From 619ff18104c230cb7a134cc92844933422abbc8f Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Wed, 22 Jul 2026 12:53:48 +0530 Subject: [PATCH] doc: add info about pkt inspection engine Documentation TODO --- .../detect/detect_engine/detect_pkt_run.png | Bin 0 -> 15214 bytes .../pre_startup_pkt_inspection.png | Bin 0 -> 41362 bytes .../reassembled_stream_window.png | Bin 0 -> 12795 bytes .../engines/detect/packet_inspection.rst | 80 ++++++++++++++++++ .../devguide/internals/engines/index.rst | 8 ++ doc/userguide/rules/rule-types.rst | 2 + 6 files changed, 90 insertions(+) create mode 100644 doc/userguide/devguide/internals/engines/detect/detect_engine/detect_pkt_run.png create mode 100644 doc/userguide/devguide/internals/engines/detect/detect_engine/pre_startup_pkt_inspection.png create mode 100644 doc/userguide/devguide/internals/engines/detect/detect_engine/reassembled_stream_window.png create mode 100644 doc/userguide/devguide/internals/engines/detect/packet_inspection.rst diff --git a/doc/userguide/devguide/internals/engines/detect/detect_engine/detect_pkt_run.png b/doc/userguide/devguide/internals/engines/detect/detect_engine/detect_pkt_run.png new file mode 100644 index 0000000000000000000000000000000000000000..b30604c8f2e0f1b67968592fcd3f0d5f7be3ee0b GIT binary patch literal 15214 zcmdse1z40@yQqzT(jhGkGIY0eHzJM1z>LJeFq9GojeyjEbayy}q#&&zT_Rml(%tt% z@!#9M|8ws-=l=KJa}UovJhSRuYrVDJngDfGx!V||7?&}XTSt;n+a;R~e^SId9D!Qp_{T13Tn6|ERa8rAT3d{m*0|2&gy*LmL=Z^yb zJ#IgH1UW8tv4a2F=T9A4&?mpHaeVf>FxFV5izbAp>+ z(B+@P`ZW*X_KWw=!D?MJVQ>TlW(Bh|wUPOwR}v0$vaq!;T`-}k69NWwK@he!7oz}b;BLAX>wh%#&KqpJz_cGt>2tO}2mZ5l&hqE23$`_d zTLCirLz4gLod99}T~z;0^*?AY2Zq^#f#U%5hl6cQ5m4vf+1T`g@2&nZ?_5{>dw2tw zbHQ5wVGjJK*ZL={^-rj0V*^Mua0N*h2owRv|VXMs29zmptt|0fyczqlM;kjmcl@7nec>iw=G{};0OlaKx+dUEG-#{qW& zbTSu*6#&crV#>c*41dYgpTv;!T)CaAxC=St;=gGBlEYu^|2lHW|MS5AlK1cj&;B=) zL!NW|{LkN@{~zDO3sU_H0v)&y0_k@1Idl)5-2! z=Yp-EjsW=plj!__KP?~*sND~12?{%(0=Bb)+5xWA|0@FX{qmXqZxWbW3NUB?4R`9t z*l&*OpOwvz(O<6e&w+~t=N|e`y~M-ncy{U1-AfA6656iDD+%bX$`8p}&urJkeSu@}`YsbI%1=M&rlxe6B#sP7A}qCxez5y6aZhF5 z6ZhdDdPLmbo`_q8%j&40OXr))I=3#tHMjZZAY%4)BEcuyOlD?gk##_ehMIaRqfXKX zCUO4pcNs6$m6eg977;N#$kRp9w5O;NEKWqy zywT+8N)T?v%RP#==pP*g1|JqB_7~p0`Qq-)2C{F#{&NF)4^fsKr1?hG$mZ_e-tg;h zWrB#9G*YFJ><5Dd2A~}Avt#ath6eSwk0ibf4{w;f;Q~j_{M^?2JFP+U=Ip147%nh| z^Yssoy|DE9n;$ z7M@9P8P}ln((2CWh~c~%!KfzNl_)y3x*DRHq4+*0n)t_7A0I3{0O8}~>rKnwONfux zy@yH6mM?Pp&ObDC9^Mhl8`LiS0??1g?*eJhul6EYVVeQD^{vA^<$HI^)u6b5fPl@I z6dW?LcJOGehj6sRm$#jL)C^g3^HTN-$mb~75 z_dAJBzV7qs<{+}i8rOd;f#1@@YybFB9;rx1Mz+7d&vfL7VQg%C6CK^Ol82YKgSnaL z$FVu&xmb~rLjLJoOiVX-cX!)P<6DZs?Hu-#_mN5l1|#u0?myA;l3L4bad|n&2a~w? z6)$Yua5zb8xXw#lsW>f-c64+Uz673?AD4Z1X{sYUpy*DAqw}Y@u5juay<9>0YPC;q zDDY}}ga$^6Ix2L91O(O<`RSrEl%jQZ=MjZQ)h%!ZmdmVq#dKLFsv*ytxL&HLf0U3v z$(1tGE09VrW`zWmjHt+f9^6Ick0V~4x4F?yxY&?%QQpXA7JkDtYU=3}+jP$XTvR_F z4RXm}_i@~M}4eq#9PjzZ8R&LUfOWt5eFF3-a^r=h_JGkdd(* z`Q+37?d00cy(1%WRy9j!#Awl=~nL-d_ypgvyhZZZaCmud+)I&#?}yP_-j&4=fWl zS9nGYijBLs_Gx5tJq#jnYiBB2Y-d^MJ>gWDnIK|8oq$RGQeUQu)-Jk2MOD@GRHNU` zn>SyVORN2ky+gcqR`Hcq$lkEOn(NJ@#02|!I}u88&%nyQ1dV)%>70O+xy}bgLvq(&9&;z=#0+X>zR&71 zMokh`b0ASe_9~(lycjnS3`zk z6PW|t9M0~Srtv8!<@Yf}yiP-xHoT9#@8^%<1Y(Ob1$I*CKN>hp7-m5}EHah>u;Q>b zF3R>g8SA|fp#Ph5w6fGQl{LZWZ{(V!MgU!L&V$mRflq8G_f0z7j;}(GW?$PaY^Xf- z6!AjmCMt;Ky*E96a*cq+yxvSf(`jpv!d)}xb}c5kpXd904t5BuPX2hvL__qM%kG&J z4c`~&y?1_}>xUhqH`b@j-A6`9=d7KZd?yzny%kvb)xol9HWmmfH%|wKX-*?g?Q%>S}(OhiYx2n6>sI6V7OEh*^X%3xqo$X2@j#|<+ zPpPZMLw&cI_m;i=xS=tF>Uh4WL9LobHxXUP;b2nf=JWnFJyMZ=QLP>iB0&O`fM4R{1)WOccR zVAzegJ!5P}ELx<97_UcI3e@a9C2B{*rbU!Eca1>c-NZQRM0D-j#Qb@ zEbkT?EGljahk56FM>JST&!SeCMr(_s%dOA~8#>4Q-dby2!dxD7I)&)g-LN^TN^xk^ zzr&j@O!aVU3&!Epz(J%Gt`V5n86$!RR`O~H#sAbCz73j?qx;ydQEds9PVlcMM((=0 zv%IJ?SaffsSmF3^%HnDFxb;Zc;Kf28@mo)~-s3mP8DyO75S86PdZ*`Iz(Y(#bXIgn zBEjQm7p2`Rv?Mu*^P8&PW^U(Np&5wCUl0etNytC za)k@4p<68$UOO{)^z@hKQEjyGp(bjAfH*T>TcD(QI2fCtqcV#%LUq*lNz-^0kYPe*+!gZ09 zX0K=x-gl7siV7o-J#NcUOL*M8!Cgc}dDans+3QxLcTP~T8YnF_)zzIo;|^XgS_WmR z19E3+08n})f8lQ|RC=L3sW=q8++=<)Plv5Fl$g~vB*_INnV|n5vT*Hl;9S4nL`nRj z!1l5NVr8)bw<}UT@@?phD^Ioo1#j+yXYKyuZRP+8=-xuYBn3S9kZBn_vL$8B^F`92 zt!T&#d_NtQp{V%Td0I_j&lhVn@q#WS)<~79mF9^ve?d$gt0djdMA5kF`m0wX4p)3i zNw_R-y7+~X@+uB9T9D&n+tTjjh4^Q@!$oP!C7CIdG$?=+7|;U=NasGiq#&E$1miMU^iM593C}NEKkI2__{f~1riR)^k(?3ymdyYffm7ljvElr zrJhsB`{J8xvWGP{vI)Ouz9$vxk@!q%hIM(UpauVFcotDAXISmHl<8Ox`E7&k7WSt| zYPG~YS6Shxh^n1s{^iR?$!?u-t5jR2R=SF9b6`fkx~)R8-iaRo#vz3mb-7QiCt}-8TAp@ zJwA4qO}0>m#Fcn`oW7#gV>A|VyM>G4l041kS z=lZSt{Z@>TURsclM07srb-|&59a6GGU9v z*ZBlHv4C}4$Mhde@_kL*!z~g{yd&&M>GC{!KU+Zd){-wJRw8JkBui*xMsJQD1=38v z*_k9Bibt<_jvmM5L00WTLz2C(tD9FAmI}(H_>;^FK4j1;0?ZI#WY@w z9i$1=m6esPU6`m751|mwY+nAXvour`3OFEJO^nozzvEe-xLu~5Z+c;)Bwjc?dEi<0 z(NRCl+6|O7sL=$UYl~ukXEzoIcoNnpu{)~ec4OT+T8xOb#7M>a9|eB1N$p<0WD2MVzY5hO-J-)IlferS=kELSvu3wtb58-i7tCPF{8myS_w| zWY9R!bsuUpyj`Sw%fh^`-ske&~&nj+4yxZ2yd$oW-E)m_#4?`?cK~ zi`(9CTTL!3_@5l@na_Rl%K-N_P$Y!V4QX>yI9KA{7qU`{c+;2}|H-PtJ_B_*W@Nyo>JHy;)nPQ5|{9E~>4 zBB=>m`Vw0mrG;uwM+|7$Qz`s*?s@k5o&n+`Y^uhOr(+wli&}=k)d7`aY#hv4p0}Y> zoK9k^j3W0x%yRC}CwZCndEGj$@lAvK6d${uVps|kn_mwCyEjNlCkg~3RU+_I=MnHc z-OPd238XGwBulYWbtVa(l3jGG>elDgNIDVMYiA!Gtizquci-D;BKK6HHE`PjgS0j| zQZRDeAnEw@Xsu>Y zt=!BKtFC)T-q9(_SG`Vlh<&lCI&o_vO#}`JLghj!9U7h-a!NI*eII{MMl1X3!