stem-1.8.0/ 0000775 0001750 0001750 00000000000 13602232262 013210 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/cache_manual.py 0000775 0001750 0001750 00000004034 13501272761 016174 0 ustar atagar atagar 0000000 0000000 #!/usr/bin/env python
# Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Caches tor's latest manual content. Run this to pick new man page changes.
"""
import re
import sys
import stem.manual
import stem.util.system
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
GITWEB_MAN_LOG = 'https://gitweb.torproject.org/tor.git/log/doc/tor.1.txt'
MAN_LOG_LINK = "href='/tor.git/commit/doc/tor.1.txt\\?id=([^']*)'"
if __name__ == '__main__':
try:
man_log_page = urllib.urlopen(GITWEB_MAN_LOG).read()
man_commit = re.search(MAN_LOG_LINK, man_log_page).group(1)
except:
print("Unable to determine the latest commit to edit tor's man page: %s" % sys.exc_info()[1])
sys.exit(1)
try:
stem_commit = stem.util.system.call('git rev-parse HEAD')[0]
except IOError as exc:
print("Unable to determine stem's current commit: %s" % exc)
sys.exit(1)
print('Latest tor commit editing man page: %s' % man_commit)
print('Current stem commit: %s' % stem_commit)
print('')
try:
cached_manual = stem.manual.Manual.from_cache()
db_schema = cached_manual.schema
except stem.manual.SchemaMismatch as exc:
cached_manual, db_schema = None, exc.database_schema
except IOError:
cached_manual, db_schema = None, None # local copy has been deleted
if db_schema != stem.manual.SCHEMA_VERSION:
print('Cached database schema is out of date (was %s, but current version is %s)' % (db_schema, stem.manual.SCHEMA_VERSION))
cached_manual = None
latest_manual = stem.manual.Manual.from_remote()
if cached_manual:
if cached_manual == latest_manual:
print('Manual information is already up to date, nothing to do.')
sys.exit(0)
print('Differences detected...\n')
print(stem.manual._manual_differences(cached_manual, latest_manual))
latest_manual.man_commit = man_commit
latest_manual.stem_commit = stem_commit
latest_manual.save(stem.manual.CACHE_PATH)
stem-1.8.0/README.md 0000664 0001750 0001750 00000000637 13501272761 014503 0 ustar atagar atagar 0000000 0000000 ## Stem (Python Tor Library)
Stem is a Python controller library for **[Tor](https://www.torproject.org/)**. With it you can use Tor's [control protocol](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt) to script against the Tor process, or build things such as [Nyx](https://nyx.torproject.org/).
Documentation and tutorials available at **[stem.torproject.org](https://stem.torproject.org/)**.
stem-1.8.0/cache_fallback_directories.py 0000775 0001750 0001750 00000003632 13526633163 021061 0 ustar atagar atagar 0000000 0000000 #!/usr/bin/env python
# Copyright 2016-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Caches tor's latest fallback directories.
"""
import re
import sys
import stem.directory
import stem.util.system
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
GITWEB_FALLBACK_LOG = 'https://gitweb.torproject.org/tor.git/log/src/app/config/fallback_dirs.inc'
FALLBACK_DIR_LINK = "href='/tor.git/commit/src/app/config/fallback_dirs.inc\\?id=([^']*)'"
if __name__ == '__main__':
try:
fallback_dir_page = urllib.urlopen(GITWEB_FALLBACK_LOG).read()
fallback_dir_commit = re.search(FALLBACK_DIR_LINK, fallback_dir_page).group(1)
except:
print("Unable to determine the latest commit to edit tor's fallback directories: %s" % sys.exc_info()[1])
sys.exit(1)
try:
stem_commit = stem.util.system.call('git rev-parse HEAD')[0]
except IOError as exc:
print("Unable to determine stem's current commit: %s" % exc)
sys.exit(1)
print('Latest tor commit editing fallback directories: %s' % fallback_dir_commit)
print('Current stem commit: %s' % stem_commit)
print('')
cached_fallback_directories = stem.directory.Fallback.from_cache()
latest_fallback_directories = stem.directory.Fallback.from_remote()
if cached_fallback_directories == latest_fallback_directories:
print('Fallback directories are already up to date, nothing to do.')
sys.exit(0)
# all fallbacks have the same header metadata, so just picking one
headers = latest_fallback_directories.values()[0].header if latest_fallback_directories else None
print('Differences detected...\n')
print(stem.directory._fallback_directory_differences(cached_fallback_directories, latest_fallback_directories))
stem.directory.Fallback._write(latest_fallback_directories, fallback_dir_commit, stem_commit, headers)
stem-1.8.0/setup.py 0000664 0001750 0001750 00000012522 13501272761 014732 0 ustar atagar atagar 0000000 0000000 #!/usr/bin/env python
# Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
#
# Release Checklist
# =================
#
# * Recache latest information (cache_manual.py and cache_fallback_directories.py)
#
# * Test with python2.6, python2.7, python3, and pypy.
# |- If using tox run...
# |
# | % tox -- --all --target RUN_ALL,ONLINE
# |
# | Otherwise, for each interpreter run...
# |
# | % [python_interpreter] run_tests.py --all --target RUN_ALL,ONLINE
# |
# |- Pypy test instructions for ubuntu are...
# |
# | % sudo apt-get install pypy
# | % wget https://bootstrap.pypa.io/get-pip.py
# | % pypy get-pip.py --user
# | % ~/.local/bin/pip install mock pycodestyle pyflakes --user
# | % pypy ./run_tests.py --all
# |
# +- Some version of python 3.x should be available in your platform's
# repositories. To test against a specific version on ubuntu try the
# following. In this example, Python 3.7...
#
# % sudo apt-get install build-essential python-dev python-setuptools python-pip python-smbus
# % sudo apt-get install libncursesw5-dev libgdbm-dev libc6-dev
# % sudo apt-get install zlib1g-dev libsqlite3-dev tk-dev
# % sudo apt-get install libssl-dev openssl libffi-dev
#
# % wget https://www.python.org/ftp/python/3.7.0/Python-3.7.0.tgz
# % tar -xzf Python-3.7.0.tgz
# % mv Python-3.7.0 ~
#
# % cd ~/Python-3.7.0
# % ./configure
# % make
#
# % cd /path/to/stem
# % ~/Python-3.7.0/python ./run_tests.py --all
#
# * Tag the release
# |- Bump stem's version (in stem/__init__.py and docs/index.rst).
# |- git commit -a -m "Stem release 1.0.0"
# |- git tag -u 9ABBEEC6 -m "stem release 1.0.0" 1.0.0 d0bb81a
# +- git push --tags
#
# * Dry-run release on https://pypi.org/project/stem/
# |- python setup.py sdist --dryrun
# |- gpg --detach-sig --armor dist/stem-dry-run-1.0.0.tar.gz
# |- twine upload dist/*
# +- Check that https://pypi.org/project/stem-dry-run/ looks correct, comparing it to https://pypi.org/project/stem/
# +- Don't worry about the 'Bug Tracker' being missing. That's an attribute of the project itself.
#
# * Final release
# |- rm dist/*
# |- python setup.py sdist
# |- gpg --detach-sig --armor dist/stem-1.0.0.tar.gz
# +- twine upload dist/*
#
# * Contact package maintainers
# * Announce the release (example: https://blog.torproject.org/blog/stem-release-11)
import distutils.core
import os
import sys
import stem
if '--dryrun' in sys.argv:
DRY_RUN = True
sys.argv.remove('--dryrun')
else:
DRY_RUN = False
SUMMARY = 'Stem is a Python controller library that allows applications to interact with Tor (https://www.torproject.org/).'
DRY_RUN_SUMMARY = 'Ignore this package. This is dry-run release creation to work around PyPI limitations (https://github.com/pypa/packaging-problems/issues/74#issuecomment-260716129).'
DESCRIPTION = """
For tutorials and API documentation see `Stem's homepage `_.
Quick Start
-----------
To install you can either use...
::
pip install stem
... or install from the source tarball. Stem supports both the python 2.x and 3.x series. To use its python3 counterpart you simply need to install using that version of python.
::
python3 setup.py install
After that, give some `tutorials `_ a try! For questions or to discuss project ideas we're available on `irc `_ and the `tor-dev@ email list `_.
""".strip()
MANIFEST = """
include cache_fallback_directories.py
include cache_manual.py
include LICENSE
include README.md
include MANIFEST.in
include requirements.txt
include run_tests.py
include tox.ini
graft docs
graft test
global-exclude __pycache__
global-exclude *.orig
global-exclude *.pyc
global-exclude *.swp
global-exclude *.swo
global-exclude .tox
global-exclude *~
recursive-exclude test/data *
recursive-exclude docs/_build *
""".strip()
# installation requires us to be in our setup.py's directory
os.chdir(os.path.dirname(os.path.abspath(__file__)))
with open('MANIFEST.in', 'w') as manifest_file:
manifest_file.write(MANIFEST)
try:
distutils.core.setup(
name = 'stem-dry-run' if DRY_RUN else 'stem',
version = stem.__version__,
description = DRY_RUN_SUMMARY if DRY_RUN else SUMMARY,
long_description = DESCRIPTION,
license = stem.__license__,
author = stem.__author__,
author_email = stem.__contact__,
url = stem.__url__,
packages = ['stem', 'stem.client', 'stem.descriptor', 'stem.interpreter', 'stem.response', 'stem.util'],
keywords = 'tor onion controller',
scripts = ['tor-prompt'],
package_data = {
'stem': ['cached_fallbacks.cfg', 'cached_manual.sqlite', 'settings.cfg'],
'stem.interpreter': ['settings.cfg'],
'stem.util': ['ports.cfg'],
}, classifiers = [
'Development Status :: 5 - Production/Stable',
'Intended Audience :: Developers',
'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
'Topic :: Security',
'Topic :: Software Development :: Libraries :: Python Modules',
],
)
finally:
if os.path.exists('MANIFEST.in'):
os.remove('MANIFEST.in')
if os.path.exists('MANIFEST'):
os.remove('MANIFEST')
stem-1.8.0/stem/ 0000775 0001750 0001750 00000000000 13602232262 014160 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/process.py 0000664 0001750 0001750 00000023530 13501272761 016221 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Helper functions for working with tor as a process.
:NO_TORRC:
when provided as a torrc_path tor is ran with a blank configuration
:DEFAULT_INIT_TIMEOUT:
number of seconds before we time out our attempt to start a tor instance
**Module Overview:**
::
launch_tor - starts up a tor process
launch_tor_with_config - starts a tor process with a custom torrc
"""
import os
import re
import signal
import subprocess
import tempfile
import threading
import stem.prereq
import stem.util.str_tools
import stem.util.system
import stem.version
NO_TORRC = ''
DEFAULT_INIT_TIMEOUT = 90
def launch_tor(tor_cmd = 'tor', args = None, torrc_path = None, completion_percent = 100, init_msg_handler = None, timeout = DEFAULT_INIT_TIMEOUT, take_ownership = False, close_output = True, stdin = None):
"""
Initializes a tor process. This blocks until initialization completes or we
error out.
If tor's data directory is missing or stale then bootstrapping will include
making several requests to the directory authorities which can take a little
while. Usually this is done in 50 seconds or so, but occasionally calls seem
to get stuck, taking well over the default timeout.
**To work to must log at NOTICE runlevel to stdout.** It does this by
default, but if you have a 'Log' entry in your torrc then you'll also need
'Log NOTICE stdout'.
Note: The timeout argument does not work on Windows or when outside the
main thread, and relies on the global state of the signal module.
.. versionchanged:: 1.6.0
Allowing the timeout argument to be a float.
.. versionchanged:: 1.7.0
Added the **close_output** argument.
