <20160621215428.GA3915@gw01.ehlo.wurstkaes.de> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Accept-Languages: en, de Organization: my personal mail account User-Agent: Mutt/1.5.21 (2010-09-15) Archived-At: Cc: draft-ietf-alto-deployments.all@tools.ietf.org, secdir@ietf.org Subject: Re: [secdir] Sector review of draft-ietf-alto-deployments-15 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 21:54:36 -0000 Hi Klaas, thanks for the review and your comments. Please see below On Mon, Jun 20, 2016 at 01:01:04PM +0000, Klaas Wierenga (kwiereng) wrote: > Hi, > > have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > This document describes use cases when deploying ALTO (Application > Layer Traffic Optimization). It provides guidance for using and > deploying ALTO services. > > The document reads well and is as far as I can tell pretty exhaustive > (if anything the emphasis seems slightly on P2P rather than CDN, but > that seems justified by the number of different P2P deployments as > opposed to CDN). I particularly like the extensive coverage of > privacy and security issues throughout the document, this was clearly > not bolted on late in the process. I have only a few comments and > therefore believe the document is: > > ready with nits > > - A number of the comments throughout the document pertain to privacy, > I think the document would have benefited from a separate privacy > considerations paragraph, in addition to the security considerations. Could you please have a look at Section 5.2 of RFC 6708. Does the discussion there address your comment? If so, we could add another direct reference to that section at a suitable place in our document. If not, what is still missing? > - Not directly security related (apart from DoS), but I wonder in how > far it is a risk that clients have a relatively static view of the > world (3.4.4), i.e. it is assumed that the network characteristics > don???t change rapidly. To use an analogy, is there a risk that when > there is some holdup on the highway, that all cars will take the sand > path for some extended period of time, thus clogging the sand path? If > this is covered in other documents I apologise, but in the reviewed > document that appears to be a risk. First, to stick with the analogy with cars, the baseline ALTO scenario is not so much about whether to drive on the highway vs. on a sand path to get to a specific destination. It's more like wisely choosing the destination, e.g.: I want to buy a specific product and I know that it is available at identical price and quality in chain stores in X street and Y street, respecively. Where should I drive to get the product? The ALTO answer would be something like: To get from your home to X street you will have to drive 5 km through a residential area with 30 km/h speed limit, while to Y street it is 8 km on a freeway with 120 km/h speed limit, but it is usually badly congested during rush hour. Obviously, this answer would not allow you to drive constantly at this speed without looking for the actual traffic conditions. In other words, leaving the analogy: ALTO is not a replacement for TCP or similar mechanisms; see AR-14 in RFC 6708 and the second part of Sec. 3.2.4. of our document, starting with "All the above listed rating criteria are subject to the remarks below: ..." on page 27. Section 7.4, "Preference of a single peer" points out the DoS risk. Does this make sense or did I miss some point? > - There is text around validation of the clients (7.3 ALTO server > access), but to my surprise there is no wording to authentication of > the server. As a client operator I would expect to be able to validate > the server, after all the server is telling me where to go for the > resources I need. The text explains what the risk of injecting wrong > information is (7.4), but the authenticity of the server itself is not > discussed. A simple server authentication seems to go a long way in > preventing rogue ALTO servers. ALTO servers and clients MUST implement https (see Sec. 8.3.5. of RFC 7285). However, in some (P2P) scenarios, there is very limited trust between the participants of the application overlay and the ALTO server operator(s). So verifying the server identity by means of the TLS cert may not be enough to answer the question whether this information source is trustworthy. This section intends to extend the guidance given in section 15.2. of RFC 7285. Thanks, Sebastian From nobody Tue Jun 21 18:39:21 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75C0012D871; Tue, 21 Jun 2016 18:39:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.646 X-Spam-Level: X-Spam-Status: No, score=-5.646 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2u9-_UPTtrbG; Tue, 21 Jun 2016 18:39:16 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3793112D86E; Tue, 21 Jun 2016 18:39:15 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml701-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CRG43580; Wed, 22 Jun 2016 01:39:13 +0000 (GMT) Received: from SZXEMA418-HUB.china.huawei.com (10.82.72.36) by lhreml701-cah.china.huawei.com (10.201.5.93) with Microsoft SMTP Server (TLS) id 14.3.235.1; Wed, 22 Jun 2016 02:39:11 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.245]) by SZXEMA418-HUB.china.huawei.com ([10.82.72.36]) with mapi id 14.03.0235.001; Wed, 22 Jun 2016 09:39:07 +0800 From: "Xialiang (Frank)" To: "'iesg@ietf.org'" , "'secdir@ietf.org'" , "draft-ietf-calext-extensions.all@tools.ietf.org" Thread-Topic: secdir review of draft-ietf-calext-extensions-03 Thread-Index: AdHMJtfMw7OBPuxATBmrOMqiIbTB8g== Date: Wed, 22 Jun 2016 01:39:06 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: multipart/alternative; boundary="_000_C02846B1344F344EB4FAA6FA7AF481F12AF5D0BASZXEMA502MBSchi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.5769EC41.0043, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.4.245, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 973470c426d6eb18bee7eb455cca75fe Archived-At: Subject: [secdir] secdir review of draft-ietf-calext-extensions-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 01:39:17 -0000 --_000_C02846B1344F344EB4FAA6FA7AF481F12AF5D0BASZXEMA502MBSchi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments. This document defines a set of new properties for iCalendar data as well as= extending the use of some existing properties to the entire iCalendar obje= ct. In general, since this document just defines several new properties and ext= ends some existing properties with new parameters for the iCalendar object,= there are limited new threats brought by this work which are covered in th= e "Security Considerations" section. Summary: this document appears in reasonably good shape, with minor issues = that should be addressed before publication. Below is a series of my comments, nits for your consideration. comments: section 7 1. This section covers the possible new threats brought by new properties a= nd parameters, but does not mention how to mitigate them explicitly. Could = you consider this point? 2. The "Security Considerations" section of [RFC5545] describes the general= security issues and its corresponding relation with the transport protocol= . It's clear and comprehensive. As the extension draft to the iCalendar obj= ect specification, it's a good practice to mention that the security consid= erations in [RFC5545] continue to apply in this document. section 5.2--5.6 These sections specify the extensive properties, and don't follow the templ= ate in [RFC5545]. Would it be better to have some text for each extensive p= roperty to point out its original specification in [RFC5545] for easy under= standing? section 5.11 The new property -- conference, is missed in the previous iCalendar compone= nts' definition in section 4; nits: Section 8.1 The section number of [RFC5545] referenced here is wrong, it should be modi= fied from 8.2.3 to 8.3.2; Section 8.2 The section number of [RFC5545] referenced here is wrong, it should be modi= fied from 8.2.4 to 8.3.3; Thanks! B.R. Frank --_000_C02846B1344F344EB4FAA6FA7AF481F12AF5D0BASZXEMA502MBSchi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello,

 

I have reviewed this document a= s part of the security directorate's ongoing effort to review all IETF docu= ments being processed by the IESG.  These comments were written primar= ily for the benefit of the security area directors.  Document editors and WG chairs should treat these comment= s just like any other last call comments.

 

This document defines a set of = new properties for iCalendar data as well as extending the use of some exis= ting properties to the entire iCalendar object.

 

In general, since this document= just defines several new properties and extends some existing properties w= ith new parameters for the iCalendar object, there are limited new threats = brought by this work which are covered in the "Security Considerations" section.

 

Summary: this document appears = in reasonably good shape, with minor issues that should be addressed before= publication.

 

Below is a series of my comment= s, nits for your consideration.

 

comments:

section 7

1. This section covers the poss= ible new threats brought by new properties and parameters, but does not men= tion how to mitigate them explicitly. Could you consider this point?

2. The "Security Considera= tions" section of [RFC5545] describes the general security issues and = its corresponding relation with the transport protocol. It's clear and comp= rehensive. As the extension draft to the iCalendar object specification, it's a good practice to mention that the security co= nsiderations in [RFC5545] continue to apply in this document.

 

section 5.2--5.6

These sections specify the exte= nsive properties, and don't follow the template in [RFC5545]. Would it be b= etter to have some text for each extensive property to point out its origin= al specification in [RFC5545] for easy understanding?

 

section 5.11<= /p>

The new property -- conference,= is missed in the previous iCalendar components' definition in section 4;

 

nits:

Section 8.1

The section number of [RFC5545]= referenced here is wrong, it should be modified from 8.2.3 to 8.3.2;<= /o:p>

 

Section 8.2

The section number of [RFC5545]= referenced here is wrong, it should be modified from 8.2.4 to 8.3.3;<= /o:p>

 

Thanks!

 

B.R.