(w07 znefts;=BTj(vHWt9)mDdngVAS#7yCs5&G0!JjPL#`T|orc z;?04Cjp6i4x`zwA3&#Y(8Lb^19cL^Fp8i2WGliYYLq#m-I64Gmm5TAP$Nu^h%MTRk zl~|fC_GSn;Ekzcy)Av)}xOL}4k&-PZ;CG^I^JoEK1hGTnqOhGvwtx}z1Cp)c%lb`oucF<$Et$M~}6pmu*6Q`KsxM~*55@NZ%S z9U0^vw1!Ze8|@*!y>3j3_6M6_z`l$hnQ02Zuk?GS)Az*apyvI1PLD&x{=tE1qwj5Z z5sywt*tNjzCCp!h@;7taZ2)V-?9%+_2FH#}XC?#VdQ#pxB3gII$~h{!hGMu}nD50! zHjnRMI;?aV+?nKJUfkN|!Ikh_&DO5HCC3t-|JD2J085J5L9cs<_)5UDqjgXF?_*Kr zPG$;Wib9ElDuud*JcI0sfqPr?jW>%(Dz@dwU2>j=AnqR_EpLvm zo6t~|oCC26E44^Wd2P_lRp6XtjN0Bc@?Jb`pPJ_;Cwuq3dBB?A?TYfG^25#!`H}ZG zTpd!^tcPIrW5bjtdS$coEylH2t+-kO{If~?r!A2iQu~!cDDv)d%-DAaNXLh4>n>8E zu&=a_dW5`f6!jTv%4E!4E4F9cBPsFc8^3(KNvNV|ezKWUV?!$u0k=7-a9~qb%spMJ zV|Nu^n$>fyzTE_PBNc{9S44W+YH-D^T1E-uUmq{+#6j$ILLDJkq`XlP1zL%p2B@p| zJ<=Yy#PSq2cBO2~B#L1Q^gKbO`nWn#9@=CZ%|zvS)oPEgU3t%8zfX|yiihRo$tY`Q zmO|3QDqrf8I*Fl9RzXHa6`@??vMY-2y0?z7Wj5R(0g7!`V~q(=AnojKOuRH8AjOQm z^fJ;+!Mu|x5Ha6LalAhh>aI0jW=;IgcBF-0b_^bF`?a)w$i(Zm;&W-ESZqp>5AlMI z##IV^Dv5A;EJ~4>xn%c)O?O9|-gI;qFyG^Te{hudGvoQm`j=->igmAFccb~*Z8j{Y zKm^dSHtNx+-iquj_Mx4JhyYgKVW2eeJfJ_jPhnN~+I> zrQezPt16cq9Aa%9v^V|~n?eZj$bnY=aDkH-rCgA}U%sy8$-sR;{)8+# zvt9TZ75cUAf>yN2TxaWz*f+7U=cP}!Gx|%RTBlrD^RF*u>D2D7j5v~wmsnxLBDAZk zs#2}G5^D;u0d0wwQ+DJ{k)cr_MJH~_lupoIW+2J=(dpi5{BTg5*O-J}A6CqwD8@Gv zo)4dsAA#aTDHD!_QZ(MjuHWgwJ`H+^67elm(629WXssPBup1JDUJr8~^Q*5)IAAeT zFq*f5v`!19B)*RMb8FJ={#cE5wAveocD~Lt99OQu;HX5v|@nEFW_K~H2 zT#^;jtPYA!(|T`%F`<_pdCkd)QN-0>)PQ*X9W=<;o?-w^)V8iE)L?HTJfxcM`lFG~ zt9Mq!$T(a1HXUq*u$@0roJMKK4Ikx810yIu+LE}E2HDmiH?F*toDu_NmtVA&~R_bbMXDUUr?SC)n5|EVaz8!4ACnQ8_X=zz=@_m>aa2}JA zl-lWmh)%J1WBtRhO3bZnY zPNjBZq(;@wb4=n>Gc%3iz1b^S55x{ZVal4@;mNHFq{OWHO(TbQ%e};mhgQ2lz7j$7 zGBQ=$jxAOXSQ@$<1x{-nv8e`1r9amPXPbrd$cBrRAGF0yee9geHhRyMs@gmm6au)6 z%rBNjSK|`h{zHT^&<+8qY91wBuN#^r?vOm>1cBISe#U*a(|5{gP4dze( zl)I*IEa`MH4iQ8jkPJN`U3XSGtWA4hzB(G*np#O&qcVdAZH`-*VE^#Bn5rG$32mO; z)VD;AKRH~1B;!=cQ#6ECn-nJ|&5t`9;4@AFz|fTFg}5O))1e{~pBXb<$w88o9T55*qjRnQ;{! z8q0`Ag$J0ON?6#Q(0NtN+jjZH=??Sz*G)BLez=%6~hCrbQd z*Z@QG+l_u`rK%(M%!uQWvC6i7of=iegeha19aQunFP%PU!C{FKP(bGIf-7D$Rll6|a(|lV@dWk8@ZVR!&#%qqHz5xMf(4+p4UOc5kc>1a{1vJ0_ z{zH-ZRgL7JJx>px4Hu);%2J(cl?Oo~H_>xLs+^WLt;1jAod?2kZ)0LAmAKO(fj^N_ z@8lus#mwy7+SmRWPpbK6{lO+9s(`J^Ov<0_V|rq9AZ);h+%xyoL6%k%Cp|M809B9) z6`^nwMZH3TqKl~E^BA=bmNKAaedl?$E;aE3|8jQYN?$?z1UEQ#Kn6;K^7H0k7Z+mq zIS@1&@sOoK(!D?u1#`gdH4`EF;Ts=OeP3|C`?Y&DnSL9cr1Nv#_aEBww4b?TH&Gdi z-Co`hjG0oy;0j-G@3(aiu6lXo73^Rh@!2bVS=na%lzXW^_wxusIa-zI&T{`Ap@vfD za+7AcN|<_}Z10oVrcYY)oIr$$9b2JYR&$R(AOoCL-^O|E(?r<%T#Yoi=yb*vD)%Ba zv7fNcHF5rjK8c79n0=>9f+^#U9;i5&XGEB2UJFL0?+L)qFg!ndo!;}N5(reuv)Tk0 zV8$F2(U-5sT`Sldyai-G$We5F8?!77zlU-Uq3<4-CUbPPj3OY^2!DBdxm2QlyPw9i-t6>GuXK=)FvMr*8QHTGu zk;XZZ*8(1$R1I+S&@NVYG&^Fs(Dvo>0pY<9OYPt6NqXXZf&tP4p`vvE3Di{tt4hVx=G^LYjpA9HwF|{tqp9?s1ICHsH;N1HobPfdEDQs|3C0UlCZi~xRDH_rN$qw+yaQ~_*W`wGd z4^QGNyKElIS1ne(ceoQGdn^UI~gujIjg{lP}cY{+ZD!Re@wNDTiLI=hM5gpr5m6bw#}ta|Iz&F&DGuO*z! z`I?7sW1%OlO)$G7TvxL+{Ojg2Kue}vd2_)Z*BLkLgWmDinNbf?yNFoequ@Z$}d;V*4SMeOyVN9ME3~j)^v=G(S>i5P^0KBGvv@J zq&p<{kE!OAD?YRib<_~2`F0E@YM-PRb7vLL|Jq`-1sFST@9X4R2PX?sLMFbxYTlOK zb}NPGpOp>86xT4f??1pM=Hbq3H3va;B{GBt1)MqV%(Ww@v)6de)^MFTpcTXcbBXJ; zU#eEm_G(Jio4ABGbv2v3Nr^gMWGG;Cc6N%GO0)vnc%MP_%Hp?gEv@Rr6e^(P;T!_K zI>aJgATfI<_rt{@Y?)UJmdZ2p3k+)bWRO?n!ER}-ez!;(;EFvIq_na#g3O1KMxh8w zJdLH@KF0n5d47i_F@k;tmZCSc%`d-VmoXpqNSMG8C21RxJQ{wX!(ke(~^C47L|@RYIwa~UV`Qb_g(_PXPSD+-Nr*~@XAa$p8|-9@K`Ey*=n8D8eLoQR&GsL&7~(>H@n zF7PalAC?MkM{=4`!fm@4Nal7LK>I>m1X8u>6 z)@#IaNQvp95tp6`H#|1OT8uOiw@J=vgD(i1X72K<$bvcf%%UUpRT`JQ+tQ2SROaE! zck@T8$jIKU%?;h$+?t$S9J^87Sn7ORnTr1ky^^~>O6!~H(=QT4O0l@A^LmvIXtE)3 zpL!@_Q&t5x4cPor!VGAU(6Xaff#42OLWfCp0!+L)%l-}wlX3@s!`6WD z4YHSGs}Rr@SE|;H3WOkLl6~%_OPE^cwE$SnL4+;a3bd~IlTFYdjjH}uUA)QWFfk$V zj?(cOOQNoiiF`*-f%gH8uq~=#QwHDdn8E42ONq-oDzVQ)mWexkk(XRfwO%a+SH!Mw z=qXdY=&{~96HS%n8}=@tqM=e@ATIgAYYFmY8$Ji7JUf`DqMQ)~V)v^UYc~9`R=GuI zFdd-|4A`NJ(W!Xw3HdZnusD@=qKu=cn_2Kz-rl2#ni{%L{46$|HhFWcMM}>8VeGZq zBdpaiuV=8QE|w{xKn(lV9kGDwMNy+#Fq9ER&JU%wRHNu<%|Md@+1lEgsF#=KyCgWs zKL#i4^^TYj2Oebsy&Xo>}KWgZg8Ff-A zNroDx4EhUt`9y@DZH_1;ilix}MMh{eadB~NUJn*bd-FxICHWH;LMyZ8rR2BY^B}z} zNXbrVT&1=U<8*o4cyX^pM&X-_GeG4;yjsL2F2-N;XDViHhc=+BEkUniIeMAsK{o{u z)Q~uXCMAQwXIp}M1p4l+-2;NZ#$PLeS>U@D;kH7PWgtu*85i1Hq^_z!?a{5Q-=-wL zjKuu=UT??%_{>yv8N4adZIXw{-kYTa;P+2`Pjh~Txt@|Bwkq-BVTFi#slNL8tW{JbP zvs(Erky4dPx<%owPkqwHrvBljeygId){wAoqY>!np#p2)p02%b@8aY!##6dSPA{Kj zFvMrTkd6xWXwxoOH10@<^>6Wb`dj(US=H%6fmN6e)6z zmYW>iq;vU=+&@xvSB$EJ8^3(H$;}WdJ=~kLZcTcx$e*6oN3OlPXNd~Ijnkh}o(Jhk zts#1HUXOF~SGEKY#&3%$2Uxn@Z8g-P30U-FhIUn%{Y!5M6tJpVzraW8yzHq9 z<+Z7PCqcV49<#9M?~Jr85@DZn-rVXInrv>-{i2E@#mCOvJ8E#sVn8Q<~{1Ca1P=Z!hFQR!vH)w_r(h?$}$zT}J4pi(=R zmsJBAY5LbIUM&H?5aCygI3P)hoMC3M&)J& zb;>;?qgtXg;L~ihQh6oY14RVd#xL)RiBSTNPV@7tXy@fdFPXGd|8@dpWp`girve~P z{&I+s@r^L9N8-cdN{1~zMIF2LE4u0S5=0G_wiLQJ=vLTXl%aZccD#xETALBrZgqCb z^sGbjW-)_q*<|nChr?s|90X2J_DpOhoN&%bum>s*C}g|7SS)K{)t0p#y5`BZ>l=&@s>O;A!wQO_5W*Czm9Igx2Y zgL9Q8Yj`X{xb#CTxK`llDwkR|$?T(-2PG}jKoZIgDoep?z|#a20&uwYYabJkJ`Y)m ztq0x`OvvN;gXOjA1#ufZwkBhrFbzsq0WVClWt}_xZq!(3L>&$KZzqpp_{XlV)y7F# z`YZzhW~oZ}oWRcOf7F+>Gy4`AR=xlVvF3KmrC`73gnU8BH_tT*R5p*WsOvqM46`q} zxI}<_ZS~d_qn+(0%W##AidP@?JEL6m<_SmyS}^IxdQVs{$2l+G9ZJH zwoN@VR)X_%8~Ynt+WckpITM4M0&SzRxn^%-Vm@lLvl_fhHf>DT)2w_$D;M&itt~Ju zs->l+@}Qtw_;;BcY}%}ElpDRB$PP2^WK}5nL~-QgBjczw7wd?h6G+bq8yERLT!I$I zXREn8r;}e$(3AUs~Lqfv9(ohIC^A#bF%?u z-uf0ukdHbq!mj&A5D zT=4|c?*|7Gy9&{|cwu2-9NgSey1IAfD?YP+pQxh(+;#!P0!