:param str tor_cmd: command for starting tor
:param list args: additional arguments for tor
:param str torrc_path: location of the torrc for us to use
:param int completion_percent: percent of bootstrap completion at which
this'll return
:param functor init_msg_handler: optional functor that will be provided with
tor's initialization stdout as we get it
:param int timeout: time after which the attempt to start tor is aborted, no
timeouts are applied if **None**
:param bool take_ownership: asserts ownership over the tor process so it
aborts if this python process terminates or a :class:`~stem.control.Controller`
we establish to it disconnects
:param bool close_output: closes tor's stdout and stderr streams when
bootstrapping is complete if true
:param str stdin: content to provide on stdin
:returns: **subprocess.Popen** instance for the tor subprocess
:raises: **OSError** if we either fail to create the tor process or reached a
timeout without success
"""
if stem.util.system.is_windows():
if timeout is not None and timeout != DEFAULT_INIT_TIMEOUT:
raise OSError('You cannot launch tor with a timeout on Windows')
timeout = None
elif threading.current_thread().__class__.__name__ != '_MainThread':
if timeout is not None and timeout != DEFAULT_INIT_TIMEOUT:
raise OSError('Launching tor with a timeout can only be done in the main thread')
timeout = None
# sanity check that we got a tor binary
if os.path.sep in tor_cmd:
# got a path (either relative or absolute), check what it leads to
if os.path.isdir(tor_cmd):
raise OSError("'%s' is a directory, not the tor executable" % tor_cmd)
elif not os.path.isfile(tor_cmd):
raise OSError("'%s' doesn't exist" % tor_cmd)
elif not stem.util.system.is_available(tor_cmd):
raise OSError("'%s' isn't available on your system. Maybe it's not in your PATH?" % tor_cmd)
# double check that we have a torrc to work with
if torrc_path not in (None, NO_TORRC) and not os.path.exists(torrc_path):
raise OSError("torrc doesn't exist (%s)" % torrc_path)
# starts a tor subprocess, raising an OSError if it fails
runtime_args, temp_file = [tor_cmd], None
if args:
runtime_args += args
if torrc_path:
if torrc_path == NO_TORRC:
temp_file = tempfile.mkstemp(prefix = 'empty-torrc-', text = True)[1]
runtime_args += ['-f', temp_file]
else:
runtime_args += ['-f', torrc_path]
if take_ownership:
runtime_args += ['__OwningControllerProcess', str(os.getpid())]
tor_process = None
try:
tor_process = subprocess.Popen(runtime_args, stdout = subprocess.PIPE, stdin = subprocess.PIPE, stderr = subprocess.PIPE)
if stdin:
tor_process.stdin.write(stem.util.str_tools._to_bytes(stdin))
tor_process.stdin.close()
if timeout:
def timeout_handler(signum, frame):
raise OSError('reached a %i second timeout without success' % timeout)
signal.signal(signal.SIGALRM, timeout_handler)
signal.setitimer(signal.ITIMER_REAL, timeout)
bootstrap_line = re.compile('Bootstrapped ([0-9]+)%')
problem_line = re.compile('\\[(warn|err)\\] (.*)$')
last_problem = 'Timed out'
while True:
# Tor's stdout will be read as ASCII bytes. This is fine for python 2, but
# in python 3 that means it'll mismatch with other operations (for instance
# the bootstrap_line.search() call later will fail).
#
# It seems like python 2.x is perfectly happy for this to be unicode, so
# normalizing to that.
init_line = tor_process.stdout.readline().decode('utf-8', 'replace').strip()
# this will provide empty results if the process is terminated
if not init_line:
raise OSError('Process terminated: %s' % last_problem)
# provide the caller with the initialization message if they want it
if init_msg_handler:
init_msg_handler(init_line)
# return the process if we're done with bootstrapping
bootstrap_match = bootstrap_line.search(init_line)
problem_match = problem_line.search(init_line)
if bootstrap_match and int(bootstrap_match.group(1)) >= completion_percent:
return tor_process
elif problem_match:
runlevel, msg = problem_match.groups()
if 'see warnings above' not in msg:
if ': ' in msg:
msg = msg.split(': ')[-1].strip()
last_problem = msg
except:
if tor_process:
tor_process.kill() # don't leave a lingering process
tor_process.wait()
raise
finally:
if timeout:
signal.alarm(0) # stop alarm
if tor_process and close_output:
if tor_process.stdout:
tor_process.stdout.close()
if tor_process.stderr:
tor_process.stderr.close()
if temp_file:
try:
os.remove(temp_file)
except:
pass
def launch_tor_with_config(config, tor_cmd = 'tor', completion_percent = 100, init_msg_handler = None, timeout = DEFAULT_INIT_TIMEOUT, take_ownership = False, close_output = True):
"""
Initializes a tor process, like :func:`~stem.process.launch_tor`, but with a
customized configuration. This writes a temporary torrc to disk, launches
tor, then deletes the torrc.
For example...
::
tor_process = stem.process.launch_tor_with_config(
config = {
'ControlPort': '2778',
'Log': [
'NOTICE stdout',
'ERR file /tmp/tor_error_log',
],
},
)
.. versionchanged:: 1.7.0
Added the **close_output** argument.