Frank

--_000_C02846B1344F344EB4FAA6FA7AF481F12AF5D0BASZXEMA502MBSchi_-- From nobody Wed Jun 22 04:37:43 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8C0E126D74; Wed, 22 Jun 2016 04:37:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iDeuVy_KNnQY; Wed, 22 Jun 2016 04:37:40 -0700 (PDT) Received: from mail-lf0-x236.google.com (mail-lf0-x236.google.com [IPv6:2a00:1450:4010:c07::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D93C312D0FE; Wed, 22 Jun 2016 04:37:39 -0700 (PDT) Received: by mail-lf0-x236.google.com with SMTP id q132so72256082lfe.3; Wed, 22 Jun 2016 04:37:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=8iAX/TIhgzTdU88Et9iR1I26xKeEEFHIKfjiDKKQKFw=; b=n3ZeV5nfeBrEETucMxLMw19wnB9edcZ0NQwLq4tJiqf61fgfVTtZdoaYtTCrEe/hOI N/I+C7lCLWNN8wyCOfI7YDsGcxC100QYcIbbcJnRGNTSL30R+r3IqthP8VGornQIYt/0 6QTHcom+67M2fqh1WRhtgH7+XeUFOvzzpg7yvGn1Uanx64z6ESfcKkZPmPcPxuTT+EIG kbvgBI40fTCHjBZMnwsRuGVw/FCAy7ll0Obih1kHtLf+A09XgIYHKTUzxrYCkaBr7GZn SZ1284SiSryI9rRJr+LHpcGmO1gZwTb6TVlJ1FzVA2zaru1oOP40R5W3lgskexy3i8+E RWBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=8iAX/TIhgzTdU88Et9iR1I26xKeEEFHIKfjiDKKQKFw=; b=fA7WIOEFQrrXYTqdDg54yi+W02OaFGJAH1WUeHNtMvrwq8oiIjm2wiioD8tkqXaP6/ /H5XwH5oerayaaTdwwn2gEUfxWsRDS0lM1fxIrkaKeVTLC3ncR7ZFsRQp18LdbGIhlDI aG+Fu8ao4BBiKSf7LQACghTXa1wY7o7ylwEUfhwL0j639MSayCvNd5GYPfBG/nDbI0pv /+D5zNsP6ghEKZQsd2FtThOKbRasx5XQnvz8YwDOA59gkc3c6Bocn60INl0Qw0LKLwFn YYQIrWpyFJeMhCgiHUdp9LC1iCwfixRNA2FlQSbCWZ0IV3MQ+CgMFeUcENQy3h6ftK6a 1mUg== X-Gm-Message-State: ALyK8tIAOqa7f7QRXpJ//gLnuakeK/ta4x7kAEPF3CP66WfxaZTW/zcUeGF1QDfAqnY6NA== X-Received: by 10.46.71.206 with SMTP id u197mr7673759lja.16.1466595458034; Wed, 22 Jun 2016 04:37:38 -0700 (PDT) Received: from voyager2.local (088156132194.dynamic-ww-04.vectranet.pl. [88.156.132.194]) by smtp.googlemail.com with ESMTPSA id z10sm1876809lbr.12.2016.06.22.04.37.36 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 22 Jun 2016 04:37:37 -0700 (PDT) To: Yaron Sheffer , IETF Security Directorate , The IESG , draft-ietf-dhc-topo-conf.all@tools.ietf.org References: <5751B895.1070400@gmail.com> <5751D4E6.6000709@gmail.com> <575344A7.30002@gmail.com> From: Tomek Mrugalski Message-ID: <504107ae-7f75-3ba7-afbd-7ed1f104f0b4@gmail.com> Date: Wed, 22 Jun 2016 13:38:56 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <575344A7.30002@gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 11:37:42 -0000 Hi Yaron, Thanks again for your review. I came up with a proposed text for the security considerations text. There's not much left from the original text, so here's the whole proposed section: 10. Security Considerations This document explains existing practice with respect to the use of Dynamic Host Configuration Protocol [RFC2131] and Dynamic Host Configuration Protocol Version 6 [RFC3315]. The security considerations for these protocols are described in their specifications and in related documents that extend these protocols. The mechanisms described in this document could possibly be exploited by an attacker to misrepresent its point of attachment in the network. This would cause the server to assign addresses, prefixes and other configuration options, which can be considered a leak of information. In particular, this could be used a preliminary stage of attack, when the DHCP server leaks information about available services in networks that attacker does not have access to. There are several ways how such an attack can be prevented. First, it seems to be a common practice to filter out DHCP traffic coming in from outside of the network and one that is directed to clients outside of the network. Second, the DHCP servers can be configured to not respond to traffic that is coming from unknown (i.e. those subnets the server is not configured to serve) subnets. Third, some relays provide the ability to reject messages that do not fit expected characteristics. For example CMTS (Cable Modem Termination System) acting as a DHCP relay detects if the MAC address specified in chaddr in incoming DHCP messages matches the MAC address of the cable modem it came from and can alter its behavior accordingly. Also, relay agents and servers that are connected to clients directly can reject traffic that looks as if it has passed a relay (this could indicate the client is attempting to spoof a relay, possibly to inject forged relay options). There are a number of general DHCP recommendations that should be considered in all DHCP deployments. While not strictly related to the mechanisms described in this document, they may be useful in certain deployment scenarios. [RFC7819] and [RFC7824] provide an analysis of privacy problems in DHCPv4 and DHCPv6, respectively. If those are of concern, [RFC7844] offers mitigation steps. Current DHCPv4 and DHCPv6 standards lack strong cryptographic protection. There is an ongoing effort in DHC working group to address this. [I-D.ietf-dhc-sedhcpv6] attempts to provide mechanism for strong authentication and encryption between DHCPv6 clients and servers. [I-D.volz-dhc-relay-server-security] attempts to improve security of exchanges between DHCP relay agents and servers. Finally, there is an ongoing effort to update DHCPv6 specification, that is currently 13 years old. Sections 23 (Security Considerations) and 24 (Privacy Considerations) of [I-D.ietf-dhc-rfc3315bis] contain more recent analysis of the security and privacy considerations. If you prefer to see the whole document, the unpublished -09 is available here: https://github.com/tomaszmrugalski/ietf-topo-conf/blob/master/draft-ietf-dhc-topo-conf-09.txt Let me know if the text addresses your comments. Thanks again for your thorough review. Tomek From nobody Wed Jun 22 10:07:30 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AB3512D191; Wed, 22 Jun 2016 10:07:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.328 X-Spam-Level: X-Spam-Status: No, score=-3.328 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d9CCnKHuMa2w; Wed, 22 Jun 2016 10:07:24 -0700 (PDT) Received: from daboo.name (daboo.name [173.13.55.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E95D12D129; Wed, 22 Jun 2016 10:07:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by daboo.name (Postfix) with ESMTP id CB59F46384E7; Wed, 22 Jun 2016 13:07:23 -0400 (EDT) X-Virus-Scanned: amavisd-new at example.com Received: from daboo.name ([127.0.0.1]) by localhost (daboo.name [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wiSAoHWx6Txj; Wed, 22 Jun 2016 13:07:23 -0400 (EDT) Received: from [17.168.87.230] (unknown [17.44.178.123]) by daboo.name (Postfix) with ESMTPSA id 68A9246384DB; Wed, 22 Jun 2016 13:07:22 -0400 (EDT) Date: Wed, 22 Jun 2016 13:07:20 -0400 From: Cyrus Daboo To: "Xialiang (Frank)" , "'iesg@ietf.org'" , "'secdir@ietf.org'" , draft-ietf-calext-extensions.all@tools.ietf.org Message-ID: <0590CB0E84F8E00754D99FE2@cyrus.local> In-Reply-To: References: X-Mailer: Mulberry/4.1.0b1 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline; size=2211 Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-calext-extensions-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 17:07:26 -0000 Hi Xialiang, Thank you for your review. Fixes described below have been made to my working copy and will be included in the next published draft. --On June 22, 2016 at 1:39:06 AM +0000 "Xialiang (Frank)" wrote: > Below is a series of my comments, nits for your consideration. > > comments: > section 7 > 1. This section covers the possible new threats brought by new properties > and parameters, but does not mention how to mitigate them explicitly. > Could you consider this point? I've added some additional text to my working copy to cover that. > 2. The "Security Considerations" section > of [RFC5545] describes the general security issues and its corresponding > relation with the transport protocol. It's clear and comprehensive. As > the extension draft to the iCalendar object specification, it's a good > practice to mention that the security considerations in [RFC5545] > continue to apply in this document. I have added the follow text as the last paragraph of Security Considerations: Security considerations in [RFC5545], and [RFC5546] MUST also be adhered to. I have also added a Privacy Considerations section with similar text. Also, on further review there were a couple of addition items I felt needed to be added to these sections. In particular text about short REFRESH-INTERVALs being used to trigger denial of service attacks. > section 5.2--5.6 > These sections specify the extensive properties, and don't follow the > template in [RFC5545]. Would it be better to have some text for each > extensive property to point out its original specification in [RFC5545] > for easy understanding? OK. I have added text in each of those sections providing a reference back to the section in RFC5545 where the original definitions reside. > section 5.11 > The new property -- conference, is missed in the previous iCalendar > components' definition in section 4; Fixed. > nits: > Section 8.1 > The section number of [RFC5545] referenced here is wrong, it should be > modified from 8.2.3 to 8.3.2; > > Section 8.2 > The section number of [RFC5545] referenced here is wrong, it should be > modified from 8.2.4 to 8.3.3; Fixed. -- Cyrus Daboo From nobody Wed Jun 22 19:36:11 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59EFA12DECE; Wed, 22 Jun 2016 19:36:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.647 X-Spam-Level: X-Spam-Status: No, score=-5.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4-fwzKe0dhDS; Wed, 22 Jun 2016 19:36:07 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCC9412DEBC; Wed, 22 Jun 2016 19:36:05 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml702-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CML10997; Thu, 23 Jun 2016 02:36:03 +0000 (GMT) Received: from SZXEMA412-HUB.china.huawei.com (10.82.72.71) by lhreml702-cah.china.huawei.com (10.201.5.99) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 23 Jun 2016 03:36:00 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.245]) by SZXEMA412-HUB.china.huawei.com ([10.82.72.71]) with mapi id 14.03.0235.001; Thu, 23 Jun 2016 10:35:53 +0800 From: "Xialiang (Frank)" To: Cyrus Daboo Thread-Topic: secdir review of draft-ietf-calext-extensions-03 Thread-Index: AQHRzKiRcj3BzPTaZ06Pv1MX/8z6HZ/2VfXQ Date: Thu, 23 Jun 2016 02:35:53 +0000 Message-ID: References: <0590CB0E84F8E00754D99FE2@cyrus.local> In-Reply-To: <0590CB0E84F8E00754D99FE2@cyrus.local> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090201.576B4B14.002D, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.4.245, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 07d7aed9d7a8a20cb49072364656a852 Archived-At: Cc: "draft-ietf-calext-extensions.all@tools.ietf.org" , "'iesg@ietf.org'" , "'secdir@ietf.org'" Subject: Re: [secdir] secdir review of draft-ietf-calext-extensions-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 02:36:09 -0000 R3JlYXQsIHRoYW5rIHlvdS4NCg0KLS0tLS3Tyrz+1K28/i0tLS0tDQq3orz+yMs6IEN5cnVzIERh Ym9vIFttYWlsdG86Y3lydXNAZGFib28ubmFtZV0gDQq3osvNyrG85DogMjAxNsTqNtTCMjPI1SAx OjA3DQrK1bz+yMs6IFhpYWxpYW5nIChGcmFuayk7ICdpZXNnQGlldGYub3JnJzsgJ3NlY2RpckBp ZXRmLm9yZyc7IGRyYWZ0LWlldGYtY2FsZXh0LWV4dGVuc2lvbnMuYWxsQHRvb2xzLmlldGYub3Jn DQrW98ziOiBSZTogc2VjZGlyIHJldmlldyBvZiBkcmFmdC1pZXRmLWNhbGV4dC1leHRlbnNpb25z LTAzDQoNCkhpIFhpYWxpYW5nLA0KVGhhbmsgeW91IGZvciB5b3VyIHJldmlldy4gRml4ZXMgZGVz Y3JpYmVkIGJlbG93IGhhdmUgYmVlbiBtYWRlIHRvIG15IHdvcmtpbmcgY29weSBhbmQgd2lsbCBi ZSBpbmNsdWRlZCBpbiB0aGUgbmV4dCBwdWJsaXNoZWQgZHJhZnQuDQoNCi0tT24gSnVuZSAyMiwg MjAxNiBhdCAxOjM5OjA2IEFNICswMDAwICJYaWFsaWFuZyAoRnJhbmspIiANCjxmcmFuay54aWFs aWFuZ0BodWF3ZWkuY29tPiB3cm90ZToNCg0KPiBCZWxvdyBpcyBhIHNlcmllcyBvZiBteSBjb21t ZW50cywgbml0cyBmb3IgeW91ciBjb25zaWRlcmF0aW9uLg0KPg0KPiBjb21tZW50czoNCj4gc2Vj dGlvbiA3DQo+IDEuIFRoaXMgc2VjdGlvbiBjb3ZlcnMgdGhlIHBvc3NpYmxlIG5ldyB0aHJlYXRz IGJyb3VnaHQgYnkgbmV3IA0KPiBwcm9wZXJ0aWVzIGFuZCBwYXJhbWV0ZXJzLCBidXQgZG9lcyBu b3QgbWVudGlvbiBob3cgdG8gbWl0aWdhdGUgdGhlbSBleHBsaWNpdGx5Lg0KPiBDb3VsZCB5b3Ug Y29uc2lkZXIgdGhpcyBwb2ludD8NCg0KSSd2ZSBhZGRlZCBzb21lIGFkZGl0aW9uYWwgdGV4dCB0 byBteSB3b3JraW5nIGNvcHkgdG8gY292ZXIgdGhhdC4NCg0KPiAyLiBUaGUgIlNlY3VyaXR5IENv bnNpZGVyYXRpb25zIiBzZWN0aW9uIG9mIFtSRkM1NTQ1XSBkZXNjcmliZXMgdGhlIA0KPiBnZW5l cmFsIHNlY3VyaXR5IGlzc3VlcyBhbmQgaXRzIGNvcnJlc3BvbmRpbmcgcmVsYXRpb24gd2l0aCB0 aGUgDQo+IHRyYW5zcG9ydCBwcm90b2NvbC4gSXQncyBjbGVhciBhbmQgY29tcHJlaGVuc2l2ZS4g QXMgdGhlIGV4dGVuc2lvbiANCj4gZHJhZnQgdG8gdGhlIGlDYWxlbmRhciBvYmplY3Qgc3BlY2lm aWNhdGlvbiwgaXQncyBhIGdvb2QgcHJhY3RpY2UgdG8gDQo+IG1lbnRpb24gdGhhdCB0aGUgc2Vj dXJpdHkgY29uc2lkZXJhdGlvbnMgaW4gW1JGQzU1NDVdIGNvbnRpbnVlIHRvIA0KPiBhcHBseSBp biB0aGlzIGRvY3VtZW50Lg0KDQpJIGhhdmUgYWRkZWQgdGhlIGZvbGxvdyB0ZXh0IGFzIHRoZSBs YXN0IHBhcmFncmFwaCBvZiBTZWN1cml0eQ0KQ29uc2lkZXJhdGlvbnM6DQoNCiAgICBTZWN1cml0 eSBjb25zaWRlcmF0aW9ucyBpbiBbUkZDNTU0NV0sIGFuZCBbUkZDNTU0Nl0gTVVTVCBhbHNvIGJl DQogICAgYWRoZXJlZCB0by4NCg0KSSBoYXZlIGFsc28gYWRkZWQgYSBQcml2YWN5IENvbnNpZGVy YXRpb25zIHNlY3Rpb24gd2l0aCBzaW1pbGFyIHRleHQuDQoNCkFsc28sIG9uIGZ1cnRoZXIgcmV2 aWV3IHRoZXJlIHdlcmUgYSBjb3VwbGUgb2YgYWRkaXRpb24gaXRlbXMgSSBmZWx0IG5lZWRlZCB0 byBiZSBhZGRlZCB0byB0aGVzZSBzZWN0aW9ucy4gSW4gcGFydGljdWxhciB0ZXh0IGFib3V0IHNo b3J0IFJFRlJFU0gtSU5URVJWQUxzIGJlaW5nIHVzZWQgdG8gdHJpZ2dlciBkZW5pYWwgb2Ygc2Vy dmljZSBhdHRhY2tzLg0KDQo+IHNlY3Rpb24gNS4yLS01LjYNCj4gVGhlc2Ugc2VjdGlvbnMgc3Bl Y2lmeSB0aGUgZXh0ZW5zaXZlIHByb3BlcnRpZXMsIGFuZCBkb24ndCBmb2xsb3cgdGhlIA0KPiB0 ZW1wbGF0ZSBpbiBbUkZDNTU0NV0uIFdvdWxkIGl0IGJlIGJldHRlciB0byBoYXZlIHNvbWUgdGV4 dCBmb3IgZWFjaCANCj4gZXh0ZW5zaXZlIHByb3BlcnR5IHRvIHBvaW50IG91dCBpdHMgb3JpZ2lu YWwgc3BlY2lmaWNhdGlvbiBpbiANCj4gW1JGQzU1NDVdIGZvciBlYXN5IHVuZGVyc3RhbmRpbmc/ DQoNCk9LLiBJIGhhdmUgYWRkZWQgdGV4dCBpbiBlYWNoIG9mIHRob3NlIHNlY3Rpb25zIHByb3Zp ZGluZyBhIHJlZmVyZW5jZSBiYWNrIHRvIHRoZSBzZWN0aW9uIGluIFJGQzU1NDUgd2hlcmUgdGhl IG9yaWdpbmFsIGRlZmluaXRpb25zIHJlc2lkZS4NCg0KPiBzZWN0aW9uIDUuMTENCj4gVGhlIG5l dyBwcm9wZXJ0eSAtLSBjb25mZXJlbmNlLCBpcyBtaXNzZWQgaW4gdGhlIHByZXZpb3VzIGlDYWxl bmRhciANCj4gY29tcG9uZW50cycgZGVmaW5pdGlvbiBpbiBzZWN0aW9uIDQ7DQoNCkZpeGVkLg0K DQo+IG5pdHM6DQo+IFNlY3Rpb24gOC4xDQo+IFRoZSBzZWN0aW9uIG51bWJlciBvZiBbUkZDNTU0 NV0gcmVmZXJlbmNlZCBoZXJlIGlzIHdyb25nLCBpdCBzaG91bGQgYmUgDQo+IG1vZGlmaWVkIGZy b20gOC4yLjMgdG8gOC4zLjI7DQo+DQo+IFNlY3Rpb24gOC4yDQo+IFRoZSBzZWN0aW9uIG51bWJl ciBvZiBbUkZDNTU0NV0gcmVmZXJlbmNlZCBoZXJlIGlzIHdyb25nLCBpdCBzaG91bGQgYmUgDQo+ IG1vZGlmaWVkIGZyb20gOC4yLjQgdG8gOC4zLjM7DQoNCkZpeGVkLg0KDQotLQ0KQ3lydXMgRGFi b28NCg0K From nobody Thu Jun 23 10:59:36 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A03112D508 for ; Thu, 23 Jun 2016 10:59:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LYAJNL0zUZBo for ; Thu, 23 Jun 2016 10:59:32 -0700 (PDT) Received: from mail.kivinen.iki.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C45812D125 for ; Thu, 23 Jun 2016 10:59:32 -0700 (PDT) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id u5NHxSwU003362 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 23 Jun 2016 20:59:28 +0300 (EEST) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id u5NHxSKB017459; Thu, 23 Jun 2016 20:59:28 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <22380.9087.964222.941397@fireball.acr.fi> Date: Thu, 23 Jun 2016 20:59:27 +0300 From: Tero Kivinen To: secdir@ietf.org X-Edit-Time: 0 min X-Total-Time: 0 min Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 17:59:35 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Benjamin Kaduk is next in the rotation. For telechat 2016-06-30 Reviewer LC end Draft John Bradley T 2016-06-23 draft-ietf-ospf-transition-to-ospfv3-09 Shawn Emery T 2016-06-24 draft-ietf-trill-irb-13 Carl Wallace T 2016-06-22 draft-ietf-forces-interfelfb-05 For telechat 2016-07-07 Shaun Cooley T 2016-06-28 draft-ietf-trill-ia-appsubtlv-08 Dan Harkins T 2016-07-07 draft-ietf-calext-availability-03 Christian Huitema T 2016-07-04 draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 Chris Inacio T 2016-07-01 draft-ietf-trill-arp-optimization-06 Leif Johansson T 2016-07-01 draft-ietf-trill-tree-selection-04 Yaron Sheffer TR2016-07-01 draft-ietf-trill-channel-tunnel-09 Takeshi Takahashi TR2015-12-28 draft-ietf-hip-rfc5203-bis-10 Hannes Tschofenig T 2015-12-28 draft-ietf-hip-rfc5204-bis-07 Tina TSOU TR2015-12-28 draft-ietf-hip-rfc5205-bis-09 Sean Turner TR2015-12-28 draft-ietf-hip-rfc6253-bis-08 Tom Yu T 2016-07-01 draft-pal-eidr-urn-2016-01 Dacheng Zhang T 2016-06-27 draft-ietf-cdni-metadata-18 Last calls and special requests: Alan DeKok 2016-04-30 draft-bradner-rfc3979bis-08 Donald Eastlake 2016-07-08 draft-pd-dispatch-msrp-websocket-12 Daniel Kahn Gillmor E 2016-02-01 draft-ietf-rtcweb-security-08 Tobias Gondrom 2016-07-11 draft-sweet-rfc2910bis-08 Phillip Hallam-Baker 2016-07-21 draft-hardy-pdf-mime-02 Steve Hanna 2016-07-18 draft-holmberg-dispatch-rfc7315-updates-07 Paul Hoffman 2016-07-04 draft-ietf-grow-blackholing-00 Russ Housley 2016-07-06 draft-ietf-nfsv4-multi-domain-fs-reqs-08 Jeffrey Hutzelman 2016-07-04 draft-ietf-sipcore-dns-dual-stack-06 Hannes Tschofenig E None draft-ietf-ntp-network-time-security-14 Hannes Tschofenig E None draft-ietf-ntp-cms-for-nts-message-06 Hannes Tschofenig E None draft-ietf-ntp-using-nts-for-ntp-05 Brian Weis E 2016-02-01 draft-ietf-cdni-uri-signing-08 Paul Wouters 2016-06-17 draft-ietf-dnsop-dnssec-roadblock-avoidance-04 -- kivinen@iki.fi From nobody Fri Jun 24 02:45:58 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E482B12D529; Fri, 24 Jun 2016 02:45:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.145 X-Spam-Level: X-Spam-Status: No, score=-4.145 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=hotmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jtqm1IoQOlu5; Fri, 24 Jun 2016 02:45:50 -0700 (PDT) Received: from BAY004-OMC4S24.hotmail.com (bay004-omc4s24.hotmail.com [65.54.190.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67FB712D14D; Fri, 24 Jun 2016 02:45:50 -0700 (PDT) Received: from APC01-SG2-obe.outbound.protection.outlook.com ([65.54.190.199]) by BAY004-OMC4S24.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Fri, 24 Jun 2016 02:45:50 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Nw2yDYSSBgPmSjMVk5CLcIKlRoT1X+QTEcllxqQp/LI=; b=ni7AoYSP392I6JQrCZFJq0B3/QNv5VEHrJxmBsCswmbUqxtOXXU2IfnSSc0IudoXEv8Jt4xpg2wrmpfQlMTRbZcgGmK/pMLCFxbpXlYXst4Hb8TIDRzgZ9f+yIeFzW3mdE6znDBSkdH3E+80rBI1awANBUPNrSbQ4VD38Gke9OhXlRg+2TleLxxQlWxKmT8UikWDu7+w8uSCklZDw4f8CC1uathrrc8tOn4RonVGV6QZohw1VekmiVqvQeQbVKkrAtNGmO+GKS8Bs7PjJU5VQwdHgeMCbV6rzyI1GJaMAIMz6p5Mvwa6xwPowCEhTQD6wg8zYVHswsAdcDGps3O+qg== Received: from SG2APC01FT025.eop-APC01.prod.protection.outlook.com (10.152.250.51) by SG2APC01HT145.eop-APC01.prod.protection.outlook.com (10.152.251.42) with Microsoft SMTP Server (TLS) id 15.1.511.7; Fri, 24 Jun 2016 09:45:47 +0000 Received: from HK2PR03MB0739.apcprd03.prod.outlook.com (10.152.250.53) by SG2APC01FT025.mail.protection.outlook.com (10.152.250.187) with Microsoft SMTP Server (TLS) id 15.1.511.7 via Frontend Transport; Fri, 24 Jun 2016 09:45:46 +0000 Received: from HK2PR03MB0739.apcprd03.prod.outlook.com ([10.161.187.153]) by HK2PR03MB0739.apcprd03.prod.outlook.com ([10.161.187.153]) with mapi id 15.01.0523.019; Fri, 24 Jun 2016 09:45:47 +0000 From: Zhang Dacheng To: The IESG , "secdir@ietf.org" Thread-Topic: SecDir review of draft-ietf-cdni-metadata-18 Thread-Index: AQHRzf0udJRVHEg89kyuP27YcBgwfA== Date: Fri, 24 Jun 2016 09:45:46 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=softfail (sender IP is 25.152.250.53) smtp.mailfrom=hotmail.com; tools.ietf.org; dkim=none (message not signed) header.d=none; tools.ietf.org; dmarc=fail action=none header.from=hotmail.com; received-spf: SoftFail (protection.outlook.com: domain of transitioning hotmail.com discourages use of 25.152.250.53 as permitted sender) x-ms-exchange-messagesentrepresentingtype: 1 x-eopattributedmessage: 0 x-forefront-antispam-report: CIP:25.152.250.53; IPV:NLI; CTRY:GB; EFV:NLI; SFV:NSPM; SFS:(10019020)(98900003); DIR:OUT; SFP:1102; SCL:1; SRVR:SG2APC01HT145; H:HK2PR03MB0739.apcprd03.prod.outlook.com; FPR:; SPF:None; LANG:en; x-ms-office365-filtering-correlation-id: fc0abe8e-e83c-4838-9f34-08d39c144f84 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(1601124038)(5061506196)(5061507196)(1603103041)(1601125047); SRVR:SG2APC01HT145; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(432015012)(82015046); SRVR:SG2APC01HT145; BCL:0; PCL:0; RULEID:; SRVR:SG2APC01HT145; x-forefront-prvs: 0983EAD6B2 Content-Type: multipart/alternative; boundary="_000_HK2PR03MB07391BCA12CFA57C7786EFA4882E0HK2PR03MB0739apcp_" MIME-Version: 1.0 X-OriginatorOrg: hotmail.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jun 2016 09:45:47.0018 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2APC01HT145 X-OriginalArrivalTime: 24 Jun 2016 09:45:50.0165 (UTC) FILETIME=[30EC0850:01D1CDFD] Archived-At: Cc: "draft-ietf-cdni-metadata.all@tools.ietf.org" Subject: [secdir] SecDir review of draft-ietf-cdni-metadata-18 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 09:45:53 -0000 --_000_HK2PR03MB07391BCA12CFA57C7786EFA4882E0HK2PR03MB0739apcp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQpJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0 eSBkaXJlY3RvcmF0ZSdzIG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwgSUVURiBkb2N1bWVu dHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiBUaGVzZSBjb21tZW50cyB3ZXJlIHdyaXR0 ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgc2VjdXJpdHkgYXJlYSBkaXJlY3Rv cnMuIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2UgY29t bWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuVGhpcyBkb2N1bWVu dCBkZWZpbmVzIHRoZSBDRE5JIG1ldGFkYXRhIGludGVyZmFjZSB3aGljaCBlbmFibGVzIGEgQ0RO IHRvIG9idGFpbiBDRE5JIG1ldGFkYXRhIGZyb20gYW5vdGhlciBvbmUuDQpUaGVyZSBhcmUgc29t ZSBpc3N1ZXMgd2hpY2ggc2hvdWxkIGJlIGZ1cnRoZXIgZGlzY3Vzc2VkIGJlZm9yZSBwdWJsaXNo aW5nIHRoZSBtZW1vLg0KMS4gVGhlIHRpdGxlIG9mIFNlY3Rpb24gOC4xIGlzIEF1dGhlbnRpY2F0 aW9uLCBidXQgdGhlIGNvbnRlbnRzIGFyZSBhbGwgYWJvdXQgdW5hdXRob3JpemVkIGFjY2VzcyB0 byBtZXRhZGF0YS4gTWF5YmUgeW91IGNvdWxkIHNheSBzb21ldGhpbmcgbGlrZSDigJhpZiBhbiBh dHRhY2tlciBjYW4gaW1wZXJzb25hdGUgYSBsZWdhbCBDRE4gd2l0aG91dCBiZWluZyBkZXRlY3Rl ZCwgaXQgaXMgYWJsZSB0b+KApuKAmQ0KMi4gVGhlcmUgaXMgYSBiaWcgb3ZlcmxhcCBiZXR3ZWVu IHNlY3Rpb24gOC4yLCBDb25maWRlbnRpYWxpdHkgYW5kIHNlY3Rpb24gOC40LCBQcml2YWN5LiBJ IHN1Z2dlc3QgdG8gbWVyZ2UgdGhlc2UgdHdvIHNlY3Rpb25zLg0KMy5JbiBzZWN0aW9uIDguMywg eW91IG1lbnRpb25lZCwg4oCdIEFuIGltcGxlbWVudGF0aW9uIG9mIHRoZSBDRE5JIG1ldGFkYXRh IGludGVyZmFjZSBNVVNUIHVzZSBzdHJvbmcgZW5jcnlwdGlvbiBhbmQgbXV0dWFsIGF1dGhlbnRp Y2F0aW9uIHRvIHByZXZlbnQgdW5kZXRlY3RhYmxlIG1vZGlmaWNhdGlvbiBvZiBtZXRhZGF0YSAo c2VlIFNlY3Rpb24gOC41KS7igJ0gTm9ybWFsbHksIHdoZW4gZGlzY3Vzc2luZyBhYm91dCBpbnRl Z3JpdHkgcHJvdGVjdGlvbiwgd2UgcHJlZmVyIHRvIHVzZSBNQUMgcmF0aGVyIHRoYW4gZW5jcnlw dGlvbi4NCjQuIEluIHNlY3Rpb24gOC41LCB0aGVyZSBpcyBhIHN0YXRlbWVudCBhYm91dCB1c2lu ZyBUTFMgdG8gcHJvdmlkZSBhdXRob3JpemF0aW9uLiBJIGRvbuKAmXQgdGhpbmsgVExTIGNhbiBk ZWNpZGUgd2hpY2ggbWV0YS1kYXRhIGNhbiBiZSBzZW50L3Byb2Nlc3NlZCBieSBhIENETi4NCjUu IEluIHNlY3Rpb24gNC4yLjEuMSwgaXQgaXMgc2F0ZWQgdGhhdCBieSBkZWZhdWx0IG5vIGF1dGhl bnRpY2F0aW9uIG5lZWRzIHRvIGJlIHByb3ZpZGVkIHdoZW4gcmVxdWVzdGluZyBjb250ZW50IGZy b20gYSBzb3VyY2UuIERvIHlvdSBhc3N1bWUgdGhlIHNvdXJjZSB3aWxsIHdvcmsgaW4gYSBzZWN1 cmUgZW52aXJvbm1lbnQ/DQo= --_000_HK2PR03MB07391BCA12CFA57C7786EFA4882E0HK2PR03MB0739apcp_ Content-Type: text/html; charset="utf-8" Content-ID: <5C6F106A7E568245ABE7AFA5250776C4@apcprd03.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJy ZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsiIGNsYXNzPSIiPg0KPCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQogPG86T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCiAgPG86QWxsb3dQTkcvPg0KIDwvbzpP ZmZpY2VEb2N1bWVudFNldHRpbmdzPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQogPHc6V29yZERvY3VtZW50Pg0KICA8dzpWaWV3Pk5vcm1hbDwvdzpWaWV3Pg0K ICA8dzpab29tPjA8L3c6Wm9vbT4NCiAgPHc6VHJhY2tNb3Zlcz5mYWxzZTwvdzpUcmFja01vdmVz Pg0KICA8dzpUcmFja0Zvcm1hdHRpbmcvPg0KICA8dzpQdW5jdHVhdGlvbktlcm5pbmcvPg0KICA8 dzpEcmF3aW5nR3JpZFZlcnRpY2FsU3BhY2luZz4xMCBwdDwvdzpEcmF3aW5nR3JpZFZlcnRpY2Fs U3BhY2luZz4NCiAgPHc6RGlzcGxheUhvcml6b250YWxEcmF3aW5nR3JpZEV2ZXJ5PjA8L3c6RGlz cGxheUhvcml6b250YWxEcmF3aW5nR3JpZEV2ZXJ5Pg0KICA8dzpEaXNwbGF5VmVydGljYWxEcmF3 aW5nR3JpZEV2ZXJ5PjI8L3c6RGlzcGxheVZlcnRpY2FsRHJhd2luZ0dyaWRFdmVyeT4NCiAgPHc6 VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQogIDx3OlNhdmVJZlhNTEludmFsaWQ+ZmFsc2U8L3c6 U2F2ZUlmWE1MSW52YWxpZD4NCiAgPHc6SWdub3JlTWl4ZWRDb250ZW50PmZhbHNlPC93Oklnbm9y ZU1peGVkQ29udGVudD4NCiAgPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5mYWxzZTwvdzpB bHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KICA8dzpEb05vdFByb21vdGVRRi8+DQogIDx3Okxp ZFRoZW1lT3RoZXI+RU4tVVM8L3c6TGlkVGhlbWVPdGhlcj4NCiAgPHc6TGlkVGhlbWVBc2lhbj5a SC1DTjwvdzpMaWRUaGVtZUFzaWFuPg0KICA8dzpMaWRUaGVtZUNvbXBsZXhTY3JpcHQ+WC1OT05F PC93OkxpZFRoZW1lQ29tcGxleFNjcmlwdD4NCiAgPHc6Q29tcGF0aWJpbGl0eT4NCiAgIDx3OlNw YWNlRm9yVUwvPg0KICAgPHc6QmFsYW5jZVNpbmdsZUJ5dGVEb3VibGVCeXRlV2lkdGgvPg0KICAg PHc6RG9Ob3RMZWF2ZUJhY2tzbGFzaEFsb25lLz4NCiAgIDx3OlVMVHJhaWxTcGFjZS8+DQogICA8 dzpEb05vdEV4cGFuZFNoaWZ0UmV0dXJuLz4NCiAgIDx3OkFkanVzdExpbmVIZWlnaHRJblRhYmxl Lz4NCiAgIDx3OkJyZWFrV3JhcHBlZFRhYmxlcy8+DQogICA8dzpTbmFwVG9HcmlkSW5DZWxsLz4N CiAgIDx3OldyYXBUZXh0V2l0aFB1bmN0Lz4NCiAgIDx3OlVzZUFzaWFuQnJlYWtSdWxlcy8+DQog ICA8dzpEb250R3Jvd0F1dG9maXQvPg0KICAgPHc6U3BsaXRQZ0JyZWFrQW5kUGFyYU1hcmsvPg0K ICAgPHc6RW5hYmxlT3BlblR5cGVLZXJuaW5nLz4NCiAgIDx3OkRvbnRGbGlwTWlycm9ySW5kZW50 cy8+DQogICA8dzpPdmVycmlkZVRhYmxlU3R5bGVIcHMvPg0KICAgPHc6VXNlRkVMYXlvdXQvPg0K ICA8L3c6Q29tcGF0aWJpbGl0eT4NCiAgPHc6Tm9MaW5lQnJlYWtzQWZ0ZXIgTGFuZz0iSkEiPiQo W3vCo8KlwrfigJjigJzjgIjjgIrjgIzjgI7jgJDjgJTjgJbjgJ3vuZnvuZvvuZ3vvITvvIjvvI7v vLvvvZvvv6Hvv6U8L3c6Tm9MaW5lQnJlYWtzQWZ0ZXI+DQogIDx3Ok5vTGluZUJyZWFrc0JlZm9y ZSBMYW5nPSJKQSI+ISUpLC46OyZndDs/XX3CosKowrDCt8uHy4nigJXigJbigJnigJ3igKbigLDi gLLigLPigLrihIPiiLbjgIHjgILjgIPjgInjgIvjgI3jgI/jgJHjgJXjgJfjgJ7vuLbvuLrvuL7v uYDvuYTvuZrvuZzvuZ7vvIHvvILvvIXvvIfvvInvvIzvvI7vvJrvvJvvvJ/vvL3vvYDvvZzvvZ3v vZ7vv6A8L3c6Tm9MaW5lQnJlYWtzQmVmb3JlPg0KICA8bTptYXRoUHI+DQogICA8bTptYXRoRm9u dCBtOnZhbD0iQ2FtYnJpYSBNYXRoIi8+DQogICA8bTpicmtCaW4gbTp2YWw9ImJlZm9yZSIvPg0K ICAgPG06YnJrQmluU3ViIG06dmFsPSImIzQ1Oy0iLz4NCiAgIDxtOnNtYWxsRnJhYyBtOnZhbD0i b2ZmIi8+DQogICA8bTpkaXNwRGVmLz4NCiAgIDxtOmxNYXJnaW4gbTp2YWw9IjAiLz4NCiAgIDxt OnJNYXJnaW4gbTp2YWw9IjAiLz4NCiAgIDxtOmRlZkpjIG06dmFsPSJjZW50ZXJHcm91cCIvPg0K ICAgPG06d3JhcEluZGVudCBtOnZhbD0iMTQ0MCIvPg0KICAgPG06aW50TGltIG06dmFsPSJzdWJT dXAiLz4NCiAgIDxtOm5hcnlMaW0gbTp2YWw9InVuZE92ciIvPg0KICA8L206bWF0aFByPjwvdzpX b3JkRG9jdW1lbnQ+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CiA8dzpMYXRlbnRTdHlsZXMgRGVmTG9ja2VkU3RhdGU9ImZhbHNlIiBEZWZVbmhpZGVXaGVuVXNl ZD0idHJ1ZSINCiAgRGVmU2VtaUhpZGRlbj0idHJ1ZSIgRGVmUUZvcm1hdD0iZmFsc2UiIERlZlBy aW9yaXR5PSI5OSINCiAgTGF0ZW50U3R5bGVDb3VudD0iMjc2Ij4NCiAgPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIwIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iTm9ybWFsIi8+DQogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcg MSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3Jt YXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMyIvPg0KICA8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUi IE5hbWU9ImhlYWRpbmcgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgNSIvPg0KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9Imhl YWRpbmcgNiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9Ijki IFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgNyIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIv Pg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9 InRydWUiIE5hbWU9ImhlYWRpbmcgOSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgMSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgMiIvPg0KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgMyIvPg0KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgNCIvPg0KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgNSIvPg0K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2Mg NiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1l PSJ0b2MgNyIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5 IiBOYW1lPSJ0b2MgOCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBOYW1lPSJ0b2MgOSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjAiIE5hbWU9ImFubm90YXRpb24gdGV4dCIvPg0KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM1IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJjYXB0aW9u Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMCIgTmFtZT0i YW5ub3RhdGlvbiByZWZlcmVuY2UiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSIxMCIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlRpdGxlIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iMSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjExIiBTZW1pSGlkZGVu PSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i U3VidGl0bGUiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIy MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9 InRydWUiIE5hbWU9IlN0cm9uZyIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjIwIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iRW1waGFzaXMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1OSIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IlRhYmxlIEdyaWQiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iUGxhY2Vob2xkZXIgVGV4 dCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEiIFNlbWlI aWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBO YW1lPSJObyBTcGFjaW5nIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjAiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBO YW1lPSJMaWdodCBTaGFkaW5nIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJMaWdodCBMaXN0Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJMaWdodCBHcmlkIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjQiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAxIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRl V2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAxIi8+DQogIDx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIi8+DQogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIg0K ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAzIi8+DQogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIFNlbWlIaWRkZW49ImZhbHNl Ig0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QiLz4NCiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmciLz4NCiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgU2VtaUhpZGRlbj0i ZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIExpc3QiLz4N CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRl bj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIEdyaWQi Lz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhp ZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRp bmcgQWNjZW50IDEiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 IkxpZ2h0IExpc3QgQWNjZW50IDEiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDEiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVu VXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDEiLz4NCiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50 IDEiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2Vt aUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBM aXN0IDEgQWNjZW50IDEiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iUmV2aXNpb24iLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzNCIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ikxpc3QgUGFyYWdyYXBoIi8+DQog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjkiIFNlbWlIaWRkZW49 ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJR dW90ZSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjMwIiBT ZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iSW50ZW5zZSBRdW90ZSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjY2IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJm YWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgMSIvPg0KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMSIvPg0KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlkZGVuPSJmYWxz ZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQg MSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBTZW1p SGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdy aWQgMyBBY2NlbnQgMSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFt ZT0iRGFyayBMaXN0IEFjY2VudCAxIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzEiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAxIi8+DQogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCAxIi8+DQogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIFNlbWlIaWRkZW49ImZh bHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCAxIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNl bWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBT aGFkaW5nIEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBO YW1lPSJMaWdodCBMaXN0IEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRl V2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCAyIi8+DQogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIFNlbWlIaWRkZW49ImZh bHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFj Y2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUi IFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRp dW0gTGlzdCAxIEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjYiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAyIi8+DQogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIg0K ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAyIi8+ DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIFNlbWlIaWRk ZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAz IEFjY2VudCAyIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NzAiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJE YXJrIExpc3QgQWNjZW50IDIiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2Ui IE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDIiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDIiLz4NCiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDIi Lz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhp ZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRp bmcgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 IkxpZ2h0IExpc3QgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVu VXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDMiLz4NCiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50 IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2Vt aUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBM aXN0IDEgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBV bmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDMiLz4NCiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgU2VtaUhpZGRlbj0i ZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNj ZW50IDMiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIg U2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkRhcmsg TGlzdCBBY2NlbnQgMyIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjcxIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFt ZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMyIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5V c2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgMyIvPg0KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAg IFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMyIvPg0K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBTZW1pSGlkZGVu PSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgU2hhZGluZyBB Y2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYx IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGln aHQgTGlzdCBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIg TmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjYzIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2Vk PSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAg IFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNCIv Pg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBTZW1pSGlk ZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3Qg MSBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY2IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0i TWVkaXVtIExpc3QgMiBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjY3IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJm YWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNCIvPg0KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgNCIvPg0KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBTZW1pSGlkZGVuPSJmYWxz ZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQg NCIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBTZW1p SGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iRGFyayBMaXN0 IEFjY2VudCA0Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NzEiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJD b2xvcmZ1bCBTaGFkaW5nIEFjY2VudCA0Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA0Ii8+DQogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCA0Ii8+DQogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNlbWlIaWRkZW49ImZh bHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2Vu dCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEiIFNl bWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBM aXN0IEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1l PSJMaWdodCBHcmlkIEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA1Ii8+DQog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIFNlbWlIaWRkZW49 ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFj Y2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYi IFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRp dW0gTGlzdCAyIEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCA1Ii8+DQogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIg0K ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA1Ii8+ DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIFNlbWlIaWRk ZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QgQWNj ZW50IDUiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIg U2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9y ZnVsIFNoYWRpbmcgQWNjZW50IDUiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI3MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDUiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDUiLz4NCiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhpZGRlbj0iZmFsc2Ui DQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRpbmcgQWNjZW50IDYi Lz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgU2VtaUhp ZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IExpc3Qg QWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ikxp Z2h0IEdyaWQgQWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2MyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2Ui IE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDYiLz4NCiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRlbj0iZmFs c2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50 IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgU2Vt aUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBM aXN0IDIgQWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NyIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2OCIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDYiLz4NCiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgU2VtaUhpZGRlbj0iZmFsc2UiDQogICBV bmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDYiLz4NCiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgU2VtaUhpZGRlbj0i ZmFsc2UiDQogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQg NiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBTZW1p SGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwg U2hhZGluZyBBY2NlbnQgNiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIg TmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNiIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjczIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5V c2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNiIvPg0KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjE5IiBTZW1pSGlkZGVuPSJmYWxzZSINCiAg IFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIEVtcGhh c2lzIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjEiIFNl bWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVl IiBOYW1lPSJJbnRlbnNlIEVtcGhhc2lzIi8+DQogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iMzEiIFNlbWlIaWRkZW49ImZhbHNlIg0KICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdWJ0bGUgUmVmZXJlbmNlIi8+DQogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzIiIFNlbWlIaWRkZW49ImZhbHNl Ig0KICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJJbnRlbnNl IFJlZmVyZW5jZSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjMzIiBTZW1pSGlkZGVuPSJmYWxzZSINCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iQm9vayBUaXRsZSIvPg0KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjM3IiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iVE9D IEhlYWRpbmciLz4NCiA8L3c6TGF0ZW50U3R5bGVzPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDEwXT4NCjxzdHlsZT4NCiAvKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KdGFibGUu TXNvTm9ybWFsVGFibGUNCgl7bXNvLXN0eWxlLW5hbWU65pmu6YCa6KGo5qC8Ow0KCW1zby10c3R5 bGUtcm93YmFuZC1zaXplOjA7DQoJbXNvLXRzdHlsZS1jb2xiYW5kLXNpemU6MDsNCgltc28tc3R5 bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLXBhcmVu dDoiIjsNCgltc28tcGFkZGluZy1hbHQ6MGNtIDUuNHB0IDBjbSA1LjRwdDsNCgltc28tcGFyYS1t YXJnaW46MGNtOw0KCW1zby1wYXJhLW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCgltc28tcGFnaW5h dGlvbjp3aWRvdy1vcnBoYW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseTpDYW1i cmlhOw0KCW1zby1hc2NpaS1mb250LWZhbWlseTpDYW1icmlhOw0KCW1zby1hc2NpaS10aGVtZS1m b250Om1pbm9yLWxhdGluOw0KCW1zby1oYW5zaS1mb250LWZhbWlseTpDYW1icmlhOw0KCW1zby1o YW5zaS10aGVtZS1mb250Om1pbm9yLWxhdGluOw0KCW1zby1mb250LWtlcm5pbmc6MS4wcHQ7fQ0K PC9zdHlsZT4NCjwhW2VuZGlmXS0tPjwhLS1TdGFydEZyYWdtZW50LS0+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsiIGNsYXNz PSIiPkhpLDwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOiAxNHB4OyIgY2xhc3M9IiI+PHNwYW4gbGFuZz0iRU4tVVMiIGNsYXNzPSIiPkkgaGF2 ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9y YXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBw cm9jZXNzZWQgYnkgdGhlIElFU0cuIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbg0KIHByaW1h cmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlIHNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiBEb2N1 bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1 c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLjwvc3Bhbj5UaGlzIGRvY3VtZW50 IGRlZmluZXMgdGhlIENETkkgbWV0YWRhdGEgaW50ZXJmYWNlIHdoaWNoIGVuYWJsZXMgYSBDRE4g dG8gb2J0YWluIENETkkgbWV0YWRhdGENCiBmcm9tIGFub3RoZXIgb25lLiZuYnNwOzwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQt c2l6ZTogMTRweDsiIGNsYXNzPSIiPlRoZXJlIGFyZSBzb21lIGlzc3VlcyB3aGljaCBzaG91bGQg YmUgZnVydGhlciBkaXNjdXNzZWQgYmVmb3JlIHB1Ymxpc2hpbmcgdGhlIG1lbW8uDQo8bzpwIGNs YXNzPSIiPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsiIGNsYXNzPSIiPjEuIFRoZSB0aXRsZSBv ZiBTZWN0aW9uIDguMSBpcyBBdXRoZW50aWNhdGlvbiwgYnV0IHRoZSBjb250ZW50cyBhcmUgYWxs IGFib3V0IHVuYXV0aG9yaXplZCBhY2Nlc3MgdG8gbWV0YWRhdGEuIE1heWJlIHlvdSBjb3VsZCBz YXkgc29tZXRoaW5nIGxpa2Ug4oCYaWYgYW4gYXR0YWNrZXIgY2FuIGltcGVyc29uYXRlIGEgbGVn YWwNCiBDRE4gd2l0aG91dCBiZWluZyBkZXRlY3RlZCwgaXQgaXMgYWJsZSB0b+KApuKAmTxvOnAg Y2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyIgY2xhc3M9IiI+Mi4gVGhlcmUgaXMg YSBiaWcgb3ZlcmxhcCBiZXR3ZWVuIHNlY3Rpb24gOC4yLCBDb25maWRlbnRpYWxpdHkgYW5kIHNl Y3Rpb24gOC40LCBQcml2YWN5LiBJIHN1Z2dlc3QgdG8gbWVyZ2UgdGhlc2UgdHdvIHNlY3Rpb25z LjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFs aWduPSJsZWZ0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsiIGNs YXNzPSIiPjMuSW4gc2VjdGlvbiA4LjMsIHlvdSBtZW50aW9uZWQsIOKAnSBBbiBpbXBsZW1lbnRh dGlvbiBvZiB0aGUgQ0ROSSBtZXRhZGF0YSBpbnRlcmZhY2UgTVVTVCB1c2Ugc3Ryb25nIGVuY3J5 cHRpb24gYW5kIG11dHVhbCBhdXRoZW50aWNhdGlvbiB0byBwcmV2ZW50IHVuZGV0ZWN0YWJsZSBt b2RpZmljYXRpb24NCiBvZiBtZXRhZGF0YSAoc2VlIFNlY3Rpb24gOC41KS7igJ0gTm9ybWFsbHks IHdoZW4gZGlzY3Vzc2luZyBhYm91dCBpbnRlZ3JpdHkgcHJvdGVjdGlvbiwgd2UgcHJlZmVyIHRv IHVzZSBNQUMgcmF0aGVyIHRoYW4gZW5jcnlwdGlvbi4NCjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJsZWZ0Ij48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsiIGNsYXNzPSIiPjQuIEluIHNlY3Rpb24gOC41 LCB0aGVyZSBpcyBhIHN0YXRlbWVudCBhYm91dCB1c2luZyBUTFMgdG8gcHJvdmlkZSBhdXRob3Jp emF0aW9uLiBJIGRvbuKAmXQgdGhpbmsgVExTIGNhbiBkZWNpZGUgd2hpY2ggbWV0YS1kYXRhIGNh biBiZSBzZW50L3Byb2Nlc3NlZCBieSBhIENETi4NCjxvOnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJsZWZ0Ij48c3BhbiBsYW5nPSJFTi1V UyIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsiIGNsYXNzPSIiPjUuIEluIHNlY3Rpb24gNC4yLjEu MSwgaXQgaXMgc2F0ZWQgdGhhdCBieSBkZWZhdWx0IG5vIGF1dGhlbnRpY2F0aW9uIG5lZWRzIHRv IGJlIHByb3ZpZGVkIHdoZW4gcmVxdWVzdGluZyBjb250ZW50IGZyb20gYSBzb3VyY2UuIERvIHlv dSBhc3N1bWUgdGhlIHNvdXJjZSB3aWxsIHdvcmsgaW4gYSBzZWN1cmUNCiBlbnZpcm9ubWVudD88 L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFt aWx5Og0KJnF1b3Q7UFQgTW9ubyZxdW90Ozttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtQVCBN b25vJnF1b3Q7O2NvbG9yOiMxQTFBMUE7bXNvLWZvbnQta2VybmluZzowcHQiIGNsYXNzPSIiPjxv OnAgY2xhc3M9IiI+PC9vOnA+PC9zcGFuPjwvcD4NCjwhLS1FbmRGcmFnbWVudC0tPg0KPC9ib2R5 Pg0KPC9odG1sPg0K --_000_HK2PR03MB07391BCA12CFA57C7786EFA4882E0HK2PR03MB0739apcp_-- From nobody Fri Jun 24 06:23:39 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 998E112B01B for ; Fri, 24 Jun 2016 06:23:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oSZDDeum8LHi for ; Fri, 24 Jun 2016 06:23:36 -0700 (PDT) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E06FF12D0C3 for ; Fri, 24 Jun 2016 06:23:35 -0700 (PDT) Received: by mail-qk0-x230.google.com with SMTP id c73so145573007qkg.2 for ; Fri, 24 Jun 2016 06:23:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=0KU9wzKXe9NRrnXkcltu62Qz9rNN6oVg5sYZu0syuUc=; b=WmmSnr571fHSuklGLn3AFVq9IAnSQYPuoV4tcjVzC0wqxe3jKNIcZdxTYUNFCA4KQ1 wi8ua/716TEguhxQ/cP9HWx0thCIvZFXQXi84bE/JCp83OCRIa1ikF+yaeaDi+PxrTUb /363NDOit1MLOd3wWkitOTu1Wongbjw/C4eHE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=0KU9wzKXe9NRrnXkcltu62Qz9rNN6oVg5sYZu0syuUc=; b=mQuVr3/SnTnwMOpAqlJn7eHpai0vCychOX8Sd5Ar7afsLrhbN+3hPVKDSUJwFh8WkV ex1kB8RADsF/27hPi16v+6EoxbdiC0gRCsqGzuv9f3EYev5ApA+zSFNno5mms7EGlH5v 6yP3KiYWflb3mnxBGgShIVJ2OFR5miLpSVFvd6c0eYEOG+Ujf0ew3cDwWQsgs64zxALh zSjToQnOiKgWsDMVtBIcEwd9J5sW4Bh419vSPIVWwdhVEC4WRb6LUv0Iak8JWg0VrLBP mPthSNgtpEZ7Cb8NmGcPa/gRVx92PmragCtKarVJkHttFsCIDgWsUTH2B3CTsq98UXOO Lw9Q== X-Gm-Message-State: ALyK8tIuiPRPQOEHEgW/c6t/kU4EKHBgcX2ppG7RrMWDB1uUPXrJRyJzK1TfnnGUBz3iLw== X-Received: by 10.200.41.14 with SMTP id y14mr4808587qty.11.1466774614770; Fri, 24 Jun 2016 06:23:34 -0700 (PDT) Received: from [172.16.0.112] ([96.231.230.69]) by smtp.gmail.com with ESMTPSA id 13sm2141759qki.3.2016.06.24.06.23.33 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 24 Jun 2016 06:23:34 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: <915CE941-46AF-466F-A2B6-294AE387C538@sn3rd.com> Date: Fri, 24 Jun 2016 09:23:32 -0400 To: secdir@ietf.org, The IESG , draft-ietf-hip-rfc6253-bis.all@ietf.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [secdir] SecDir review of draft-ietf-hip-rfc6253-bis-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 13:23:38 -0000 I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written primarily for the benefit of the security = area directors. Document editors and WG chairs should treat these = comments just like any other last call comments. This document specifies the certificate parameter and the error = signaling in case of a failed verification. Additionally, this document = specifies the representations of Host Identity Tags in X.509 version 3 = (v3). This version deprecates the SPKI representations, makes use IAN = and SAN SHOULD vice MUST, treats all revocation reasons as = =E2=80=9Crevoked=E2=80=9D, and doesn=E2=80=99t require that the entire = cert path be sent. Summary: Ship-It. Comments: None. spt From nobody Fri Jun 24 07:01:49 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EBAB12D0C8; Fri, 24 Jun 2016 07:01:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.221 X-Spam-Level: X-Spam-Status: No, score=-104.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9rWiY42ny6ui; Fri, 24 Jun 2016 07:01:38 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43E1112DB40; Fri, 24 Jun 2016 07:01:17 -0700 (PDT) X-AuditID: c1b4fb2d-f79936d0000030e4-90-576d3d2b7472 Received: from ESESSHC004.ericsson.se (Unknown_Domain [153.88.183.30]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id B5.1E.12516.B2D3D675; Fri, 24 Jun 2016 16:01:15 +0200 (CEST) Received: from [148.135.149.68] (153.88.183.153) by smtp.internal.ericsson.com (153.88.183.32) with Microsoft SMTP Server id 14.3.294.0; Fri, 24 Jun 2016 16:01:14 +0200 To: Sean Turner , , The IESG , References: <915CE941-46AF-466F-A2B6-294AE387C538@sn3rd.com> From: Gonzalo Camarillo Message-ID: Date: Fri, 24 Jun 2016 17:01:14 +0300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <915CE941-46AF-466F-A2B6-294AE387C538@sn3rd.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrDLMWRmVeSWpSXmKPExsUyM2K7nK62bW64wb+lKhZT139mt5jxZyKz xZVVjcwWHxY+ZHFg8Viy5CeTx8GDjAFMUVw2Kak5mWWpRfp2CVwZz282sxQ0sFese3mTsYHx FmsXIyeHhICJxIrLvcwQtpjEhXvr2boYuTiEBI4wSix82cwC4axhlHi8YjY7SJWwgLXE6fVd YLaIQJXEtndXwSYJCdhIdKxZA2azCVhIbLl1nwXE5hWwlzi+8xpYPYuAqsSqN//B4qICMRKN tw+zQ9QISpyc+QQszilgK3Hn+yegOAcHs4CmxPpd+iBhZgF5ieats5khVmlLLH/WwjKBUWAW ku5ZCB2zkHQsYGRexShanFpcnJtuZKyXWpSZXFycn6eXl1qyiREYpge3/Nbdwbj6teMhRgEO RiUe3gXKOeFCrIllxZW5hxglOJiVRHhDbXLDhXhTEiurUovy44tKc1KLDzFKc7AoifP6v1QM FxJITyxJzU5NLUgtgskycXBKNTBqMvz1rNa7HF10a2bmlIzVMh7yLP8DHzm2l4SzLZFWk2Hf 7hvxMoip8O6pD19zzjWflmKcXCK14MjHSWvEs4pywgzm7NjHOd/w4qkbjRsTTiSIFXXopZf7 t9qozZ+74rvZg+Ddby9+DfykHmezT5Az+rjhbxO2NXKBC5ymOj6fOZvLQECf8ZMSS3FGoqEW c1FxIgCihcgMTwIAAA== Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-hip-rfc6253-bis-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 14:01:41 -0000 Thanks for the review, Sean! Gonzalo On 24/06/2016 4:23 PM, Sean Turner wrote: > I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. > > This document specifies the certificate parameter and the error signaling in case of a failed verification. Additionally, this document specifies the representations of Host Identity Tags in X.509 version 3 (v3). This version deprecates the SPKI representations, makes use IAN and SAN SHOULD vice MUST, treats all revocation reasons as “revoked”, and doesn’t require that the entire cert path be sent. > > Summary: Ship-It. > > Comments: None. > > spt > From nobody Fri Jun 24 09:36:05 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04DBF12DC42 for ; Fri, 24 Jun 2016 09:36:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xhW6jW_0Yfg1 for ; Fri, 24 Jun 2016 09:35:57 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 915B712DCBE for ; Fri, 24 Jun 2016 09:31:58 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 6B86B300498 for ; Fri, 24 Jun 2016 12:31:56 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Z486EiDO3gZb for ; Fri, 24 Jun 2016 12:31:55 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id B8DF230048F; Fri, 24 Jun 2016 12:31:54 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Fri, 24 Jun 2016 12:30:32 -0400 Message-Id: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> To: draft-ietf-nfsv4-multi-domain-fs-reqs.all@ietf.org Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IESG , IETF SecDir Subject: [secdir] SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 16:36:00 -0000 I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. Version reviewed: draft-ietf-nfsv4-multi-domain-fs-reqs-08 Summary: Not Ready Major Concerns: The whole document needs an editing pass. In many places it talks about issues. To be consistent with the title of the document, it should be talking about guidance or deployment alternatives. The Abstract does not reflect the content of the document. Please rewrite the Abstract. Some things that I believe belong in the Abstract include: - This document provide guidance on the deployment of the NFSv4 protocols in environments with multiple NFSv4 domains. - The server must offer a multi-domain-capable file system and support RPCSEC_GSS for user authentication. - The server must also support identity mapping. I did not find the Introduction helpful. I really needed to read the whole document to get a feeling to the guidance that it contains. The reader needs some background that is not directly explained in the Introduction. I suggest some topics that should be covered in the Introduction: - Point to NFSv4 specifications - Users and Groups are named with the name@domain syntax - Explain the difference between an NFS domain and NFSv4 domain - This document provides guidance on deploying servers that support multiple NFSv4 domains - Features that the NFSv4 server must implementation to work in this environment I think it might also be useful to explain some other concepts toward the front of the document, but I am not sure if they belong in the Introduction or the Terminology section: - Stand-alone NFSv4 domain - Federated File System (FedFS) In Section 1, it says: Multi-domain deployments require support for global identities in name services and security services, and file systems capable of the on-disk representation of identities belonging to multiple NFSv4 domains. I do not think that "global" is the right term here. The identities clearly need to be unique across all of the NFSv4 domains involved, but this may not mean global uniqueness. In Section 4, please provide a pointers for AUTH_NONE, AUTH_SYS, and RPCSEC_GSS. In section 5.2, it says: The AUTH_NONE security flavor can be useful in a multi-domain deployment to grant universal access to public data without any credentials. I assume this is read-only access. If my assumption is correct, please expand this paragraph to cover this point. In Section 8, it says: ... We don't treat them fully here, but implementors should study the protocols in question to get a more complete set of security considerations. Does the first paragraph os Section 8 include all of the references that are relevant. If so, then I do not understand the point of this sentence. If not, then please expand the first paragraph of Section 8 to cover all of the places that an implementer needs to look. Minor Concerns: The first sentence of the introduction says: An NFSv4 domain is defined as a set of users and groups named by a particular domain using the NFSv4 name@domain syntax. Please define "domain" without using that word in the definition. In Section 8, it says: ... Even when not using labeled security, since there could be many realms (credential issuer) for a given server, it's important to verify that the server a client is talking to has a credential for the name the client has for the server, and that that credential's issuer (i.e., its realm) is allowed to issue it. I cannot figure this out. First, it has nothing to do with security labels, so it might deserve a paragraph of its own. Second, maybe the point can be made more directly, perhaps something that begins: "When the server accepts user credential from more than one realm, then the server must verify that ... and ...". Third, the points in the last paragraph of Section 8 should be made before this one. Nits: Please pick one spelling and use it throughout the document: - unix or UNIX - uid or UID - gid or GID - AUTH_NONE or AUTH_NULL In Section 2, it says: Stringified UID or GID: NFSv4 owner and group strings that consist of decimal numeric values with no leading zeros, and which do not contain an '@' sign. See Section 5.9 "Interpreting owner and owner_group" [RFC5661]. Please reword the last sentence so that it is clear that this is a pointer to Section 5.9 of RFC 5661. From nobody Fri Jun 24 14:24:06 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D28FA12D674; Fri, 24 Jun 2016 14:24:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.327 X-Spam-Level: X-Spam-Status: No, score=-8.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ovWMGtXqNgYy; Fri, 24 Jun 2016 14:23:56 -0700 (PDT) Received: from mx144.netapp.com (mx144.netapp.com [216.240.21.25]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E00F12B012; Fri, 24 Jun 2016 14:23:56 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.26,522,1459839600"; d="scan'208";a="124917471" Received: from hioexcmbx07-prd.hq.netapp.com ([10.122.105.40]) by mx144-out.netapp.com with ESMTP; 24 Jun 2016 14:22:21 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com (10.122.105.36) by hioexcmbx07-prd.hq.netapp.com (10.122.105.40) with Microsoft SMTP Server (TLS) id 15.0.1156.6; Fri, 24 Jun 2016 14:22:18 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com ([::1]) by hioexcmbx03-prd.hq.netapp.com ([fe80::bc9d:c26a:65b2:409%21]) with mapi id 15.00.1156.000; Fri, 24 Jun 2016 14:22:18 -0700 From: "Adamson, Andy" To: Russ Housley Thread-Topic: SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 Thread-Index: AQHRzjdtyikHWcv0hU2EfZTj9Mg2CJ/5leOA Date: Fri, 24 Jun 2016 21:22:18 +0000 Message-ID: <2CEDD215-51CA-4399-AC1C-A2997D4BDE8E@netapp.com> References: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> In-Reply-To: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3112) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.122.56.79] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-nfsv4-multi-domain-fs-reqs.all@ietf.org" , IESG , IETF SecDir Subject: Re: [secdir] SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 21:24:01 -0000 SGVsbG8gUnVzcw0KDQpUaGFua3MgZm9yIHRoZSByZXZpZXcuIEnigJlsbCByZXNwb25kIHNvb24u DQoNCuKAlD5BbmR5DQoNCj4gT24gSnVuIDI0LCAyMDE2LCBhdCAxMjozMCBQTSwgUnVzcyBIb3Vz bGV5IDxob3VzbGV5QHZpZ2lsc2VjLmNvbT4gd3JvdGU6DQo+IA0KPiBJIHJldmlld2VkIHRoaXMg ZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgU2VjdXJpdHkgRGlyZWN0b3JhdGUncyBvbmdvaW5nDQo+ IGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0 aGUgSUVTRy4gIFRoZXNlDQo+IGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRo ZSBiZW5lZml0IG9mIHRoZSBTZWN1cml0eSBBcmVhDQo+IERpcmVjdG9ycy4gIERvY3VtZW50IGF1 dGhvcnMsIGRvY3VtZW50IGVkaXRvcnMsIGFuZCBXRyBjaGFpcnMgc2hvdWxkDQo+IHRyZWF0IHRo ZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgSUVURiBMYXN0IENhbGwgY29tbWVudHMu DQo+IA0KPiBWZXJzaW9uIHJldmlld2VkOiBkcmFmdC1pZXRmLW5mc3Y0LW11bHRpLWRvbWFpbi1m cy1yZXFzLTA4DQo+IA0KPiANCj4gU3VtbWFyeTogTm90IFJlYWR5DQo+IA0KPiANCj4gTWFqb3Ig Q29uY2VybnM6DQo+IA0KPiBUaGUgd2hvbGUgZG9jdW1lbnQgbmVlZHMgYW4gZWRpdGluZyBwYXNz LiAgSW4gbWFueSBwbGFjZXMgaXQgdGFsa3MgYWJvdXQNCj4gaXNzdWVzLiAgVG8gYmUgY29uc2lz dGVudCB3aXRoIHRoZSB0aXRsZSBvZiB0aGUgZG9jdW1lbnQsIGl0IHNob3VsZCBiZQ0KPiB0YWxr aW5nIGFib3V0IGd1aWRhbmNlIG9yIGRlcGxveW1lbnQgYWx0ZXJuYXRpdmVzLg0KPiANCj4gVGhl IEFic3RyYWN0IGRvZXMgbm90IHJlZmxlY3QgdGhlIGNvbnRlbnQgb2YgdGhlIGRvY3VtZW50LiAg UGxlYXNlDQo+IHJld3JpdGUgdGhlIEFic3RyYWN0LiAgU29tZSB0aGluZ3MgdGhhdCBJIGJlbGll dmUgYmVsb25nIGluIHRoZSBBYnN0cmFjdA0KPiBpbmNsdWRlOg0KPiANCj4gLSBUaGlzIGRvY3Vt ZW50IHByb3ZpZGUgZ3VpZGFuY2Ugb24gdGhlIGRlcGxveW1lbnQgb2YgdGhlIE5GU3Y0DQo+ICAg cHJvdG9jb2xzIGluIGVudmlyb25tZW50cyB3aXRoIG11bHRpcGxlIE5GU3Y0IGRvbWFpbnMuDQo+ IC0gVGhlIHNlcnZlciBtdXN0IG9mZmVyIGEgbXVsdGktZG9tYWluLWNhcGFibGUgZmlsZSBzeXN0 ZW0gYW5kIHN1cHBvcnQNCj4gICBSUENTRUNfR1NTIGZvciB1c2VyIGF1dGhlbnRpY2F0aW9uLg0K PiAtIFRoZSBzZXJ2ZXIgbXVzdCBhbHNvIHN1cHBvcnQgaWRlbnRpdHkgbWFwcGluZy4NCj4gDQo+ IA0KPiBJIGRpZCBub3QgZmluZCB0aGUgSW50cm9kdWN0aW9uIGhlbHBmdWwuICBJIHJlYWxseSBu ZWVkZWQgdG8gcmVhZCB0aGUNCj4gd2hvbGUgZG9jdW1lbnQgdG8gZ2V0IGEgZmVlbGluZyB0byB0 aGUgZ3VpZGFuY2UgdGhhdCBpdCBjb250YWlucy4gIFRoZQ0KPiByZWFkZXIgbmVlZHMgc29tZSBi YWNrZ3JvdW5kIHRoYXQgaXMgbm90IGRpcmVjdGx5IGV4cGxhaW5lZCBpbiB0aGUgDQo+IEludHJv ZHVjdGlvbi4gIEkgc3VnZ2VzdCBzb21lIHRvcGljcyB0aGF0IHNob3VsZCBiZSBjb3ZlcmVkIGlu IHRoZQ0KPiBJbnRyb2R1Y3Rpb246DQo+IA0KPiAtIFBvaW50IHRvIE5GU3Y0IHNwZWNpZmljYXRp b25zDQo+IC0gVXNlcnMgYW5kIEdyb3VwcyBhcmUgbmFtZWQgd2l0aCB0aGUgbmFtZUBkb21haW4g c3ludGF4DQo+IC0gRXhwbGFpbiB0aGUgZGlmZmVyZW5jZSBiZXR3ZWVuIGFuIE5GUyBkb21haW4g YW5kIE5GU3Y0IGRvbWFpbg0KPiAtIFRoaXMgZG9jdW1lbnQgcHJvdmlkZXMgZ3VpZGFuY2Ugb24g ZGVwbG95aW5nIHNlcnZlcnMgdGhhdCBzdXBwb3J0DQo+ICAgbXVsdGlwbGUgTkZTdjQgZG9tYWlu cw0KPiAtIEZlYXR1cmVzIHRoYXQgdGhlIE5GU3Y0IHNlcnZlciBtdXN0IGltcGxlbWVudGF0aW9u IHRvIHdvcmsgaW4gdGhpcw0KPiAgIGVudmlyb25tZW50DQo+IA0KPiANCj4gSSB0aGluayBpdCBt aWdodCBhbHNvIGJlIHVzZWZ1bCB0byBleHBsYWluIHNvbWUgb3RoZXIgY29uY2VwdHMgdG93YXJk DQo+IHRoZSBmcm9udCBvZiB0aGUgZG9jdW1lbnQsIGJ1dCBJIGFtIG5vdCBzdXJlIGlmIHRoZXkg YmVsb25nIGluIHRoZQ0KPiBJbnRyb2R1Y3Rpb24gb3IgdGhlIFRlcm1pbm9sb2d5IHNlY3Rpb246 DQo+IA0KPiAtIFN0YW5kLWFsb25lIE5GU3Y0IGRvbWFpbg0KPiAtIEZlZGVyYXRlZCBGaWxlIFN5 c3RlbSAoRmVkRlMpDQo+IA0KPiANCj4gSW4gU2VjdGlvbiAxLCBpdCBzYXlzOg0KPiANCj4gICBN dWx0aS1kb21haW4gZGVwbG95bWVudHMgcmVxdWlyZSBzdXBwb3J0IGZvciBnbG9iYWwgaWRlbnRp dGllcyBpbg0KPiAgIG5hbWUgc2VydmljZXMgYW5kIHNlY3VyaXR5IHNlcnZpY2VzLCBhbmQgZmls ZSBzeXN0ZW1zIGNhcGFibGUgb2YgdGhlDQo+ICAgb24tZGlzayByZXByZXNlbnRhdGlvbiBvZiBp ZGVudGl0aWVzIGJlbG9uZ2luZyB0byBtdWx0aXBsZSBORlN2NA0KPiAgIGRvbWFpbnMuDQo+IA0K PiBJIGRvIG5vdCB0aGluayB0aGF0ICJnbG9iYWwiIGlzIHRoZSByaWdodCB0ZXJtIGhlcmUuICBU aGUgaWRlbnRpdGllcw0KPiBjbGVhcmx5IG5lZWQgdG8gYmUgdW5pcXVlIGFjcm9zcyBhbGwgb2Yg dGhlIE5GU3Y0IGRvbWFpbnMgaW52b2x2ZWQsIGJ1dA0KPiB0aGlzIG1heSBub3QgbWVhbiBnbG9i YWwgdW5pcXVlbmVzcy4NCj4gDQo+IA0KPiBJbiBTZWN0aW9uIDQsIHBsZWFzZSBwcm92aWRlIGEg cG9pbnRlcnMgZm9yIEFVVEhfTk9ORSwgQVVUSF9TWVMsDQo+IGFuZCBSUENTRUNfR1NTLg0KPiAN Cj4gDQo+IEluIHNlY3Rpb24gNS4yLCBpdCBzYXlzOg0KPiANCj4gICBUaGUgQVVUSF9OT05FIHNl Y3VyaXR5IGZsYXZvciBjYW4gYmUgdXNlZnVsIGluIGEgbXVsdGktZG9tYWluDQo+ICAgZGVwbG95 bWVudCB0byBncmFudCB1bml2ZXJzYWwgYWNjZXNzIHRvIHB1YmxpYyBkYXRhIHdpdGhvdXQgYW55 DQo+ICAgY3JlZGVudGlhbHMuDQo+IA0KPiBJIGFzc3VtZSB0aGlzIGlzIHJlYWQtb25seSBhY2Nl c3MuICBJZiBteSBhc3N1bXB0aW9uIGlzIGNvcnJlY3QsDQo+IHBsZWFzZSBleHBhbmQgdGhpcyBw YXJhZ3JhcGggdG8gY292ZXIgdGhpcyBwb2ludC4NCj4gDQo+IA0KPiBJbiBTZWN0aW9uIDgsIGl0 IHNheXM6DQo+IA0KPiAgIC4uLiAgV2UgZG9uJ3QNCj4gICB0cmVhdCB0aGVtIGZ1bGx5IGhlcmUs IGJ1dCBpbXBsZW1lbnRvcnMgc2hvdWxkIHN0dWR5IHRoZSBwcm90b2NvbHMgaW4NCj4gICBxdWVz dGlvbiB0byBnZXQgYSBtb3JlIGNvbXBsZXRlIHNldCBvZiBzZWN1cml0eSBjb25zaWRlcmF0aW9u cy4NCj4gDQo+IERvZXMgdGhlIGZpcnN0IHBhcmFncmFwaCBvcyBTZWN0aW9uIDggaW5jbHVkZSBh bGwgb2YgdGhlIHJlZmVyZW5jZXMNCj4gdGhhdCBhcmUgcmVsZXZhbnQuICBJZiBzbywgdGhlbiBJ IGRvIG5vdCB1bmRlcnN0YW5kIHRoZSBwb2ludCBvZiB0aGlzDQo+IHNlbnRlbmNlLiAgSWYgbm90 LCB0aGVuIHBsZWFzZSBleHBhbmQgdGhlIGZpcnN0IHBhcmFncmFwaCBvZiBTZWN0aW9uIDgNCj4g dG8gY292ZXIgYWxsIG9mIHRoZSBwbGFjZXMgdGhhdCBhbiBpbXBsZW1lbnRlciBuZWVkcyB0byBs b29rLg0KPiANCj4gDQo+IE1pbm9yIENvbmNlcm5zOg0KPiANCj4gVGhlIGZpcnN0IHNlbnRlbmNl IG9mIHRoZSBpbnRyb2R1Y3Rpb24gc2F5czoNCj4gDQo+ICAgQW4gTkZTdjQgZG9tYWluIGlzIGRl ZmluZWQgYXMgYSBzZXQgb2YgdXNlcnMgYW5kIGdyb3VwcyBuYW1lZCBieSBhDQo+ICAgcGFydGlj dWxhciBkb21haW4gdXNpbmcgdGhlIE5GU3Y0IG5hbWVAZG9tYWluIHN5bnRheC4NCj4gDQo+IFBs ZWFzZSBkZWZpbmUgImRvbWFpbiIgd2l0aG91dCB1c2luZyB0aGF0IHdvcmQgaW4gdGhlIGRlZmlu aXRpb24uDQo+IA0KPiANCj4gSW4gU2VjdGlvbiA4LCBpdCBzYXlzOg0KPiANCj4gICAuLi4gRXZl biB3aGVuIG5vdCB1c2luZyBsYWJlbGVkDQo+ICAgc2VjdXJpdHksIHNpbmNlIHRoZXJlIGNvdWxk IGJlIG1hbnkgcmVhbG1zIChjcmVkZW50aWFsIGlzc3VlcikgZm9yIGENCj4gICBnaXZlbiBzZXJ2 ZXIsIGl0J3MgaW1wb3J0YW50IHRvIHZlcmlmeSB0aGF0IHRoZSBzZXJ2ZXIgYSBjbGllbnQgaXMN Cj4gICB0YWxraW5nIHRvIGhhcyBhIGNyZWRlbnRpYWwgZm9yIHRoZSBuYW1lIHRoZSBjbGllbnQg aGFzIGZvciB0aGUNCj4gICBzZXJ2ZXIsIGFuZCB0aGF0IHRoYXQgY3JlZGVudGlhbCdzIGlzc3Vl ciAoaS5lLiwgaXRzIHJlYWxtKSBpcw0KPiAgIGFsbG93ZWQgdG8gaXNzdWUgaXQuICANCj4gDQo+ IEkgY2Fubm90IGZpZ3VyZSB0aGlzIG91dC4gIEZpcnN0LCBpdCBoYXMgbm90aGluZyB0byBkbyB3 aXRoIHNlY3VyaXR5DQo+IGxhYmVscywgc28gaXQgbWlnaHQgZGVzZXJ2ZSBhIHBhcmFncmFwaCBv ZiBpdHMgb3duLiAgU2Vjb25kLCBtYXliZSB0aGUNCj4gcG9pbnQgY2FuIGJlIG1hZGUgbW9yZSBk aXJlY3RseSwgcGVyaGFwcyBzb21ldGhpbmcgdGhhdCBiZWdpbnM6ICJXaGVuDQo+IHRoZSBzZXJ2 ZXIgYWNjZXB0cyB1c2VyIGNyZWRlbnRpYWwgZnJvbSBtb3JlIHRoYW4gb25lIHJlYWxtLCB0aGVu IHRoZQ0KPiBzZXJ2ZXIgbXVzdCB2ZXJpZnkgdGhhdCAuLi4gYW5kIC4uLiIuICBUaGlyZCwgdGhl IHBvaW50cyBpbiB0aGUgbGFzdA0KPiBwYXJhZ3JhcGggb2YgU2VjdGlvbiA4IHNob3VsZCBiZSBt YWRlIGJlZm9yZSB0aGlzIG9uZS4NCj4gDQo+IA0KPiBOaXRzOg0KPiANCj4gUGxlYXNlIHBpY2sg b25lIHNwZWxsaW5nIGFuZCB1c2UgaXQgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQ6DQo+ICAgLSB1 bml4IG9yIFVOSVgNCj4gICAtIHVpZCBvciBVSUQNCj4gICAtIGdpZCBvciBHSUQNCj4gICAtIEFV VEhfTk9ORSBvciBBVVRIX05VTEwNCj4gDQo+IA0KPiBJbiBTZWN0aW9uIDIsIGl0IHNheXM6DQo+ IA0KPiAgICAgIFN0cmluZ2lmaWVkIFVJRCBvciBHSUQ6IE5GU3Y0IG93bmVyIGFuZCBncm91cCBz dHJpbmdzIHRoYXQgY29uc2lzdA0KPiAgICAgIG9mIGRlY2ltYWwgbnVtZXJpYyB2YWx1ZXMgd2l0 aCBubyBsZWFkaW5nIHplcm9zLCBhbmQgd2hpY2ggZG8gbm90DQo+ICAgICAgY29udGFpbiBhbiAn QCcgc2lnbi4gIFNlZSBTZWN0aW9uIDUuOSAiSW50ZXJwcmV0aW5nIG93bmVyIGFuZA0KPiAgICAg IG93bmVyX2dyb3VwIiBbUkZDNTY2MV0uDQo+IA0KPiBQbGVhc2UgcmV3b3JkIHRoZSBsYXN0IHNl