~pHn+5jYmz3+`0fD8t zYA#nLDe;^1p4WYm5GlQY3*zZ_!rqV-_PqZ66+AE8%4`b1yHVx3K?4-arR3N- zES;_b^>p`i^0T21d_2DwOPm*mK~Z$s2JTZ0KA>p*m~JV2C;5966ciapN4KS>sUdO7 z?#&QNJSB+{ZO7NnNqFbqEc5{x>6YRmA|QxN)56tIOaY|5n66!#;%6P-=X01$gt(tF zf`e5;lv7m!g(4}bdyhWj^^bx_$-$4|KqgB%VYU}YrU6+sK{Hzi{iCNq1*0oa)LtVFHTU;utE^sWbH4!F#6p;Jbw0Tqys&MP3B zfC|XEsNp&Ul-u(2qa1)K8I`~}ni-LBj34lC9?}{#Y04oGJW69gp7xQIRjXHNu8Ol% z-qixV65q40<*+VEy=rIMKNVQ!=`K|~*~z7O0)*V3Wn|FnmqIQ(Iyy!&X-EpPm5f$7 zVg9J;Y;43OBJu?S-wsQ6@rJp;ZA`7`KldDNCBto>m6nk~U0OPYWW)h(XsTk=y|y|! z-%n?FczDK#Km#?}ezF4%mwg~)I7RLfCDaR$jD=j0y e!zIYU$IC6lBY2CaD6LKfkA-brna&a`WmsZtwJ*g()b_RU!PiNbo)5%xe9qVeR z?P6`?2qw1n-CNLck=+G=7QgQ;(!zURv31}7&JPV|>@V$aWpA9Vm%X)($KGt;x992N z;^=Ab`lpRnF3!$2R(l7vHzU^F-NolmyIpW`+}qt=A6KyPKbf7-aOO8hN@z8-xAwIA z-d9R|Z+V1v4I6t~yZtYV2=Bdd!tQt8Yw)ncTD$msAHUo5BUQeiEZ@6JotQT|kqar<3E}+rP~Gf0;JwHZD#! zp6-5tKJGS-SWkQJKV>uQ9$(u2((f+`)^F$jmHN6a_JCBP!h517Cb>tjJwX$Z-h1Bv zk|);P*2Z&h6hU$PKBMe^4Dk0`oWcMqU3clD{ajk~AKzW(|jlHBeGl_0T42cKWn zhX~^`axh(XW{-=7GiAUu8F_jlm|P2lmbGwI*v_kC&lL6rUh& z`yQ$Ow(J3M0XE}DP5GDP&%@K*#lc3|#nFY}nmD^S1KGm>Z^!Y^ny`-cw$7l36`%vb zi@^{C(jHi3rM(wU_SV(}t^a2V{X3z45b85v9;~OAJ8&QVC4w#XTfyF!+daA7_Y(HS zT5`_>{&B?m`1hmvKS^J1Q3*!^-`Rs7wuB$yN`GB71!DPf`C8-w*n~ zOa1TK$NxV4zelUTtsnk(zSl2m8px(L*3-()#+@L-t^|Kh5Y+x_By?YC z{|yK2H_r9`m_Lw+?kSCbiik@7M?}=u-gDPM`|gv0CxVAY2+M51?_b?B!oxr4okg6|O);rIvzmWAk=*4vpvnG)f$JF?PcK(M z9+wNd%F@}>9%S@Hg+cO(phpQWEcbjO;K>XB8$#RPq0%pk^be#s_i{;pm*V^(WOcSy zBIFl;jb*H{9(KFwC4$QOA#Frx*Ts5*V1^LZfUgOQfezopq5Yg9&`!S>&ioHm*pI1* z{dnXrW~6>FfBXIZ5|REMExI4+f&;=5-0%H)TnQ;FVBG&cUHpBP{kfcce<$Jf3u^(N z{_oQD`!j?7-xvCiZ0&cKbNtV}`0qK*|3Ut3f1SVkNl`*if}HQ4_y66LAJ_$9Bmcil z{sKAtvt;r&Ty%V2W$%Tb{|3hW^H2U4G47sA_IEMv?}8k=LFKpWECwwnW z`d8iX-IVDMzB?h;x;u{Gyb~UN_1<@%{z3O$WH$``d(<-lH~j^u_`_#cMfM2%FZB?A zb<_!nhrKnxqFkH_M#34y)52C*Pa9hocl%3w&HpAh@y`(u@qO=oPYH?aKku8e|2zUB zvKMdsZDRdFbK(2>&R>$9KjcbnoUkBn015U#eyUV_KZCxwdgIa5a*K*xxNt$#%IcS>ejm{UZ>%LOCB!Abo9_Y55AdYEjjg>00pS!C z*2P*m5X!lPPdaWBbse#9v}zNg*(AR_lm=Hm}U7^y#G0RL;8vLBfI)9u=y)D;m9;eTN0{*yVo z-{c3x_v;+?)xdtC**>@Z^AlTtZd1het4Q}h`F}RCwSSg>SAO8%mu&vu$i)vP?Z1)T zkBjcXIQzW!uV?q)eDV*(?z`UEU#U;t^W1)@1piU@?Y`ZwJ^%h{kxjfO{1rV zKsX>LRg?^T&1P-E*wB{>SNiNPSaNOx$sT>xWQt+7@%8+?1GrzGBBp>*stmc{YwA^%m*HZD)%1H2z z6X%!WvaS=!F5&om^{t(k71RocS9TIx16N;GFt*sR^1&L(8c%$-BO(|1G%{Ia+8Dns zDSh#(YyLKU21kS92zLN z`2NEFzq6^V@$ysOKD~9CY)|%nqo>|7OsBfk#va^v$TkZ*(U$nwXC$!q;+rCx4S}o3 z$HDoS6SMB!aw~mJ)C!K>@*9pbHRuw{77B;gw>pDcXUNzCEY#TpA09KQcp>r5^YzYg z^~cWdW_r%MJaU_8?eE~tVewZm)pU10c{?~lLuHp%*A;hZ)iGc*TMl=*i5%omg!R4Pck@LJ~)@-a#dDGb`dA;GAz4%g0a}RthGyKUe$Q}2H6Wi#U=LC?3pJQI?z zZbwwDfBHGqjAsN}tD%n42)IDlki-LWJ>)K5zJSpZ`0`|r;Mt$gdHrnh?upkd*!kCp z^%h3+xWH`wiiF$Qm!3L5`N)$gVx=~-W#YcjKvwm3DT2`qf5Pii^RPPf()!2Svp0N( zO9Gesd6$DYTWT)g>Uz!mwJ92Y;$d0=M0u=zO}OFK=^LLO93l=Uqb^_n_IY}fB6xFA zoiR(OZqwbN50CBYzRK5fsBB~QagM3q`zw6(VdL^*8A*<2bT`qvBAH9hMG(ob&MvKlj|*TB+OFu8Q7k*UGSe_cEZCrKwoXnCUf9n;55xvCH=@ z;+aGmd(49aUE28XS2PYTe11?@&g@*#Fo=*+i#*6$ts_O2OuCTNDt=IgqI-6g!vLn+f{$V>!?A!(7XO)&`;#Mp7q$c3yZq;Cdhcyh%Y98!sHuWiN)y<`DAEghok4Kg#=1bbx1UHY{ziN(Hd*?IqF8$c~ z3qPN`S9-5};AzB97!t&#%hc@7530Xt&SWj3D4$&w@`2`9Io5pZ5j<|{+CU=V_r>}= z-XfHe2S+qpz0@T*`SxeS?k3uUCq8g6Hq$AgDptp1x0ujO56Li$4=Q^VQRpu5?(5>u zx=wr+*!Ym2XmYLpLZ*`}7kMEuiX!wQPz_!vcmuqJ;<~uQRBvXkz{ zJB-vh$Xa=<;1Lkt`wJHqSz-3~$yy-qQ%f3`dUBPBgM$t^K;e@>I=yX1+m9rEU6JCg zGxmAsb)MzKThefc_Audb1Qcx%m`3A7udBA7rfhpXnnTWi?X6+Se0P@g>l$QeZoF&5BW%AGEDw&QfD%(4 z#Yj-ltc0p6=)yVPIjBjkPp0Z@2G%!)-G)>!BDrBZij`wK6!b?cY)O@v+r}fcfwRDpejTBIJDlq#wCBD2B&AI7 zUhWK#pqL%djmPr%a2w4+14d^{bn~flkqgo}&@f6OXT;_3D{Ky&VT>5TbX|c!cq1Hv zTeZm0;z1(|5nty=MwGLN5Hls!WGEO;6y>Y1+-J2DFky~phOa5U7`6yMAS-(W?jHqo zfJdj%b(%i=t11*#j9o3_H$!M{Vc^Kw1bmars{G0!$2n4r>4G)KP~JoC*um3p>-2a^ zOjnr`Aq=*SRfudldZJc}ZsMm93RaZBSHtQgEpu$4ZE^mGhG#-`GmR?@=N-oaFC*ma zUvcdS&_#rdls({uxR6*~P2#c`N}46pQIho~3wyx{b3~fA(jz3Ay*M8($;k#~F;kp@ zGv(t9Ny4OanGly-j0C#Gh!;I5S5&UitC5X9Mt_w3S@n@5*YX3z$0U7J)TMzEbRIbu z!BGSjZBx5Qo5Q5Ez4XHom6?aHPwyB%B=2sxqJyR^SvO)PcCa`a5kkdnR9}+f9+Z&y z9xto}Rf=(iH69Lg4fT!SFta1Zc;f{*i;$|h2#ZI&Dq)|w9!B}c?;e*geAN_jl}!h5 zZ5Y$oQKR$Z4>Y-I-w}Uc9w1eUc9@p>sw^A5#ZLhrh;UOLq?;ox=&~*oa@&r!irwZl zW1|E%YkpSqNCB*_Uc69h64tt`*4CjY;~IAu=vHv zi5pu~ck0imt{%3!@q%UfD};>}GX!_Ak}Y@aeAatVzZovEt5`^j*Hl6N$Rj;?8nN9eIQ3j(ZViQ7?@! z3yENXUUg+1-C&9QJhp+;L#W5&TQ=ZIMy4gFY40}=;~>QmIAx2P_mZ1z*qm#2<5x;B zoW8JyEDpOxQw%u**w^sBkG@fq>P8cn`Zk}<`)X&p))iA4$;EnfHha>2sh6fXPE%h& z2IIs@%d1xc4JUEkUC1cAf1`fORd87qK|usJsqU61R#eJAws;Bem+H`V27$JQMsG3G zzhYhSz1%0jT<}t*g!9ei#mj9WB?LgCz!@En6~N%(^gHOIg2bDjuWOBi0x}Je_~qc=`4?- z2}KExo&%%udX_X5m1J`?)X>cSP?10N=d6-U)&U74;tV0Lyp&75r zkScMujK?Z-rRHm#mjC8*GNq%U?R~f9^C=64AO?R1HwNog*8WH%JdLYgjvQHtZj5e- zMWbb6O8pAnO!OSN3NvQktK0>ocptql6p=H#6))`%@Cpp&*^?3 zD}03pr^i5gkmW-gOd___Jk&v1gNKSsJ`g>9WHa2zF(DEXy+Q=d##6wAV25CA0vT|L zmdXpo1vsyTKwNNjCtR#poF#SX%c0)O3zs=G&UJFfZIx^6 zV~7Yy>_vPXN4E7AGYKFVx*A>=XS&W55%)p>X1GiyeBqG#S6-}m!!{8IS7cDLL;W@~ zO&sO{bAUOw^5mIh_V`KkEy-f<*=}<5(Oqtmny8L5d^PUwEKBxP%qp!! zsfg*a7Kd#7!eOKak|@mr_SqVy$%9o5HN@HCrs=quyCIi(vd^Sxi>|>kmogZcUZcf~ z7X5DZ-BzCBPNSNOEP1Ao&DxU>)OZ(-!eiGFv>LkhE1gp$S;`h2j`-F^m+#a&JwIHt zb6RqiiJCk^93PfPZ-uhLSP(T}&KeyqP65IvKo$LQ8b8T>N~X1`tvR%i^4MX1c&rXG zPmbpBwXft}8Ybv3_Mm@wQX^NwSsXcIFMsAxN}=D8%ZFnR%!{!xJ*b*3&(wL*(MrZQ zk`m7=OV{ygm`444Psi=;V<+9k=SsRzT*73WM#95UD>hk3`X?NkiCPEfddBn;}fhmEf+ zu2>J0G=KGg+oO+myh^~nSGG_-sg%F{^|g*^Y{F5kAtSob3cX@xBS*yb62$vwFxm$Q zn4n1`oohZr`c(W1eiNqZvzjx)%gkPppBm3QF1{u!GRu0du=I2qW0Xmpe?nwL!VA&? z23?