:param dict config: configuration options, such as "{'ControlPort': '9051'}",
values can either be a **str** or **list of str** if for multiple values
:param str tor_cmd: command for starting tor
:param int completion_percent: percent of bootstrap completion at which
this'll return
:param functor init_msg_handler: optional functor that will be provided with
tor's initialization stdout as we get it
:param int timeout: time after which the attempt to start tor is aborted, no
timeouts are applied if **None**
:param bool take_ownership: asserts ownership over the tor process so it
aborts if this python process terminates or a :class:`~stem.control.Controller`
we establish to it disconnects
:param bool close_output: closes tor's stdout and stderr streams when
bootstrapping is complete if true
:returns: **subprocess.Popen** instance for the tor subprocess
:raises: **OSError** if we either fail to create the tor process or reached a
timeout without success
"""
# TODO: Drop this version check when tor 0.2.6.3 or higher is the only game
# in town.
try:
use_stdin = stem.version.get_system_tor_version(tor_cmd) >= stem.version.Requirement.TORRC_VIA_STDIN
except IOError:
use_stdin = False
# we need to be sure that we're logging to stdout to figure out when we're
# done bootstrapping
if 'Log' in config:
stdout_options = ['DEBUG stdout', 'INFO stdout', 'NOTICE stdout']
if isinstance(config['Log'], str):
config['Log'] = [config['Log']]
has_stdout = False
for log_config in config['Log']:
if log_config in stdout_options:
has_stdout = True
break
if not has_stdout:
config['Log'].append('NOTICE stdout')
config_str = ''
for key, values in list(config.items()):
if isinstance(values, str):
config_str += '%s %s\n' % (key, values)
else:
for value in values:
config_str += '%s %s\n' % (key, value)
if use_stdin:
return launch_tor(tor_cmd, ['-f', '-'], None, completion_percent, init_msg_handler, timeout, take_ownership, close_output, stdin = config_str)
else:
torrc_descriptor, torrc_path = tempfile.mkstemp(prefix = 'torrc-', text = True)
try:
with open(torrc_path, 'w') as torrc_file:
torrc_file.write(config_str)
# prevents tor from erroring out due to a missing torrc if it gets a sighup
args = ['__ReloadTorrcOnSIGHUP', '0']
return launch_tor(tor_cmd, args, torrc_path, completion_percent, init_msg_handler, timeout, take_ownership)
finally:
try:
os.close(torrc_descriptor)
os.remove(torrc_path)
except:
pass
stem-1.8.0/stem/exit_policy.py 0000664 0001750 0001750 00000105436 13501272761 017101 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Representation of tor exit policies. These can be easily used to check if
exiting to a destination is permissible or not. For instance...
::
>>> from stem.exit_policy import ExitPolicy, MicroExitPolicy
>>> policy = ExitPolicy('accept *:80', 'accept *:443', 'reject *:*')
>>> print(policy)
accept *:80, accept *:443, reject *:*
>>> print(policy.summary())
accept 80, 443
>>> policy.can_exit_to('75.119.206.243', 80)
True
>>> policy = MicroExitPolicy('accept 80,443')
>>> print(policy)
accept 80,443
>>> policy.can_exit_to('75.119.206.243', 80)
True
::
ExitPolicy - Exit policy for a Tor relay
|- MicroExitPolicy - Microdescriptor exit policy
|
|- can_exit_to - check if exiting to this destination is allowed or not
|- is_exiting_allowed - check if any exiting is allowed
|- summary - provides a short label, similar to a microdescriptor
|- has_private - checks if policy has anything expanded from the 'private' keyword
|- strip_private - provides a copy of the policy without 'private' entries
|- has_default - checks if policy ends with the defaultly appended suffix
|- strip_default - provides a copy of the policy without the default suffix
|- __str__ - string representation
+- __iter__ - ExitPolicyRule entries that this contains
ExitPolicyRule - Single rule of an exit policy chain
|- MicroExitPolicyRule - Single rule for a microdescriptor policy
|
|- is_address_wildcard - checks if we'll accept any address
|- is_port_wildcard - checks if we'll accept any port
|- get_address_type - provides the protocol our ip address belongs to
|- is_match - checks if we match a given destination
|- get_mask - provides the address representation of our mask
|- get_masked_bits - provides the bit representation of our mask
|- is_default - flag indicating if this was part of the default end of a policy
|- is_private - flag indicating if this was expanded from a 'private' keyword
+- __str__ - string representation for this rule
get_config_policy - provides the ExitPolicy based on torrc rules
.. data:: AddressType (enum)
Enumerations for IP address types that can be in an exit policy.
============ ===========
AddressType Description
============ ===========
**WILDCARD** any address of either IPv4 or IPv6
**IPv4** IPv4 address
**IPv6** IPv6 address
============ ===========
"""
from __future__ import absolute_import
import re
import socket
import zlib
import stem.prereq
import stem.util
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
AddressType = stem.util.enum.Enum(('WILDCARD', 'Wildcard'), ('IPv4', 'IPv4'), ('IPv6', 'IPv6'))
# Addresses aliased by the 'private' policy. From the tor man page...
#
# To specify all internal and link-local networks (including 0.0.0.0/8,
# 169.254.0.0/16, 127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, and 172.16.0.0/12),
# you can use the 'private' alias instead of an address.
PRIVATE_ADDRESSES = (
'0.0.0.0/8',
'169.254.0.0/16',
'127.0.0.0/8',
'192.168.0.0/16',
'10.0.0.0/8',
'172.16.0.0/12',
)
def get_config_policy(rules, ip_address = None):
"""
Converts an ExitPolicy found in a torrc to a proper exit pattern. This
accounts for...
* ports being optional
* the 'private' keyword
.. deprecated:: 1.7.0
Tor's torrc parameters lack a formal spec, making it difficult for this
method to be reliable. Callers are encouraged to move to
:func:`~stem.control.Controller.get_exit_policy` instead.