bnRlbmNlIHNvIHRoYXQgaXQgaXMgY2xlYXIgdGhhdCB0aGlzIGlzIGENCj4gcG9pbnRlciB0byBT ZWN0aW9uIDUuOSBvZiBSRkMgNTY2MS4NCj4gDQo+IA0KDQo= From nobody Sun Jun 26 17:14:47 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C0DA12D090 for ; Sun, 26 Jun 2016 17:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ljZ-aXY4lJlV for ; Sun, 26 Jun 2016 17:14:43 -0700 (PDT) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42FB012B01C for ; Sun, 26 Jun 2016 17:14:43 -0700 (PDT) Received: from [10.32.60.91] (142-254-17-215.dsl.dynamic.fusionbroadband.com [142.254.17.215]) (authenticated bits=0) by mail.proper.com (8.15.2/8.14.9) with ESMTPSA id u5R0EeaO057095 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 26 Jun 2016 17:14:41 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 142-254-17-215.dsl.dynamic.fusionbroadband.com [142.254.17.215] claimed to be [10.32.60.91] From: "Paul Hoffman" To: secdir Date: Sun, 26 Jun 2016 17:14:40 -0700 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.4r5234) Archived-At: Subject: [secdir] SecDir review of draft-ietf-grow-blackholing X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 00:14:44 -0000 This draft, "BLACKHOLE BGP Community for Blackholing", describes a new optional BGP community with the specific semantics of "please blackhole this traffic for me". The idea is to have a single common community instead of all the ad hoc communities that ISPs have created for this semantic. The beginning of the security considerations section is daunting in that it says, in essence, "BGP has no authentication, so injecting dangerous messages is trivial; thus this new dangerous community is not a problem". It then goes on to say "and this new community can be used as a DoS by your downstream peers because they can tell you lies, but you were already susceptible to those lies". And then "and this can be used for CPU exhaustion against you if you're not careful" without saying how to be careful. There are currently two active threads on ietf@ about security implications of this draft. There are questions about whether this draft lacks enough specificity to prevent CPU exhaustion attacks even from well-meaning peers, whether it should be standards track given that it is underspecified, whether it should suggest that IXPs should implement it, and other questions seem to be coming up. I think that this document *might* be OK as an Informational RFC if there is more discussion about how to prevent a CPU exhaustion attack for recipients and more MUSTs instead of SHOULDs for what other communities need to be applied to these messages. --Paul Hoffman From nobody Sun Jun 26 21:06:58 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8487812D11D; Sun, 26 Jun 2016 21:06:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gq3cs9_1jPHm; Sun, 26 Jun 2016 21:06:48 -0700 (PDT) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 625B112B053; Sun, 26 Jun 2016 21:06:48 -0700 (PDT) X-AuditID: c618062d-f79886d000002334-91-57709c2c3cf5 Received: from EUSAAHC002.ericsson.se (Unknown_Domain [147.117.188.78]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 0D.8A.09012.C2C90775; Mon, 27 Jun 2016 05:23:24 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC002.ericsson.se ([147.117.188.78]) with mapi id 14.03.0294.000; Mon, 27 Jun 2016 00:06:46 -0400 From: Kevin Ma J To: Zhang Dacheng , The IESG , "secdir@ietf.org" Thread-Topic: SecDir review of draft-ietf-cdni-metadata-18 Thread-Index: AQHRzf0udJRVHEg89kyuP27YcBgwfJ/8r8fQ Date: Mon, 27 Jun 2016 04:06:46 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.12] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206E355DCeusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrAIsWRmVeSWpSXmKPExsUyuXSPn67OnIJwg4OfrC3OXVjKZjHjz0Rm iw8LH7JYvL9wjsWBxeNxzxk2jyVLfjJ5fLn8mS2AOYrLJiU1J7MstUjfLoEr482CZ0wFp0or Zi1ZydzAuKWoi5GTQ0LARGLiyzYWCFtM4sK99WxdjFwcQgJHGSVaHu9kB0kICSxnlHjUUgli swloSTz++pcJxBYRyJPYuGorG4jNLJAosXT7FjBbWMBS4uP+K4wQNVYSu7f+YYOwjSQuXfwL FmcRUJXY8KePFcTmFfCVODt9NtAuDqBdMRI7T/KChDkFYiWWX7kI1soIdNv3U2uYIFaJS9x6 Mp8J4mYBiSV7zjND2KISLx//Y4WwlSTmvL7GDFGfL7Ht4gIWiFWCEidnPmGZwCg6C8moWUjK ZiEpmwV0EbOApsT6XfoQJYoSU7ofskPYGhKtc+ayI4svYGRfxchRWlyQk5tuZLCJERhvxyTY dHcw3p/ueYhRgINRiYdXQaIgXIg1say4MvcQowQHs5II7/pFQCHelMTKqtSi/Pii0pzU4kOM 0hwsSuK8Yo8Uw4UE0hNLUrNTUwtSi2CyTBycUg2MG5y/f+O48uDj9W8iU1oat8hvN/K7kvUn TmPelOyamWs52a54efipv9iW/cdzY1V4MX9DQaTA9avhuw9Ir1c8dqRNUDbd/PCTsDeP8/4f 2Kjz857vi5e+gimODoprtavM3Ntuvt/9TIRJJOn3J6fehUYXst53r/9066X9UV6Dxd9/xG57 btubpcRSnJFoqMVcVJwIAHduS4SzAgAA Archived-At: Cc: "draft-ietf-cdni-metadata.all@tools.ietf.org" Subject: Re: [secdir] SecDir review of draft-ietf-cdni-metadata-18 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 04:06:50 -0000 --_000_A419F67F880AB2468214E154CB8A556206E355DCeusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGFjaGVuZywNCg0KDQoNCiAgVGhhbmsgeW91IGZvciB0aGUgcmV2aWV3Lg0KICAxLTMuIFdl IHdpbGwgdXBkYXRlIHRoZSB0ZXh0IGluIHRoZSBuZXh0IHJldmlzaW9uLg0KICA0LiBJIHRoaW5r IHRoZSB0aG91Z2h0IHdhcyB0aGF0IG9uY2UgYXV0aGVudGljYXRlZCwgYW5kIGFzc3VtaW5nIHRo YXQgZENETnMgaGF2ZSBhY2Nlc3MgdG8gYWxsIG1ldGFkYXRhIGFjY2Vzc2libGUgZnJvbSB0aGF0 IEhvc3RJbmRleCwgdGhlbiB0aGUgZENETiBpcyBhdXRob3JpemVkIHRvIHJldHJpZXZlIHRoZSBt ZXRhZGF0YTsgd2UgZGlkIG5vdCB0cnkgdG8gZGlmZmVyZW50aWF0ZSBhdXRob3JpemF0aW9uIG9m IGRpZmZlcmVudCBtZXRhZGF0YSBpbiB0aGUgdHJlZS4gIERvIHlvdSB0aGluayBpdCB3b3VsZCBi ZSBiZXN0IHRvIGp1c3QgcmVtb3ZlIHRoYXQgYnVsbGV0LCBvciB0cnkgdG8gY2xhcmlmeSB0aGUg dGV4dD8NCiAgNS4gVGhlIFNvdXJjZSBtZXRhZGF0YSB0ZWxscyB0aGUgZENETiBmcm9tIHdoZXJl IGl0IG1heSBhY3F1aXJlIHRoZSBjb250ZW50IHRoYXQgaXQgaXMgZ29pbmcgdG8gZGlzdHJpYnV0 ZS4gIEdlbmVyYWxseSwgY29udGVudCBkZWxpdmVyeSBpcyBub3QgbmVjZXNzYXJpbHkgYXV0aGVu dGljYXRlZC4gIFRoZSBkQ0ROIGlzIGxpa2VseSBqdXN0IHB1bGxpbmcgdGhlIGNvbnRlbnQgZnJv bSBhIHVDRE4gY2FjaGUsIGFuZCB0aHVzIHdvdWxkIGhhdmUgd2hhdGV2ZXIgYXV0aGVudGljYXRp b24gcG9saWN5IGlzIHNldCB0aGVyZSAod2hpY2ggY291bGQgYmUgbm9uZSkuICBUaGUgQ0ROSSBk ZWxpdmVyeSBhdXRoZW50aWNhdGlvbiBtZWNoYW5pc20gaXMgYmVpbmcgZGVmaW5lZCBpbiBkcmFm dC1pZXRmLWNkbmktdXJpLXNpZ25pbmcuICBJZiBkZXNpcmVkLCB0aGUgVVJJIFNpZ25pbmcgb2Jq ZWN0IGNvdWxkIGJlIGFkZGVkLiAgSWYgVVJJIFNpZ25pbmcgaXMgcmVxdWlyZWQgYnkgdGhlIGNv bnRlbnQgb3duZXIsIHRoZSBDRE5zIGFyZSByZXF1aXJlZCB0byBtYWludGFpbiBpdDsgYnV0IGlm IHRoZSBjb250ZW50IG93bmVyIGRvZXNuJ3QgY2FyZSAoZS5nLiwgdGhlIGFzc2V0IGlzIG5vdCB2 YWx1YWJsZSksIGFuZCB0aGUgdUNETiBkb2Vzbid0IGNhcmUgKGUuZy4sIHRoZXJlIGlzIG5vIERv UyBjb25jZXJuKSwgdGhlbiB0aGUgY29udGVudCBjYW4gYmUgc2VudCB1bmF1dGhlbnRpY2F0ZWQs IHJlZ2FyZGxlc3Mgb2YgdGhlIHNlY3VyaXR5IG9mIHRoZSBlbnZpcm9ubWVudC4NCg0KdGhhbngh DQoNCi0tICBLZXZpbiBKLiBNYQ0KDQpGcm9tOiBaaGFuZyBEYWNoZW5nIFttYWlsdG86emhhbmdf ZGFjaGVuZ0Bob3RtYWlsLmNvbV0NClNlbnQ6IEZyaWRheSwgSnVuZSAyNCwgMjAxNiA1OjQ2IEFN DQpUbzogVGhlIElFU0c7IHNlY2RpckBpZXRmLm9yZw0KQ2M6IGRyYWZ0LWlldGYtY2RuaS1tZXRh ZGF0YS5hbGxAdG9vbHMuaWV0Zi5vcmcNClN1YmplY3Q6IFNlY0RpciByZXZpZXcgb2YgZHJhZnQt aWV0Zi1jZG5pLW1ldGFkYXRhLTE4DQoNCkhpLA0KSSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1l bnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0 byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4g VGhlc2UgY29tbWVudHMgd2VyZSB3cml0dGVuIHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2Yg dGhlIHNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFp cnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBj YWxsIGNvbW1lbnRzLlRoaXMgZG9jdW1lbnQgZGVmaW5lcyB0aGUgQ0ROSSBtZXRhZGF0YSBpbnRl cmZhY2Ugd2hpY2ggZW5hYmxlcyBhIENETiB0byBvYnRhaW4gQ0ROSSBtZXRhZGF0YSBmcm9tIGFu b3RoZXIgb25lLg0KVGhlcmUgYXJlIHNvbWUgaXNzdWVzIHdoaWNoIHNob3VsZCBiZSBmdXJ0aGVy IGRpc2N1c3NlZCBiZWZvcmUgcHVibGlzaGluZyB0aGUgbWVtby4NCjEuIFRoZSB0aXRsZSBvZiBT ZWN0aW9uIDguMSBpcyBBdXRoZW50aWNhdGlvbiwgYnV0IHRoZSBjb250ZW50cyBhcmUgYWxsIGFi b3V0IHVuYXV0aG9yaXplZCBhY2Nlc3MgdG8gbWV0YWRhdGEuIE1heWJlIHlvdSBjb3VsZCBzYXkg c29tZXRoaW5nIGxpa2Ug4oCYaWYgYW4gYXR0YWNrZXIgY2FuIGltcGVyc29uYXRlIGEgbGVnYWwg Q0ROIHdpdGhvdXQgYmVpbmcgZGV0ZWN0ZWQsIGl0IGlzIGFibGUgdG/igKbigJkNCjIuIFRoZXJl IGlzIGEgYmlnIG92ZXJsYXAgYmV0d2VlbiBzZWN0aW9uIDguMiwgQ29uZmlkZW50aWFsaXR5IGFu ZCBzZWN0aW9uIDguNCwgUHJpdmFjeS4gSSBzdWdnZXN0IHRvIG1lcmdlIHRoZXNlIHR3byBzZWN0 aW9ucy4NCjMuSW4gc2VjdGlvbiA4LjMsIHlvdSBtZW50aW9uZWQsIOKAnSBBbiBpbXBsZW1lbnRh dGlvbiBvZiB0aGUgQ0ROSSBtZXRhZGF0YSBpbnRlcmZhY2UgTVVTVCB1c2Ugc3Ryb25nIGVuY3J5 cHRpb24gYW5kIG11dHVhbCBhdXRoZW50aWNhdGlvbiB0byBwcmV2ZW50IHVuZGV0ZWN0YWJsZSBt b2RpZmljYXRpb24gb2YgbWV0YWRhdGEgKHNlZSBTZWN0aW9uIDguNSku4oCdIE5vcm1hbGx5LCB3 aGVuIGRpc2N1c3NpbmcgYWJvdXQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHdlIHByZWZlciB0byB1 c2UgTUFDIHJhdGhlciB0aGFuIGVuY3J5cHRpb24uDQo0LiBJbiBzZWN0aW9uIDguNSwgdGhlcmUg aXMgYSBzdGF0ZW1lbnQgYWJvdXQgdXNpbmcgVExTIHRvIHByb3ZpZGUgYXV0aG9yaXphdGlvbi4g SSBkb27igJl0IHRoaW5rIFRMUyBjYW4gZGVjaWRlIHdoaWNoIG1ldGEtZGF0YSBjYW4gYmUgc2Vu dC9wcm9jZXNzZWQgYnkgYSBDRE4uDQo1LiBJbiBzZWN0aW9uIDQuMi4xLjEsIGl0IGlzIHNhdGVk IHRoYXQgYnkgZGVmYXVsdCBubyBhdXRoZW50aWNhdGlvbiBuZWVkcyB0byBiZSBwcm92aWRlZCB3 aGVuIHJlcXVlc3RpbmcgY29udGVudCBmcm9tIGEgc291cmNlLiBEbyB5b3UgYXNzdW1lIHRoZSBz b3VyY2Ugd2lsbCB3b3JrIGluIGEgc2VjdXJlIGVudmlyb25tZW50Pw0K --_000_A419F67F880AB2468214E154CB8A556206E355DCeusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29QbGFpblRleHQsIGxpLk1zb1Bs YWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNv LXN0eWxlLWxpbms6IlBsYWluIFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5 Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFu LlBsYWluVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IlBsYWluIFRleHQgQ2hhciI7DQoJbXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IjsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4 PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8 bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0i MSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5 IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5IaSBEYWNoZW5nLDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mbmJzcDsgVGhhbmsgeW91IGZvciB0aGUgcmV2aWV3Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAxLTMu IFdlIHdpbGwgdXBkYXRlIHRoZSB0ZXh0IGluIHRoZSBuZXh0IHJldmlzaW9uLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgNC4gSSB0 aGluayB0aGUgdGhvdWdodCB3YXMgdGhhdCBvbmNlIGF1dGhlbnRpY2F0ZWQsIGFuZCBhc3N1bWlu ZyB0aGF0IGRDRE5zIGhhdmUgYWNjZXNzIHRvIGFsbCBtZXRhZGF0YSBhY2Nlc3NpYmxlIGZyb20g dGhhdCBIb3N0SW5kZXgsIHRoZW4gdGhlIGRDRE4gaXMgYXV0aG9yaXplZCB0byByZXRyaWV2ZSB0 aGUNCiBtZXRhZGF0YTsgd2UgZGlkIG5vdCB0cnkgdG8gZGlmZmVyZW50aWF0ZSBhdXRob3JpemF0 aW9uIG9mIGRpZmZlcmVudCBtZXRhZGF0YSBpbiB0aGUgdHJlZS4mbmJzcDsgRG8geW91IHRoaW5r IGl0IHdvdWxkIGJlIGJlc3QgdG8ganVzdCByZW1vdmUgdGhhdCBidWxsZXQsIG9yIHRyeSB0byBj bGFyaWZ5IHRoZSB0ZXh0Pw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOzUuIFRoZSBTb3VyY2UgbWV0YWRhdGEgdGVsbHMg dGhlIGRDRE4gZnJvbSB3aGVyZSBpdCBtYXkgYWNxdWlyZSB0aGUgY29udGVudCB0aGF0IGl0IGlz IGdvaW5nIHRvIGRpc3RyaWJ1dGUuJm5ic3A7IEdlbmVyYWxseSwgY29udGVudCBkZWxpdmVyeSBp cyBub3QgbmVjZXNzYXJpbHkgYXV0aGVudGljYXRlZC4mbmJzcDsgVGhlIGRDRE4NCiBpcyBsaWtl bHkganVzdCBwdWxsaW5nIHRoZSBjb250ZW50IGZyb20gYSB1Q0ROIGNhY2hlLCBhbmQgdGh1cyB3 b3VsZCBoYXZlIHdoYXRldmVyIGF1dGhlbnRpY2F0aW9uIHBvbGljeSBpcyBzZXQgdGhlcmUgKHdo aWNoIGNvdWxkIGJlIG5vbmUpLiZuYnNwOyBUaGUgQ0ROSSBkZWxpdmVyeSBhdXRoZW50aWNhdGlv biBtZWNoYW5pc20gaXMgYmVpbmcgZGVmaW5lZCBpbiBkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25p bmcuJm5ic3A7IElmIGRlc2lyZWQsIHRoZSBVUkkgU2lnbmluZw0KIG9iamVjdCBjb3VsZCBiZSBh ZGRlZC4mbmJzcDsgSWYgVVJJIFNpZ25pbmcgaXMgcmVxdWlyZWQgYnkgdGhlIGNvbnRlbnQgb3du ZXIsIHRoZSBDRE5zIGFyZSByZXF1aXJlZCB0byBtYWludGFpbiBpdDsgYnV0IGlmIHRoZSBjb250 ZW50IG93bmVyIGRvZXNuJ3QgY2FyZSAoZS5nLiwgdGhlIGFzc2V0IGlzIG5vdCB2YWx1YWJsZSks IGFuZCB0aGUgdUNETiBkb2Vzbid0IGNhcmUgKGUuZy4sIHRoZXJlIGlzIG5vIERvUyBjb25jZXJu KSwgdGhlbiB0aGUgY29udGVudA0KIGNhbiBiZSBzZW50IHVuYXV0aGVudGljYXRlZCwgcmVnYXJk bGVzcyBvZiB0aGUgc2VjdXJpdHkgb2YgdGhlIGVudmlyb25tZW50LjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+dGhhbnghPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tLSZuYnNw OyBLZXZpbiBKLiBNYTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4g NC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7 LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiBaaGFuZyBEYWNoZW5nIFttYWlsdG86emhhbmdfZGFj aGVuZ0Bob3RtYWlsLmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIEp1bmUgMjQsIDIw MTYgNTo0NiBBTTxicj4NCjxiPlRvOjwvYj4gVGhlIElFU0c7IHNlY2RpckBpZXRmLm9yZzxicj4N CjxiPkNjOjwvYj4gZHJhZnQtaWV0Zi1jZG5pLW1ldGFkYXRhLmFsbEB0b29scy5pZXRmLm9yZzxi cj4NCjxiPlN1YmplY3Q6PC9iPiBTZWNEaXIgcmV2aWV3IG9mIGRyYWZ0LWlldGYtY2RuaS1tZXRh ZGF0YS0xODxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPkhpLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPkkg aGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVj dG9yYXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWlu ZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuIFRoZXNlDQogY29tbWVudHMgd2VyZSB3cml0dGVuIHBy aW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlIHNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiBE b2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRz IGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLlRoaXMgZG9jdW1lbnQgZGVm aW5lcyB0aGUgQ0ROSSBtZXRhZGF0YSBpbnRlcmZhY2Ugd2hpY2ggZW5hYmxlcyBhIENETiB0byBv YnRhaW4NCiBDRE5JIG1ldGFkYXRhIGZyb20gYW5vdGhlciBvbmUuJm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdCI+VGhlcmUgYXJlIHNvbWUgaXNzdWVzIHdoaWNoIHNob3VsZCBiZSBmdXJ0aGVyIGRp c2N1c3NlZCBiZWZvcmUgcHVibGlzaGluZyB0aGUgbWVtby4NCjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQi PjEuIFRoZSB0aXRsZSBvZiBTZWN0aW9uIDguMSBpcyBBdXRoZW50aWNhdGlvbiwgYnV0IHRoZSBj b250ZW50cyBhcmUgYWxsIGFib3V0IHVuYXV0aG9yaXplZCBhY2Nlc3MgdG8gbWV0YWRhdGEuIE1h eWJlIHlvdSBjb3VsZCBzYXkgc29tZXRoaW5nIGxpa2UNCiDigJhpZiBhbiBhdHRhY2tlciBjYW4g aW1wZXJzb25hdGUgYSBsZWdhbCBDRE4gd2l0aG91dCBiZWluZyBkZXRlY3RlZCwgaXQgaXMgYWJs ZSB0b+KApuKAmTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPjIuIFRoZXJlIGlzIGEgYmlnIG92ZXJsYXAg YmV0d2VlbiBzZWN0aW9uIDguMiwgQ29uZmlkZW50aWFsaXR5IGFuZCBzZWN0aW9uIDguNCwgUHJp dmFjeS4gSSBzdWdnZXN0IHRvIG1lcmdlIHRoZXNlIHR3byBzZWN0aW9ucy48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0Ij4zLkluIHNlY3Rpb24gOC4zLCB5b3UgbWVudGlvbmVkLCDigJ0gQW4gaW1wbGVtZW50 YXRpb24gb2YgdGhlIENETkkgbWV0YWRhdGEgaW50ZXJmYWNlIE1VU1QgdXNlIHN0cm9uZyBlbmNy eXB0aW9uIGFuZCBtdXR1YWwgYXV0aGVudGljYXRpb24gdG8gcHJldmVudA0KIHVuZGV0ZWN0YWJs ZSBtb2RpZmljYXRpb24gb2YgbWV0YWRhdGEgKHNlZSBTZWN0aW9uIDguNSku4oCdIE5vcm1hbGx5 LCB3aGVuIGRpc2N1c3NpbmcgYWJvdXQgaW50ZWdyaXR5IHByb3RlY3Rpb24sIHdlIHByZWZlciB0 byB1c2UgTUFDIHJhdGhlciB0aGFuIGVuY3J5cHRpb24uDQo8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0Ij40 LiBJbiBzZWN0aW9uIDguNSwgdGhlcmUgaXMgYSBzdGF0ZW1lbnQgYWJvdXQgdXNpbmcgVExTIHRv IHByb3ZpZGUgYXV0aG9yaXphdGlvbi4gSSBkb27igJl0IHRoaW5rIFRMUyBjYW4gZGVjaWRlIHdo aWNoIG1ldGEtZGF0YSBjYW4gYmUgc2VudC9wcm9jZXNzZWQNCiBieSBhIENETi4gPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdCI+NS4gSW4gc2VjdGlvbiA0LjIuMS4xLCBpdCBpcyBzYXRlZCB0aGF0IGJ5IGRl ZmF1bHQgbm8gYXV0aGVudGljYXRpb24gbmVlZHMgdG8gYmUgcHJvdmlkZWQgd2hlbiByZXF1ZXN0 aW5nIGNvbnRlbnQgZnJvbSBhIHNvdXJjZS4gRG8geW91IGFzc3VtZSB0aGUNCiBzb3VyY2Ugd2ls bCB3b3JrIGluIGEgc2VjdXJlIGVudmlyb25tZW50Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A419F67F880AB2468214E154CB8A556206E355DCeusaamb103erics_-- From nobody Sun Jun 26 23:03:30 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 864C212B01D for ; Sun, 26 Jun 2016 23:03:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.647 X-Spam-Level: X-Spam-Status: No, score=-5.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nP0hi-1q_IVm for ; Sun, 26 Jun 2016 23:03:27 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AA5B12B029 for ; Sun, 26 Jun 2016 23:03:27 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u5R63OX7021814 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jun 2016 06:03:24 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.13.8) with ESMTP id u5R63Msj020957 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 27 Jun 2016 06:03:24 GMT Received: from abhmp0008.oracle.com (abhmp0008.oracle.com [141.146.116.14]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id u5R63LEP025676; Mon, 27 Jun 2016 06:03:22 GMT Received: from [10.159.73.153] (/10.159.73.153) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 26 Jun 2016 23:03:21 -0700 References: <5729944D.4040403@oracle.com> To: secdir@ietf.org From: Shawn M Emery X-Forwarded-Message-Id: <5729944D.4040403@oracle.com> Message-ID: <5770C231.9060301@oracle.com> Date: Mon, 27 Jun 2016 00:05:37 -0600 User-Agent: Mozilla/5.0 (X11; SunOS i86pc; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: <5729944D.4040403@oracle.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: draft-ietf-trill-irb.all@tools.ietf.org Subject: [secdir] Review of draft-ietf-trill-irb-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 06:03:28 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft specifies layer 3 (inter-subnet) gateway messaging of the TRILL (Transparent Interconnection of Lots of Links) protocol. The security considerations section does exist and refers to Intermediate System to Intermediate System (IS-IS) authentication (RFC 5310) for securing information advertised by Routing Bridges. For generic TRILL security the draft refers to RFC 6325. For sensitive data, it prescribes end-to-end security, but does not reference or provide details on how this is done in a layer 3 deployment. General comments: None. Editorial comments: Does TRILL and FGL need to be expanded in the Abstract and Introduction section, respectively? I think it would be helpful to describe the "Inner.VLAN" syntax used throughout the document. s/that belong to same/that belong to the same/ s/VLANs in entire/VLANs in the entire/ s/optimal pair-wise forwarding path/optimal pair-wise forwarding paths/ s/check the Inner.MacDA/checks the Inner.MacDA/ s/tenant gateway MAC change/tenant gateway MAC changes,/ s/Zhenbin Li, Zhibo Hu./Zhenbin Li, and Zhibo Hu./ Shawn. -- From nobody Mon Jun 27 10:39:37 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58A5C12D0E4; Mon, 27 Jun 2016 10:39:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.946 X-Spam-Level: X-Spam-Status: No, score=-15.946 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lvnU5KGjFkKi; Mon, 27 Jun 2016 10:39:33 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7007D12D0ED; Mon, 27 Jun 2016 10:39:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5608; q=dns/txt; s=iport; t=1467049173; x=1468258773; h=from:to:subject:date:message-id:mime-version; bh=Ntn0A4hqngMAw6hq03IyZQWn/jHfyiGK/SzYLvMrmkc=; b=ZRiYmAW1s0/wzqT/citkaTM5L3ChKqMysisH+QKGEjuZRE+3wfoXPSR/ Aa2vzpODtanL3ay/D6h/uEkwzXP75DWWEQwurCXJTqYAKapOqZMlw8mwS 622mSyCoEAJOgXuan0I/9BaYTit75LnUV/UOdPfaZZyDs3KzdL1ucAhWy I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AIAgDZY3FX/40NJK1bgnBOVoEDtSaFA?= =?us-ascii?q?YF7hjaBGDgUAQEBAQEBAWUnhFMjCl4BDD4CBDAmAQQBGogosmmQHQEBAQEBAQE?= =?us-ascii?q?DAQEBAQEBAQEfhiiMDoJaBZkBAY4vjyuPfgEeNoNwiWZ/AQEB?= X-IronPort-AV: E=Sophos;i="5.26,537,1459814400"; d="scan'208,217";a="117411526" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Jun 2016 17:39:32 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by alln-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id u5RHdW9R023415 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 27 Jun 2016 17:39:32 GMT Received: from xch-aln-012.cisco.com (173.36.7.22) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 27 Jun 2016 12:39:31 -0500 Received: from xch-aln-012.cisco.com ([173.36.7.22]) by XCH-ALN-012.cisco.com ([173.36.7.22]) with mapi id 15.00.1210.000; Mon, 27 Jun 2016 12:39:31 -0500 From: "Shaun Cooley (shcooley)" To: "draft-ietf-trill-ia-appsubtlv.all@tools.ietf.org" , "secdir@ietf.org" , "iesg@ietf.org" Thread-Topic: secdir review of draft-ietf-trill-ia-appsubtlv-08 Thread-Index: AdHQmLjX5lOI0DGcQkeBM/f6iFiNTQ== Date: Mon, 27 Jun 2016 17:39:31 +0000 Message-ID: <5a378e11b43e44a2b94de7399a215965@XCH-ALN-012.cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.103.179] Content-Type: multipart/alternative; boundary="_000_5a378e11b43e44a2b94de7399a215965XCHALN012ciscocom_" MIME-Version: 1.0 Archived-At: Subject: [secdir] secdir review of draft-ietf-trill-ia-appsubtlv-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 17:39:35 -0000 --_000_5a378e11b43e44a2b94de7399a215965XCHALN012ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGly ZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJl aW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBw cmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4g IERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2UgY29tbWVu dHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClRoaXMgZG9jdW1l bnQgc3BlY2lmaWVzIGEgVFJJTEwgKFRyYW5zcGFyZW50IEludGVyY29ubmVjdGlvbiBvZiBMb3Rz IG9mIExpbmtzKSBpbnRlcm1lZGlhdGUgc3lzdGVtLXRvLWludGVybWVkaWF0ZSBzeXN0ZW0gKElT LUlTKSBzdWItdHlwZSBsZW5ndGggdmFsdWUgKHN1Yi1UTFYpIGRhdGEgZm9ybWF0IGZvciBpcyB1 c2VkIGZvciByZXBvcnRpbmcgc2V0cyBvZiBhZGRyZXNzZXMgYXNzb2NpYXRlZCB3aXRoIGEgcG9y dCBvbiBhIFRSSUxMIHN3aXRjaC4gVGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24g cmVsaWVzIG9uIGV4aXN0aW5nIFJGQ3MgZm9yIHRyYW5zcG9ydCBzZWN1cml0eSBvZiB0aGUgcHJv cG9zZWQgZGF0YSBmb3JtYXQuDQoNCkkgY29uc2lkZXIgdGhpcyBkb2N1bWVudCByZWFkeSBmb3Ig cHVibGljYXRpb24uDQoNCi1TaGF1bg0K --_000_5a378e11b43e44a2b94de7399a215965XCHALN012ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUx OA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWlu IDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4N CjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlv dXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286 c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1V UyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50 IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8g cmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuJm5i c3A7IFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0 IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4mbmJzcDsgRG9jdW1lbnQNCiBlZGl0b3Jz IGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkg b3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGRv Y3VtZW50IHNwZWNpZmllcyBhIFRSSUxMIChUcmFuc3BhcmVudCBJbnRlcmNvbm5lY3Rpb24gb2Yg TG90cyBvZiBMaW5rcykgaW50ZXJtZWRpYXRlIHN5c3RlbS10by1pbnRlcm1lZGlhdGUgc3lzdGVt IChJUy1JUykgc3ViLXR5cGUgbGVuZ3RoIHZhbHVlIChzdWItVExWKSBkYXRhIGZvcm1hdCBmb3Ig aXMgdXNlZCBmb3IgcmVwb3J0aW5nIHNldHMgb2YgYWRkcmVzc2VzIGFzc29jaWF0ZWQgd2l0aCBh DQogcG9ydCBvbiBhIFRSSUxMIHN3aXRjaC4gVGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNl Y3Rpb24gcmVsaWVzIG9uIGV4aXN0aW5nIFJGQ3MgZm9yIHRyYW5zcG9ydCBzZWN1cml0eSBvZiB0 aGUgcHJvcG9zZWQgZGF0YSBmb3JtYXQuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBjb25z aWRlciB0aGlzIGRvY3VtZW50IHJlYWR5IGZvciBwdWJsaWNhdGlvbi48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+LVNoYXVuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_5a378e11b43e44a2b94de7399a215965XCHALN012ciscocom_-- From nobody Tue Jun 28 06:48:49 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 867FC12B059; Tue, 28 Jun 2016 06:48:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.347 X-Spam-Level: X-Spam-Status: No, score=-8.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ObMj3jCDPE16; Tue, 28 Jun 2016 06:48:40 -0700 (PDT) Received: from mx142.netapp.com (mx142.netapp.com [216.240.21.19]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CF11128B44; Tue, 28 Jun 2016 06:48:40 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.26,541,1459839600"; d="scan'208";a="119969501" Received: from hioexcmbx02-prd.hq.netapp.com ([10.122.105.35]) by mx142-out.netapp.com with ESMTP; 28 Jun 2016 06:48:24 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com (10.122.105.36) by hioexcmbx02-prd.hq.netapp.com (10.122.105.35) with Microsoft SMTP Server (TLS) id 15.0.1156.6; Tue, 28 Jun 2016 06:48:20 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com ([::1]) by hioexcmbx03-prd.hq.netapp.com ([fe80::bc9d:c26a:65b2:409%21]) with mapi id 15.00.1156.000; Tue, 28 Jun 2016 06:48:20 -0700 From: "Adamson, Andy" To: Russ Housley Thread-Topic: SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 Thread-Index: AQHRzjdtyikHWcv0hU2EfZTj9Mg2CJ//YGIA Date: Tue, 28 Jun 2016 13:48:19 +0000 Message-ID: References: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> In-Reply-To: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3112) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.122.56.79] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-nfsv4-multi-domain-fs-reqs.all@ietf.org" , IESG , IETF SecDir Subject: Re: [secdir] SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jun 2016 13:48:42 -0000 DQo+IE9uIEp1biAyNCwgMjAxNiwgYXQgMTI6MzAgUE0sIFJ1c3MgSG91c2xleSA8aG91c2xleUB2 aWdpbHNlYy5jb20+IHdyb3RlOg0KPiANCj4gSSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBh cnQgb2YgdGhlIFNlY3VyaXR5IERpcmVjdG9yYXRlJ3Mgb25nb2luZw0KPiBlZmZvcnQgdG8gcmV2 aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuICBUaGVz ZQ0KPiBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0 aGUgU2VjdXJpdHkgQXJlYQ0KPiBEaXJlY3RvcnMuICBEb2N1bWVudCBhdXRob3JzLCBkb2N1bWVu dCBlZGl0b3JzLCBhbmQgV0cgY2hhaXJzIHNob3VsZA0KPiB0cmVhdCB0aGVzZSBjb21tZW50cyBq dXN0IGxpa2UgYW55IG90aGVyIElFVEYgTGFzdCBDYWxsIGNvbW1lbnRzLg0KPiANCj4gVmVyc2lv biByZXZpZXdlZDogZHJhZnQtaWV0Zi1uZnN2NC1tdWx0aS1kb21haW4tZnMtcmVxcy0wOA0KPiAN Cj4gDQo+IFN1bW1hcnk6IE5vdCBSZWFkeQ0KPiANCj4gDQo+IE1ham9yIENvbmNlcm5zOg0KPiAN Cj4gVGhlIHdob2xlIGRvY3VtZW50IG5lZWRzIGFuIGVkaXRpbmcgcGFzcy4gIEluIG1hbnkgcGxh Y2VzIGl0IHRhbGtzIGFib3V0DQo+IGlzc3Vlcy4gIFRvIGJlIGNvbnNpc3RlbnQgd2l0aCB0aGUg dGl0bGUgb2YgdGhlIGRvY3VtZW50LCBpdCBzaG91bGQgYmUNCj4gdGFsa2luZyBhYm91dCBndWlk YW5jZSBvciBkZXBsb3ltZW50IGFsdGVybmF0aXZlcy4NCg0KVGhlIGlzc3VlcyBhcmUgY2VudHJh bCBhcyBndWlkYW5jZSBvciBkZXBsb3ltZW50IGFsdGVybmF0aXZlcyBhcmUgaW4gcmVhY3Rpb24g dG8gdGhlIGlzc3VlcyBkaXNjdXNzZWQuDQpJIGNhbiBwb2ludCB0aGF0IG91dC4NCg0KPiANCj4g VGhlIEFic3RyYWN0IGRvZXMgbm90IHJlZmxlY3QgdGhlIGNvbnRlbnQgb2YgdGhlIGRvY3VtZW50 LiAgUGxlYXNlDQo+IHJld3JpdGUgdGhlIEFic3RyYWN0LiAgU29tZSB0aGluZ3MgdGhhdCBJIGJl bGlldmUgYmVsb25nIGluIHRoZSBBYnN0cmFjdA0KPiBpbmNsdWRlOg0KPiANCj4gLSBUaGlzIGRv Y3VtZW50IHByb3ZpZGUgZ3VpZGFuY2Ugb24gdGhlIGRlcGxveW1lbnQgb2YgdGhlIE5GU3Y0DQo+ ICAgcHJvdG9jb2xzIGluIGVudmlyb25tZW50cyB3aXRoIG11bHRpcGxlIE5GU3Y0IGRvbWFpbnMu DQoNCkFncmVlZCAtIHRoZSBhYnN0cmFjdCBpcyBpc3N1ZXMgY2VudHJpYywgSSBjYW4gY2hhbmdl IHRoYXQuDQoNCj4gLSBUaGUgc2VydmVyIG11c3Qgb2ZmZXIgYSBtdWx0aS1kb21haW4tY2FwYWJs ZSBmaWxlIHN5c3RlbQ0KDQpUaGlzIGlzIGluIHRoZSBhYnN0cmFjdC4gSSBjYW4gcmV3b3JkLg0K DQo+IGFuZCBzdXBwb3J0DQo+ICAgUlBDU0VDX0dTUyBmb3IgdXNlciBhdXRoZW50aWNhdGlvbi4N Cg0KT0sNCg0KPiAtIFRoZSBzZXJ2ZXIgbXVzdCBhbHNvIHN1cHBvcnQgaWRlbnRpdHkgbWFwcGlu Zy4NCg0KTm8gaXQgZG9lc27igJl0IGlmIHRoZSBtdWx0aS1kb21haW4gY2FwYWJsZSBmaWxlIHN5 c3RlbSBzdG9yZXMgbmFtZUBkb21haW4uIChub25lIGN1cnJlbnRseSBkb+KApuKApikNCg0KPiAN Cj4gDQo+IEkgZGlkIG5vdCBmaW5kIHRoZSBJbnRyb2R1Y3Rpb24gaGVscGZ1bC4gIEkgcmVhbGx5 IG5lZWRlZCB0byByZWFkIHRoZQ0KPiB3aG9sZSBkb2N1bWVudCB0byBnZXQgYSBmZWVsaW5nIHRv IHRoZSBndWlkYW5jZSB0aGF0IGl0IGNvbnRhaW5zLiAgVGhlDQo+IHJlYWRlciBuZWVkcyBzb21l IGJhY2tncm91bmQgdGhhdCBpcyBub3QgZGlyZWN0bHkgZXhwbGFpbmVkIGluIHRoZSANCj4gSW50 cm9kdWN0aW9uLiAgSSBzdWdnZXN0IHNvbWUgdG9waWNzIHRoYXQgc2hvdWxkIGJlIGNvdmVyZWQg aW4gdGhlDQo+IEludHJvZHVjdGlvbjoNCj4gDQo+IC0gUG9pbnQgdG8gTkZTdjQgc3BlY2lmaWNh dGlvbnMNCj4gLSBVc2VycyBhbmQgR3JvdXBzIGFyZSBuYW1lZCB3aXRoIHRoZSBuYW1lQGRvbWFp biBzeW50YXgNCj4gLSBFeHBsYWluIHRoZSBkaWZmZXJlbmNlIGJldHdlZW4gYW4gTkZTIGRvbWFp biBhbmQgTkZTdjQgZG9tYWluDQo+IC0gVGhpcyBkb2N1bWVudCBwcm92aWRlcyBndWlkYW5jZSBv biBkZXBsb3lpbmcgc2VydmVycyB0aGF0IHN1cHBvcnQNCj4gICBtdWx0aXBsZSBORlN2NCBkb21h aW5zDQo+IC0gRmVhdHVyZXMgdGhhdCB0aGUgTkZTdjQgc2VydmVyIG11c3QgaW1wbGVtZW50YXRp b24gdG8gd29yayBpbiB0aGlzDQo+ICAgZW52aXJvbm1lbnQNCj4gDQo+IA0KPiBJIHRoaW5rIGl0 IG1pZ2h0IGFsc28gYmUgdXNlZnVsIHRvIGV4cGxhaW4gc29tZSBvdGhlciBjb25jZXB0cyB0b3dh cmQNCj4gdGhlIGZyb250IG9mIHRoZSBkb2N1bWVudCwgYnV0IEkgYW0gbm90IHN1cmUgaWYgdGhl eSBiZWxvbmcgaW4gdGhlDQo+IEludHJvZHVjdGlvbiBvciB0aGUgVGVybWlub2xvZ3kgc2VjdGlv bjoNCj4gDQo+IC0gU3RhbmQtYWxvbmUgTkZTdjQgZG9tYWluDQoNCk9LDQoNCj4gLSBGZWRlcmF0 ZWQgRmlsZSBTeXN0ZW0gKEZlZEZTKQ0KDQpGZWRGUyBpcyBleHBsYWluZWQgaW4gdGhlIEludHJv ZHVjdGlvbjoNCg0KICBUaGUgRmVkRlMgaXMgdGhlIHN0YW5kYXJkaXplZCBtZXRob2Qgb2YgY29u c3RydWN0aW5nIGFuZA0KICAgYWRtaW5pc3RyYXRpbmcgYW4gZW50ZXJwcmlzZS13aWRlIE5GU3Y0 IGZpbGVzeXN0ZW0sIGFuZCBzbyBpcw0KICAgcmVmZXJlbmNlZCBpbiB0aGlzIGRvY3VtZW50LiAg VGhlIGlzc3VlcyB3aXRoIG11bHRpLWRvbWFpbg0KICAgZGVwbG95bWVudHMgZGVzY3JpYmVkIGlu IHRoaXMgZG9jdW1lbnQgYXBwbHkgdG8gYWxsIG11bHRpLWRvbWFpbg0KICAgZGVwbG95bWVudHMs IHdoZXRoZXIgdGhleSBhcmUgcnVuIGFzIGEgRmVkRlMgb3Igbm90Lg0KDQoNCj4gDQo+IEluIFNl Y3Rpb24gMSwgaXQgc2F5czoNCj4gDQo+ICAgTXVsdGktZG9tYWluIGRlcGxveW1lbnRzIHJlcXVp cmUgc3VwcG9ydCBmb3IgZ2xvYmFsIGlkZW50aXRpZXMgaW4NCj4gICBuYW1lIHNlcnZpY2VzIGFu ZCBzZWN1cml0eSBzZXJ2aWNlcywgYW5kIGZpbGUgc3lzdGVtcyBjYXBhYmxlIG9mIHRoZQ0KPiAg IG9uLWRpc2sgcmVwcmVzZW50YXRpb24gb2YgaWRlbnRpdGllcyBiZWxvbmdpbmcgdG8gbXVsdGlw bGUgTkZTdjQNCj4gICBkb21haW5zLg0KPiANCj4gSSBkbyBub3QgdGhpbmsgdGhhdCAiZ2xvYmFs IiBpcyB0aGUgcmlnaHQgdGVybSBoZXJlLiAgVGhlIGlkZW50aXRpZXMNCj4gY2xlYXJseSBuZWVk IHRvIGJlIHVuaXF1ZSBhY3Jvc3MgYWxsIG9mIHRoZSBORlN2NCBkb21haW5zIGludm9sdmVkLCBi dXQNCj4gdGhpcyBtYXkgbm90IG1lYW4gZ2xvYmFsIHVuaXF1ZW5lc3MuDQoNCldlbGwuIFNheSB5 b3UgaGF2ZSBpZGVudGl0aWVzIHRoYXQgYXJlIHVuaXF1ZSBhY3Jvc3MgTkZTdjQgZG9tYWluIOKA nEHigJ0gYW5kIE5GU3Y0IGRvbWFpbiDigJxC4oCdLCBhbmQgdGhlc2UgZG9tYWlucyBoYXZlIHN1 cHBvcnQgaW4gdGhlIG5hbWUgc2VydmljZXMgYW5kIHNlY3VyaXR5IHNlcnZpY2VzLiAgVGhlbiBO RlNWNCBkb21haW4g4oCYQ+KAmSBqb2lucyB0aGUgbXVsdGktZG9tYWluIG5hbWVzcGFjZS4gIFdl IHRoZW4gZXhwZWN0IHRoZSBtdWx0aS1kb21haW4gY2FwYWJsZSBmaWxlIHN5c3RlbSBhbmQgdGhl IG5hbWUvc2VjdXJpdHkgc2VydmljZXMgdG8gc3VwcG9ydCB0aGlzIG5ldyBkb21haW4uIFRoaXMg aXMgd2h5IEkgY2hvc2Ug4oCcZ2xvYmFs4oCdLg0KDQpJIGNhbiB0YWxrIGFib3V0IHRoaXMgYW5k IHRpZSBpdCBpbnRvIHRoZSBOYW1lQGRvbWFpbiBDb25zdHJhaW50cyBzZWN0aW9uIDUuMS4NCg0K PiANCj4gDQo+IEluIFNlY3Rpb24gNCwgcGxlYXNlIHByb3ZpZGUgYSBwb2ludGVycyBmb3IgQVVU SF9OT05FLCBBVVRIX1NZUywNCj4gYW5kIFJQQ1NFQ19HU1MuDQoNCk9LDQoNCj4gDQo+IA0KPiBJ biBzZWN0aW9uIDUuMiwgaXQgc2F5czoNCj4gDQo+ICAgVGhlIEFVVEhfTk9ORSBzZWN1cml0eSBm bGF2b3IgY2FuIGJlIHVzZWZ1bCBpbiBhIG11bHRpLWRvbWFpbg0KPiAgIGRlcGxveW1lbnQgdG8g Z3JhbnQgdW5pdmVyc2FsIGFjY2VzcyB0byBwdWJsaWMgZGF0YSB3aXRob3V0IGFueQ0KPiAgIGNy ZWRlbnRpYWxzLg0KPiANCj4gSSBhc3N1bWUgdGhpcyBpcyByZWFkLW9ubHkgYWNjZXNzLiAgSWYg bXkgYXNzdW1wdGlvbiBpcyBjb3JyZWN0LA0KPiBwbGVhc2UgZXhwYW5kIHRoaXMgcGFyYWdyYXBo IHRvIGNvdmVyIHRoaXMgcG9pbnQuDQoNClN1cmUuDQoNCj4gDQo+IA0KPiBJbiBTZWN0aW9uIDgs IGl0IHNheXM6DQo+IA0KPiAgIC4uLiAgV2UgZG9uJ3QNCj4gICB0cmVhdCB0aGVtIGZ1bGx5IGhl cmUsIGJ1dCBpbXBsZW1lbnRvcnMgc2hvdWxkIHN0dWR5IHRoZSBwcm90b2NvbHMgaW4NCj4gICBx dWVzdGlvbiB0byBnZXQgYSBtb3JlIGNvbXBsZXRlIHNldCBvZiBzZWN1cml0eSBjb25zaWRlcmF0 aW9ucy4NCg0KSSBjaGFuZ2VkIHRoZSBmaXJzdCBwYXJhZ3JhcGggdG8gaW5jbHVkZSBhbGwgcmVs ZXZhbnQgcHJvdG9jb2xzLCBhbmQgZGlkIG5vdCByZW1vdmUgdGhlIGFib3ZlIHNlbnRlbmNlLg0K VGhhbmtzIGZvciBwb2ludGluZyB0aGlzIG91dC4NCg0KPiANCj4gRG9lcyB0aGUgZmlyc3QgcGFy YWdyYXBoIG9zIFNlY3Rpb24gOCBpbmNsdWRlIGFsbCBvZiB0aGUgcmVmZXJlbmNlcw0KPiB0aGF0 IGFyZSByZWxldmFudC4gIElmIHNvLCB0aGVuIEkgZG8gbm90IHVuZGVyc3RhbmQgdGhlIHBvaW50 IG9mIHRoaXMNCj4gc2VudGVuY2UuICBJZiBub3QsIHRoZW4gcGxlYXNlIGV4cGFuZCB0aGUgZmly c3QgcGFyYWdyYXBoIG9mIFNlY3Rpb24gOA0KPiB0byBjb3ZlciBhbGwgb2YgdGhlIHBsYWNlcyB0 aGF0IGFuIGltcGxlbWVudGVyIG5lZWRzIHRvIGxvb2suDQo+IA0KPiANCj4gTWlub3IgQ29uY2Vy bnM6DQo+IA0KPiBUaGUgZmlyc3Qgc2VudGVuY2Ugb2YgdGhlIGludHJvZHVjdGlvbiBzYXlzOg0K PiANCj4gICBBbiBORlN2NCBkb21haW4gaXMgZGVmaW5lZCBhcyBhIHNldCBvZiB1c2VycyBhbmQg Z3JvdXBzIG5hbWVkIGJ5IGENCj4gICBwYXJ0aWN1bGFyIGRvbWFpbiB1c2luZyB0aGUgTkZTdjQg bmFtZUBkb21haW4gc3ludGF4Lg0KPiANCj4gUGxlYXNlIGRlZmluZSAiZG9tYWluIiB3aXRob3V0 IHVzaW5nIHRoYXQgd29yZCBpbiB0aGUgZGVmaW5pdGlvbi4NCg0KWWVhaOKApg0KDQo+IA0KPiAN Cj4gSW4gU2VjdGlvbiA4LCBpdCBzYXlzOg0KPiANCj4gICAuLi4gRXZlbiB3aGVuIG5vdCB1c2lu ZyBsYWJlbGVkDQo+ICAgc2VjdXJpdHksIHNpbmNlIHRoZXJlIGNvdWxkIGJlIG1hbnkgcmVhbG1z IChjcmVkZW50aWFsIGlzc3VlcikgZm9yIGENCj4gICBnaXZlbiBzZXJ2ZXIsIGl0J3MgaW1wb3J0 YW50IHRvIHZlcmlmeSB0aGF0IHRoZSBzZXJ2ZXIgYSBjbGllbnQgaXMNCj4gICB0YWxraW5nIHRv IGhhcyBhIGNyZWRlbnRpYWwgZm9yIHRoZSBuYW1lIHRoZSBjbGllbnQgaGFzIGZvciB0aGUNCj4g ICBzZXJ2ZXIsIGFuZCB0aGF0IHRoYXQgY3JlZGVudGlhbCdzIGlzc3VlciAoaS5lLiwgaXRzIHJl YWxtKSBpcw0KPiAgIGFsbG93ZWQgdG8gaXNzdWUgaXQuICANCj4gDQo+IEkgY2Fubm90IGZpZ3Vy ZSB0aGlzIG91dC4gIEZpcnN0LCBpdCBoYXMgbm90aGluZyB0byBkbyB3aXRoIHNlY3VyaXR5DQo+ IGxhYmVscywgc28gaXQgbWlnaHQgZGVzZXJ2ZSBhIHBhcmFncmFwaCBvZiBpdHMgb3duLiAgU2Vj b25kLCBtYXliZSB0aGUNCj4gcG9pbnQgY2FuIGJlIG1hZGUgbW9yZSBkaXJlY3RseSwgcGVyaGFw