+#WszEye#MDe>sGlQ*En3mlg`bjKWS~sF5N_*SMeK)eZHvO^09!m=~x79h$W<% z*b>{KiEwo16F9(djzYkWJK3A6_fSuQ?}{tdzHPyIRFh4@@mkef6kl^}=x3q3xeFp0 zWQd*+UXqwH#bWJodLjnNaRK7@bT(p9M=sD<7mGNDi^RmT6hhmdr%1`?;umq_Spu`B z@(B1nJ#NMcwnSQgqrRb2eNg7OMXBi0@YcYNIDgr~c9Q1TO9EqF+{JOLL3+zk>lH%e zF-rls2%~h=_Ngo0aU_W*LugX?Kt)GM5v`fQoBJy%S~8b0N!NlBT=N@WCD4$yPaPe~ zg1c?X-<@pKe{mNp84HV?bMA2Ut(2AFm#a2va?e9eaNKmZuZ#JSvL!?DfaZA`}tviH)svT&Mi6 zQcs@QN$0{IURkuLM)71xiwkEXNrpwJAdZ(N{n~kruIfImoaf+nJYhHVpk__}wLHJW z!gKtzKwq;7Z4y2tFun2%Ud3zZDpJp>&THVY%Z|?z`!)?dbt)8tei~e0JL%|wb0=@J zp3+hvizsAm;%^Xl6{=WX3_@(Ms)iNQMaL*A%F97;c1g*hjiQUWvb5Q)OsdiGI!ozN zYS2Q-{#CT2ERB8|fm%sATjx`7_CvfW6(dJk`{3P1U6K(HVN#ke#w=s{6G5|GD;Zyn zu^f`Z4|o|^o{2N@W~gg$Ch-*0Wm$0Zzl?NCxE0sF8^QeUR&vuR2eerYk9_*xAwv$8h#s zT9<@yiyB{-Yz%8RXkp@h6DP+Nm)F>;j-7~J;@Le}<(;W8;kb=P4XOuPWU#xrPaJC- zuG1E9YBR=fJdzo)eP!FBC|IAQswPF7J4uK8m~!zdjL{_69`V-ATwmqUmj1b;36WAB z63G172~_T1uHHpl!mCG-V7yDaFQx*r{#7P^anP1c3 zUY$IfIU~aoirPIYE$ zY{~j#L4S2(W7m`LhNxz!wcF7I*9_+!wRnSBj5+VA5v{rxkMHQmS*4x4-Q71I@%XxJ zv|F3o;v3H6VqMYlqkS{fR&k=WOx^8lxIx+V5Bb>zT*jB|G}1X)`Q_4s;;s!TY;>$< zF1+CAJh2kQ9P=<7x0<^vSaJb8i3MrNU8H%L;DahyBRpNJ9k zAj`vdx(abqc~OYLPQR~|H*%y@k&dTB9!-0U;~|IC1bxdy+UdIk)+0(BQPlHF7E@)` z6iRoO+UOo2IFdM4IqVQmLn5y(oPY`8m>W-!XHLk%&&&`Lwc{Lcn%Owxry0A2!{jv&P!M9}-ZnK_rO`JFSX2#;&y78s8o@$&^qgAbYslDjj2}+oR_a}eejnN< zeJE3mzFpidwX6P6U76lM{w*uF+{twKj2AI)bZMq_42i4%Y^ z7MB|Z(AXi4>Yaukn0lsw#4i##SWC^tRx~)_FES(L(1q8L#DHhx8roD}Ce3X3R=Z2g=D4i0-W z&h36;O;ku@qts-dtU62VR>C6JDXxZ9b++pY!9fBiNrsVgp~1ea72dU}TBs#cZ9>$w5ycup z$EZ&oW3WWRmqYT5Tm#`+q3RGQJP|Stg%zxNzMA`8Q$=w)kUs?#}W? zD5|UjuF$(N8go->HcS!0enQy}%KVMyE)ADaJF${pw=(G@ig`(^4mVOYhu(&hU-0`?JGs6)luM zVC+yZ_*lZ{d{XUd`n04Y<9ASIiedEw&ud6~OzzW%3h7m7sk*I8Y8G6)I$q$Cz^EJh z+SV8DI}cKIaW!PtmzDXfvqa4BrHr=_1)9|Hw5iuP<(MW+JgOr@y2*DYz{bDCHK(pR za!%5TC{@sg$xdWSj{$6@G=h?GeMzZ;xi>ojlk}YfG~U+Tv;!Of(#HirT_fI--$%#1 z7KFo$YH57&CrTGnNZ3LTLqj93lQ5%jy+*uu%2IaKO2d+31u+E~Gat<;IVGnS6oJ-- zBLehqD6rM)v_myX83JS}&=N-9N_uFCV!W8f5?07NAOlejqnC;tyDxV^1PTilRIyU? z)k`LK6tRjQ@|{9f5KqIT?3dXP%ZPw%fg8u`+AXe%3^|eHoKwO`2F;ofom*oj3GKTiK};vAOyY+mzSshJDmfg>LE?A!>x+m& z4Rzh=Oa01t^uvmAj1Nm%bX4kgx~}h<3uG#ujD$}@gtce zo|hfUEWbJH8x*p^<-r&AB^)AwW2}PCzv6!#hwu)zgU98 z^%aeXGC7U$(9cptB$`AN#651Z6sm=H-!nx7k~yHm4iJfD`0HY#UaBXxtw-rL$wMWG zcx8eSWCxY7q5^A1Dt9!x6@tP!F?Q7RsR>sdPHHhm`w$7i7GE!NaFxtM9zZgsL*>YD zF-eu&5Ga`tS>quLbA~|?AFcHvO)Xw+<|Y4PJY36!amSAOzBuciT1KYV9-2R+$JhFL zRxF{-sO@PN)2Jl;W8AUU6_9Ehw}OUd;3c!kmmj;z`5r|y`^~Kih{zr1I+c9-7TYqJ z#iH#d$~wQ^T?^@yeE{b!F@F>9x`SrjOjx$ue9bVEIhGyTS%dCJBb9noWr?|1M>ikR zcXPHiQ`Sq{nP-zU-a@~L3CWr1&kc^bIN$hJcn%GNzjn-y=X6|EZ9i3vFiYnfYHT_Zb!#pP=_Kk>MO8*H%~OstGW$DAXt$^`bX3bNF11uO6o6KbWGj835P502rvLk=0{4l$~>HpnLE<>VR34n6s2C10hg#4!6 z&<+5S$J8g}Jpd_DI0ObxgC+b@!NH3QN(&P$M)|zUZKml-^FvIG7LyFltWf3XmSWXWO0KbML(5d61tb zpb%`qn{G0j3k>2XF?-d?RGyxn4TY+{ z^_-st;L}P=KG>3kMSX~@op>@8c^mLU z&dlaTvVB>|mYJ`9eZupD1p(OsD9Xs?1I!mvd9+LU&fMxVG!L`^C^5eCnn;txfZdV7 zppDsCu(0xY$>F}`k>KD=P?a!S)-7KS(9Si?!;iNzpXe_F5N+_%=X=w256;|92wZ!A zHE2^U{%}A4gX$FCdptPATI7_!-T>k7bc)Pso&X5*xpVE>g}QM-mbLAWMEUjhoeNN< zLq+CwwT~QnyUO2rpI@P{SZot>ZDaN61Hh{tfYeIwoVmTe0pFlj*u=BD08sqCuxlKE zkokGO1_Q95yy>7!-@;gv91e|Fq(I@?4_u#DwLcP}7$pl4Qf!H#p9PSXmxKH$>xZGr zvPX6=8%fr{!bh6?AkTIPKyzjc!0LPk?Qh>8K&R&(n8`Ve)Ye2&F3Mvy(A0~$=*_k1 z95x=LFt!n<(3|Z)XRjl_R&cgR7qy%L_$WnrsRn)EiO>ApOHvhNR=}4IkqC>;)kW_H z5=J9%)&XUg`i!StW{c?jngRA>ZF|Ej{g`nnm-k!Acb=(oAXs7>WCviFgY1m$SYyO} z_=4n!%v{BUhG+&=q?do0pA~$>XP&6eX|Q}&!4SydO|F*#LYlFHrce6XlaI(* zUlR{{|MW^Zm|_qBRMXf-Jw=MpcK)9pJ39ed{u~Kyc@2sTm?fRF&fYia7p$D5UEz!a zSg~?Iw%^pDor4*;s4d>A7tU3)Q_PViaM(N@Tk}S~dgAg5--XM}G&W;%RrBQp#FNwp z69?C}EU|0^I!f;g5R5|AQEm;cqr*_3xG<+OC7fgpihSmW^J>(Sr8Q3-0!r;AW~ru~ z0jV1o1d45HoF2VBXBG}`!Ws|;bhy-QO=Uy^x>xp1S)s<0ch%raB|vp@+8UVNmxCd| znw^-doMzKO4Lr0z^LgNr!-qK?pdX=tEGHYyh#KSj*_p1?5JL&thM+hn$*W;{ON41~5!jj$GAS2gDHg80QerzB>Yj0k28f2dCZ}wI79o!iMRLGxS{r^g{l`Y1Z;Nm z+xx5LbHjKq7fg|SNf#>F~ZFH6ws zn1s)q$pfy<1~T>vh;|LM_%o8Si8&;Vg$b#WrltZ?B7pE58Mp6AOQGkOCKiC;{s0ersv>E{QRY8Wp* z&vI)$IQ_^A!5WDLR?h?+hbbS;`U zd!d6h??yl!d;|WRpkXP8LpZhpfchj?CsY^-^WHd8yd?h=lI8xC&$}Kh2rdNijb&JMhQ}6woY7*uBUNHB=oA-r1T3LRc`T3BmPpqq~K+JEhl3H zY*f4Mj=_@4(p0BuiAARofV~3~RHdPvD;cN=jv=7(3lB1E6VxohLNZ<>CZODpnMxE9 z6e?Q~0d-$${M>VZHXoGxs{6UW?DjG9T3Lom%FlO9ecss|V3znQIsu@!8#SPApce8R zR0{m`&~A*9c*lF#&vr#V*Lw7{c4FPn~L#Aci!)EzAOMNrV2MAvgPv&2TGdl3mK-d(%u6>4Sb)j)9{@IJnmL5se@29wm(zx6$n&-KGAPm52n!ixvI#qG8I6}R z4gB`@zAVIxl2AWWwKkPWxy3p%_R}I0B=dTr)Hr-ca7@vtd^PKH6Q)(J>{83dcujDFD z?LO04*YKo1OB>E-X4|L`KL6wHt_>Me^|6PvM4ikLKHLY)ril@cH?mj6FXTbh+=&f< zJj~W^%q`7xtO7^qooS0vbeG(U2|(n#H^od|8Ws5FL`2OKicRjRqsffY@$GHl%o#Hn zG)oqHyMT)9XMo$C`7m!(FC`y)fRcrQuS;7%V5QkoU5kIzZxvv$R`0tj&16X*l8hYL zG zdCGo*#1iVQd|Xtpbq?>IJPKwfAuY^v8L6%9qoKgvCW^S+3wEop!J+Hy>O$<#1y^m{ zXy63?6ZR&4jV-^ce9-wbR)xv2@4Rll+5yHHkyb*%)Am-^4VginOh?Ob(gR<5eVrCd z=N|Q%u`QngSgk)U-aWt~@zB`G+c&(g`_msEvAv88a|K>e+R^5b9IqbZY*wO%Y&j_W z85BOKHDsM$uMdNF!q*+Yw0tsu>}+Zdca?J~>y+^B!$wwOls+8Danr&%BPo_yby=vM zA@Wqh$z1IKS^D{!;|HrRt6tA*gmLPzD~IS-{}aFwC!Rse{SU1S8zEDf1&g6 zV_$LwtlTrsI|+75DQxob9-h&HXlFs^<@8 zSS{|umYFw!9Ngzf6Ed%Tv3B(ZM-R^8zRg_Av--7#_8<6CjN@94-&BTtNva$AIiBx& z#6e1ibkXEG;pmuGq0*SBfFlA+HG5}3j$a>TYb{OqEctv?t?lAvZvL4V9pnp6;}b6VFB!vWluGHD9%-Z>%qaIL-{QxiId)%zj8Ye>hGk5o z`MG)q@aES@ZS}{KiF9zp$5INz2c#8V1ehx_P5aA*6F9V8+8UQzp_MeDki!v(ZgJHl z5~WB^%v>nylo%9Pu5EXD2tIIedQ)*J5Q@#3|3-D08AJkHpmC~$$d&Jbn*B4?;1Ur?bv?