:param str,list rules: comma separated rules or list to be converted
:param str ip_address: this relay's IP address for the 'private' policy if
it's present, this defaults to the local address
:returns: :class:`~stem.exit_policy.ExitPolicy` reflected by the rules
:raises: **ValueError** if input isn't a valid tor exit policy
"""
if ip_address and not (stem.util.connection.is_valid_ipv4_address(ip_address) or stem.util.connection.is_valid_ipv6_address(ip_address, allow_brackets = True)):
raise ValueError("%s isn't a valid IP address" % ip_address)
elif ip_address and stem.util.connection.is_valid_ipv6_address(ip_address, allow_brackets = True) and not (ip_address[0] == '[' and ip_address[-1] == ']'):
ip_address = '[%s]' % ip_address # ExitPolicy validation expects IPv6 addresses to be bracketed
if stem.util._is_str(rules):
rules = rules.split(',')
result = []
for rule in rules:
rule = rule.strip()
if not rule:
continue
if not re.search(':[\\d\\-\\*]+$', rule):
rule = '%s:*' % rule
if 'private' in rule:
acceptance = rule.split(' ', 1)[0]
port = rule.rsplit(':', 1)[1]
addresses = list(PRIVATE_ADDRESSES)
if ip_address:
addresses.append(ip_address)
else:
try:
addresses.append(socket.gethostbyname(socket.gethostname()))
except:
pass # we might not have a network connection
for private_addr in addresses:
result.append(ExitPolicyRule('%s %s:%s' % (acceptance, private_addr, port)))
else:
result.append(ExitPolicyRule(rule))
return ExitPolicy(*result)
def _flag_private_rules(rules):
"""
Determine if part of our policy was expanded from the 'private' keyword. This
doesn't differentiate if this actually came from the 'private' keyword or a
series of rules exactly matching it.
"""
matches = [] # find all possible starting indexes
for i, rule in enumerate(rules):
if i + len(PRIVATE_ADDRESSES) > len(rules):
break
rule_str = '%s/%s' % (rule.address, rule.get_masked_bits())
if rule_str == PRIVATE_ADDRESSES[0]:
matches.append(i)
for start_index in matches:
# To match the private policy the following must all be true...
#
# * series of addresses and bit masks match PRIVATE_ADDRESSES
# * all rules have the same port range
# * all rules have the same acceptance (all accept or reject entries)
#
# The last rule is dynamically based on the relay's public address. It may
# not be present if get_config_policy() created this policy and we couldn't
# resolve our address.
last_index = start_index + len(PRIVATE_ADDRESSES)
rule_set = rules[start_index:last_index]
last_rule = rules[last_index] if len(rules) > last_index else None
is_match = True
min_port, max_port = rule_set[0].min_port, rule_set[0].max_port
is_accept = rule_set[0].is_accept
for i, rule in enumerate(rule_set):
rule_str = '%s/%s' % (rule.address, rule.get_masked_bits())
if rule_str != PRIVATE_ADDRESSES[i] or rule.min_port != min_port or rule.max_port != max_port or rule.is_accept != is_accept:
is_match = False
break
if is_match:
for rule in rule_set:
rule._is_private = True
if last_rule and not last_rule.is_address_wildcard() and last_rule.min_port == min_port and last_rule.max_port == max_port and last_rule.is_accept == is_accept:
last_rule._is_private = True
def _flag_default_rules(rules):
"""
Determine if part of our policy ends with the defaultly appended suffix.
"""
if len(rules) >= len(DEFAULT_POLICY_RULES):
rules_suffix = tuple(rules[-len(DEFAULT_POLICY_RULES):])
if rules_suffix == DEFAULT_POLICY_RULES:
for rule in rules_suffix:
rule._is_default_suffix = True
class ExitPolicy(object):
"""
Policy for the destinations that a relay allows or denies exiting to. This
is, in effect, just a list of :class:`~stem.exit_policy.ExitPolicyRule`
entries.
:param list rules: **str** or :class:`~stem.exit_policy.ExitPolicyRule`
entries that make up this policy
"""
def __init__(self, *rules):
# sanity check the types
for rule in rules:
if not stem.util._is_str(rule) and not isinstance(rule, ExitPolicyRule):
raise TypeError('Exit policy rules can only contain strings or ExitPolicyRules, got a %s (%s)' % (type(rule), rules))
# Unparsed representation of the rules we were constructed with. Our
# _get_rules() method consumes this to provide ExitPolicyRule instances.
# This is lazily evaluated so we don't need to actually parse the exit
# policy if it's never used.
is_all_str = True
for rule in rules:
if not stem.util._is_str(rule):
is_all_str = False
if rules and is_all_str:
byte_rules = [stem.util.str_tools._to_bytes(r) for r in rules]
self._input_rules = zlib.compress(b','.join(byte_rules))
else:
self._input_rules = rules
self._rules = None
self._hash = None
# Result when no rules apply. According to the spec policies default to 'is
# allowed', but our microdescriptor policy subclass might want to change
# this.
self._is_allowed_default = True
@lru_cache()
def can_exit_to(self, address = None, port = None, strict = False):
"""
Checks if this policy allows exiting to a given destination or not. If the
address or port is omitted then this will check if we're allowed to exit to
any instances of the defined address or port.
:param str address: IPv4 or IPv6 address (with or without brackets)
:param int port: port number
:param bool strict: if the address or port is excluded then check if we can
exit to **all** instances of the defined address or port
:returns: **True** if exiting to this destination is allowed, **False** otherwise
"""
if not self.is_exiting_allowed():
return False
for rule in self._get_rules():
if rule.is_match(address, port, strict):
return rule.is_accept
return self._is_allowed_default
@lru_cache()
def is_exiting_allowed(self):
"""
Provides **True** if the policy allows exiting whatsoever, **False**
otherwise.
"""
rejected_ports = set()
for rule in self._get_rules():
if rule.is_accept:
for port in range(rule.min_port, rule.max_port + 1):
if port not in rejected_ports:
return True
elif rule.is_address_wildcard():
if rule.is_port_wildcard():
return False
else:
rejected_ports.update(range(rule.min_port, rule.max_port + 1))
return self._is_allowed_default
@lru_cache()
def summary(self):
"""
Provides a short description of our policy chain, similar to a
microdescriptor. This excludes entries that don't cover all IP
addresses, and is either white-list or blacklist policy based on
the final entry. For instance...