cyBzb21ldGhpbmcgdGhhdCBiZWdpbnM6ICJXaGVuDQo+IHRoZSBzZXJ2ZXIgYWNjZXB0cyB1c2Vy IGNyZWRlbnRpYWwgZnJvbSBtb3JlIHRoYW4gb25lIHJlYWxtLCB0aGVuIHRoZQ0KPiBzZXJ2ZXIg bXVzdCB2ZXJpZnkgdGhhdCAuLi4gYW5kIC4uLiIuICBUaGlyZCwgdGhlIHBvaW50cyBpbiB0aGUg bGFzdA0KPiBwYXJhZ3JhcGggb2YgU2VjdGlvbiA4IHNob3VsZCBiZSBtYWRlIGJlZm9yZSB0aGlz IG9uZS4NCg0KdGhpcyBpcyBjb25mdXNpbmcuIEnigJlsbCByZS13cml0ZS4NCg0KPiANCj4gDQo+ IE5pdHM6DQo+IA0KPiBQbGVhc2UgcGljayBvbmUgc3BlbGxpbmcgYW5kIHVzZSBpdCB0aHJvdWdo b3V0IHRoZSBkb2N1bWVudDoNCj4gICAtIHVuaXggb3IgVU5JWA0KPiAgIC0gdWlkIG9yIFVJRA0K PiAgIC0gZ2lkIG9yIEdJRA0KPiAgIC0gQVVUSF9OT05FIG9yIEFVVEhfTlVMTA0KPiANCj4gDQo+ IEluIFNlY3Rpb24gMiwgaXQgc2F5czoNCj4gDQo+ICAgICAgU3RyaW5naWZpZWQgVUlEIG9yIEdJ RDogTkZTdjQgb3duZXIgYW5kIGdyb3VwIHN0cmluZ3MgdGhhdCBjb25zaXN0DQo+ICAgICAgb2Yg ZGVjaW1hbCBudW1lcmljIHZhbHVlcyB3aXRoIG5vIGxlYWRpbmcgemVyb3MsIGFuZCB3aGljaCBk byBub3QNCj4gICAgICBjb250YWluIGFuICdAJyBzaWduLiAgU2VlIFNlY3Rpb24gNS45ICJJbnRl cnByZXRpbmcgb3duZXIgYW5kDQo+ICAgICAgb3duZXJfZ3JvdXAiIFtSRkM1NjYxXS4NCj4gDQo+ IFBsZWFzZSByZXdvcmQgdGhlIGxhc3Qgc2VudGVuY2Ugc28gdGhhdCBpdCBpcyBjbGVhciB0aGF0 IHRoaXMgaXMgYQ0KPiBwb2ludGVyIHRvIFNlY3Rpb24gNS45IG9mIFJGQyA1NjYxLg0KDQp3aWxs IGRvDQoNClRoYW5rcyBmb3IgdGhlIHJldmlldw0KDQrigJQ+QW5keQ0KPiANCj4gDQoNCg== From nobody Tue Jun 28 19:56:29 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CD3612D770 for ; Tue, 28 Jun 2016 19:56:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.45 X-Spam-Level: X-Spam-Status: No, score=-2.45 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U2ey7JzqBdkw for ; Tue, 28 Jun 2016 19:56:26 -0700 (PDT) Received: from mail-ob0-x22b.google.com (mail-ob0-x22b.google.com [IPv6:2607:f8b0:4003:c01::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A61412D575 for ; Tue, 28 Jun 2016 19:56:26 -0700 (PDT) Received: by mail-ob0-x22b.google.com with SMTP id ru5so7479223obc.1 for ; Tue, 28 Jun 2016 19:56:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=71zkHOUA7nhGqpJGGYwv6jR067rlY8IEyMGvmMsvfhI=; b=x6mj9vXBODagxhDRCYNfcLhIFyBcc79GS2vkZke7zMzfz6kdonxcX4nTAxCt1SiduQ GhadHYDequrBdAM96YdmX49a+/eTy9pEK/s7/xMqp1l8k2mUW4/gEopc+upR1igY76Us VZnCycM8sPlBR61WzUX3kn+Kqn8O/XzvIoVaV/qvk/Z54V8yxnO6UiOkEap1gkhjK/zB BkqlUhP/kdkFEF1AlEpCRMfs1/ppHB6LQ7LZ6O5iviwt5xqQVHi8EvIJ4zVorz4g/wuA MIQwL/S+0zJDGRqJWx1qSxJa6nEhmaID/iHYKYjHXKU19nJoaSFXTOGJ0/B+1PhbLXqi AMaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=71zkHOUA7nhGqpJGGYwv6jR067rlY8IEyMGvmMsvfhI=; b=lebfxPuLnUDxtSTbp3K7mxVKq4LPj1wzk5qD4CdCyaTy3W6SsYYgEL43149KjUWYl9 PVf4joULsmlIfiqAZ+OBQKwRCkmYGxXkujT7iI5B6O6aoBVSDJLzmHHBFJhU6X765Avl vdQDqfIJNZxVa9e2aVBvQ0mnBQsbZcgV6kCssrUKlw4CflK2gtlVmiyib6xMJNQP59Db 7BGktAUR7s4fLD+K5WKakmi4r7F53tBSMQZMd+zEzy3BOuiKnATEyzGooMsN++PRn4ZO SxQ2RuI/dA3+8CepAXKfCbxAEOPb5TmipOnVtgyEqxlwWRhKl7I1cu9W05KUQHKUIqXD hB/A== X-Gm-Message-State: ALyK8tI5BPNbSEBPukVvx9hC9cnH6QfjOGAuIsP4+5/GCAulUkdqoS0uJz6H3apTZYlFAhi1/VIBFDXiDFbS8w== X-Received: by 10.157.36.227 with SMTP id z90mr4287186ota.124.1467168985807; Tue, 28 Jun 2016 19:56:25 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.52.242 with HTTP; Tue, 28 Jun 2016 19:56:11 -0700 (PDT) In-Reply-To: <5770C231.9060301@oracle.com> References: <5729944D.4040403@oracle.com> <5770C231.9060301@oracle.com> From: Donald Eastlake Date: Tue, 28 Jun 2016 22:56:11 -0400 Message-ID: To: Shawn M Emery Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: draft-ietf-trill-irb.all@tools.ietf.org, "secdir@ietf.org" Subject: Re: [secdir] Review of draft-ietf-trill-irb-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 02:56:28 -0000 Hi Shawan, Thanks for our comments. On Mon, Jun 27, 2016 at 2:05 AM, Shawn M Emery wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These comments were written primarily for the benefit of the security > area directors. Document editors and WG chairs should treat these > comments just like any other last call comments. > > This draft specifies layer 3 (inter-subnet) gateway messaging of the > TRILL (Transparent Interconnection of Lots of Links) protocol. > > The security considerations section does exist and refers to Intermediate > System to Intermediate System (IS-IS) authentication (RFC 5310) for securing > information advertised by Routing Bridges. For generic TRILL security the > draft refers to RFC 6325. For sensitive data, it prescribes end-to-end > security, but does not reference or provide details on how this is done in > a layer 3 deployment. Would you think it helpful if it gave IPsec and/or TLS as examples of protocols that might be used for end-to-end security? > General comments: > > None. > > Editorial comments: > > Does TRILL and FGL need to be expanded in the Abstract and Introduction > section, respectively? > I think it would be helpful to describe the "Inner.VLAN" syntax used > throughout the document. The payload of a TRILL Data packet looks like an Ethernet frame with a VLAN tag which is the inner.VLAN. This could be added to the definitions in Section 2. > s/that belong to same/that belong to the same/ OK. > s/VLANs in entire/VLANs in the entire/ OK. > s/optimal pair-wise forwarding path/optimal pair-wise forwarding paths/ I don't see that in version -13. > s/check the Inner.MacDA/checks the Inner.MacDA/ OK. > s/tenant gateway MAC change/tenant gateway MAC changes,/ OK. > s/Zhenbin Li, Zhibo Hu./Zhenbin Li, and Zhibo Hu./ OK. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 155 Beaver Street, Milford, MA 01757 USA d3e3e3@gmail.com > Shawn. > -- From nobody Tue Jun 28 20:58:28 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D280012D9CB for ; Tue, 28 Jun 2016 20:58:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.647 X-Spam-Level: X-Spam-Status: No, score=-5.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Phblct5L_TXx for ; Tue, 28 Jun 2016 20:58:24 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF4D712D0E6 for ; Tue, 28 Jun 2016 20:58:24 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u5T3wKVp016923 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 29 Jun 2016 03:58:20 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.13.8/8.13.8) with ESMTP id u5T3wIm9017199 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 29 Jun 2016 03:58:18 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by userv0121.oracle.com (8.13.8/8.13.8) with ESMTP id u5T3wGxT002697; Wed, 29 Jun 2016 03:58:17 GMT Received: from [10.159.68.123] (/10.159.68.123) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 28 Jun 2016 20:58:16 -0700 To: Donald Eastlake References: <5729944D.4040403@oracle.com> <5770C231.9060301@oracle.com> From: Shawn M Emery Message-ID: <577347DF.2060202@oracle.com> Date: Tue, 28 Jun 2016 22:00:31 -0600 User-Agent: Mozilla/5.0 (X11; SunOS i86pc; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: draft-ietf-trill-irb.all@tools.ietf.org, "secdir@ietf.org" Subject: Re: [secdir] Review of draft-ietf-trill-irb-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 03:58:27 -0000 On 06/28/16 08:56 PM, Donald Eastlake wrote: > Hi Shawan, > > Thanks for our comments. > > On Mon, Jun 27, 2016 at 2:05 AM, Shawn M Emery wrote: >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the IESG. >> These comments were written primarily for the benefit of the security >> area directors. Document editors and WG chairs should treat these >> comments just like any other last call comments. >> >> This draft specifies layer 3 (inter-subnet) gateway messaging of the >> TRILL (Transparent Interconnection of Lots of Links) protocol. >> >> The security considerations section does exist and refers to Intermediate >> System to Intermediate System (IS-IS) authentication (RFC 5310) for securing >> information advertised by Routing Bridges. For generic TRILL security the >> draft refers to RFC 6325. For sensitive data, it prescribes end-to-end >> security, but does not reference or provide details on how this is done in >> a layer 3 deployment. > Would you think it helpful if it gave IPsec and/or TLS as examples of > protocols that might be used for end-to-end security? Yes, whatever is commonly used in TRILL and if there are ones that shouldn't be used then I would suggest writing text describing why not. >> General comments: >> >> None. >> >> Editorial comments: >> >> Does TRILL and FGL need to be expanded in the Abstract and Introduction >> section, respectively? >> I think it would be helpful to describe the "Inner.VLAN" syntax used >> throughout the document. > The payload of a TRILL Data packet looks like an Ethernet frame with a > VLAN tag which is the inner.VLAN. This could be added to the > definitions in Section 2. Thanks for clarifying. > ... >> s/optimal pair-wise forwarding path/optimal pair-wise forwarding paths/ > I don't see that in version -13. The text was part of a new-line. Let's try: s/wise forwarding path/wise forwarding paths/ Shawn. -- From nobody Wed Jun 29 06:53:00 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BB0012DAE1 for ; Wed, 29 Jun 2016 06:52:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BsgEbVcAGJAa for ; Wed, 29 Jun 2016 06:52:57 -0700 (PDT) Received: from mail-vk0-x236.google.com (mail-vk0-x236.google.com [IPv6:2607:f8b0:400c:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D754212B028 for ; Wed, 29 Jun 2016 06:52:55 -0700 (PDT) Received: by mail-vk0-x236.google.com with SMTP id c2so66800257vkg.1 for ; Wed, 29 Jun 2016 06:52:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to:cc; bh=x+PRVQoxVDOowJlnLTpEwo9IN1oQ4PZsFJdw4l09x9Y=; b=jLNFRewZcQPni04xlERqcaANwrSOQO29RvkmFoVoKSDIZbGMYlt9zhThK0VT2HLI/d 81r4yQIitNkMe5dR4jp/U1SMqR/b1mi6L1RrZEenrN9zfWrVfQyqriBiSO5q/JXLxLo0 pt4Wz58n/GgPD6+apkmnvpUerEphwACelRSoIraGdNTNhC+eNVB1nb3kZdwHPw7S8E0y jDGYx7xcx5F9eeeFvvppeKVbRg88XsZd8bq7SiUWQwb+rY4xTb6JDq9KGBwYuy+YD2gr OnmU2FOv0TEiPZh4fta47jzBOdw+yr5U25JHUb1PsuKlPfsawZSRYbcjnMgjhEpfZC3o DwYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=x+PRVQoxVDOowJlnLTpEwo9IN1oQ4PZsFJdw4l09x9Y=; b=Q2R4Ojx0iCfdhsG1G1S1o+qsEBc+77gtlDTR+QWbsZA9rx+tjnNuIJJq6my60y25yg c2AHiGyqgx42wMOzLSYykFE96GGpboT6fORj53VZniu/qJ4H9q0LLJi9+mXiQxtVBJ0U EvPXmPlinD+JCHKuEbBnAhnuSN2s8QM4z1hpV15S57nApa9k5tbG+fDFoq0RCMHJJI/g 7E6pIUetCPFrhUncc6PIxNbIzi/wOdS1LrRKZviGn17mvIlbWQAQzy3HksHefRNJRnhz 6/cyDvWp7m5yhfQ9ehoIWE9jjCSRuFJIPs7L1B8YLOSIx+Mwj5GmGx9HKB/36VQOFiXk +PYA== X-Gm-Message-State: ALyK8tILd+0m3iuupqwe/oHifDhw+Ew/zhBVzi06+WWKsm4dQpOQ6ec+HHG1O7tpAE1ToVpxhw0TuTprUx9cPA== X-Received: by 10.176.69.196 with SMTP id u62mr3654872uau.111.1467208374919; Wed, 29 Jun 2016 06:52:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.159.36.236 with HTTP; Wed, 29 Jun 2016 06:52:54 -0700 (PDT) From: Kathleen Moriarty Date: Wed, 29 Jun 2016 09:52:54 -0400 Message-ID: To: "secdir@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Karen ODonoghue Subject: [secdir] Security Presentation on Sunday of IETF X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 13:52:58 -0000 Hello, If you happen to be a good, effective presenter and will be arriving in time to give the Security overview presentation with Karen (copied) on the Sunday of the IETF in Berlin, please send Stephen and I an email. I have asked the SecChairs to each send an updated slide in from the last time this presentation was given and will help pull that together to make it easier for the presenter. We can use the same format as last time to make it easy, but may want to change it up for the next time. Any volunteers? Thank you! -- Best regards, Kathleen & Stephen From nobody Wed Jun 29 09:56:30 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25C7712D9CD; Wed, 29 Jun 2016 09:56:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.327 X-Spam-Level: X-Spam-Status: No, score=-8.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0hH8hhaO82WT; Wed, 29 Jun 2016 09:56:26 -0700 (PDT) Received: from mx143.netapp.com (mx143.netapp.com [216.240.21.24]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5E9412D591; Wed, 29 Jun 2016 09:56:26 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.26,547,1459839600"; d="scan'208";a="123953427" Received: from hioexcmbx08-prd.hq.netapp.com ([10.122.105.41]) by mx143-out.netapp.com with ESMTP; 29 Jun 2016 09:51:25 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com (10.122.105.36) by hioexcmbx08-prd.hq.netapp.com (10.122.105.41) with Microsoft SMTP Server (TLS) id 15.0.1156.6; Wed, 29 Jun 2016 09:51:23 -0700 Received: from HIOEXCMBX03-PRD.hq.netapp.com ([::1]) by hioexcmbx03-prd.hq.netapp.com ([fe80::bc9d:c26a:65b2:409%21]) with mapi id 15.00.1156.000; Wed, 29 Jun 2016 09:51:23 -0700 From: "Adamson, Andy" To: Russ Housley Thread-Topic: SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 Thread-Index: AQHRzjdtyikHWcv0hU2EfZTj9Mg2CJ//YGIAgAHFeYA= Date: Wed, 29 Jun 2016 16:51:22 +0000 Message-ID: <3B7F13D7-99A6-49F6-B399-6FD64C6F66D9@netapp.com> References: <988BE781-CAC5-49B8-ADAD-F8637C6776D9@vigilsec.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3112) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.122.56.79] Content-Type: text/plain; charset="utf-8" Content-ID: <1FB86B0263D020448A02D627B3C4AA33@hq.netapp.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-nfsv4-multi-domain-fs-reqs.all@ietf.org" , IESG , IETF SecDir Subject: Re: [secdir] SecDir Review of draft-ietf-nfsv4-multi-domain-fs-reqs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 16:56:29 -0000 SGVsbG8gUnVzcw0KDQpJIGp1c3Qgc3VibWl0dGVkIGRyYWZ0LWlldGYtbmZzdjQtbXVsdGktZG9t YWluLWZzLXJlcXMtMDkgd2hpY2ggcmVzcG9uZHMgdG8geW91ciByZXZpZXcgY29tbWVudHMgb24g ZHJhZnQtMDguDQoNClRoYW5rcyBhZ2FpbiBmb3IgdGhlIGhlbHBmdWwgcmV2aWV3Lg0KDQrigJQ+ QW5keQ0KDQoNCj4gT24gSnVuIDI4LCAyMDE2LCBhdCA5OjQ4IEFNLCBBZGFtc29uLCBBbmR5IDxX aWxsaWFtLkFkYW1zb25AbmV0YXBwLmNvbT4gd3JvdGU6DQo+IA0KPj4gDQo+PiBPbiBKdW4gMjQs IDIwMTYsIGF0IDEyOjMwIFBNLCBSdXNzIEhvdXNsZXkgPGhvdXNsZXlAdmlnaWxzZWMuY29tPiB3 cm90ZToNCj4+IA0KPj4gSSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIFNl Y3VyaXR5IERpcmVjdG9yYXRlJ3Mgb25nb2luZw0KPj4gZWZmb3J0IHRvIHJldmlldyBhbGwgSUVU RiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiAgVGhlc2UNCj4+IGNvbW1l bnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBTZWN1cml0 eSBBcmVhDQo+PiBEaXJlY3RvcnMuICBEb2N1bWVudCBhdXRob3JzLCBkb2N1bWVudCBlZGl0b3Jz LCBhbmQgV0cgY2hhaXJzIHNob3VsZA0KPj4gdHJlYXQgdGhlc2UgY29tbWVudHMganVzdCBsaWtl IGFueSBvdGhlciBJRVRGIExhc3QgQ2FsbCBjb21tZW50cy4NCj4+IA0KPj4gVmVyc2lvbiByZXZp ZXdlZDogZHJhZnQtaWV0Zi1uZnN2NC1tdWx0aS1kb21haW4tZnMtcmVxcy0wOA0KPj4gDQo+PiAN Cj4+IFN1bW1hcnk6IE5vdCBSZWFkeQ0KPj4gDQo+PiANCj4+IE1ham9yIENvbmNlcm5zOg0KPj4g DQo+PiBUaGUgd2hvbGUgZG9jdW1lbnQgbmVlZHMgYW4gZWRpdGluZyBwYXNzLiAgSW4gbWFueSBw bGFjZXMgaXQgdGFsa3MgYWJvdXQNCj4+IGlzc3Vlcy4gIFRvIGJlIGNvbnNpc3RlbnQgd2l0aCB0 aGUgdGl0bGUgb2YgdGhlIGRvY3VtZW50LCBpdCBzaG91bGQgYmUNCj4+IHRhbGtpbmcgYWJvdXQg Z3VpZGFuY2Ugb3IgZGVwbG95bWVudCBhbHRlcm5hdGl2ZXMuDQo+IA0KPiBUaGUgaXNzdWVzIGFy ZSBjZW50cmFsIGFzIGd1aWRhbmNlIG9yIGRlcGxveW1lbnQgYWx0ZXJuYXRpdmVzIGFyZSBpbiBy ZWFjdGlvbiB0byB0aGUgaXNzdWVzIGRpc2N1c3NlZC4NCj4gSSBjYW4gcG9pbnQgdGhhdCBvdXQu DQo+IA0KPj4gDQo+PiBUaGUgQWJzdHJhY3QgZG9lcyBub3QgcmVmbGVjdCB0aGUgY29udGVudCBv ZiB0aGUgZG9jdW1lbnQuICBQbGVhc2UNCj4+IHJld3JpdGUgdGhlIEFic3RyYWN0LiAgU29tZSB0 aGluZ3MgdGhhdCBJIGJlbGlldmUgYmVsb25nIGluIHRoZSBBYnN0cmFjdA0KPj4gaW5jbHVkZToN Cj4+IA0KPj4gLSBUaGlzIGRvY3VtZW50IHByb3ZpZGUgZ3VpZGFuY2Ugb24gdGhlIGRlcGxveW1l bnQgb2YgdGhlIE5GU3Y0DQo+PiAgcHJvdG9jb2xzIGluIGVudmlyb25tZW50cyB3aXRoIG11bHRp cGxlIE5GU3Y0IGRvbWFpbnMuDQo+IA0KPiBBZ3JlZWQgLSB0aGUgYWJzdHJhY3QgaXMgaXNzdWVz IGNlbnRyaWMsIEkgY2FuIGNoYW5nZSB0aGF0Lg0KPiANCj4+IC0gVGhlIHNlcnZlciBtdXN0IG9m ZmVyIGEgbXVsdGktZG9tYWluLWNhcGFibGUgZmlsZSBzeXN0ZW0NCj4gDQo+IFRoaXMgaXMgaW4g dGhlIGFic3RyYWN0LiBJIGNhbiByZXdvcmQuDQo+IA0KPj4gYW5kIHN1cHBvcnQNCj4+ICBSUENT RUNfR1NTIGZvciB1c2VyIGF1dGhlbnRpY2F0aW9uLg0KPiANCj4gT0sNCj4gDQo+PiAtIFRoZSBz ZXJ2ZXIgbXVzdCBhbHNvIHN1cHBvcnQgaWRlbnRpdHkgbWFwcGluZy4NCj4gDQo+IE5vIGl0IGRv ZXNu4oCZdCBpZiB0aGUgbXVsdGktZG9tYWluIGNhcGFibGUgZmlsZSBzeXN0ZW0gc3RvcmVzIG5h bWVAZG9tYWluLiAobm9uZSBjdXJyZW50bHkgZG/igKbigKYpDQo+IA0KPj4gDQo+PiANCj4+IEkg ZGlkIG5vdCBmaW5kIHRoZSBJbnRyb2R1Y3Rpb24gaGVscGZ1bC4gIEkgcmVhbGx5IG5lZWRlZCB0 byByZWFkIHRoZQ0KPj4gd2hvbGUgZG9jdW1lbnQgdG8gZ2V0IGEgZmVlbGluZyB0byB0aGUgZ3Vp ZGFuY2UgdGhhdCBpdCBjb250YWlucy4gIFRoZQ0KPj4gcmVhZGVyIG5lZWRzIHNvbWUgYmFja2dy b3VuZCB0aGF0IGlzIG5vdCBkaXJlY3RseSBleHBsYWluZWQgaW4gdGhlIA0KPj4gSW50cm9kdWN0 aW9uLiAgSSBzdWdnZXN0IHNvbWUgdG9waWNzIHRoYXQgc2hvdWxkIGJlIGNvdmVyZWQgaW4gdGhl DQo+PiBJbnRyb2R1Y3Rpb246DQo+PiANCj4+IC0gUG9pbnQgdG8gTkZTdjQgc3BlY2lmaWNhdGlv bnMNCj4+IC0gVXNlcnMgYW5kIEdyb3VwcyBhcmUgbmFtZWQgd2l0aCB0aGUgbmFtZUBkb21haW4g c3ludGF4DQo+PiAtIEV4cGxhaW4gdGhlIGRpZmZlcmVuY2UgYmV0d2VlbiBhbiBORlMgZG9tYWlu IGFuZCBORlN2NCBkb21haW4NCj4+IC0gVGhpcyBkb2N1bWVudCBwcm92aWRlcyBndWlkYW5jZSBv biBkZXBsb3lpbmcgc2VydmVycyB0aGF0IHN1cHBvcnQNCj4+ICBtdWx0aXBsZSBORlN2NCBkb21h aW5zDQo+PiAtIEZlYXR1cmVzIHRoYXQgdGhlIE5GU3Y0IHNlcnZlciBtdXN0IGltcGxlbWVudGF0 aW9uIHRvIHdvcmsgaW4gdGhpcw0KPj4gIGVudmlyb25tZW50DQo+PiANCj4+IA0KPj4gSSB0aGlu ayBpdCBtaWdodCBhbHNvIGJlIHVzZWZ1bCB0byBleHBsYWluIHNvbWUgb3RoZXIgY29uY2VwdHMg dG93YXJkDQo+PiB0aGUgZnJvbnQgb2YgdGhlIGRvY3VtZW50LCBidXQgSSBhbSBub3Qgc3VyZSBp ZiB0aGV5IGJlbG9uZyBpbiB0aGUNCj4+IEludHJvZHVjdGlvbiBvciB0aGUgVGVybWlub2xvZ3kg c2VjdGlvbjoNCj4+IA0KPj4gLSBTdGFuZC1hbG9uZSBORlN2NCBkb21haW4NCj4gDQo+IE9LDQo+ IA0KPj4gLSBGZWRlcmF0ZWQgRmlsZSBTeXN0ZW0gKEZlZEZTKQ0KPiANCj4gRmVkRlMgaXMgZXhw bGFpbmVkIGluIHRoZSBJbnRyb2R1Y3Rpb246DQo+IA0KPiAgVGhlIEZlZEZTIGlzIHRoZSBzdGFu ZGFyZGl6ZWQgbWV0aG9kIG9mIGNvbnN0cnVjdGluZyBhbmQNCj4gICBhZG1pbmlzdHJhdGluZyBh biBlbnRlcnByaXNlLXdpZGUgTkZTdjQgZmlsZXN5c3RlbSwgYW5kIHNvIGlzDQo+ICAgcmVmZXJl bmNlZCBpbiB0aGlzIGRvY3VtZW50LiAgVGhlIGlzc3VlcyB3aXRoIG11bHRpLWRvbWFpbg0KPiAg IGRlcGxveW1lbnRzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGFwcGx5IHRvIGFsbCBtdWx0 aS1kb21haW4NCj4gICBkZXBsb3ltZW50cywgd2hldGhlciB0aGV5IGFyZSBydW4gYXMgYSBGZWRG UyBvciBub3QuDQo+IA0KPiANCj4+IA0KPj4gSW4gU2VjdGlvbiAxLCBpdCBzYXlzOg0KPj4gDQo+ PiAgTXVsdGktZG9tYWluIGRlcGxveW1lbnRzIHJlcXVpcmUgc3VwcG9ydCBmb3IgZ2xvYmFsIGlk ZW50aXRpZXMgaW4NCj4+ICBuYW1lIHNlcnZpY2VzIGFuZCBzZWN1cml0eSBzZXJ2aWNlcywgYW5k IGZpbGUgc3lzdGVtcyBjYXBhYmxlIG9mIHRoZQ0KPj4gIG9uLWRpc2sgcmVwcmVzZW50YXRpb24g b2YgaWRlbnRpdGllcyBiZWxvbmdpbmcgdG8gbXVsdGlwbGUgTkZTdjQNCj4+ICBkb21haW5zLg0K Pj4gDQo+PiBJIGRvIG5vdCB0aGluayB0aGF0ICJnbG9iYWwiIGlzIHRoZSByaWdodCB0ZXJtIGhl cmUuICBUaGUgaWRlbnRpdGllcw0KPj4gY2xlYXJseSBuZWVkIHRvIGJlIHVuaXF1ZSBhY3Jvc3Mg YWxsIG9mIHRoZSBORlN2NCBkb21haW5zIGludm9sdmVkLCBidXQNCj4+IHRoaXMgbWF5IG5vdCBt ZWFuIGdsb2JhbCB1bmlxdWVuZXNzLg0KPiANCj4gV2VsbC4gU2F5IHlvdSBoYXZlIGlkZW50aXRp ZXMgdGhhdCBhcmUgdW5pcXVlIGFjcm9zcyBORlN2NCBkb21haW4g4oCcQeKAnSBhbmQgTkZTdjQg ZG9tYWluIOKAnELigJ0sIGFuZCB0aGVzZSBkb21haW5zIGhhdmUgc3VwcG9ydCBpbiB0aGUgbmFt ZSBzZXJ2aWNlcyBhbmQgc2VjdXJpdHkgc2VydmljZXMuICBUaGVuIE5GU1Y0IGRvbWFpbiDigJhD 4oCZIGpvaW5zIHRoZSBtdWx0aS1kb21haW4gbmFtZXNwYWNlLiAgV2UgdGhlbiBleHBlY3QgdGhl IG11bHRpLWRvbWFpbiBjYXBhYmxlIGZpbGUgc3lzdGVtIGFuZCB0aGUgbmFtZS9zZWN1cml0eSBz ZXJ2aWNlcyB0byBzdXBwb3J0IHRoaXMgbmV3IGRvbWFpbi4gVGhpcyBpcyB3aHkgSSBjaG9zZSDi gJxnbG9iYWzigJ0uDQo+IA0KPiBJIGNhbiB0YWxrIGFib3V0IHRoaXMgYW5kIHRpZSBpdCBpbnRv IHRoZSBOYW1lQGRvbWFpbiBDb25zdHJhaW50cyBzZWN0aW9uIDUuMS4NCj4gDQo+PiANCj4+IA0K Pj4gSW4gU2VjdGlvbiA0LCBwbGVhc2UgcHJvdmlkZSBhIHBvaW50ZXJzIGZvciBBVVRIX05PTkUs IEFVVEhfU1lTLA0KPj4gYW5kIFJQQ1NFQ19HU1MuDQo+IA0KPiBPSw0KPiANCj4+IA0KPj4gDQo+ PiBJbiBzZWN0aW9uIDUuMiwgaXQgc2F5czoNCj4+IA0KPj4gIFRoZSBBVVRIX05PTkUgc2VjdXJp dHkgZmxhdm9yIGNhbiBiZSB1c2VmdWwgaW4gYSBtdWx0aS1kb21haW4NCj4+ICBkZXBsb3ltZW50 IHRvIGdyYW50IHVuaXZlcnNhbCBhY2Nlc3MgdG8gcHVibGljIGRhdGEgd2l0aG91dCBhbnkNCj4+ ICBjcmVkZW50aWFscy4NCj4+IA0KPj4gSSBhc3N1bWUgdGhpcyBpcyByZWFkLW9ubHkgYWNjZXNz LiAgSWYgbXkgYXNzdW1wdGlvbiBpcyBjb3JyZWN0LA0KPj4gcGxlYXNlIGV4cGFuZCB0aGlzIHBh cmFncmFwaCB0byBjb3ZlciB0aGlzIHBvaW50Lg0KPiANCj4gU3VyZS4NCj4gDQo+PiANCj4+IA0K Pj4gSW4gU2VjdGlvbiA4LCBpdCBzYXlzOg0KPj4gDQo+PiAgLi4uICBXZSBkb24ndA0KPj4gIHRy ZWF0IHRoZW0gZnVsbHkgaGVyZSwgYnV0IGltcGxlbWVudG9ycyBzaG91bGQgc3R1ZHkgdGhlIHBy b3RvY29scyBpbg0KPj4gIHF1ZXN0aW9uIHRvIGdldCBhIG1vcmUgY29tcGxldGUgc2V0IG9mIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb25zLg0KPiANCj4gSSBjaGFuZ2VkIHRoZSBmaXJzdCBwYXJhZ3Jh cGggdG8gaW5jbHVkZSBhbGwgcmVsZXZhbnQgcHJvdG9jb2xzLCBhbmQgZGlkIG5vdCByZW1vdmUg dGhlIGFib3ZlIHNlbnRlbmNlLg0KPiBUaGFua3MgZm9yIHBvaW50aW5nIHRoaXMgb3V0Lg0KPiAN Cj4+IA0KPj4gRG9lcyB0aGUgZmlyc3QgcGFyYWdyYXBoIG9zIFNlY3Rpb24gOCBpbmNsdWRlIGFs bCBvZiB0aGUgcmVmZXJlbmNlcw0KPj4gdGhhdCBhcmUgcmVsZXZhbnQuICBJZiBzbywgdGhlbiBJ IGRvIG5vdCB1bmRlcnN0YW5kIHRoZSBwb2ludCBvZiB0aGlzDQo+PiBzZW50ZW5jZS4gIElmIG5v dCwgdGhlbiBwbGVhc2UgZXhwYW5kIHRoZSBmaXJzdCBwYXJhZ3JhcGggb2YgU2VjdGlvbiA4DQo+ PiB0byBjb3ZlciBhbGwgb2YgdGhlIHBsYWNlcyB0aGF0IGFuIGltcGxlbWVudGVyIG5lZWRzIHRv IGxvb2suDQo+PiANCj4+IA0KPj4gTWlub3IgQ29uY2VybnM6DQo+PiANCj4+IFRoZSBmaXJzdCBz ZW50ZW5jZSBvZiB0aGUgaW50cm9kdWN0aW9uIHNheXM6DQo+PiANCj4+ICBBbiBORlN2NCBkb21h aW4gaXMgZGVmaW5lZCBhcyBhIHNldCBvZiB1c2VycyBhbmQgZ3JvdXBzIG5hbWVkIGJ5IGENCj4+ ICBwYXJ0aWN1bGFyIGRvbWFpbiB1c2luZyB0aGUgTkZTdjQgbmFtZUBkb21haW4gc3ludGF4Lg0K Pj4gDQo+PiBQbGVhc2UgZGVmaW5lICJkb21haW4iIHdpdGhvdXQgdXNpbmcgdGhhdCB3b3JkIGlu IHRoZSBkZWZpbml0aW9uLg0KPiANCj4gWWVhaOKApg0KPiANCj4+IA0KPj4gDQo+PiBJbiBTZWN0 aW9uIDgsIGl0IHNheXM6DQo+PiANCj4+ICAuLi4gRXZlbiB3aGVuIG5vdCB1c2luZyBsYWJlbGVk DQo+PiAgc2VjdXJpdHksIHNpbmNlIHRoZXJlIGNvdWxkIGJlIG1hbnkgcmVhbG1zIChjcmVkZW50 aWFsIGlzc3VlcikgZm9yIGENCj4+ICBnaXZlbiBzZXJ2ZXIsIGl0J3MgaW1wb3J0YW50IHRvIHZl cmlmeSB0aGF0IHRoZSBzZXJ2ZXIgYSBjbGllbnQgaXMNCj4+ICB0YWxraW5nIHRvIGhhcyBhIGNy ZWRlbnRpYWwgZm9yIHRoZSBuYW1lIHRoZSBjbGllbnQgaGFzIGZvciB0aGUNCj4+ICBzZXJ2ZXIs IGFuZCB0aGF0IHRoYXQgY3JlZGVudGlhbCdzIGlzc3VlciAoaS5lLiwgaXRzIHJlYWxtKSBpcw0K Pj4gIGFsbG93ZWQgdG8gaXNzdWUgaXQuICANCj4+IA0KPj4gSSBjYW5ub3QgZmlndXJlIHRoaXMg b3V0LiAgRmlyc3QsIGl0IGhhcyBub3RoaW5nIHRvIGRvIHdpdGggc2VjdXJpdHkNCj4+IGxhYmVs cywgc28gaXQgbWlnaHQgZGVzZXJ2ZSBhIHBhcmFncmFwaCBvZiBpdHMgb3duLiAgU2Vjb25kLCBt YXliZSB0aGUNCj4+IHBvaW50IGNhbiBiZSBtYWRlIG1vcmUgZGlyZWN0bHksIHBlcmhhcHMgc29t ZXRoaW5nIHRoYXQgYmVnaW5zOiAiV2hlbg0KPj4gdGhlIHNlcnZlciBhY2NlcHRzIHVzZXIgY3Jl ZGVudGlhbCBmcm9tIG1vcmUgdGhhbiBvbmUgcmVhbG0sIHRoZW4gdGhlDQo+PiBzZXJ2ZXIgbXVz dCB2ZXJpZnkgdGhhdCAuLi4gYW5kIC4uLiIuICBUaGlyZCwgdGhlIHBvaW50cyBpbiB0aGUgbGFz dA0KPj4gcGFyYWdyYXBoIG9mIFNlY3Rpb24gOCBzaG91bGQgYmUgbWFkZSBiZWZvcmUgdGhpcyBv bmUuDQo+IA0KPiB0aGlzIGlzIGNvbmZ1c2luZy4gSeKAmWxsIHJlLXdyaXRlLg0KPiANCj4+IA0K Pj4gDQo+PiBOaXRzOg0KPj4gDQo+PiBQbGVhc2UgcGljayBvbmUgc3BlbGxpbmcgYW5kIHVzZSBp dCB0aHJvdWdob3V0IHRoZSBkb2N1bWVudDoNCj4+ICAtIHVuaXggb3IgVU5JWA0KPj4gIC0gdWlk IG9yIFVJRA0KPj4gIC0gZ2lkIG9yIEdJRA0KPj4gIC0gQVVUSF9OT05FIG9yIEFVVEhfTlVMTA0K Pj4gDQo+PiANCj4+IEluIFNlY3Rpb24gMiwgaXQgc2F5czoNCj4+IA0KPj4gICAgIFN0cmluZ2lm aWVkIFVJRCBvciBHSUQ6IE5GU3Y0IG93bmVyIGFuZCBncm91cCBzdHJpbmdzIHRoYXQgY29uc2lz dA0KPj4gICAgIG9mIGRlY2ltYWwgbnVtZXJpYyB2YWx1ZXMgd2l0aCBubyBsZWFkaW5nIHplcm9z LCBhbmQgd2hpY2ggZG8gbm90DQo+PiAgICAgY29udGFpbiBhbiAnQCcgc2lnbi4gIFNlZSBTZWN0 aW9uIDUuOSAiSW50ZXJwcmV0aW5nIG93bmVyIGFuZA0KPj4gICAgIG93bmVyX2dyb3VwIiBbUkZD NTY2MV0uDQo+PiANCj4+IFBsZWFzZSByZXdvcmQgdGhlIGxhc3Qgc2VudGVuY2Ugc28gdGhhdCBp dCBpcyBjbGVhciB0aGF0IHRoaXMgaXMgYQ0KPj4gcG9pbnRlciB0byBTZWN0aW9uIDUuOSBvZiBS RkMgNTY2MS4NCj4gDQo+IHdpbGwgZG8NCj4gDQo+IFRoYW5rcyBmb3IgdGhlIHJldmlldw0KPiAN Cj4g4oCUPkFuZHkNCg0K From nobody Wed Jun 29 11:23:51 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D6B812D5E7 for ; Wed, 29 Jun 2016 11:23:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.45 X-Spam-Level: X-Spam-Status: No, score=-2.45 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PZHWExUUaRpw for ; Wed, 29 Jun 2016 11:23:46 -0700 (PDT) Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79FCF12D5DE for ; Wed, 29 Jun 2016 11:23:43 -0700 (PDT) Received: by mail-ob0-x22c.google.com with SMTP id ru5so37398807obc.1 for ; Wed, 29 Jun 2016 11:23:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=SOstYPPI3MKJjmffOwYCeJ0V8Q8wNIZ2gicwfKA4WLM=; b=AjSJ3X7Ux6xVZs9PMi9LJzA09pyohR3UV+ViBzcnbYFyCKKNULNRWQr0HQONzQ5WsD nEZIU0Qjk+tJ0rORa6CoxhjibJAsmbo3yqVaWH6dSo03RPtOBpX65b+8PM4PEtFLWUPt xYenAobwXSSV6QuijZ86HFOpVGKD77txKdEIHndqg2OlQRQQt4q9iILGlw5qzO2Ajb9m VPpEUfP6PjG67O/+MdosiUhIm67IjbAFmay33pqLAwoYC05c+aCw6Lmd5193bIcFSDak PZ9y8wqLdqsNrdYbs5CE3qLw9dpniSGzrPVoJVnlPd32SXAsIlHz6Pc3+1DGdT/yQN6V iTbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=SOstYPPI3MKJjmffOwYCeJ0V8Q8wNIZ2gicwfKA4WLM=; b=PiyBMIljWdWjA0zadTD1p0143uJno0SgvbwX02L+Nj0m1BGKrM5zS6KnYZvVUMbXso zW01i8imtlHTWQdvOIwMF7t1RaJoKv6/bqwflwp9vex1B9COdkLPjPBkC2zdxag7Katc 3FeZ7AVxp8fTCkzlnucr2LKYjvjtcPNYT+wzZ+ChrzlOe3G1kCvab2izKhBteliCEg2x ViMuACRJ1ma8hDTqag5E5ecAACOUADxEr9Bf6/vdJJJVJqM8MKvC5QF0BYf3npqNLoKi PmERVcfMtdFc+siHQ/gt87xiDrmxQ68bZ8UalEbkd+OwW/v2GlDSBKOJZBTi7L5/1QGX cDYA== X-Gm-Message-State: ALyK8tIr87x6PsFf+RbU9XnpQS6ahEbDroUF/8lDJ4qO7jgL/FbcfWbVEFrrpoWmPaqs8uvfOR5l9N7wWDYu6Q== X-Received: by 10.202.229.66 with SMTP id c63mr6643404oih.81.1467224622836; Wed, 29 Jun 2016 11:23:42 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.52.242 with HTTP; Wed, 29 Jun 2016 11:23:28 -0700 (PDT) In-Reply-To: <577347DF.2060202@oracle.com> References: <5729944D.4040403@oracle.com> <5770C231.9060301@oracle.com> <577347DF.2060202@oracle.com> From: Donald Eastlake Date: Wed, 29 Jun 2016 14:23:28 -0400 Message-ID: To: Shawn M Emery Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: draft-ietf-trill-irb.all@tools.ietf.org, "secdir@ietf.org" Subject: Re: [secdir] Review of draft-ietf-trill-irb-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 18:23:50 -0000 Hi Shawn, On Wed, Jun 29, 2016 at 12:00 AM, Shawn M Emery wrote: > On 06/28/16 08:56 PM, Donald Eastlake wrote: >> >> Hi Shawan, >> >> Thanks for our comments. >> >> On Mon, Jun 27, 2016 at 2:05 AM, Shawn M Emery >> wrote: >>> >>> I have reviewed this document as part of the security directorate's >>> ongoing effort to review all IETF documents being processed by the IESG. >>> These comments were written primarily for the benefit of the security >>> area directors. Document editors and WG chairs should treat these >>> comments just like any other last call comments. >>> >>> This draft specifies layer 3 (inter-subnet) gateway messaging of the >>> TRILL (Transparent Interconnection of Lots of Links) protocol. >>> >>> The security considerations section does exist and refers to Intermediate >>> System to Intermediate System (IS-IS) authentication (RFC 5310) for >>> securing >>> information advertised by Routing Bridges. For generic TRILL security >>> the >>> draft refers to RFC 6325. For sensitive data, it prescribes end-to-end >>> security, but does not reference or provide details on how this is done >>> in >>> a layer 3 deployment. >> >> Would you think it helpful if it gave IPsec and/or TLS as examples of >> protocols that might be used for end-to-end security? > > Yes, whatever is commonly used in TRILL and if there are ones that shouldn't > be used then I would suggest writing text describing why not. End stations attached to a TRILL campus think they are on the same local link unless they use or listen for special link control or TRILL IS-IS PDUs. So I would say it is no business of TRILL's to say what end-to-end security protocol they should or shouldn't use. The Security Considerations section is just pointing out the general recommendation that end-to-end security is a good idea to supplement any security of more limited transit scope, particularly for sensitive information. >>> General comments: >>> >>> None. >>> >>> Editorial comments: >>> >>> Does TRILL and FGL need to be expanded in the Abstract and Introduction >>> section, respectively? >>> I think it would be helpful to describe the "Inner.VLAN" syntax used >>> throughout the document. >> >> The payload of a TRILL Data packet looks like an Ethernet frame with a >> VLAN tag which is the inner.VLAN. This could be added to the >> definitions in Section 2. > > Thanks for clarifying. > >> ... >>> >>> s/optimal pair-wise forwarding path/optimal pair-wise forwarding paths/ >> >> I don't see that in version -13. > > The text was part of a new-line. Let's try: > > s/wise forwarding path/wise forwarding paths/ Ah, sorry, found it now. OK. Thanks, Donald (document Shepherd) =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 155 Beaver Street, Milford, MA 01757 USA d3e3e3@gmail.com > Shawn. > -- From nobody Wed Jun 29 15:57:41 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0235312D8F2 for ; Wed, 29 Jun 2016 15:57:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QjbUMRZV_8uK for ; Wed, 29 Jun 2016 15:57:35 -0700 (PDT) Received: from xsmtp05.mail2web.com (xsmtp05.mail2web.com [168.144.250.245]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C16A12D8ED for ; Wed, 29 Jun 2016 15:57:33 -0700 (PDT) Received: from [10.5.2.49] (helo=xmail11.myhosting.com) by xsmtp05.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1bIOQF-0001PO-9u for secdir@ietf.org; Wed, 29 Jun 2016 18:57:32 -0400 Received: (qmail 19382 invoked from network); 29 Jun 2016 22:57:30 -0000 Received: from unknown (HELO huitema2) (Authenticated-user:_huitema@huitema.net@[131.107.174.2]) (envelope-sender ) by xmail11.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 29 Jun 2016 22:57:30 -0000 From: "Christian Huitema" To: , , Date: Wed, 29 Jun 2016 15:57:27 -0700 Message-ID: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdHSVHw3wGPy2LWlRRa/K3WxEmXT2A== Content-Language: en-us Archived-At: Subject: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 22:57:37 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document is ready with 2 nits. The document specifies an extension to the Label Distribution Protocol (LDP, RFC 5036) to provide bindings between Pseudo Wires (PW) and Label Switch Paths (LSP) established over MPLS-TP (RFC6773). The goal is to ensure that both directions of the PW are mapped to the same LSP, and thus avoid asymmetric routing. The document specifies additional LDP extensions to carry the required information. The security section acknowledges one concern: that attackers could misuse the option to force a pseudo wire through an unnatural path, either as a denial of service attack, or to facilitate traffic interception. The proposed mitigation to that attack is essentially "careful Implementation", i.e. only accept binding requests where the LSP endpoints match the PW endpoints. Should a mismatch occur, I assume that the endpoint will reject the proposed binding, as specified in section 5, PSN Binding Operation for MS-PW. And here is one nit: I would like to see the verification behavior specified as part of the binding operations, rather than merely mentioned in the security section. Also, is there a specific error case for the security failure, or just the generic error message? The next nit is tied to the general security profile of LDP, which is specified to use TCP(MD5). There is no expectation of privacy for LDP data. I am not sure that the new extensions increase the "privacy surface" of LDP. They do carry global identifiers of source and destination, and inform about the path of packets between these destinations, and it seems that adversaries could use that for monitoring and targeting purposes. But it is possible that the information is already present in LDP. A note to that effect in the security section would have been nice. -- Christian Huitema From nobody Wed Jun 29 16:55:36 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EEF312D961; Wed, 29 Jun 2016 16:55:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LnSDjgi4bmcn; Wed, 29 Jun 2016 16:55:34 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18B1912DEF8; Wed, 29 Jun 2016 16:54:53 -0700 (PDT) X-AuditID: c6180641-f796f6d000000e1e-b6-57745f8ca336 Received: from EUSAAHC003.ericsson.se (Unknown_Domain [147.117.188.81]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id 70.05.03614.C8F54775; Thu, 30 Jun 2016 01:53:48 +0200 (CEST) Received: from EUSAAMB107.ericsson.se ([147.117.188.124]) by EUSAAHC003.ericsson.se ([147.117.188.81]) with mapi id 14.03.0294.000; Wed, 29 Jun 2016 19:54:51 -0400 From: Suresh Krishnan To: Tomek Mrugalski , Yaron Sheffer , IETF Security Directorate , "The IESG" , "draft-ietf-dhc-topo-conf.all@tools.ietf.org" Thread-Topic: SecDir review of draft-ietf-dhc-topo-conf-08 Thread-Index: AQHRvboHXmaXobDEYkKp6QMo3tFpbA== Date: Wed, 29 Jun 2016 23:54:51 +0000 Message-ID: References: <5751B895.1070400@gmail.com> <5751D4E6.6000709@gmail.com> <575344A7.30002@gmail.com> <504107ae-7f75-3ba7-afbd-7ed1f104f0b4@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrJLMWRmVeSWpSXmKPExsUyuXRPoG5PfEm4wc8XBhZ7u08xW8z4M5HZ 4sPChywW+68tYLJYdX8GuwOrx85Zd9k9liz5yeTx5fJntgDmKC6blNSczLLUIn27BK6Mr39N Cm4qVHw5tY+xgfGuZBcjJ4eEgIlEz5Q2FghbTOLCvfVsXYxcHEICRxklLkz/wwjhLGeUeL9u LlgVG1DHhp2fmUASIgLNTBJPFnUzgSSEBSwl3kxcxg5iiwhYSfSdngJl60l8/N4I1swioCrx eeEzMJtXwFeisXE3C8SGyYwSP2efBGtgBLrj+6k1YEOZBcQlbj2ZzwRxn4DEkj3nmSFsUYmX j/+xQthKEh9/z2eHqNeRWLD7ExuErS2xbOFrZohlghInZz5hmcAoMgvJ2FlIWmYhaZmFpGUB I8sqRo7S4oKc3HQjw02MwAg5JsHmuINxb6/nIUYBDkYlHt4FPCXhQqyJZcWVuYcYJTiYlUR4 j8cBhXhTEiurUovy44tKc1KLDzFKc7AoifPqv1QMFxJITyxJzU5NLUgtgskycXBKNTCuOn3U oFFQveBXRVfXs9XK75ilVjf+O3rB3UTosb9YwfmdKeXeL+XFPEXcXrAecyrls3NzY+Bs5N6o bqS+44dARCo/izr/xJIv33e93/fFeuIHpl156VrPOiKylhwKWuKjWHfiW8Cyn5dvFT5IOyg9 cerVigtTTpi+2lFYcaNk494Ka7cGlblKLMUZiYZazEXFiQC2Ehq8jAIAAA== Archived-At: Subject: Re: [secdir] SecDir review of draft-ietf-dhc-topo-conf-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2016 23:55:36 -0000 Hi Yaron,=0A= Any thoughts on this new text? Does this address your concerns?