%;#!HO?$l&W%d@UhGMSsrRoxYey(L#RBs zWtod-%2Uk=_!7;SlgFb73P-D5nJRbgSe|sl|9t<+)7UG?W!FW&1w?wpfq-bF3dAqf z=mR@ar04u_ZWON;0x6O@Z^-m6>7NOSi?7YPN@SUp*(i-$PMVGSoNv(u{F9wZ{xT4N zyp>ciyrbW8T7J#CYU;X!>|=>XG({1LfjEK>*%(1t6LPTSO;M{~(*eo8YQH7Rw()8M z;VF+VULM1Qc%tSUC`SC*tMub_tEkf0-EEqbzYJjC-Y2Fz#X0YzTQ{i`2}bJ!t9(EO zb7mFXwa4!2%RblnCjX=4RMPqRcP>fQm@p<14(XG^7mteT1C2!zu3(Z#o$l4$aw3E--+ zQc91PB_B~=$2H02sSLTbv9hT>w0p^EC|p$ZTtx4(F0D%cZ2_SaEN0eZ8IW*pP5x>( z$7Qh|tsaZ6hJnD>+LH7Rtee2&-}K3#=q&DF+6bfQwTX6|KgLR6X#Jnh9ixs#c}8_U z#5D>Smo_&!!C$X|1-@feTt$q@1~BM=Qq!5oBS9W0w)PjV@mOW*jWPB%e-KW-d%_-q zk5^>JaYEZN#2wPlkLbxRAQxQ6_(rRN4;358sLOE;8TJGkJ$hD=uik@Zp_xvnLY+gG z_Mps+aPKE_-u1;ccBh~3mAh-_I80TeHBE@KDUnQ=gd)3+N4YErL7b$@Bm<99yJz0B z_nds&+^@a6%7azc?P{r40&+fz86lb88#N^phdJWFa&n#>ES_iTdj&mY6??3_{mzT( za&){uNZYxSp4--z=xG%aqC zib=TMd}Z$4pqc-yIO8>GHk4AdCXA%cSHY}ZVGKtX&`6#@7jiynNdnY^Ewkko2Q2s7 zN?iK-q0b+RlUl4Il;8q9%i^8ls4X>dsu97RoO+(&-HwXv1M$A4ZBAghKT*g?KEC<3 zWs7K7L|8PH5SivP5VRvUOeQZolC+u}OBt{Gt|>LB0psS(iv^O#hCLz_STAh(0pz+# zSiRy{Uajw#2>u%=l=B{RlJo}^=T40{a&M4bs49M0Vx_(#s|z>BKpNK0d)y|X<3`WRn`3kAYh*Hmiy4#>Y^syO~iA&A5 znLew;Z-LQFbSogj2%gKeaN%kj8xV2sd0;-$6e`WTqGAAZKX6&kI)ftyqW|u^AczIs zNy9VAY~S8J%eL(?eZyy6Z3HBah7<_(!o~h8bKANL2+IS!$Kj_=P!p9b$ri(3;=YcG z{%l-!!O-NK+BN2vjq}6SHc_#RRE;h2XVQR`MLAsS)w-{+2uoy9a zXtd#oIGO_HPg}7KsU`*Czw4L+TUrvRUtK4T<7}v*xvBDjMw9Hm#{Ez$w}U*S%T%MC zx%YI1;WwUqdCDL7MKO8wl1e|1VQj&w(8cLe5S1)|izb&yMaEISbQor8hvT26H$c6e zhyZ7MnfI3+LcoDiozav1(thM!eh3i_ypwCyLWljc9ICc>u=ozsq!fF0&`oMkb^FO5 zk$eEIs)ibsnP`poz;1U+j(CQ1ijrfW77y|p-uG069=Wjg<-KV(iUP`g89xEJ9}xw) z&u$D~yDT0I>SLBxq((sSH{s6)gz!_VVnT;_!IQ@(AP+c61^WmBuE8rrY+BV2SuLdi zHjyp6H}HC-+n9Km2gn};xrGJbEVB~L~fYlu=qiH=`>qUg($UWN`ms%8EVo zb0Ej@GTS5pTtln%s~D@KrZXWJ#Sb*oaE)7tq(X!e>%tehK*b^&f2MxQj><)N(s3M| zO!n}iMLX9khzq1Qz661-0}kyNds(5M zjmYvV`R$X)?9e1ECZS`Btbnq`9|7--KP>LfFSEE34T_Fu%IbtU7Fq5fi4-fQU62W{ zLEOEw%t=H;GegJmDP&n0Td%B}hS7af^By?r73CEgux#WdQrl5C2= z?Uijd>_el4lj@r3D411aAWb^?7F1%2Gp>v*dBJQMi70>OLq3Kb;oP96sV^Bnk_IZ> z7Hbm|7nlWB3XW03E!WAxE2}B0d!<))D0r zDd2IN_Sx=Oj?3jC7NjXKdMoLayJ>NT$&1Oz9o1QZ<^gVCq%zjv$tW=d(eW`6M;0Cd zvaxHH`S3Q}s%~$TD~H7hij7oaS>G`Y$AJXtXkotElUkync-{~m)qQ(e7bJ45Tu+xW zmArfm>X6OY$sa)P)OQ4_SRxVN{e`x#k4c07hO@b zxAEN;00lO4h}udXqSGXQN;al6qof$k5peWv&6qLTp0Hfb1F0O=PhPxtPkxS+7}Hxw za5Sl?S&A^AmlkuHcHA(8>nYyqwqU{%A7_rygDfEM{S_dOI5*pFxI0?AoXAQz+VWe& zMV0b9;FiFp@}l}r^pjTvwOzeZ1%&{t10TOwh=A*rCt((Zm;~D`kVtCov*>dHpZF&E z3E3}BN?OK~IODroR>wHSkImV|ERwiAC?w(gf*!x>LZO7Em!=yuhU-1~aA=e96RDm< zlpLf$s*OVhO~;(KME{);qGP!-Ux6D5a}?0brYP1z4puL8%GqKSh+r`VFGh}%dhwp4 z#gQO-aBXAxTCUE0r;C1EpzKYz_efuw+9tpKd|02sxZ|CKj$4upQWVR0w}j3Bqq=s- zQ0_R7q`FK?xuGK>wT@wgjIiwetMTq=OmmYv%f&EV+i*Ph(O|MG(y8xkPyD)4D#`tw zb$|-x_MeoXvH~aX96iT#Zp@mPIbsWuOLMEAuAWo^w*YePm%1D*4LgG46}5R{e8=g- zP6<{vN4UV8(rAi}HgADzQb9MYt1XCGGd~s$M?sQ3HGT@3sB|~x%Hmn6lKc4r7H``c*(Zmmt`V}pZEXI}&8?E#HbNrg z*pNi8hES9FOrvK*GQ@13sOB7~4uR-QQI?vz-fM11nI$TWU>UZ42a)I|WXtYbQ$kDT=;WkUvWO!Wne`r zd}wrRg&(BxAZePcVnVrdcHt%Cqza9jh@`HA4Oi<*s_D{GPq#c>J({K1cko=G{z&rW zge^Fl3_b_&gXQ_8x8R}-L$;X^ShFkz3*BdWtYQd4=Sh`CzF3Y&Aesq{GFmWpG`3zm z?FsHg)J1ZJerfnd2!|yso8g8=wdooAQCe3acBO9)NKFqDcbx?muco=K{L zy0&fPdBpQOOwPi62-*&o_K`QFxw?n@CyL1H6{hs6e+HM|mL?|FxVTdBD0!>w3Gp_R zL7H@qboSaM5I)2fo|_U|wsvEE9zE0f(;&#^VN?zSkJX@0%Y=)@GP;(Q}P} zAEz*q=^Nl$)a$$F?tRJ*6RKTpoS5%Fr8pzExPg4v@6~I%BYg%6Uz%)fCDK7<65<=V zgTBP8g1t(4Y+W7WDx31IX4@BNC>v9Vblq38R=|~~IZD2^TTwc>5R1wt=1@^gm21wB z%u|ih4XwwVww5xtPwj`&crMgt%DBl)o#kmQwbB|*fCqR}^FE;I6FF_+t7yS1Lgaz+ zzlE5D>hSs#5fxeihj_UgxKoqlbQ-n7;9k^7V#}sl7%7ryRGb3taeP))ihIckfMT*D zu)6&_Q?+DNE=QL>4uD7;!THLXUzju%Z9k1qw?bjAU0AHYh}1P|(ZqeWJ}b2r*Af*0 z?h8Hh2cFHQkVDy9ob@1pWr;)sNl(!(A4gS)<=|Z)*UT66)4|QbX_++WRQzgL`x10!BED+d5Y)f+m1X8#UU}Qep%uf|5ze7?QKzCu9SYE z;VSx16wgz#R(eI$X!Q*Fks0_re;taSdE@p1ZQB0Muc(U7 z6y1n0s!A)gO*-DjB-mr>W7-|mD$g%k36jcXFKRRkG+HlpyXZ2svmt#C^)0Dz!sn8c zxT-19q>gGl#qfxbp9E$aIFaOI*)^we+Y9n_P5B|N-STK$AT1Xn9fwi;LWZP5B56j!@$br4H=W_6MXHeB6Sv^V=+d4pj7mIOAsh{}c8b-h)iu$@pv^8{ zg>;jiogg>1Y;tQ$V6_@Kf1aQ*q6E+mv6Dcp&zuu7nW_vMzhG3Onfl8VI7msJG#Z{k zUJ%dojqlL3-6;zz(ahNJ8C3^5VCJJV=(L_^+4rL*WzHvOwhVW(yfpnN0#H(=pyQl{fMYUOZ}44;t0B6q zlOw#`Y|-6>N_Oi zG_Wc@+S7VTRf4Lv_wHH#^QG3&!8s1o*YDKSb3T41Smpa%AakqexYot`o_i}>i<$ei z0OvR6D}{~*r?iAu3|p_TP15VAVP{Q{gk0gx5Um`gWcIz2x|l3b+{j&t?{F3YD03n| zH!QOAf}x3hVg{I17skFjUrz}-N)$uercKbWJ9jN_-MtkptfRz!-wK4Jwf594 z;lc%EY`*o9OUbD+A^zYpoMcUqQqp{;l?4d_Sml>U<<%(%_0qlra>&BQxf}d7t7V? zUP^J*7asK(+%Ej6FtT~o`icY{>bNaPthmN17)K!LquUY<;reG=v9~p4%!DFe<_RBU@RER>c|)oLZIt(iJ6DX6GA^6} zp9U;9zXMD{kQ4k%bz;3vmcr8m5k7sHh>(?Vd~UhZ;JVAITq6NY4?H3=Op1&P0d*C~ zOY;$W1~QZ=_t@+PLYf~$h`B|ov=JPDnAgN?6WV4{gAQVYnxkmgG!2XjJ0Y-(7#!k* z9vs|avj%{Ns}dodwtVr1K}U0GPVrHmo^6A-$4gdo04~WUh+7F=4eDA0*SXhtE?@$s zB(NF)qCKuj{h2_hTnFi*n+zQ(MXnj-HZ?~txPh4{j|_tPAY{@fc%x?zb8^b@cQ+8 z)*Q_G6W1xSM`Z{H#=kz*?pEwcnL)N*`POWf(+&lS0-nuHV|Iq+DQ43V)A$Ioi^)8YU6_(&U#HPAz_^-F@NzXhyv0uk~`f z^eh1;9j*YuYbC4NnQtA(B{whu5Mfbc0Dj2cW)S@2^ZROKmqD;}M}jfp1@IFoK%X5i=ou7O*KU=k2>bUYFCBbH zcJr<>U56Xfw$e;UQ;VA(B`w1#Hy)_}(97a|(?ynBZ9FvR>%-SAhIq zm*sw2K)yjHGhDCGpz(eLut0E|v{>o?_%gH({atfMKn=FN{`~kSs%rHfG}vcA90uIr z_~=Ssrd^y0f0z#oCB)|qlS5F7+1BC*=We0atKx?yz*!*$>{^{wE^A~b`JdYUErOWu z#RC{5Af`3+{wQGts4@Z@5c?!f|27EBKhP<%;>RnDBA`fa2go@4 zuUs6fgLziuM(!CYh~wWvA{PI#8MN(D-aPWZT%M6Y_W&L^DPH*MgnsJD9OV=J7t9vV zp$u^X6sVGbnTlZ40L!Ba;8z;6M?#UC4Q91j1?0j`y9{PFkoOZl8eA#?rM{3cr$D+`J9$ z1EsTO69YX-kCn;l za<5wz1%BWzsg!Q?fEcAD;0CirDcMJN{|i6~A#yB1fy5vF(Y$TYfTaWPZ#C^@6?