::
>>> policy = ExitPolicy('accept *:80', 'accept *:443', 'reject *:*')
>>> policy.summary()
'accept 80, 443'
>>> policy = ExitPolicy('accept *:443', 'reject *:1-1024', 'accept *:*')
>>> policy.summary()
'reject 1-442, 444-1024'
:returns: **str** with a concise summary for our policy
"""
# determines if we're a white-list or blacklist
is_whitelist = not self._is_allowed_default
for rule in self._get_rules():
if rule.is_address_wildcard() and rule.is_port_wildcard():
is_whitelist = not rule.is_accept
break
# Iterates over the policies and adds the the ports we'll return (ie,
# allows if a white-list and rejects if a blacklist). Regardless of a
# port's allow/reject policy, all further entries with that port are
# ignored since policies respect the first matching policy.
display_ports, skip_ports = [], set()
for rule in self._get_rules():
if not rule.is_address_wildcard():
continue
elif rule.is_port_wildcard():
break
for port in range(rule.min_port, rule.max_port + 1):
if port in skip_ports:
continue
# if accept + white-list or reject + blacklist then add
if rule.is_accept == is_whitelist:
display_ports.append(port)
# all further entries with this port should be ignored
skip_ports.add(port)
# convert port list to a list of ranges (ie, ['1-3'] rather than [1, 2, 3])
if display_ports:
display_ranges, temp_range = [], []
display_ports.sort()
display_ports.append(None) # ending item to include last range in loop
for port in display_ports:
if not temp_range or temp_range[-1] + 1 == port:
temp_range.append(port)
else:
if len(temp_range) > 1:
display_ranges.append('%i-%i' % (temp_range[0], temp_range[-1]))
else:
display_ranges.append(str(temp_range[0]))
temp_range = [port]
else:
# everything for the inverse
is_whitelist = not is_whitelist
display_ranges = ['1-65535']
# constructs the summary string
label_prefix = 'accept ' if is_whitelist else 'reject '
return (label_prefix + ', '.join(display_ranges)).strip()
def has_private(self):
"""
Checks if we have any rules expanded from the 'private' keyword. Tor
appends these by default to the start of the policy and includes a dynamic
address (the relay's public IP).
.. versionadded:: 1.3.0
:returns: **True** if we have any private rules expanded from the 'private'
keyword, **False** otherwise
"""
for rule in self._get_rules():
if rule.is_private():
return True
return False
def strip_private(self):
"""
Provides a copy of this policy without 'private' policy entries.
.. versionadded:: 1.3.0
:returns: **ExitPolicy** without private rules
"""
return ExitPolicy(*[rule for rule in self._get_rules() if not rule.is_private()])
def has_default(self):
"""
Checks if we have the default policy suffix.
.. versionadded:: 1.3.0
:returns: **True** if we have the default policy suffix, **False** otherwise
"""
for rule in self._get_rules():
if rule.is_default():
return True
return False
def strip_default(self):
"""
Provides a copy of this policy without the default policy suffix.
.. versionadded:: 1.3.0
:returns: **ExitPolicy** without default rules
"""
return ExitPolicy(*[rule for rule in self._get_rules() if not rule.is_default()])
def _get_rules(self):
# Local reference to our input_rules so this can be lock free. Otherwise
# another thread might unset our input_rules while processing them.
input_rules = self._input_rules
if self._rules is None and input_rules is not None:
rules = []
is_all_accept, is_all_reject = True, True
if isinstance(input_rules, bytes):
decompressed_rules = zlib.decompress(input_rules).split(b',')
else:
decompressed_rules = input_rules
for rule in decompressed_rules:
if isinstance(rule, bytes):
rule = stem.util.str_tools._to_unicode(rule)
if stem.util._is_str(rule):
if not rule.strip():
continue
rule = ExitPolicyRule(rule.strip())
if rule.is_accept:
is_all_reject = False
else:
is_all_accept = False
rules.append(rule)
if rule.is_address_wildcard() and rule.is_port_wildcard():
break # this is a catch-all, no reason to include more
# If we only have one kind of entry *and* end with a wildcard then
# we might as well use the simpler version. For instance...
#
# reject *:80, reject *:443, reject *:*
#
# ... could also be represented as simply...
#
# reject *:*
#
# This mostly comes up with reject-all policies because the
# 'reject private:*' appends an extra seven rules that have no
# effect.
if rules and (rules[-1].is_address_wildcard() and rules[-1].is_port_wildcard()):
if is_all_accept:
rules = [ExitPolicyRule('accept *:*')]
elif is_all_reject:
rules = [ExitPolicyRule('reject *:*')]
_flag_private_rules(rules)
_flag_default_rules(rules)
self._rules = rules
self._input_rules = None
return self._rules
def __len__(self):
return len(self._get_rules())
def __iter__(self):
for rule in self._get_rules():
yield rule
@lru_cache()
def __str__(self):
return ', '.join([str(rule) for rule in self._get_rules()])
def __hash__(self):
if self._hash is None:
my_hash = 0
for rule in self._get_rules():
my_hash *= 1024
my_hash += hash(rule)
self._hash = my_hash
return self._hash
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, ExitPolicy) else False
def __ne__(self, other):
return not self == other
class MicroExitPolicy(ExitPolicy):
"""
Exit policy provided by the microdescriptors. This is a distilled version of
a normal :class:`~stem.exit_policy.ExitPolicy` contains, just consisting of a
list of ports that are either accepted or rejected. For instance...
::
accept 80,443 # only accepts common http ports
reject 1-1024 # only accepts non-privileged ports
Since these policies are a subset of the exit policy information (lacking IP
ranges) clients can only use them to guess if a relay will accept traffic or
not. To quote the `dir-spec `_ (section 3.2.1)...
::
With microdescriptors, clients don't learn exact exit policies:
clients can only guess whether a relay accepts their request, try the
BEGIN request, and might get end-reason-exit-policy if they guessed
wrong, in which case they'll have to try elsewhere.