=0A= =0A= Thanks=0A= Suresh=0A= =0A= On 06/22/2016 07:37 AM, Tomek Mrugalski wrote:=0A= > Hi Yaron,=0A= >=0A= > Thanks again for your review. I came up with a proposed text for the=0A= > security considerations text. There's not much left from the original=0A= > text, so here's the whole proposed section:=0A= >=0A= > 10. Security Considerations=0A= >=0A= > This document explains existing practice with respect to the use of= =0A= > Dynamic Host Configuration Protocol [RFC2131] and Dynamic Host=0A= > Configuration Protocol Version 6 [RFC3315]. The security=0A= > considerations for these protocols are described in their=0A= > specifications and in related documents that extend these protocols.= =0A= >=0A= > The mechanisms described in this document could possibly be exploited= =0A= > by an attacker to misrepresent its point of attachment in the=0A= > network. This would cause the server to assign addresses, prefixes= =0A= > and other configuration options, which can be considered a leak of=0A= > information. In particular, this could be used a preliminary stage= =0A= > of attack, when the DHCP server leaks information about available=0A= > services in networks that attacker does not have access to.=0A= >=0A= > There are several ways how such an attack can be prevented. First,= =0A= > it seems to be a common practice to filter out DHCP traffic coming in= =0A= > from outside of the network and one that is directed to clients=0A= > outside of the network. Second, the DHCP servers can be configured= =0A= > to not respond to traffic that is coming from unknown (i.e. those=0A= > subnets the server is not configured to serve) subnets. Third, some= =0A= > relays provide the ability to reject messages that do not fit=0A= > expected characteristics. For example CMTS (Cable Modem Termination= =0A= > System) acting as a DHCP relay detects if the MAC address specified= =0A= > in chaddr in incoming DHCP messages matches the MAC address of the=0A= > cable modem it came from and can alter its behavior accordingly.=0A= > Also, relay agents and servers that are connected to clients directly= =0A= > can reject traffic that looks as if it has passed a relay (this could= =0A= > indicate the client is attempting to spoof a relay, possibly to=0A= > inject forged relay options).=0A= >=0A= > There are a number of general DHCP recommendations that should be=0A= > considered in all DHCP deployments. While not strictly related to=0A= > the mechanisms described in this document, they may be useful in=0A= > certain deployment scenarios. [RFC7819] and [RFC7824] provide an=0A= > analysis of privacy problems in DHCPv4 and DHCPv6, respectively. If= =0A= > those are of concern, [RFC7844] offers mitigation steps.=0A= >=0A= > Current DHCPv4 and DHCPv6 standards lack strong cryptographic=0A= > protection. There is an ongoing effort in DHC working group to=0A= > address this. [I-D.ietf-dhc-sedhcpv6] attempts to provide mechanism= =0A= > for strong authentication and encryption between DHCPv6 clients and= =0A= > servers. [I-D.volz-dhc-relay-server-security] attempts to improve=0A= > security of exchanges between DHCP relay agents and servers.=0A= >=0A= > Finally, there is an ongoing effort to update DHCPv6 specification,= =0A= > that is currently 13 years old. Sections 23 (Security=0A= > Considerations) and 24 (Privacy Considerations) of=0A= > [I-D.ietf-dhc-rfc3315bis] contain more recent analysis of the=0A= > security and privacy considerations.=0A= >=0A= > If you prefer to see the whole document, the unpublished -09 is=0A= > available here:=0A= > https://github.com/tomaszmrugalski/ietf-topo-conf/blob/master/draft-ietf-= dhc-topo-conf-09.txt=0A= >=0A= > Let me know if the text addresses your comments.=0A= >=0A= > Thanks again for your thorough review.=0A= >=0A= > Tomek=0A= >=0A= >=0A= =0A= From nobody Wed Jun 29 19:39:41 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 034DE12B04D; Wed, 29 Jun 2016 19:39:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.647 X-Spam-Level: X-Spam-Status: No, score=-5.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N3rA2izaDVd7; Wed, 29 Jun 2016 19:39:37 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A87D12D0C5; Wed, 29 Jun 2016 19:39:36 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml705-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CMX31739; Thu, 30 Jun 2016 02:39:34 +0000 (GMT) Received: from SZXEMA411-HUB.china.huawei.com (10.82.72.70) by lhreml705-cah.china.huawei.com (10.201.5.168) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 30 Jun 2016 03:39:26 +0100 Received: from SZXEMA510-MBX.china.huawei.com ([169.254.3.42]) by szxema411-hub.china.huawei.com ([10.82.72.70]) with mapi id 14.03.0235.001; Thu, 30 Jun 2016 10:39:21 +0800 From: Mach Chen To: Christian Huitema , "iesg@ietf.org" , "secdir@ietf.org" , "draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org" Thread-Topic: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 Thread-Index: AdHSVHw3wGPy2LWlRRa/K3WxEmXT2AAHEg9Q Date: Thu, 30 Jun 2016 02:39:20 +0000 Message-ID: References: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> In-Reply-To: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> Accept-Language: en-US, zh-CN Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.102.135] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A0B0202.57748667.000E, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.3.42, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 36a2ce1a02483ab3701dd16be321420b Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 02:39:40 -0000 Hi Christian, Thanks for your review and comments! Please see my replies inline... > -----Original Message----- > From: Christian Huitema [mailto:huitema@huitema.net] > Sent: Thursday, June 30, 2016 6:57 AM > To: iesg@ietf.org; secdir@ietf.org; > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > Subject: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 >=20 > I have reviewed this document as part of the security directorate's ongoi= ng > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area dire= ctors. > Document editors and WG chairs should treat these comments just like any > other last call comments. >=20 > The document is ready with 2 nits. >=20 > The document specifies an extension to the Label Distribution Protocol (L= DP, > RFC 5036) to provide bindings between Pseudo Wires (PW) and Label Switch > Paths (LSP) established over MPLS-TP (RFC6773). The goal is to ensure tha= t > both directions of the PW are mapped to the same LSP, and thus avoid > asymmetric routing. The document specifies additional LDP extensions to c= arry > the required information. >=20 > The security section acknowledges one concern: that attackers could misus= e > the option to force a pseudo wire through an unnatural path, either as a = denial > of service attack, or to facilitate traffic interception. The proposed mi= tigation to > that attack is essentially "careful Implementation", i.e. only accept bin= ding > requests where the LSP endpoints match the PW endpoints. Should a mismatc= h > occur, I assume that the endpoint will reject the proposed binding, as sp= ecified > in section 5, PSN Binding Operation for MS-PW. >=20 > And here is one nit: I would like to see the verification behavior specif= ied as part > of the binding operations, rather than merely mentioned in the security s= ection. OK, how about adding the following text? For SS-PW: "In addition, if the received PSN tunnel/LSP end points do not match the PW= end points, PE2 MUST reply with a Label Release message with status code s= et to "Reject - unable to use the suggested tunnel/LSPs" (TBD4) and the rec= eived PSN Tunnel Binding TLV MUST also be carried." For MS-PW: "In addition, if the received PSN tunnel/LSP end points do not match the PW= Segment end points, the receiving PE MUST reply with a Label Release messa= ge with status code set to "Reject - unable to use the suggested tunnel/LSP= s" (TBD4) and the received PSN Tunnel Binding TLV MUST also be carried." > Also, is there a specific error case for the security failure, or just th= e generic > error message? Since this is a potential attack, seems it is safer not to deliver more spe= cific reason to the attacker. I think the generic error message is sufficie= nt. How do you think? >=20 > The next nit is tied to the general security profile of LDP, which is spe= cified to > use TCP(MD5). There is no expectation of privacy for LDP data. > I am not sure that the new extensions increase the "privacy surface" of L= DP. > They do carry global identifiers of source and destination, and inform ab= out the > path of packets between these destinations, and it seems that adversaries > could use that for monitoring and targeting purposes. But it is possible = that the > information is already present in LDP. A note to that effect in the secur= ity > section would have been nice. Actually, the information is already present in both sides of the LDP sessi= on, otherwise the receiving PE cannot bind/match/compare those IDs. IMHO, t= his new extension does not increase the "privacy surface" of LDP.=20 The aforementioned information is not special/different from other informat= ion (e.g., the FECs, Labels, PE addresses, etc.) that are already transmitt= ed over the LDP session. I'm incline to not add extra text here if you are = OK with it. Best regards, Mach >=20 > -- Christian Huitema >=20 >=20 From nobody Wed Jun 29 21:48:43 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63C8512D5A2 for ; Wed, 29 Jun 2016 21:48:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4zg5mdl2TyKz for ; Wed, 29 Jun 2016 21:48:35 -0700 (PDT) Received: from xsmtp01.mail2web.com (xsmtp01.mail2web.com [168.144.250.230]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B53412D8F9 for ; Wed, 29 Jun 2016 21:48:33 -0700 (PDT) Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp01.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1bITtr-0006j7-E8 for secdir@ietf.org; Thu, 30 Jun 2016 00:48:32 -0400 Received: (qmail 667 invoked from network); 30 Jun 2016 04:48:26 -0000 Received: from unknown (HELO huitema1) (Authenticated-user:_huitema@huitema.net@[24.16.156.113]) (envelope-sender ) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 30 Jun 2016 04:48:26 -0000 From: "Christian Huitema" To: "'Mach Chen'" , , , References: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> In-Reply-To: Date: Wed, 29 Jun 2016 21:48:24 -0700 Message-ID: <05cc01d1d28a$a472ecd0$ed58c670$@huitema.net> MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJppj18XNd2LgZk1IOL006eX+38mQFj5NxLnsaorKA= Content-Language: en-us Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 04:48:36 -0000 On Wednesday, June 29, 2016 7:39 PM, Mach Chen wrote: > > Hi Christian, > > Thanks for your review and comments! You are welcome. > Please see my replies inline... > > > -----Original Message----- > > From: Christian Huitema [mailto:huitema@huitema.net] > > Sent: Thursday, June 30, 2016 6:57 AM > > To: iesg@ietf.org; secdir@ietf.org; > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > > Subject: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 > > > > I have reviewed this document as part of the security directorate's ongoing > > effort to review all IETF documents being processed by the IESG. These > > comments were written primarily for the benefit of the security area > directors. > > Document editors and WG chairs should treat these comments just like any > > other last call comments. > > > > The document is ready with 2 nits. > > > > The document specifies an extension to the Label Distribution Protocol (LDP, > > RFC 5036) to provide bindings between Pseudo Wires (PW) and Label Switch > > Paths (LSP) established over MPLS-TP (RFC6773). The goal is to ensure that > > both directions of the PW are mapped to the same LSP, and thus avoid > > asymmetric routing. The document specifies additional LDP extensions to > carry > > the required information. > > > > The security section acknowledges one concern: that attackers could misuse > > the option to force a pseudo wire through an unnatural path, either as a > denial > > of service attack, or to facilitate traffic interception. The proposed > mitigation to > > that attack is essentially "careful Implementation", i.e. only accept binding > > requests where the LSP endpoints match the PW endpoints. Should a > mismatch > > occur, I assume that the endpoint will reject the proposed binding, as > specified > > in section 5, PSN Binding Operation for MS-PW. > > > > And here is one nit: I would like to see the verification behavior specified as > part > > of the binding operations, rather than merely mentioned in the security > section. > > OK, how about adding the following text? > > For SS-PW: > "In addition, if the received PSN tunnel/LSP end points do not match the PW > end points, PE2 MUST reply with a Label Release message with status code set > to "Reject - unable to use the suggested tunnel/LSPs" (TBD4) and the received > PSN Tunnel Binding TLV MUST also be carried." Yes. > For MS-PW: > "In addition, if the received PSN tunnel/LSP end points do not match the PW > Segment end points, the receiving PE MUST reply with a Label Release > message with status code set to "Reject - unable to use the suggested > tunnel/LSPs" (TBD4) and the received PSN Tunnel Binding TLV MUST also be > carried." Yes, that works. > > Also, is there a specific error case for the security failure, or just the generic > > error message? > > Since this is a potential attack, seems it is safer not to deliver more specific > reason to the attacker. I think the generic error message is sufficient. How do > you think? OK. > > The next nit is tied to the general security profile of LDP, which is specified to > > use TCP(MD5). There is no expectation of privacy for LDP data. > > I am not sure that the new extensions increase the "privacy surface" of LDP. > > They do carry global identifiers of source and destination, and inform about > the > > path of packets between these destinations, and it seems that adversaries > > could use that for monitoring and targeting purposes. But it is possible that > the > > information is already present in LDP. A note to that effect in the security > > section would have been nice. > > Actually, the information is already present in both sides of the LDP session, > otherwise the receiving PE cannot bind/match/compare those IDs. IMHO, this > new extension does not increase the "privacy surface" of LDP. > > The aforementioned information is not special/different from other > information (e.g., the FECs, Labels, PE addresses, etc.) that are already > transmitted over the LDP session. I'm incline to not add extra text here if you > are OK with it. If you do not actually increase the privacy surface, then yes, that's OK. -- Christian Huitema From nobody Wed Jun 29 23:04:57 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 022ED12DA20; Wed, 29 Jun 2016 23:04:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.647 X-Spam-Level: X-Spam-Status: No, score=-5.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id beYNO-otkLvS; Wed, 29 Jun 2016 23:04:46 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0092E12DA1C; Wed, 29 Jun 2016 23:04:44 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml705-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CRU57010; Thu, 30 Jun 2016 06:04:42 +0000 (GMT) Received: from SZXEMA413-HUB.china.huawei.com (10.82.72.72) by lhreml705-cah.china.huawei.com (10.201.5.168) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 30 Jun 2016 07:04:41 +0100 Received: from SZXEMA510-MBX.china.huawei.com ([169.254.3.42]) by SZXEMA413-HUB.china.huawei.com ([10.82.72.72]) with mapi id 14.03.0235.001; Thu, 30 Jun 2016 14:04:38 +0800 From: Mach Chen To: Christian Huitema , "iesg@ietf.org" , "secdir@ietf.org" , "draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org" Thread-Topic: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 Thread-Index: AdHSVHw3wGPy2LWlRRa/K3WxEmXT2AAHEg9Q//+tnwD//2V7AA== Date: Thu, 30 Jun 2016 06:04:37 +0000 Message-ID: References: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> <05cc01d1d28a$a472ecd0$ed58c670$@huitema.net> In-Reply-To: <05cc01d1d28a$a472ecd0$ed58c670$@huitema.net> Accept-Language: en-US, zh-CN Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.102.135] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090206.5774B67B.0014, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.3.42, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: bc01f132eebbc0ed6d970ef9afe87297 Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 06:04:49 -0000 Hi Christian, Thanks for your prompt response! We will update the draft as agreed. Best regards, Mach > -----Original Message----- > From: Christian Huitema [mailto:huitema@huitema.net] > Sent: Thursday, June 30, 2016 12:48 PM > To: Mach Chen; iesg@ietf.org; secdir@ietf.org; > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > Subject: RE: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-0= 8 >=20 > On Wednesday, June 29, 2016 7:39 PM, Mach Chen wrote: > > > > Hi Christian, > > > > Thanks for your review and comments! >=20 > You are welcome. >=20 > > Please see my replies inline... > > > > > -----Original Message----- > > > From: Christian Huitema [mailto:huitema@huitema.net] > > > Sent: Thursday, June 30, 2016 6:57 AM > > > To: iesg@ietf.org; secdir@ietf.org; > > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > > > Subject: SECDIR review of > > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 > > > > > > I have reviewed this document as part of the security directorate's > ongoing > > > effort to review all IETF documents being processed by the IESG. > > > These comments were written primarily for the benefit of the > > > security area > > directors. > > > Document editors and WG chairs should treat these comments just like > > > any other last call comments. > > > > > > The document is ready with 2 nits. > > > > > > The document specifies an extension to the Label Distribution > > > Protocol > (LDP, > > > RFC 5036) to provide bindings between Pseudo Wires (PW) and Label > > > Switch Paths (LSP) established over MPLS-TP (RFC6773). The goal is > > > to ensure > that > > > both directions of the PW are mapped to the same LSP, and thus avoid > > > asymmetric routing. The document specifies additional LDP extensions > > > to > > carry > > > the required information. > > > > > > The security section acknowledges one concern: that attackers could > misuse > > > the option to force a pseudo wire through an unnatural path, either > > > as a > > denial > > > of service attack, or to facilitate traffic interception. The > > > proposed > > mitigation to > > > that attack is essentially "careful Implementation", i.e. only > > > accept > binding > > > requests where the LSP endpoints match the PW endpoints. Should a > > mismatch > > > occur, I assume that the endpoint will reject the proposed binding, > > > as > > specified > > > in section 5, PSN Binding Operation for MS-PW. > > > > > > And here is one nit: I would like to see the verification behavior > specified as > > part > > > of the binding operations, rather than merely mentioned in the > > > security > > section. > > > > OK, how about adding the following text? > > > > For SS-PW: > > "In addition, if the received PSN tunnel/LSP end points do not match > > the > PW > > end points, PE2 MUST reply with a Label Release message with status > > code > set > > to "Reject - unable to use the suggested tunnel/LSPs" (TBD4) and the > received > > PSN Tunnel Binding TLV MUST also be carried." >=20 > Yes. >=20 > > For MS-PW: > > "In addition, if the received PSN tunnel/LSP end points do not match > > the > PW > > Segment end points, the receiving PE MUST reply with a Label Release > > message with status code set to "Reject - unable to use the suggested > > tunnel/LSPs" (TBD4) and the received PSN Tunnel Binding TLV MUST also > > be carried." >=20 > Yes, that works. >=20 > > > Also, is there a specific error case for the security failure, or > > > just > the generic > > > error message? > > > > Since this is a potential attack, seems it is safer not to deliver > > more > specific > > reason to the attacker. I think the generic error message is sufficient= . > How do > > you think? >=20 > OK. >=20 > > > The next nit is tied to the general security profile of LDP, which > > > is > specified to > > > use TCP(MD5). There is no expectation of privacy for LDP data. > > > I am not sure that the new extensions increase the "privacy surface" > > > of > LDP. > > > They do carry global identifiers of source and destination, and > > > inform > about > > the > > > path of packets between these destinations, and it seems that > adversaries > > > could use that for monitoring and targeting purposes. But it is > > > possible > that > > the > > > information is already present in LDP. A note to that effect in the > security > > > section would have been nice. > > > > Actually, the information is already present in both sides of the LDP > session, > > otherwise the receiving PE cannot bind/match/compare those IDs. IMHO, > > this new extension does not increase the "privacy surface" of LDP. > > > > The aforementioned information is not special/different from other > > information (e.g., the FECs, Labels, PE addresses, etc.) that are > > already transmitted over the LDP session. I'm incline to not add extra > > text here > if you > > are OK with it. >=20 > If you do not actually increase the privacy surface, then yes, that's OK. >=20 > -- Christian Huitema >=20 >=20 From nobody Thu Jun 30 02:55:54 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE2F812D9DD for ; Thu, 30 Jun 2016 02:55:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.121 X-Spam-Level: X-Spam-Status: No, score=-1.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1QrQll2cPPI7 for ; Thu, 30 Jun 2016 02:55:49 -0700 (PDT) Received: from mail.kivinen.iki.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67AD012D991 for ; Thu, 30 Jun 2016 02:55:49 -0700 (PDT) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id u5U9ti0M000635 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 30 Jun 2016 12:55:44 +0300 (EEST) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id u5U9ti9b009324; Thu, 30 Jun 2016 12:55:44 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <22388.60576.417230.872199@fireball.acr.fi> Date: Thu, 30 Jun 2016 12:55:44 +0300 From: Tero Kivinen To: secdir@ietf.org X-Edit-Time: 0 min X-Total-Time: 0 min Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 09:55:52 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Watson Ladd is next in the rotation. For telechat 2016-06-30 Reviewer LC end Draft John Bradley T 2016-06-23 draft-ietf-ospf-transition-to-ospfv3-11 Carl Wallace T 2016-06-22 draft-ietf-forces-interfelfb-05 For telechat 2016-07-07 Dan Harkins T 2016-07-07 draft-ietf-calext-availability-03 Chris Inacio T 2016-07-01 draft-ietf-trill-arp-optimization-06 Leif Johansson T 2016-07-01 draft-ietf-trill-tree-selection-05 Yaron Sheffer TR2016-07-01 draft-ietf-trill-channel-tunnel-09 Takeshi Takahashi TR2015-12-28 draft-ietf-hip-rfc5203-bis-10 Hannes Tschofenig T 2015-12-28 draft-ietf-hip-rfc5204-bis-07 Tina TSOU TR2015-12-28 draft-ietf-hip-rfc5205-bis-09 Paul Wouters T 2016-06-17 draft-ietf-dnsop-dnssec-roadblock-avoidance-04 Tom Yu T 2016-07-01 draft-pal-eidr-urn-2016-01 For telechat 2016-08-04 Tobias Gondrom T 2016-07-11 draft-sweet-rfc2910bis-08 Warren Kumari T 2016-08-02 draft-sweet-rfc2911bis-09 Last calls and special requests: Alan DeKok 2016-04-30 draft-bradner-rfc3979bis-08 Donald Eastlake 2016-07-08 draft-pd-dispatch-msrp-websocket-12 Daniel Kahn Gillmor E 2016-02-01 draft-ietf-rtcweb-security-08 Phillip Hallam-Baker 2016-07-21 draft-hardy-pdf-mime-02 Steve Hanna 2016-07-18 draft-holmberg-dispatch-rfc7315-updates-07 Jeffrey Hutzelman 2016-07-04 draft-ietf-sipcore-dns-dual-stack-06 Simon Josefsson 2016-07-13 draft-ietf-6lo-ethertype-request-01 Benjamin Kaduk 2016-07-11 draft-ietf-dnsop-maintain-ds-03 Charlie Kaufman 2016-07-08 draft-ietf-ice-dualstack-fairness-03 Scott Kelly 2016-07-08 draft-ietf-mmusic-mux-exclusive-08 Stephen Kent 2016-07-12 draft-ietf-nfsv4-scsi-layout-06 Hannes Tschofenig E None draft-ietf-ntp-network-time-security-14 Hannes Tschofenig E None draft-ietf-ntp-cms-for-nts-message-06 Hannes Tschofenig E None draft-ietf-ntp-using-nts-for-ntp-05 Brian Weis E 2016-02-01 draft-ietf-cdni-uri-signing-09 -- kivinen@iki.fi From nobody Thu Jun 30 10:10:39 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25C9C12D18D; Thu, 30 Jun 2016 10:10:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RICZz3xaKuy7; Thu, 30 Jun 2016 10:10:36 -0700 (PDT) Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AA9312B053; Thu, 30 Jun 2016 10:10:36 -0700 (PDT) Received: by mail-oi0-x234.google.com with SMTP id u201so74418324oie.0; Thu, 30 Jun 2016 10:10:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4Ow2NgO0BBnzZfgwJjbwQPTN+jjR+6Jx3+NfCHXpbsg=; b=kdnsRU/UvC1ywxts8kpQQjss/kWKpWlsQNjP86mVlMC25c0NJNVRLAu7vBRCFamaX3 mVFTUdqNBO6TAecupv6vGppgsn5LVI7v4JJOxrlQXlKWlTcW/lr7uIKAQkRqiBXhgqz1 CSHKN77A8Y5F5SdCHVxrm7vxQJsJmLBwokZ3ElL+8Tp95y+O8NwYunpeDpYcK64vw+w5 wtA//9KRuMxPidDDCuYtc3Li7CAEh5CIfzAPqnfFbhmIrcbh0ThC1fTvf1UCCd8T/tYo CNtYuiTttu1ZNVkkZQGp7Qzg1hKRg6ggnFN8ZTITkGXzZ8oc4uNzbhanQFTC6TG9HUzO VeqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4Ow2NgO0BBnzZfgwJjbwQPTN+jjR+6Jx3+NfCHXpbsg=; b=Ddy32AFnTRL9cV/Kz0ffwBCVBh3Y8O/T5CIvmdyUXep0AEoBILphE3GpGXmjx1clTI qkiOTRhBWhCFqtbHd6/Ld8lEn9aMmrFKnBGtld6cMVMuYYqTgkByZhBbBAS09DvAZ9U8 ABxVFM/vgfD3RbmoeaTxE+EyPoyEAKjUeMzm/CqZld2Gw2ifkyPYA7JmhldaQSau+KI6 322P9ha4bfw/Tv2WcrwiqMlXlmgIlURmFnJkAAxH2F06cA8Fxpv+sWKbfMIywZlYSHOY ufY6DN/8WOmZVNvetfgjXZamzAls1ILzCb4LwK6evbSI/IS/d90zc9YAGO9bl7e30dQi EOIw== X-Gm-Message-State: ALyK8tLWoelOynNmfpJ2hMvRZOqqxjrnSCDUTrT9qcHiGCQTmLeYPgXLl2UHt8s4XXCHtD1T1Xr4jYdHHjMWsQ== X-Received: by 10.157.23.232 with SMTP id j95mr9873395otj.109.1467306635365; Thu, 30 Jun 2016 10:10:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.182.43.6 with HTTP; Thu, 30 Jun 2016 10:10:15 -0700 (PDT) In-Reply-To: References: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> <05cc01d1d28a$a472ecd0$ed58c670$@huitema.net> From: "Andrew G. Malis" Date: Thu, 30 Jun 2016 13:10:15 -0400 Message-ID: To: Mach Chen Content-Type: multipart/alternative; boundary=94eb2c09ae1ac71d25053681f25f Archived-At: Cc: "BRUNGARD, DEBORAH A \(ATTLABS\)" , "iesg@ietf.org" , "draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 17:10:38 -0000 --94eb2c09ae1ac71d25053681f25f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Mach, You should wait for Deborah=E2=80=99s go-ahead before doing an update, I th= ink that she'll prefer that the update occur following the end of IETF last call. Thanks, Andy On Thu, Jun 30, 2016 at 2:04 AM, Mach Chen wrote: > Hi Christian, > > Thanks for your prompt response! > > We will update the draft as agreed. > > Best regards, > Mach > > > -----Original Message----- > > From: Christian Huitema [mailto:huitema@huitema.net] > > Sent: Thursday, June 30, 2016 12:48 PM > > To: Mach Chen; iesg@ietf.org; secdir@ietf.org; > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > > Subject: RE: SECDIR review of > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 > > > > On Wednesday, June 29, 2016 7:39 PM, Mach Chen wrote: > > > > > > Hi Christian, > > > > > > Thanks for your review and comments! > > > > You are welcome. > > > > > Please see my replies inline... > > > > > > > -----Original Message----- > > > > From: Christian Huitema [mailto:huitema@huitema.net] > > > > Sent: Thursday, June 30, 2016 6:57 AM > > > > To: iesg@ietf.org; secdir@ietf.org; > > > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > > > > Subject: SECDIR review of > > > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 > > > > > > > > I have reviewed this document as part of the security directorate's > > ongoing > > > > effort to review all IETF documents being processed by the IESG. > > > > These comments were written primarily for the benefit of the > > > > security area > > > directors. > > > > Document editors and WG chairs should treat these comments just lik= e > > > > any other last call comments. > > > > > > > > The document is ready with 2 nits. > > > > > > > > The document specifies an extension to the Label Distribution > > > > Protocol > > (LDP, > > > > RFC 5036) to provide bindings between Pseudo Wires (PW) and Label > > > > Switch Paths (LSP) established over MPLS-TP (RFC6773). The goal is > > > > to ensure > > that > > > > both directions of the PW are mapped to the same LSP, and thus avoi= d > > > > asymmetric routing. The document specifies additional LDP extension= s > > > > to > > > carry > > > > the required information. > > > > > > > > The security section acknowledges one concern: that attackers could > > misuse > > > > the option to force a pseudo wire through an unnatural path, either > > > > as a > > > denial > > > > of service attack, or to facilitate traffic interception. The > > > > proposed > > > mitigation to > > > > that attack is essentially "careful Implementation", i.e. only > > > > accept > > binding > > > > requests where the LSP endpoints match the PW endpoints. Should a > > > mismatch > > > > occur, I assume that the endpoint will reject the proposed binding, > > > > as > > > specified > > > > in section 5, PSN Binding Operation for MS-PW. > > > > > > > > And here is one nit: I would like to see the verification behavior > > specified as > > > part > > > > of the binding operations, rather than merely mentioned in the > > > > security > > > section. > > > > > > OK, how about adding the following text? > > > > > > For SS-PW: > > > "In addition, if the received PSN tunnel/LSP end points do not match > > > the > > PW > > > end points, PE2 MUST reply with a Label Release message with status > > > code > > set > > > to "Reject - unable to use the suggested tunnel/LSPs" (TBD4) and the > > received > > > PSN Tunnel Binding TLV MUST also be carried." > > > > Yes. > > > > > For MS-PW: > > > "In addition, if the received PSN tunnel/LSP end points do not match > > > the > > PW > > > Segment end points, the receiving PE MUST reply with a Label Release > > > message with status code set to "Reject - unable to use the suggested > > > tunnel/LSPs" (TBD4) and the received PSN Tunnel Binding TLV MUST also > > > be carried." > > > > Yes, that works. > > > > > > Also, is there a specific error case for the security failure, or > > > > just > > the generic > > > > error message? > > > > > > Since this is a potential attack, seems it is safer not to deliver > > > more > > specific > > > reason to the attacker. I think the generic error message is sufficie= nt > --94eb2c09ae1ac71d25053681f25f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Mach,