@xjqQYsY%ub(*=UJcwMN7wYg_GI%^UO$t!wZnd8C0}ls~ZHRn>GiZSNlnh z=75n}uVqPfZ}Qw!vc<-`;y4QdbVGn^R8y-0 z%u)4>5rAMWCIRBJR^Qm%uw=%6oy)LlK!W5Z78>q&da_yFgQ`FGJOOg+Ssj)-#fVIU z2l$7;ML+0FlbAk$zrhUa%?7m&5p+^4v(CnCIdvFXINyrGK_zkYR0j|2-gltDM)nf{ z&a`q+mjOX8Y;j?~;Av?t(HSeo*~vjUAfbCWPJyROd9=j&2*-&nC-W0H-CpbMb<~sp2)nX?*rHF2wYLVc3c|T$p;n+k)xtj<@3j zpeigM(d^fik;2S0KJrVM(m|ZzFUxi*bzGKyKuGrvcN=~iIM1L=;$3*5qPYO=Kj06N zupnjTiBu_jgQXc559WB6Kb0v;0LQrGIB@@7{6AXicbLNNXG5j~A+#}#IqY!-8#UmP zTw;U&enk>#{X5-NmG*!ADpL+bdhGqT15V=(LiaY{Y&UW;qh3!w(PNq(ue^UZkFXJ+ zNW3&NDb;~!8Zp7oQLpfVUm?t~d8Tj3ZRQcx$N|Gz|LnlXNtTK(DG~s#t;K0#0Mw!s zxch^gAm}zwsA|FWGEjR7f{=(FRDf7Sk`iF&G^I+)aM@#24C@NL)GOQuGgB2 z9_?Kb$=ES9nrEOAR6Ss`FHG~*d$FAAf#f)P`5vIwQ}&e^)ph{3D%>IsnSbh9I!{Hb z%^u{p+k;rcwsBnWFFYusHzvheefJ75cb1)rvo1d!0X4-R&gS@ji zXf9IIKur_&D81o47Ma!KGsA@qZT|r%5II zJ@U^(^~Lj4&(*utfPnXw>K6Dn1MU(8VWmY-_UlNx@ zOMRlMu-n&aJQCAdTK;1HchMS#j__Ns$fL)^?A; z>sEr#2DXvWLia(JrfYT8bP9s&3{^*mM({7>Nn>aV$Ul)e*?)LCzW-VLc~$|os6T76g)@RsJOq$P&y_yrqy^@iOqVIiZcOZBn5u(wkX?0` zHVQ78!uVA0=Z)whHqVmM!Mx#-hY6GBX&lEL+WDu0sMXQ#D3K-gizy!xl_HyCVraz} zjkTaBZ&#%m4(^JI{HeH# z?#OefesK1kS$^c`txqQ%Pq5cd+1;~yA#qmIBscB!bwj=Mr850WZ&eWW(2A)3b{|8vbK9cp(3jRb zwcTE{-W{lQ=McM!Mm%kwgk1DWBGuP9GSX9#_pv=d;_&0Uo ziYwv}N^KtlnWPMIU(35a|JbV0v~Y9iYZ3?8s9K_^*NCnS#<3_T&TzWcxq(vc)2qm% zj<S)I+EX2zTT?Bb214IuK5SO)6P~yXI+UGl zwvJM9O<7fIP50qmY?7ziaeSa5eF76M6>E>O>-%wRJU)6A^@MTJrEIN#xQCI%|Be<6 zi(8tTJOhqXph1|p1^6FYk>8)~)N>2)h#W)Yn_)a(S;hg=J`-stpzt-LoNZ=s0CYkCWM(OpcU zB+lJ+U?u=;b753c_ed>!cGXJUVXWj!&uns1B^fT(B6f3k$%|j7C!_y%RUPC#X;Cuf zRorzDdK4b$t5@f9e2Fer7VxT_H47ug`PrTb&b)5^d0 zaL=%8jT2Y9*X)C#iAuCcQ6)b3t94vff!^{jNoxA$B@Mp`v< z6}D(VvOJp%;wn6K5dWo3gE+oEqJZtabVJQ}h0}bZv>%qg0G&Fl;v8jIT_ul^h+Qcc ze@(R19Z`7>M*d8`vK{!jUUD4QHL-*IwlfGx&xv_}5EM$jUDyPX{`MY_+6DWFZaYj$_;>~B{t|U#5p&psvrS7RBqkP^!NK=d#yVW5>w`kh?n`9U z`Ib4<^4SIK50`J`-3)x_{b%%gwTmQ4o|n2xUXi|;KDQMTxI^M;e{Bh~e=uG2Ea(Ct zHW<58`YU7zH1UL!GuL#|n;f`-_ozvd;L)8tLuUbrp8kS*XC%%dD-!PUwflbp z&h>cJVW?HFkc%b2?iBN>*{yeA)QH-kLImszk1P=!u(LQC>Ss5Y#kcC;OH|KLhT{kM z+35Zm6d0;JyX&e_fIdg$uEhgJ;)^Iw`%UEGFa=}c&qOZ_F6N||@-b_+>HKk&p-37D z{aa}aD4Bzr1&Jx$9}`rD>A((e2l=nvnFy)HOG6xg2_d)eG<<&#Colq!Ud}%zc-qnM z_8N#@c5G%-ivjd`$>`t=O41*KKAv;FzT(50y?&+CYuJv?H|C!L3yn?ZeB(g)Tf9o^ zW$wrQgqZX)-^UnP>n~auIRyo*helPcT}xbS$9d6b82KA&%AS2?)2P@K#Gk^UPa0A~ z??482q*hM zN6*^SF-~YI-cdf0AM-!ivMVR{9TCF;LL_WN{cQ5%@4_wobofASVbTMU^G719hf(NF zoB4dt(%icRPY4_9EhuN#xA6L{D zY6DYRi_~*2KirjID*MnZhR6$_8Ty&0j_-@%MeP&<50+bUTh6iOOe$5$?(%mpA}^Pm zyFnNk6hS5{Dq@E2)1|J?)q5YE*Nc?8OGV_P%0pO`i(jZs*i+e+WQaYm2-crc`0Oq_ zkEVGSF!ycnT~c)~$@k6TkeSvWTqDsxeRqiK0!O~3rLU&8j>W%DX0M7XpzJ(}Zqj?HVcUBvc0 zB%H9e+dg61HV>h1=Qj1yWBqjWO;6Hm;4DTV`YpY+ITds1BM^bdjcnB7- z5C2|TP8=<=tGxKvqNDQ?*CiU8f?a+?7*)_)A52>e%go#1*NNz~Ipz$U^ozHPLU;7% z^!3(ZJB=GEOZ5CWVAGmR4c-C?wsQe?>)Z*uBD*jvj;*K6wb|+SR;j-gG3!}wJOVX} z$=dFNHv8`nz;!Nh)&)6&$;=xb`+d0)7H753yQ(iU(%@-7IbUofS?}CZMl6wDT%`=Q zUonKECDF9fPFRn2JdE-zhknnUqxVYQ(**dQ%%r-SMoSry%=AcH?75#_wIi${hK&Vo zCwmPMxSF>9T0aj-E5j_GSkoS~7SSr?VLTp@r}ed8cC8s|jvOl!?h6mn8p%JEuwtjn zk!c8C+3kK|IczXARW|OrHnJ>MP}jw*oNWI9joNe}98301iKL#K7Q5w6P_;*~GTh>@ zN!vHP>FZv!Pw7~$_4VW?c(!WT|Kl(a1NlVtanGodt>)9$BLCZjZ4 ziB6|ewL}sxIQO%ejPF=#Sa?h9fhSY7UahgzbiJ)T3Z1696W2<19-D-*>|F~WtT#(- zlm>i}m)fTW9&Gp?73kdSbKyz2;W_|HI8d3;i>d9^-l$cY9%vFgty#xyV2pSsiA4}A z@J1PVlz7G2f7lPMirRu&o{9NK8U)Dk(=H=Y*-xg|1C@hR2y*`^Jxh#tGT`QfNj5s? zRUJf$v-IvhXs@Buh|RKBruO_v@-g08us;M5G`6gA3Jo$1*|Uk)C$``KP*-6yW256VZ0;=L#YB(qi=UjXxq8nx=l8r#IX}|2obWygsIy`a576L@k$xl6pTgA~`Zr%F z%7?%CxCfvGG=*;N%WQ^1te1M3?B&jSncQFlh;;u>&I?2`X3zO_r=UAgM0WY5Y`&Aylk!6;y3!mea4lOlQCC+{uG5sFO!+ z0`KsXXNrw9_w0*~P@mc#iiEt?B$V=AG{SlIa%-zp{=vBA+G~EZA%k(p0OA^5ipoEu zaOFwNz)dQrCz~?cGT7Aa;xn6TY1k<7j>p} zmp8G!ubl4f60S|0Yl?i)3t%Xai20uTgO!m;;;1Rt-gs11b z>@s1YHEQMj?Vas&aQ1TCr~Vzk+fo20_vfl}+3QoN8c;fvZA$z^Ni3;A+mSV*eWvnxfBX z?=LfLCC^D)uPwc`CukV^y>6m- ze0^DImBb`MiXMY7DdSN(93$ghXA&#+O?opU3zSr2o4}>e4I#|gNNbH(zx#gxM_&^1 zJ%8)B;2{IwKt+1I?)=!MToS}O9UX7kmeb76K0f8v;=DHCLA*nBTiaU{1GWj76@2cO zX~4gUl^Y}uN^a-JbKzWQuVzKL7@8VPcg}Pm1!#i~%7WCe;dD?;M-S>4A6Zp0{HtQk zvEt09CEDxk*EW-NzMm;@sMfmO-8$X-|J3#z!Xf|^qYXhPKcY~iO^oA8~>eay0&oq>C(#J2pavgX{OZnfzPqP*Rmp|G9sT$sr2`|l&kl<3thJY;wH=-9aC;0CYs(zzY&L>bUJl9z}5iUF&Zbk4*$&IAkPCW*zZvEP@Fp?L$T2vorzcHj zL6Bf}v_f7E8Pcry6=OEToG^k$zP^tSiRytZ*GM0bt`^f4UtdP#C~3#}u7k04%7YV| z{Gq^RQ6ATC^@#QM<*(z5<+?$HiyIkUsPbE0I&SpkroV`6k7BXtVOUZJsXR9(i`A=_ z?9atBq(H%C@!i%}H}SE$bN3HgQf@XkdQSw^kHtCITm|P8rQuMbx&s3d- z{nj}5t)1^_Hwtj*AG=E-y=>j*aEHz(mR!daBG=Q8mvz(fg!SfwLyoOL#%SKEcm9hD z!F6h%8Ogu>CQD6Re{Q(0y=5`~LM79#f#YDbZ=a+D1c16hT^%PoH^8nb-szEWT2SkS z`Fd4&9^?FuoJZ)65GCy(1<{kcyo9nMUnz2*XAW84bN#dv+2a(esh%GMi+cLtF}}X_ zHT4o!YpPQ5d*Y8GNz|$2^)s*vRTZQ&c}wnnNOxf_+r4nSi$YcmSFcZz75AzqhP9-Q(m`jSi^ji0)5oYkO3y=HgO{em#c_Vf0T=PnRqw5Dfk(-$=$k zL4b{UEe6x_fo2*rJiP{Ar)F+`J}W2Zkr#}H9M&r{v$mEOc`!3$QahPlDCvhM;Ym~G zFnvBVbrEs`^dUvHWJ_Kf3H`oeLL6fs7h~(q2~vjw?bsRynJDt)xTaHEVw~w)5j4mr z{Y8sJe=NGFch*E7p$vqXlFByY=3;*qiFpOt_uxeu?=d7xyk~2aI(MlLX~Dwugn1j? z$|)#EkVw56IJj?qAAP(rTJP52?6Nw7>I)W~u|AI%YQH|jrLN>P=gWK4NcMpSwtWzO zfSihQz^O4faBt{T{OVJ?Xt_^bHRi1QDE(CQ_f9}QCG5i{;M;`D2(#WW%0=`(riq{m zef>I@tunty9G-4)-7KFQO{mUL32Lz+SeS}}Jj|Ht!eKL}Y@@GOuHeYZ;w28M|7b9d zKS&p$g2Q@eXeAKdhI9?>D4^wEr=Va}P*8ZvSZzNkTx+bN5-EO_g(aRW>+|Qediki^ zcWXWO`-8<5gL_q?q@11)WEzppU&HXnn8(}}%pVK$Zx$4CT^mxl*jQZ5vXEbil%(dc ze%@t1gedz6h6L}_av;g#d22W0pQ*8~KMBY&Io?