:var bool is_accept: **True** if these are ports that we accept, **False** if
they're ports that we reject
:param str policy: policy string that describes this policy
"""
def __init__(self, policy):
# Microdescriptor policies are of the form...
#
# MicrodescriptrPolicy ::= ("accept" / "reject") SP PortList NL
# PortList ::= PortOrRange
# PortList ::= PortList "," PortOrRange
# PortOrRange ::= INT "-" INT / INT
self._policy = policy
if policy.startswith('accept'):
self.is_accept = True
elif policy.startswith('reject'):
self.is_accept = False
else:
raise ValueError("A microdescriptor exit policy must start with either 'accept' or 'reject': %s" % policy)
policy = policy[6:]
if not policy.startswith(' '):
raise ValueError('A microdescriptor exit policy should have a space separating accept/reject from its port list: %s' % self._policy)
policy = policy.lstrip()
# convert our port list into MicroExitPolicyRule
rules = []
for port_entry in policy.split(','):
if '-' in port_entry:
min_port, max_port = port_entry.split('-', 1)
else:
min_port = max_port = port_entry
if not stem.util.connection.is_valid_port(min_port) or \
not stem.util.connection.is_valid_port(max_port):
raise ValueError("'%s' is an invalid port range" % port_entry)
rules.append(MicroExitPolicyRule(self.is_accept, int(min_port), int(max_port)))
super(MicroExitPolicy, self).__init__(*rules)
self._is_allowed_default = not self.is_accept
def __str__(self):
return self._policy
def __hash__(self):
return hash(str(self))
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, MicroExitPolicy) else False
def __ne__(self, other):
return not self == other
class ExitPolicyRule(object):
"""
Single rule from the user's exit policy. These rules are chained together to
form complete policies that describe where a relay will and will not allow
traffic to exit.
The format of these rules are formally described in the `dir-spec
`_ as an
'exitpattern'. Note that while these are similar to tor's man page entry for
ExitPolicies, it's not the exact same. An exitpattern is better defined and
stricter in what it'll accept. For instance, ports are not optional and it
does not contain the 'private' alias.
This should be treated as an immutable object.
.. versionchanged:: 1.5.0
Support for 'accept6/reject6' entries and '\\*4/6' wildcards.
:var bool is_accept: indicates if exiting is allowed or disallowed
:var str address: address that this rule is for
:var int min_port: lower end of the port range that we include (inclusive)
:var int max_port: upper end of the port range that we include (inclusive)
:param str rule: exit policy rule to be parsed
:raises: **ValueError** if input isn't a valid tor exit policy rule
"""
def __init__(self, rule):
# policy ::= "accept[6]" exitpattern | "reject[6]" exitpattern
# exitpattern ::= addrspec ":" portspec
rule = stem.util.str_tools._to_unicode(rule)
self.is_accept = rule.startswith('accept')
is_ipv6_only = rule.startswith('accept6') or rule.startswith('reject6')
if rule.startswith('accept6') or rule.startswith('reject6'):
exitpattern = rule[7:]
elif rule.startswith('accept') or rule.startswith('reject'):
exitpattern = rule[6:]
else:
raise ValueError("An exit policy must start with either 'accept[6]' or 'reject[6]': %s" % rule)
if not exitpattern.startswith(' '):
raise ValueError('An exit policy should have a space separating its accept/reject from the exit pattern: %s' % rule)
exitpattern = exitpattern.lstrip()
if ':' not in exitpattern or ']' in exitpattern.rsplit(':', 1)[1]:
raise ValueError("An exitpattern must be of the form 'addrspec:portspec': %s" % rule)
self.address = None
self._address_type = None
self._masked_bits = None
self.min_port = self.max_port = None
self._hash = None
# Our mask in ip notation (ex. '255.255.255.0'). This is only set if we
# either have a custom mask that can't be represented by a number of bits,
# or the user has called mask(), lazily loading this.
self._mask = None
# Malformed exit policies are rejected, but there's an exception where it's
# just skipped: when an accept6/reject6 rule has an IPv4 address...
#
# "Using an IPv4 address with accept6 or reject6 is ignored and generates
# a warning."
self._skip_rule = False
addrspec, portspec = exitpattern.rsplit(':', 1)
self._apply_addrspec(rule, addrspec, is_ipv6_only)
self._apply_portspec(rule, portspec)
# Flags to indicate if this rule seems to be expanded from the 'private'
# keyword or tor's default policy suffix.
self._is_private = False
self._is_default_suffix = False
def is_address_wildcard(self):
"""
**True** if we'll match against **any** address, **False** otherwise.
Note that this is different than \\*4, \\*6, or '/0' address which are
wildcards for only either IPv4 or IPv6.
:returns: **bool** for if our address matching is a wildcard
"""
return self._address_type == _address_type_to_int(AddressType.WILDCARD)
def is_port_wildcard(self):
"""
**True** if we'll match against any port, **False** otherwise.
:returns: **bool** for if our port matching is a wildcard
"""
return self.min_port in (0, 1) and self.max_port == 65535
def is_match(self, address = None, port = None, strict = False):
"""
**True** if we match against the given destination, **False** otherwise. If
the address or port is omitted then this will check if we're allowed to
exit to any instances of the defined address or port.
:param str address: IPv4 or IPv6 address (with or without brackets)
:param int port: port number
:param bool strict: if the address or port is excluded then check if we can
exit to **all** instances of the defined address or port
:returns: **bool** indicating if we match against this destination
:raises: **ValueError** if provided with a malformed address or port
"""
if self._skip_rule:
return False
# validate our input and check if the argument doesn't match our address type
if address is not None:
address_type = self.get_address_type()
if stem.util.connection.is_valid_ipv4_address(address):
if address_type == AddressType.IPv6:
return False
elif stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True):
if address_type == AddressType.IPv4:
return False
address = address.lstrip('[').rstrip(']')
else:
raise ValueError("'%s' isn't a valid IPv4 or IPv6 address" % address)
if port is not None and not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port" % port)
# If we're not matching against an address or port but the rule has one
# then we're a fuzzy match. When that happens...
#
# * If strict and a reject rule then we're a match ('can exit to *all* instances').
# * If not strict and an accept rule then match ('an exit ot *any* instance').
fuzzy_match = False
if not self.is_address_wildcard():
# Already got the integer representation of our mask and our address
# with the mask applied. Just need to check if this address with the
# mask applied matches.
if address is None:
fuzzy_match = True
else:
comparison_addr_bin = stem.util.connection.address_to_int(address)
comparison_addr_bin &= self._get_mask_bin()
if self._get_address_bin() != comparison_addr_bin:
return False
if not self.is_port_wildcard():
if port is None:
fuzzy_match = True
elif port < self.min_port or port > self.max_port:
return False
if fuzzy_match:
return strict != self.is_accept
else:
return True
def get_address_type(self):
"""
Provides the :data:`~stem.exit_policy.AddressType` for our policy.