You should wait for Deborah=E2=80= =99s go-ahead before doing an update, I think that she'll prefer that t= he update occur following the end of IETF last call.

Thanks,
Andy


On Thu, Jun 30, 2016 at 2:04 AM, Mach Ch= en <mach.chen@huawei.com> wrote:
Hi Christian,

Thanks for your prompt response!

We will update the draft as agreed.

Best regards,
Mach

> -----Original Message-----
> From: Christian Huitema [mailto:huitema@huitema.net]
> Sent: Thursday, June 30= , 2016 12:48 PM
> To: Mach Chen; iesg@ietf.org; secdir@ietf.org;
> draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org
> Subject: RE: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-ls= p-08
>
> On Wednesday, June 29, 2016 7:39 PM, Mach Chen wrote:
> >
> > Hi Christian,
> >
> > Thanks for your review and comments!
>
> You are welcome.
>
> > Please see my replies inline...
> >
> > > -----Original Message-----
> > > From: Christian Huitema [mailto:huitema@huitema.net]
> > > Sent: Thursday, June 30, 2016 6:57 AM
> > > To: iesg@ietf.org; secdir@ietf.org;
> > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org > > > Subject: SECDIR review of
> > > draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08
> > >
> > > I have reviewed this document as part of the security direct= orate's
> ongoing
> > > effort to review all IETF documents being processed by the I= ESG.
> > > These comments were written primarily for the benefit of the=
> > > security area
> > directors.
> > > Document editors and WG chairs should treat these comments j= ust like
> > > any other last call comments.
> > >
> > > The document is ready with 2 nits.
> > >
> > > The document specifies an extension to the Label Distributio= n
> > > Protocol
> (LDP,
> > > RFC 5036) to provide bindings between Pseudo Wires (PW) and = Label
> > > Switch Paths (LSP) established over MPLS-TP (RFC6773). The g= oal is
> > > to ensure
> that
> > > both directions of the PW are mapped to the same LSP, and th= us avoid
> > > asymmetric routing. The document specifies additional LDP ex= tensions
> > > to
> > carry
> > > the required information.
> > >
> > > The security section acknowledges one concern: that attacker= s could
> misuse
> > > the option to force a pseudo wire through an unnatural path,= either
> > > as a
> > denial
> > > of service attack, or to facilitate traffic interception. Th= e
> > > proposed
> > mitigation to
> > > that attack is essentially "careful Implementation"= ;, i.e. only
> > > accept
> binding
> > > requests where the LSP endpoints match the PW endpoints. Sho= uld a
> > mismatch
> > > occur, I assume that the endpoint will reject the proposed b= inding,
> > > as
> > specified
> > > in section 5, PSN Binding Operation for MS-PW.
> > >
> > > And here is one nit: I would like to see the verification be= havior
> specified as
> > part
> > > of the binding operations, rather than merely mentioned in t= he
> > > security
> > section.
> >
> > OK, how about adding the following text?
> >
> > For SS-PW:
> > "In addition, if the received PSN tunnel/LSP end points do n= ot match
> > the
> PW
> > end points, PE2 MUST reply with a Label Release message with stat= us
> > code
> set
> > to "Reject - unable to use the suggested tunnel/LSPs" (= TBD4) and the
> received
> > PSN Tunnel Binding TLV MUST also be carried."
>
> Yes.
>
> > For MS-PW:
> > "In addition, if the received PSN tunnel/LSP end points do n= ot match
> > the
> PW
> > Segment end points, the receiving PE MUST reply with a Label Rele= ase
> > message with status code set to "Reject - unable to use the = suggested
> > tunnel/LSPs" (TBD4) and the received PSN Tunnel Binding TLV = MUST also
> > be carried."
>
> Yes, that works.
>
> > > Also, is there a specific error case for the security failur= e, or
> > > just
> the generic
> > > error message?
> >
> > Since this is a potential attack, seems it is safer not to delive= r
> > more
> specific
> > reason to the attacker. I think the generic error message is suff= icient