|XzQV5B=nHWzs)Oe_b$l#OUvn9~ zORQ8{T;EBqlKke<%*!!(v{5EuJ$cf)?53cgSIO_!x3W33f5)(rLZ?}S`9AL|_3!p3hmEUZuAn&WztJ9{9`ZFwFOK?a7onE5-Xy-Wd8V(%;W z<=UA$Sd^5M_FZw13k&ANFbe$#c4PN_Q2F`nwUa5_aQHP!6FC{uVr=ky9(6VL7cX9T zGRV+1Bx2of&_D-B`aMOw(i*p{mXx7&Im=0U=zxV+Z)%5$gDWb2C#wwQ)e(R9v5^rc zfcSc+GXyZjt_$)!^Sj*y!)gSIF%uu(lQevZ%-QJSz#GP@s!>Dj&-4!^R7>3R?X*8y zbw!-nY7yfieLPsq5z@KwzQ>iF@5NQ8PWv2Fc9!}Vdln`Sf5(D)-wJD`ZgOl<< zFLgM4fqc(KdXYbnx4xKW5Oa0IcmR)Uh(^$>P8K1`A!S5-md$^hfa-{?VGQ#8A-1a% zc3fFsYEmkCaq8@e>vO!ob4ynBtTLx>IQnFCrna@dTAS8EKV)W?O)K_dmXcUL&XW0s zB<1cIY_#x2R=nY{taQ`#fYg9)fvNK*BBieluRz3iOE~3>)n=ErWEgvmGXJM{ecy)W z*;;U?w^yaXxqJ{B#l)G2Dt?gBd2ca6Xw2DfIP_#JL3$}YSZQFpnzxtwjo3KwNVW7~h-l%4g^tMklUpQw7ecC0}bD0hy3(ocK$%n1(< zYuI1XFI7wV_xk3DjHIkN232l%MBQ-Y2VXWdw*K8s0Sj%*oTY|bPG4-s^&ERCO;0(1$N?MwLukfZ< zQssg+(E*P_o@NqD!lH8X_UncfSNO;)ihcp+E=uIoRJ`VoCbvEWu&rCUHA6Y(2nAjGL%)qSw^X z5>C!FbhKc{=EhI1Gt#q({GX2?n3wTXT|J%c*|S+L_UvMS)%^bTIl2xH2U+KHvWg`{ zN=nM>zHMSycnFLNcx{H*35bZ|QbgQVebkZ#Gl<@m+D|?Oe%V}9{I+moV`IYNHb9@b+?k!5duEr&2sc@+2E8t;Hcj`E zbQPRI&%Q7<&8;064zRU)n=0nj0c!B(GY$S#A9uhrx0vYZrGPmCJvo=rfENGm?yk!T zIj6xJN`+q>QVHABfptfxU(|Ui z0uRg9YHy`)j0oe)moG0@dg+C{55LLE%C>=u?0pQAlS7g$X*BpMmKffMeKd{Oo?G|K z3WERm=(+}ne0{(I&E@Q+wBr_@XR5U7p|M*?c>8ux%mK6-lp3&ziW*=y_GZXHPbu@H z((aKh!0^Oc#mBP6k35G$4Py{$yd&P2s?|pZ1eC_ZvZVJ%@v#EKMn-fejSLKuf3=Va zR;5KE>SQ&4_HEHs;$P07WT#kBm(}d24Iy+PWkq zB_#j!1EK1>YiVf=s?1+e&eR}!~tFILY7x#s3qKF&ns_y2%mpJ7VVJ)QqblAd? zo-t8UQ-6ID{&BB0rScfTkF`a7>(;mS@k-zH$_w#ZUc?LMe@AXH_#PgPnQbFr;a}17 zx-E5_jI#0{j?RPx-x^2#Ilv^Ym3!$67NCW`)K^75*T?7Ey`#M4muCf%ETn7N6@n(xOqFG&`2gph|bcLq=K9?7Eh3b z=t?Rmz}?+t5Gc444(^7R!5|611n%P<;ArI10Qn`0Jr;*R;+9NuG!sNmQcepDrTu~E z(5C=DFmN~elO}K{ zUMvEM1`{K^=?hYnUt9pN_$*me<>+3Va11}68O%|>j8~yQ=j4e(Ao29smR^s5#i9u) z_um>Fuow)|fgULOjBp$dOZ@FHM=YBDcJwjs;KhG4JI!GJyO7eXmM8?ld11eUn;{G#detSrTm5ltKx3+DSQX`kO_407|MuWcU@zmHlw`U;h%ia-Qo#8 zj1tCSJuwI*Ek~eKwTaFs0@Bik(&mFck{eyRY5iQz?&K7?N8@+$P-aC-eYeVm!LXTK*$ zU<^IQ|8^yOHT=LY&Gnxdeox$gEB*@5A3pw&KR^B`2l#(00T9(6J^_k?UvmAX6Hx0#cNNfB{Q%%;=B7dBY#kDQ%VC z?rJ`Dx&NXkV|3s+BpOaYdC?m{I!%8@r;Kr5qs#AE!l#9pU{RnqR*++~d=PrD>52{2mm($PJDeA z(8cIy=V7#Y&FRNuSRBC_>x9L?(R!b(UqJ1rF-BM{I4)Z}Cv!m(2tM?)Rk$Ys`&&%^ z55f4Wz{|+z=f_>&Mul=@?2X0MLX0`2^8M09iytVQ3#l7OUW|7xf?6j}9;jjDt)Dzs)YXvV~Zq~)lYNo4Yuzq8e zxHzl6anVejLwe?HV!Q2|A&&M1OJvE4SA%%3?v$anDdP)4^B=lJ@?upy-mX{}iqd~d zmYx@EJ~@}OX?D{c71J=g&Fc_BqS*OewQ5tP{-S3Vk`RKvg%2elO6}S31%PrcXu% z@dpa0>)}tjdXl{dpUk&DyI0H(TlX?G?@3O+dx4ij(4b?hU3f|a>c!#CgElI*5APIv zK?Y^Z>dNjpXL|gzoIi-p@YMuWyyH1_pX`G9nf{Vl``@KOQ>`p~ZNkAE7lYP&sF110 z%9BkZY`ik3_ni4@CANa+%ajG&qnyt}RITS%Kt!UOZ;N>cq2&j$`e7nb53nRnRiDvo z8@5{*`A!b-Q+GK8)3WAd^XjIx#7P0A_yV7?r{FK5_JV4CsvcX0>DBNP{E%IaHD|@# zTJOab1caXA6~LA5nVGrE!lPHGa!p0qPcqC|UxDHgcV$d{0+7DkU|N7=4W5+EI{4 z{m`AF;QC6sa1dHtvB`xhhy__eK03NgAP~HE6Tdd7igzGLGj;{uBjY|n3v&-P8zve} z4z=IFqTSnM17n~Y9+!KUMTo5MWnEp|c*C-vHI`&lu}Oiv%5QQYE>?3!pF>1by7S4& z1eeBN+h>&>!j~3fR4S_#ydvL6e9N>(he>C*cOf}xyJhB^n)d$YI}Z8k0#MB1JpT{b zHJ3CFEsRH}bgtEtm+zpEBU*$l2y$bFm(=r42x}aSU1e|GfKBgQn?Wh_V7fWm$+yfa z65e-VvqAhDXg`#OAjA15_~f;V<|Yr>%rBS5zYTl7De(Au$@)_#*3h#;fxrr`JQiCk zD=6}-)tyvA&vPvjlf(N8iXVYGfc<%z(*NRWgfLtAEMZ7%h@$hU+M$tMtLDl{T;bjv$`8nEhe0@$R%F>0 z3Qz@N&(q@ol4E$?_+rJz0L78(9$}G{dqgK-T2)(P2qi@z#J`N7${P znu${PB+1-*$m9^e6n#v4z9dLi(=$$0T-T}Km26Kd<0L$HMW(D2WR4Mm70DcTXsN+2 zhDXV^fXVp0qCwKm-6sXo0`%5d-n0@!)nAJPo21{^cA(=in^U^cxod_=G6JVB?j%m$ zY6?6F-4Ckbj=>#7RlHhRS#lDgx4w5+F;RUa-SOSiGcy9kUV{fo)d;nYQ)`M%j{HL) ze_KA=gq+UX5|2}fhOMHp^pp8r()APxaq(=fve?MT3uUzHZaHdXWTh%QOk5nt@hvmA zEBS%JX4g;+1YrG)^iafrnDxsP}E|c_lTizNuH#=nr05a{s4U76~2Hf4}JA;1- zPY8t?|9;TO}&RU5bM^)m9!|#(Ygb zPTb-|`%2RZ=oJ^*OGVsvugO5S6HV#kZYbh|?IkD34#!nX_zNDeo=7P`Jqf>j0t%<>~e; zIjXeND4vPN&FuUN`gNByLZ(c6Aicu?A=1z-+4Z>|4jCZclt9*ixQVGJCpVehI;a$o z5OP4UmO3=TGdM*GYI0EJmNGt#d-rtZrBVw1XjR>^#L~W|EZP31tRz5cEW_8I^BxG2 z@9ckdE4k}gvL%hj`5}(%b6Tb*h`B*hadB5&iXD&}k}cUthiRYaa0kCL+bv%a0|Cp= zH?ax3zjrDIna(_%ms&yHvhUK(O%gpL>kkAiOS!4+JMP@u_8?186{j07X~^S$Lc48l z#t#sBZ$m~xQQk739H)fJ=H#dYye)Ml?GK4*#uwG<@4Fqk$WNVUvWpkhT5b@(*?^+D zp;f$p7=YMjz_K$_$xv+H%|MW4vtLZE_|;uDAr{Za04{m|ELqARVM}A%CMc#MK(P5) zv`yQc9Tr5t7@%W_YX&_>aVkk&kn+M+S2zXZw{nRXQNvbE-DFX`0fXiWuw1v*!|fFXo0kKc2Blf80*I1 zsmJM7Y{id0h*iXjB(2k&{uwHNZEv!&Rdg5|Z=Y;gLx#DedAd>lKp6gLrA*wM;1LT> zS=)kzO>(vTr91U$+2g%^I9#Z3n|XS}IgvyS)qX#J-A21d?~{Zzd@E0HGavUBUCz1F z-{H{BFcB^;Q#5>}c|CU0nLzY;=Ik6`a`2b08JbnYmnMAv$m zid!0;Q_%Ar?-7&Qcj@#3wHvk|FbO63OE9yrpUU;}44?;V}# z&ssH1%0@=-zhSXg8Qm;;4&s!E@2;&HtAokTP7c0=-LTA(*$11uN0UA&3*-n9m!8I3 zhb#j>yyIO9^KYjB@h@pB^jrT0qhH@)S^irVI0(u`riN z&8gS;^|H3=;UaPCKpt3V`&hP^n!S1N`TbANY?lH^7`I~0`W}bXy3)t(9r@yZo+eKV zIR@Qze8#HDLLBaBL^j02=B=D!?SkfVs3R33GYdD&(pbx4D_4QAFmL>6|0xhuls>ZN ztm!VGIHqh0eGh=mDPEnpBOx1E&5|-4MtSHnmJYP^ZVajDRuBLK^=a=%o3I690Hw}2 zK0Dv*7K#Ef=MU7?JTlFtM+P#r+r1(u=KzumSVx2xuy`I8tSzhOIS^3++8L`6dYX3@N|iJ()n`8M2FI<(SadZID~R?Kp#$$Xzi8rs)e?}r$;78WS?o9UQ%%oMIE++1n_y>Ti6(X7UC4s zRT-yKEVDc-aBe1Fcjj%hY~T8A9Y;6>RZNJ-*1uTj@D?Y6-fSC)8r5?3u0$I$e?$s& z{B}b~g?kZqVAb)+Nc-g-&P5CJv-ySs*v*Ave5PLQ`$EaxVb9A{4OXiSsP7D#FX%`C z@U993dZ7~+7uVwxH?8kJ1yXttx(=sS ztcl4WA6BzGa?{F1GMlS5s}Sfxd4k@v%sbfiBSMUYQq4l9Nd7DU*j?F!%c~iY#>21>Ma=@K}2F#bu_o z)Y7qVQKDabG>^2^<(;)r8@8<y(zS;gHv_~G&uUd}-Z+s~^<)nTbUC6e{G zkDVaz9zS9~s16fvqk+Gy#T?l2)j*O@K&B|F{wgF6!`T}ax8kQd{Pw}}mPzFhhhAGJ zX-2T~ivvB=fM*(M@uPK+fVuV*`G4rDmMw0mn+(acdD!>C-)fuB?BIimZ0BQ?wp@>^ znDUYwO^+DSTFLT8`wrj!9U3h{mOdp?nrKpyP1bxco;g-%=a!AzElvY=tF*KWNF(ub z>G_}UnA24mi>~Dr%`O4LOv!mUuiK-vilW(}ogW4tkjCv_scZ{)o$KM7Cm$+N>!~-r z4AWVLCJwfy6+=|`V#}82KA!*`!$hu%F*^v_9! zep4=-_H58hi72^pG}l6qe;;$^_9(*)joE>_z8-GkGbud?%TV&}E&=~tBBg5}(lyWB z4{WTN277BW;K5hcO|SFtInrm}N$xqll`k;&B=a!$7Nh5FtBpeiWsFYVC=jiY(_s!3 zm%)cq%2qYMH5cT(eKf&q#B*wxBr97$3AR;bDLI}M+aHp?=ggj1tmta_v2tYHCGWRu z<{s#7&;WV#a~IlMbIpC5!oYjoX>y@hqMH2nGAWs#b;;d@HbCgD%><_bh9F}E9|g`6 ztF6APe9q652e6)=kG(QoCFmw6~9Sz06WA$&{B8Wt)svi zc2k*Jg9Z9jpvcPW@f{86u(#YIx2eb3kez&Q;v{yDTS;(f@P&)K&`@!Vh?Ob5qb6ux zb{+EOB_HdCt)c+$)(Y=?B(GV+F_OV?H2OeiK@-?r{cfRl;E=@AvK4Rwp=$lzhv00b zM@n7vHD{!i%VT+%f2~OH#tNZB_nfc9l2s&1IpGn=CP~A@o~9>L#JA;ZF0OH`PTV^T zb`9X~_7F+qP$A{SH&%j2UPXwWS9Uw!@x(*Z|w{I;|3=Jsl8iH hMP6Q6RZ$rNQBj0Kf#8V}ng#cm4D^h3GqsNd{|~C-oZA2Z literal 0 HcmV?d00001 diff --git a/doc/userguide/devguide/internals/engines/detect/packet_inspection.rst b/doc/userguide/devguide/internals/engines/detect/packet_inspection.rst new file mode 100644 index 0000000000..6c48d4889d --- /dev/null +++ b/doc/userguide/devguide/internals/engines/detect/packet_inspection.rst @@ -0,0 +1,80 @@ +Packet Inspection in Suricata +============================= + +Please note that there are several inspection engines inside Suricata, each of which +is invoked based on the signature's requirement and type. This document is concerned with +the packet inspection engine and isolates only the parts relevant to them. + +There are several things in place in the engine to make inspection of a packet at run-time +fast and accurate. Some optimizations occur even before the engine starts. But, of +course Suricata does not know the nature of the traffic it is going to encounter; what it +does know are the rules that are going to be matched against the unexpected traffic. + +.. image:: detect_engine/pre_startup_pkt_inspection.png + +The second round of optimizations comes when Suricata has actually seen the network traffic. With +the internal prefiltering engines, the possible matching list of signatures is further reduced. +So, ideally, when a packet comes in, Suricata quickly gets to matching it against as precise +a rule set as it can. + +.. image:: detect_engine/detect_pkt_run.png + +There are two types of packet inspection engines registered by Suricata: + +1. Packet inspection engine + +2. Packet payload inspection engine + +Packet inspection engine +------------------------ + +As the name suggests, this engine runs all the available runtime matchers for the signature against +the given packet. + +e.g. for a rule like: + +.. container:: example-rule + + alert tcp any any -> any any (ttl:8; sid:123;) + +During parsing of the signature, a ``ttl`` keyword matcher is registered. So, this inspection engine +will try to match ``ttl`` in the packet. + +Packet payload inspection engine +-------------------------------- + +This is a bit more complex as the rule at hand may be a ``pkt``, ``pkt-stream``, or ``stream`` :ref:`type rule `. +Each of the types differ in its processing with respect to the inspection window. + +There are two types of payloads that Suricata typically deals with. + +1. Packet payload + + This means only the current packet buffer is evaluated. The inspection window is the beginning to + the end of the packet payload. + +2. Stream payload + + This means the current stream chunk that is ready for inspection is evaluated. The inspection window + is the beginning of the stream chunk to the ACK'd data. + +For a packet to be reassembled into the stream and be inspected, it must be a part of an accepted TCP +segment or the engine must be in one of the exceptional scenarios. + +.. container:: example-rule + + alert tcp any any -> any any (content:"suricata"; sid:123;) + +During parsing of the signature, Suricata categorizes this as a ``stream`` type rule which means there +is a requirement for a payload match which may exist in one or more packets. This is the default +categorization for anything that requires a content match unless there's another keyword that makes +the evaluation needed to be done per packet too. + +For TCP, as a part of inspection, if there's a stream type rule at hand, the inspection will first be +attempted on the ACK'd stream window available. If that fails, the engine falls back on packet +in order to match as soon as possible. + +For example, if the content to be matched in the rule arrived over a span of multiple packets, +it'll be matched when the packets are reassembled and ACK'd. + +.. image:: detect_engine/reassembled_stream_window.png diff --git a/doc/userguide/devguide/internals/engines/index.rst b/doc/userguide/devguide/internals/engines/index.rst index efc7cf1fbc..39b4bb354a 100644 --- a/doc/userguide/devguide/internals/engines/index.rst +++ b/doc/userguide/devguide/internals/engines/index.rst @@ -12,6 +12,14 @@ Stream stream/inspection_raw_data +Detect +------ + +.. toctree:: + :maxdepth: 2 + + detect/packet_inspection + Defrag ------ diff --git a/doc/userguide/rules/rule-types.rst b/doc/userguide/rules/rule-types.rst index 6d239cba0c..09970c7e04 100644 --- a/doc/userguide/rules/rule-types.rst +++ b/doc/userguide/rules/rule-types.rst @@ -1,3 +1,5 @@ +.. _rule-types: + .. role:: example-rule-action .. role:: example-rule-header .. role:: example-rule-options