--94eb2c09ae1ac71d25053681f25f-- From nobody Thu Jun 30 17:48:43 2016 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 755B212D0B1; Thu, 30 Jun 2016 17:48:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.646 X-Spam-Level: X-Spam-Status: No, score=-5.646 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tpxGp3YTmX3Y; Thu, 30 Jun 2016 17:48:39 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD4D912D0B3; Thu, 30 Jun 2016 17:48:37 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml702-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CRV89984; Fri, 01 Jul 2016 00:48:34 +0000 (GMT) Received: from SZXEMA413-HUB.china.huawei.com (10.82.72.72) by lhreml702-cah.china.huawei.com (10.201.5.99) with Microsoft SMTP Server (TLS) id 14.3.235.1; Fri, 1 Jul 2016 01:48:32 +0100 Received: from SZXEMA510-MBX.china.huawei.com ([169.254.3.42]) by SZXEMA413-HUB.china.huawei.com ([10.82.72.72]) with mapi id 14.03.0235.001; Fri, 1 Jul 2016 08:48:27 +0800 From: Mach Chen To: "Andrew G. Malis" Thread-Topic: SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 Thread-Index: AdHSVHw3wGPy2LWlRRa/K3WxEmXT2AAHEg9Q//+tnwD//2V7AIABacqA//76gQA= Date: Fri, 1 Jul 2016 00:48:26 +0000 Message-ID: References: <029601d1d259$9d2a1c40$d77e54c0$@huitema.net> <05cc01d1d28a$a472ecd0$ed58c670$@huitema.net> In-Reply-To: Accept-Language: en-US, zh-CN Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.102.135] Content-Type: multipart/alternative; boundary="_000_F73A3CB31E8BE34FA1BBE3C8F0CB2AE28CC891F3SZXEMA510MBXchi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.5775BDE3.0068, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.3.42, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: bc01f132eebbc0ed6d970ef9afe87297 Archived-At: Cc: "BRUNGARD, DEBORAH A \(ATTLABS\)" , "iesg@ietf.org" , "draft-ietf-pals-mpls-tp-pw-over-bidir-lsp.all@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] SECDIR review of draft-ietf-pals-mpls-tp-pw-over-bidir-lsp-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jul 2016 00:48:42 -0000 --_000_F73A3CB31E8BE34FA1BBE3C8F0CB2AE28CC891F3SZXEMA510MBXchi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQW5keSwNCg0KVGhhbmtzIGZvciB5b3VyIGd1aWRhbmNlIQ0KDQpZZXMsIHRoYXTigJlzIHRo ZSBwbGFuLg0KDQpCZXN0IHJlZ2FyZHMsDQpNYWNoDQoNCkZyb206IEFuZHJldyBHLiBNYWxpcyBb bWFpbHRvOmFnbWFsaXNAZ21haWwuY29tXQ0KU2VudDogRnJpZGF5LCBKdWx5IDAxLCAyMDE2IDE6 MTAgQU0NClRvOiBNYWNoIENoZW4NCkNjOiBDaHJpc3RpYW4gSHVpdGVtYTsgaWVzZ0BpZXRmLm9y Zzsgc2VjZGlyQGlldGYub3JnOyBkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJpZGly LWxzcC5hbGxAaWV0Zi5vcmc7IEJSVU5HQVJELCBERUJPUkFIIEEgKEFUVExBQlMpDQpTdWJqZWN0 OiBSZTogU0VDRElSIHJldmlldyBvZiBkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJp ZGlyLWxzcC0wOA0KDQpNYWNoLA0KDQpZb3Ugc2hvdWxkIHdhaXQgZm9yIERlYm9yYWjigJlzIGdv LWFoZWFkIGJlZm9yZSBkb2luZyBhbiB1cGRhdGUsIEkgdGhpbmsgdGhhdCBzaGUnbGwgcHJlZmVy IHRoYXQgdGhlIHVwZGF0ZSBvY2N1ciBmb2xsb3dpbmcgdGhlIGVuZCBvZiBJRVRGIGxhc3QgY2Fs bC4NCg0KVGhhbmtzLA0KQW5keQ0KDQoNCk9uIFRodSwgSnVuIDMwLCAyMDE2IGF0IDI6MDQgQU0s IE1hY2ggQ2hlbiA8bWFjaC5jaGVuQGh1YXdlaS5jb208bWFpbHRvOm1hY2guY2hlbkBodWF3ZWku Y29tPj4gd3JvdGU6DQpIaSBDaHJpc3RpYW4sDQoNClRoYW5rcyBmb3IgeW91ciBwcm9tcHQgcmVz cG9uc2UhDQoNCldlIHdpbGwgdXBkYXRlIHRoZSBkcmFmdCBhcyBhZ3JlZWQuDQoNCkJlc3QgcmVn YXJkcywNCk1hY2gNCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBDaHJp c3RpYW4gSHVpdGVtYSBbbWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5uZXQ8bWFpbHRvOmh1aXRlbWFA aHVpdGVtYS5uZXQ+XQ0KPiBTZW50OiBUaHVyc2RheSwgSnVuZSAzMCwgMjAxNiAxMjo0OCBQTQ0K PiBUbzogTWFjaCBDaGVuOyBpZXNnQGlldGYub3JnPG1haWx0bzppZXNnQGlldGYub3JnPjsgc2Vj ZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+Ow0KPiBkcmFmdC1pZXRmLXBhbHMt bXBscy10cC1wdy1vdmVyLWJpZGlyLWxzcC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYt cGFscy1tcGxzLXRwLXB3LW92ZXItYmlkaXItbHNwLmFsbEBpZXRmLm9yZz4NCj4gU3ViamVjdDog UkU6IFNFQ0RJUiByZXZpZXcgb2YgZHJhZnQtaWV0Zi1wYWxzLW1wbHMtdHAtcHctb3Zlci1iaWRp ci1sc3AtMDgNCj4NCj4gT24gV2VkbmVzZGF5LCBKdW5lIDI5LCAyMDE2IDc6MzkgUE0sIE1hY2gg Q2hlbiB3cm90ZToNCj4gPg0KPiA+IEhpIENocmlzdGlhbiwNCj4gPg0KPiA+IFRoYW5rcyBmb3Ig eW91ciByZXZpZXcgYW5kIGNvbW1lbnRzIQ0KPg0KPiBZb3UgYXJlIHdlbGNvbWUuDQo+DQo+ID4g UGxlYXNlIHNlZSBteSByZXBsaWVzIGlubGluZS4uLg0KPiA+DQo+ID4gPiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPiA+ID4gRnJvbTogQ2hyaXN0aWFuIEh1aXRlbWEgW21haWx0bzpodWl0 ZW1hQGh1aXRlbWEubmV0PG1haWx0bzpodWl0ZW1hQGh1aXRlbWEubmV0Pl0NCj4gPiA+IFNlbnQ6 IFRodXJzZGF5LCBKdW5lIDMwLCAyMDE2IDY6NTcgQU0NCj4gPiA+IFRvOiBpZXNnQGlldGYub3Jn PG1haWx0bzppZXNnQGlldGYub3JnPjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0 Zi5vcmc+Ow0KPiA+ID4gZHJhZnQtaWV0Zi1wYWxzLW1wbHMtdHAtcHctb3Zlci1iaWRpci1sc3Au YWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJpZGly LWxzcC5hbGxAaWV0Zi5vcmc+DQo+ID4gPiBTdWJqZWN0OiBTRUNESVIgcmV2aWV3IG9mDQo+ID4g PiBkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJpZGlyLWxzcC0wOA0KPiA+ID4NCj4g PiA+IEkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5 IGRpcmVjdG9yYXRlJ3MNCj4gb25nb2luZw0KPiA+ID4gZWZmb3J0IHRvIHJldmlldyBhbGwgSUVU RiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLg0KPiA+ID4gVGhlc2UgY29t bWVudHMgd2VyZSB3cml0dGVuIHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlDQo+ID4g PiBzZWN1cml0eSBhcmVhDQo+ID4gZGlyZWN0b3JzLg0KPiA+ID4gRG9jdW1lbnQgZWRpdG9ycyBh bmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UNCj4gPiA+ IGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQo+ID4gPg0KPiA+ID4gVGhlIGRvY3VtZW50 IGlzIHJlYWR5IHdpdGggMiBuaXRzLg0KPiA+ID4NCj4gPiA+IFRoZSBkb2N1bWVudCBzcGVjaWZp ZXMgYW4gZXh0ZW5zaW9uIHRvIHRoZSBMYWJlbCBEaXN0cmlidXRpb24NCj4gPiA+IFByb3RvY29s DQo+IChMRFAsDQo+ID4gPiBSRkMgNTAzNikgdG8gcHJvdmlkZSBiaW5kaW5ncyBiZXR3ZWVuIFBz ZXVkbyBXaXJlcyAoUFcpIGFuZCBMYWJlbA0KPiA+ID4gU3dpdGNoIFBhdGhzIChMU1ApIGVzdGFi bGlzaGVkIG92ZXIgTVBMUy1UUCAoUkZDNjc3MykuIFRoZSBnb2FsIGlzDQo+ID4gPiB0byBlbnN1 cmUNCj4gdGhhdA0KPiA+ID4gYm90aCBkaXJlY3Rpb25zIG9mIHRoZSBQVyBhcmUgbWFwcGVkIHRv IHRoZSBzYW1lIExTUCwgYW5kIHRodXMgYXZvaWQNCj4gPiA+IGFzeW1tZXRyaWMgcm91dGluZy4g VGhlIGRvY3VtZW50IHNwZWNpZmllcyBhZGRpdGlvbmFsIExEUCBleHRlbnNpb25zDQo+ID4gPiB0 bw0KPiA+IGNhcnJ5DQo+ID4gPiB0aGUgcmVxdWlyZWQgaW5mb3JtYXRpb24uDQo+ID4gPg0KPiA+ ID4gVGhlIHNlY3VyaXR5IHNlY3Rpb24gYWNrbm93bGVkZ2VzIG9uZSBjb25jZXJuOiB0aGF0IGF0 dGFja2VycyBjb3VsZA0KPiBtaXN1c2UNCj4gPiA+IHRoZSBvcHRpb24gdG8gZm9yY2UgYSBwc2V1 ZG8gd2lyZSB0aHJvdWdoIGFuIHVubmF0dXJhbCBwYXRoLCBlaXRoZXINCj4gPiA+IGFzIGENCj4g PiBkZW5pYWwNCj4gPiA+IG9mIHNlcnZpY2UgYXR0YWNrLCBvciB0byBmYWNpbGl0YXRlIHRyYWZm aWMgaW50ZXJjZXB0aW9uLiBUaGUNCj4gPiA+IHByb3Bvc2VkDQo+ID4gbWl0aWdhdGlvbiB0bw0K PiA+ID4gdGhhdCBhdHRhY2sgaXMgZXNzZW50aWFsbHkgImNhcmVmdWwgSW1wbGVtZW50YXRpb24i LCBpLmUuIG9ubHkNCj4gPiA+IGFjY2VwdA0KPiBiaW5kaW5nDQo+ID4gPiByZXF1ZXN0cyB3aGVy ZSB0aGUgTFNQIGVuZHBvaW50cyBtYXRjaCB0aGUgUFcgZW5kcG9pbnRzLiBTaG91bGQgYQ0KPiA+ IG1pc21hdGNoDQo+ID4gPiBvY2N1ciwgSSBhc3N1bWUgdGhhdCB0aGUgZW5kcG9pbnQgd2lsbCBy ZWplY3QgdGhlIHByb3Bvc2VkIGJpbmRpbmcsDQo+ID4gPiBhcw0KPiA+IHNwZWNpZmllZA0KPiA+ ID4gaW4gc2VjdGlvbiA1LCBQU04gQmluZGluZyBPcGVyYXRpb24gZm9yIE1TLVBXLg0KPiA+ID4N Cj4gPiA+IEFuZCBoZXJlIGlzIG9uZSBuaXQ6IEkgd291bGQgbGlrZSB0byBzZWUgdGhlIHZlcmlm aWNhdGlvbiBiZWhhdmlvcg0KPiBzcGVjaWZpZWQgYXMNCj4gPiBwYXJ0DQo+ID4gPiBvZiB0aGUg YmluZGluZyBvcGVyYXRpb25zLCByYXRoZXIgdGhhbiBtZXJlbHkgbWVudGlvbmVkIGluIHRoZQ0K PiA+ID4gc2VjdXJpdHkNCj4gPiBzZWN0aW9uLg0KPiA+DQo+ID4gT0ssIGhvdyBhYm91dCBhZGRp bmcgdGhlIGZvbGxvd2luZyB0ZXh0Pw0KPiA+DQo+ID4gRm9yIFNTLVBXOg0KPiA+ICJJbiBhZGRp dGlvbiwgaWYgdGhlIHJlY2VpdmVkIFBTTiB0dW5uZWwvTFNQIGVuZCBwb2ludHMgZG8gbm90IG1h dGNoDQo+ID4gdGhlDQo+IFBXDQo+ID4gZW5kIHBvaW50cywgUEUyIE1VU1QgcmVwbHkgd2l0aCBh IExhYmVsIFJlbGVhc2UgbWVzc2FnZSB3aXRoIHN0YXR1cw0KPiA+IGNvZGUNCj4gc2V0DQo+ID4g dG8gIlJlamVjdCAtIHVuYWJsZSB0byB1c2UgdGhlIHN1Z2dlc3RlZCB0dW5uZWwvTFNQcyIgKFRC RDQpIGFuZCB0aGUNCj4gcmVjZWl2ZWQNCj4gPiBQU04gVHVubmVsIEJpbmRpbmcgVExWIE1VU1Qg YWxzbyBiZSBjYXJyaWVkLiINCj4NCj4gWWVzLg0KPg0KPiA+IEZvciBNUy1QVzoNCj4gPiAiSW4g YWRkaXRpb24sIGlmIHRoZSByZWNlaXZlZCBQU04gdHVubmVsL0xTUCBlbmQgcG9pbnRzIGRvIG5v dCBtYXRjaA0KPiA+IHRoZQ0KPiBQVw0KPiA+IFNlZ21lbnQgZW5kIHBvaW50cywgdGhlIHJlY2Vp dmluZyBQRSBNVVNUIHJlcGx5IHdpdGggYSBMYWJlbCBSZWxlYXNlDQo+ID4gbWVzc2FnZSB3aXRo IHN0YXR1cyBjb2RlIHNldCB0byAiUmVqZWN0IC0gdW5hYmxlIHRvIHVzZSB0aGUgc3VnZ2VzdGVk DQo+ID4gdHVubmVsL0xTUHMiIChUQkQ0KSBhbmQgdGhlIHJlY2VpdmVkIFBTTiBUdW5uZWwgQmlu ZGluZyBUTFYgTVVTVCBhbHNvDQo+ID4gYmUgY2FycmllZC4iDQo+DQo+IFllcywgdGhhdCB3b3Jr cy4NCj4NCj4gPiA+IEFsc28sIGlzIHRoZXJlIGEgc3BlY2lmaWMgZXJyb3IgY2FzZSBmb3IgdGhl IHNlY3VyaXR5IGZhaWx1cmUsIG9yDQo+ID4gPiBqdXN0DQo+IHRoZSBnZW5lcmljDQo+ID4gPiBl cnJvciBtZXNzYWdlPw0KPiA+DQo+ID4gU2luY2UgdGhpcyBpcyBhIHBvdGVudGlhbCBhdHRhY2ss IHNlZW1zIGl0IGlzIHNhZmVyIG5vdCB0byBkZWxpdmVyDQo+ID4gbW9yZQ0KPiBzcGVjaWZpYw0K PiA+IHJlYXNvbiB0byB0aGUgYXR0YWNrZXIuIEkgdGhpbmsgdGhlIGdlbmVyaWMgZXJyb3IgbWVz c2FnZSBpcyBzdWZmaWNpZW50DQoNCg== --_000_F73A3CB31E8BE34FA1BBE3C8F0CB2AE28CC891F3SZXEMA510MBXchi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTIgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 5a6L5L2TOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQOWui+S9kyI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZp bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt YXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OuWui+S9kzt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmltDQoJe21zby1zdHlsZS1uYW1lOmltO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fu cy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5 Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA5MC4wcHQgNzIuMHB0IDkwLjBwdDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IlpI LUNOIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQt c2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkhpIEFuZHksPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZx dW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2Nv bG9yOiMxRjQ5N0QiPlRoYW5rcyBmb3IgeW91ciBndWlkYW5jZSE8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQt c2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDs7Y29sb3I6IzFGNDk3RCI+WWVzLCB0aGF04oCZcyB0aGUgcGxhbi48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+QmVzdCByZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+TWFjaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNt IDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiBBbmRy ZXcgRy4gTWFsaXMgW21haWx0bzphZ21hbGlzQGdtYWlsLmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9i PiBGcmlkYXksIEp1bHkgMDEsIDIwMTYgMToxMCBBTTxicj4NCjxiPlRvOjwvYj4gTWFjaCBDaGVu PGJyPg0KPGI+Q2M6PC9iPiBDaHJpc3RpYW4gSHVpdGVtYTsgaWVzZ0BpZXRmLm9yZzsgc2VjZGly QGlldGYub3JnOyBkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJpZGlyLWxzcC5hbGxA aWV0Zi5vcmc7IEJSVU5HQVJELCBERUJPUkFIIEEgKEFUVExBQlMpPGJyPg0KPGI+U3ViamVjdDo8 L2I+IFJlOiBTRUNESVIgcmV2aWV3IG9mIGRyYWZ0LWlldGYtcGFscy1tcGxzLXRwLXB3LW92ZXIt YmlkaXItbHNwLTA4PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPk1h Y2gsPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+WW91IHNob3VsZCB3 YWl0IGZvciBEZWJvcmFo4oCZcyBnby1haGVhZCBiZWZvcmUgZG9pbmcgYW4gdXBkYXRlLCBJIHRo aW5rIHRoYXQgc2hlJ2xsIHByZWZlciB0aGF0IHRoZSB1cGRhdGUgb2NjdXIgZm9sbG93aW5nIHRo ZSBlbmQgb2YgSUVURiBsYXN0IGNhbGwuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIj5UaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkFuZHk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIj5PbiBUaHUsIEp1biAzMCwgMjAxNiBhdCAyOjA0IEFNLCBNYWNoIENoZW4g Jmx0OzxhIGhyZWY9Im1haWx0bzptYWNoLmNoZW5AaHVhd2VpLmNvbSIgdGFyZ2V0PSJfYmxhbmsi Pm1hY2guY2hlbkBodWF3ZWkuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkhpIENocmlzdGlhbiw8 YnI+DQo8YnI+DQpUaGFua3MgZm9yIHlvdXIgcHJvbXB0IHJlc3BvbnNlITxicj4NCjxicj4NCldl IHdpbGwgdXBkYXRlIHRoZSBkcmFmdCBhcyBhZ3JlZWQuPGJyPg0KPGJyPg0KQmVzdCByZWdhcmRz LDxicj4NCk1hY2g8YnI+DQo8YnI+DQo8c3BhbiBjbGFzcz0iaW0iPiZndDsgLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS08L3NwYW4+PGJyPg0KPHNwYW4gY2xhc3M9ImltIj4mZ3Q7IEZyb206IENo cmlzdGlhbiBIdWl0ZW1hIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5u ZXQiPmh1aXRlbWFAaHVpdGVtYS5uZXQ8L2E+XTwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj4m Z3Q7IFNlbnQ6IFRodXJzZGF5LCBKdW5lIDMwLCAyMDE2IDEyOjQ4IFBNPGJyPg0KJmd0OyBUbzog TWFjaCBDaGVuOyA8YSBocmVmPSJtYWlsdG86aWVzZ0BpZXRmLm9yZyI+aWVzZ0BpZXRmLm9yZzwv YT47IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9h Pjs8YnI+DQomZ3Q7IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLXBhbHMtbXBscy10cC1wdy1v dmVyLWJpZGlyLWxzcC5hbGxAaWV0Zi5vcmciPmRyYWZ0LWlldGYtcGFscy1tcGxzLXRwLXB3LW92 ZXItYmlkaXItbHNwLmFsbEBpZXRmLm9yZzwvYT48YnI+DQomZ3Q7IFN1YmplY3Q6IFJFOiBTRUNE SVIgcmV2aWV3IG9mIGRyYWZ0LWlldGYtcGFscy1tcGxzLXRwLXB3LW92ZXItYmlkaXItbHNwLTA4 PGJyPg0KJmd0Ozxicj4NCiZndDsgT24gV2VkbmVzZGF5LCBKdW5lIDI5LCAyMDE2IDc6MzkgUE0s IE1hY2ggQ2hlbiB3cm90ZTo8YnI+DQomZ3Q7ICZndDs8YnI+DQomZ3Q7ICZndDsgSGkgQ2hyaXN0 aWFuLDxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyBUaGFua3MgZm9yIHlvdXIgcmV2aWV3 IGFuZCBjb21tZW50cyE8YnI+DQomZ3Q7PGJyPg0KJmd0OyBZb3UgYXJlIHdlbGNvbWUuPGJyPg0K Jmd0Ozxicj4NCiZndDsgJmd0OyBQbGVhc2Ugc2VlIG15IHJlcGxpZXMgaW5saW5lLi4uPGJyPg0K Jmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsgLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08 YnI+DQomZ3Q7ICZndDsgJmd0OyBGcm9tOiBDaHJpc3RpYW4gSHVpdGVtYSBbbWFpbHRvOjxhIGhy ZWY9Im1haWx0bzpodWl0ZW1hQGh1aXRlbWEubmV0Ij5odWl0ZW1hQGh1aXRlbWEubmV0PC9hPl08 YnI+DQomZ3Q7ICZndDsgJmd0OyBTZW50OiBUaHVyc2RheSwgSnVuZSAzMCwgMjAxNiA2OjU3IEFN PGJyPg0KJmd0OyAmZ3Q7ICZndDsgVG86IDxhIGhyZWY9Im1haWx0bzppZXNnQGlldGYub3JnIj5p ZXNnQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNk aXJAaWV0Zi5vcmc8L2E+Ozxicj4NCiZndDsgJmd0OyAmZ3Q7IDxhIGhyZWY9Im1haWx0bzpkcmFm dC1pZXRmLXBhbHMtbXBscy10cC1wdy1vdmVyLWJpZGlyLWxzcC5hbGxAaWV0Zi5vcmciPmRyYWZ0 LWlldGYtcGFscy1tcGxzLXRwLXB3LW92ZXItYmlkaXItbHNwLmFsbEBpZXRmLm9yZzwvYT48YnI+ DQomZ3Q7ICZndDsgJmd0OyBTdWJqZWN0OiBTRUNESVIgcmV2aWV3IG9mPGJyPg0KJmd0OyAmZ3Q7 ICZndDsgZHJhZnQtaWV0Zi1wYWxzLW1wbHMtdHAtcHctb3Zlci1iaWRpci1sc3AtMDg8YnI+DQom Z3Q7ICZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyAmZ3Q7IEkgaGF2ZSByZXZpZXdlZCB0aGlzIGRv Y3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlJ3M8YnI+DQomZ3Q7IG9u Z29pbmc8YnI+DQomZ3Q7ICZndDsgJmd0OyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3Vt ZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuPGJyPg0KJmd0OyAmZ3Q7ICZndDsgVGhl c2UgY29tbWVudHMgd2VyZSB3cml0dGVuIHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhl PGJyPg0KJmd0OyAmZ3Q7ICZndDsgc2VjdXJpdHkgYXJlYTxicj4NCiZndDsgJmd0OyBkaXJlY3Rv cnMuPGJyPg0KJmd0OyAmZ3Q7ICZndDsgRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNo b3VsZCB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2U8YnI+DQomZ3Q7ICZndDsgJmd0OyBh bnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLjxicj4NCiZndDsgJmd0OyAmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7ICZndDsgVGhlIGRvY3VtZW50IGlzIHJlYWR5IHdpdGggMiBuaXRzLjxicj4NCiZndDsg Jmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsgVGhlIGRvY3VtZW50IHNwZWNpZmllcyBhbiBl eHRlbnNpb24gdG8gdGhlIExhYmVsIERpc3RyaWJ1dGlvbjxicj4NCiZndDsgJmd0OyAmZ3Q7IFBy b3RvY29sPGJyPg0KJmd0OyAoTERQLDxicj4NCiZndDsgJmd0OyAmZ3Q7IFJGQyA1MDM2KSB0byBw cm92aWRlIGJpbmRpbmdzIGJldHdlZW4gUHNldWRvIFdpcmVzIChQVykgYW5kIExhYmVsPGJyPg0K Jmd0OyAmZ3Q7ICZndDsgU3dpdGNoIFBhdGhzIChMU1ApIGVzdGFibGlzaGVkIG92ZXIgTVBMUy1U UCAoUkZDNjc3MykuIFRoZSBnb2FsIGlzPGJyPg0KJmd0OyAmZ3Q7ICZndDsgdG8gZW5zdXJlPGJy Pg0KJmd0OyB0aGF0PGJyPg0KJmd0OyAmZ3Q7ICZndDsgYm90aCBkaXJlY3Rpb25zIG9mIHRoZSBQ VyBhcmUgbWFwcGVkIHRvIHRoZSBzYW1lIExTUCwgYW5kIHRodXMgYXZvaWQ8YnI+DQomZ3Q7ICZn dDsgJmd0OyBhc3ltbWV0cmljIHJvdXRpbmcuIFRoZSBkb2N1bWVudCBzcGVjaWZpZXMgYWRkaXRp b25hbCBMRFAgZXh0ZW5zaW9uczxicj4NCiZndDsgJmd0OyAmZ3Q7IHRvPGJyPg0KJmd0OyAmZ3Q7 IGNhcnJ5PGJyPg0KJmd0OyAmZ3Q7ICZndDsgdGhlIHJlcXVpcmVkIGluZm9ybWF0aW9uLjxicj4N CiZndDsgJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsgVGhlIHNlY3VyaXR5IHNlY3Rpb24g YWNrbm93bGVkZ2VzIG9uZSBjb25jZXJuOiB0aGF0IGF0dGFja2VycyBjb3VsZDxicj4NCiZndDsg bWlzdXNlPGJyPg0KJmd0OyAmZ3Q7ICZndDsgdGhlIG9wdGlvbiB0byBmb3JjZSBhIHBzZXVkbyB3 aXJlIHRocm91Z2ggYW4gdW5uYXR1cmFsIHBhdGgsIGVpdGhlcjxicj4NCiZndDsgJmd0OyAmZ3Q7 IGFzIGE8YnI+DQomZ3Q7ICZndDsgZGVuaWFsPGJyPg0KJmd0OyAmZ3Q7ICZndDsgb2Ygc2Vydmlj ZSBhdHRhY2ssIG9yIHRvIGZhY2lsaXRhdGUgdHJhZmZpYyBpbnRlcmNlcHRpb24uIFRoZTxicj4N CiZndDsgJmd0OyAmZ3Q7IHByb3Bvc2VkPGJyPg0KJmd0OyAmZ3Q7IG1pdGlnYXRpb24gdG88YnI+ DQomZ3Q7ICZndDsgJmd0OyB0aGF0IGF0dGFjayBpcyBlc3NlbnRpYWxseSAmcXVvdDtjYXJlZnVs IEltcGxlbWVudGF0aW9uJnF1b3Q7LCBpLmUuIG9ubHk8YnI+DQomZ3Q7ICZndDsgJmd0OyBhY2Nl cHQ8YnI+DQomZ3Q7IGJpbmRpbmc8YnI+DQomZ3Q7ICZndDsgJmd0OyByZXF1ZXN0cyB3aGVyZSB0 aGUgTFNQIGVuZHBvaW50cyBtYXRjaCB0aGUgUFcgZW5kcG9pbnRzLiBTaG91bGQgYTxicj4NCiZn dDsgJmd0OyBtaXNtYXRjaDxicj4NCiZndDsgJmd0OyAmZ3Q7IG9jY3VyLCBJIGFzc3VtZSB0aGF0 IHRoZSBlbmRwb2ludCB3aWxsIHJlamVjdCB0aGUgcHJvcG9zZWQgYmluZGluZyw8YnI+DQomZ3Q7 ICZndDsgJmd0OyBhczxicj4NCiZndDsgJmd0OyBzcGVjaWZpZWQ8YnI+DQomZ3Q7ICZndDsgJmd0 OyBpbiBzZWN0aW9uIDUsIFBTTiBCaW5kaW5nIE9wZXJhdGlvbiBmb3IgTVMtUFcuPGJyPg0KJmd0 OyAmZ3Q7ICZndDs8YnI+DQomZ3Q7ICZndDsgJmd0OyBBbmQgaGVyZSBpcyBvbmUgbml0OiBJIHdv dWxkIGxpa2UgdG8gc2VlIHRoZSB2ZXJpZmljYXRpb24gYmVoYXZpb3I8YnI+DQomZ3Q7IHNwZWNp ZmllZCBhczxicj4NCiZndDsgJmd0OyBwYXJ0PGJyPg0KJmd0OyAmZ3Q7ICZndDsgb2YgdGhlIGJp bmRpbmcgb3BlcmF0aW9ucywgcmF0aGVyIHRoYW4gbWVyZWx5IG1lbnRpb25lZCBpbiB0aGU8YnI+ DQomZ3Q7ICZndDsgJmd0OyBzZWN1cml0eTxicj4NCiZndDsgJmd0OyBzZWN0aW9uLjxicj4NCiZn dDsgJmd0Ozxicj4NCiZndDsgJmd0OyBPSywgaG93IGFib3V0IGFkZGluZyB0aGUgZm9sbG93aW5n IHRleHQ/PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7IEZvciBTUy1QVzo8YnI+DQomZ3Q7 ICZndDsgJnF1b3Q7SW4gYWRkaXRpb24sIGlmIHRoZSByZWNlaXZlZCBQU04gdHVubmVsL0xTUCBl bmQgcG9pbnRzIGRvIG5vdCBtYXRjaDxicj4NCiZndDsgJmd0OyB0aGU8YnI+DQomZ3Q7IFBXPGJy Pg0KJmd0OyAmZ3Q7IGVuZCBwb2ludHMsIFBFMiBNVVNUIHJlcGx5IHdpdGggYSBMYWJlbCBSZWxl YXNlIG1lc3NhZ2Ugd2l0aCBzdGF0dXM8YnI+DQomZ3Q7ICZndDsgY29kZTxicj4NCiZndDsgc2V0 PGJyPg0KJmd0OyAmZ3Q7IHRvICZxdW90O1JlamVjdCAtIHVuYWJsZSB0byB1c2UgdGhlIHN1Z2dl c3RlZCB0dW5uZWwvTFNQcyZxdW90OyAoVEJENCkgYW5kIHRoZTxicj4NCiZndDsgcmVjZWl2ZWQ8 YnI+DQomZ3Q7ICZndDsgUFNOIFR1bm5lbCBCaW5kaW5nIFRMViBNVVNUIGFsc28gYmUgY2Fycmll ZC4mcXVvdDs8YnI+DQomZ3Q7PGJyPg0KJmd0OyBZZXMuPGJyPg0KJmd0Ozxicj4NCiZndDsgJmd0 OyBGb3IgTVMtUFc6PGJyPg0KJmd0OyAmZ3Q7ICZxdW90O0luIGFkZGl0aW9uLCBpZiB0aGUgcmVj ZWl2ZWQgUFNOIHR1bm5lbC9MU1AgZW5kIHBvaW50cyBkbyBub3QgbWF0Y2g8YnI+DQomZ3Q7ICZn dDsgdGhlPGJyPg0KJmd0OyBQVzxicj4NCiZndDsgJmd0OyBTZWdtZW50IGVuZCBwb2ludHMsIHRo ZSByZWNlaXZpbmcgUEUgTVVTVCByZXBseSB3aXRoIGEgTGFiZWwgUmVsZWFzZTxicj4NCiZndDsg Jmd0OyBtZXNzYWdlIHdpdGggc3RhdHVzIGNvZGUgc2V0IHRvICZxdW90O1JlamVjdCAtIHVuYWJs ZSB0byB1c2UgdGhlIHN1Z2dlc3RlZDxicj4NCiZndDsgJmd0OyB0dW5uZWwvTFNQcyZxdW90OyAo VEJENCkgYW5kIHRoZSByZWNlaXZlZCBQU04gVHVubmVsIEJpbmRpbmcgVExWIE1VU1QgYWxzbzxi cj4NCiZndDsgJmd0OyBiZSBjYXJyaWVkLiZxdW90Ozxicj4NCiZndDs8YnI+DQomZ3Q7IFllcywg dGhhdCB3b3Jrcy48YnI+DQomZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsgQWxzbywgaXMgdGhlcmUg YSBzcGVjaWZpYyBlcnJvciBjYXNlIGZvciB0aGUgc2VjdXJpdHkgZmFpbHVyZSwgb3I8YnI+DQom Z3Q7ICZndDsgJmd0OyBqdXN0PGJyPg0KJmd0OyB0aGUgZ2VuZXJpYzxicj4NCiZndDsgJmd0OyAm Z3Q7IGVycm9yIG1lc3NhZ2U/PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7IFNpbmNlIHRo aXMgaXMgYSBwb3RlbnRpYWwgYXR0YWNrLCBzZWVtcyBpdCBpcyBzYWZlciBub3QgdG8gZGVsaXZl cjxicj4NCiZndDsgJmd0OyBtb3JlPGJyPg0KJmd0OyBzcGVjaWZpYzxicj4NCiZndDsgJmd0OyBy ZWFzb24gdG8gdGhlIGF0dGFja2VyLiBJIHRoaW5rIHRoZSBnZW5lcmljIGVycm9yIG1lc3NhZ2Ug aXMgc3VmZmljaWVudDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_F73A3CB31E8BE34FA1BBE3C8F0CB2AE28CC891F3SZXEMA510MBXchi_--