:returns: :data:`~stem.exit_policy.AddressType` for the type of address that we have
"""
return _int_to_address_type(self._address_type)
def get_mask(self, cache = True):
"""
Provides the address represented by our mask. This is **None** if our
address type is a wildcard.
:param bool cache: caches the result if **True**
:returns: str of our subnet mask for the address (ex. '255.255.255.0')
"""
# Lazy loading our mask because it is very infrequently requested. There's
# no reason to usually use memory for it.
if not self._mask:
address_type = self.get_address_type()
if address_type == AddressType.WILDCARD:
mask = None
elif address_type == AddressType.IPv4:
mask = stem.util.connection.get_mask_ipv4(self._masked_bits)
elif address_type == AddressType.IPv6:
mask = stem.util.connection.get_mask_ipv6(self._masked_bits)
if not cache:
return mask
self._mask = mask
return self._mask
def get_masked_bits(self):
"""
Provides the number of bits our subnet mask represents. This is **None** if
our mask can't have a bit representation.
:returns: int with the bit representation of our mask
"""
return self._masked_bits
def is_private(self):
"""
Checks if this rule was expanded from the 'private' policy keyword.
.. versionadded:: 1.3.0
:returns: **True** if this rule was expanded from the 'private' keyword, **False** otherwise.
"""
return self._is_private
def is_default(self):
"""
Checks if this rule belongs to the default exit policy suffix.
.. versionadded:: 1.3.0
:returns: **True** if this rule was part of the default end of a policy, **False** otherwise.
"""
return self._is_default_suffix
@lru_cache()
def __str__(self):
"""
Provides the string representation of our policy. This does not
necessarily match the rule that we were constructed from (due to things
like IPv6 address collapsing or the multiple representations that our mask
can have). However, it is a valid that would be accepted by our constructor
to re-create this rule.
"""
label = 'accept ' if self.is_accept else 'reject '
if self.is_address_wildcard():
label += '*:'
else:
address_type = self.get_address_type()
if address_type == AddressType.IPv4:
label += self.address
else:
label += '[%s]' % self.address
# Including our mask label as follows...
# - exclude our mask if it doesn't do anything
# - use our masked bit count if we can
# - use the mask itself otherwise
if (address_type == AddressType.IPv4 and self._masked_bits == 32) or \
(address_type == AddressType.IPv6 and self._masked_bits == 128):
label += ':'
elif self._masked_bits is not None:
label += '/%i:' % self._masked_bits
else:
label += '/%s:' % self.get_mask()
if self.is_port_wildcard():
label += '*'
elif self.min_port == self.max_port:
label += str(self.min_port)
else:
label += '%i-%i' % (self.min_port, self.max_port)
return label
@lru_cache()
def _get_mask_bin(self):
# provides an integer representation of our mask
return int(stem.util.connection._address_to_binary(self.get_mask(False)), 2)
@lru_cache()
def _get_address_bin(self):
# provides an integer representation of our address
return stem.util.connection.address_to_int(self.address) & self._get_mask_bin()
def _apply_addrspec(self, rule, addrspec, is_ipv6_only):
# Parses the addrspec...
# addrspec ::= "*" | ip4spec | ip6spec
# Expand IPv4 and IPv6 specific wildcards into /0 entries so we have one
# fewer bizarre special case headaches to deal with.
if addrspec == '*4':
addrspec = '0.0.0.0/0'
elif addrspec == '*6' or (addrspec == '*' and is_ipv6_only):
addrspec = '[0000:0000:0000:0000:0000:0000:0000:0000]/0'
if '/' in addrspec:
self.address, addr_extra = addrspec.split('/', 1)
else:
self.address, addr_extra = addrspec, None
if addrspec == '*':
self._address_type = _address_type_to_int(AddressType.WILDCARD)
self.address = self._masked_bits = None
elif stem.util.connection.is_valid_ipv4_address(self.address):
# ipv4spec ::= ip4 | ip4 "/" num_ip4_bits | ip4 "/" ip4mask
# ip4 ::= an IPv4 address in dotted-quad format
# ip4mask ::= an IPv4 mask in dotted-quad format
# num_ip4_bits ::= an integer between 0 and 32
if is_ipv6_only:
self._skip_rule = True
self._address_type = _address_type_to_int(AddressType.IPv4)
if addr_extra is None:
self._masked_bits = 32
elif stem.util.connection.is_valid_ipv4_address(addr_extra):
# provided with an ip4mask
try:
self._masked_bits = stem.util.connection._get_masked_bits(addr_extra)
except ValueError:
# mask can't be represented as a number of bits (ex. '255.255.0.255')
self._mask = addr_extra
self._masked_bits = None
elif addr_extra.isdigit():
# provided with a num_ip4_bits
self._masked_bits = int(addr_extra)
if self._masked_bits < 0 or self._masked_bits > 32:
raise ValueError('IPv4 masks must be in the range of 0-32 bits')
else:
raise ValueError("The '%s' isn't a mask nor number of bits: %s" % (addr_extra, rule))
elif self.address.startswith('[') and self.address.endswith(']') and \
stem.util.connection.is_valid_ipv6_address(self.address[1:-1]):
# ip6spec ::= ip6 | ip6 "/" num_ip6_bits
# ip6 ::= an IPv6 address, surrounded by square brackets.
# num_ip6_bits ::= an integer between 0 and 128
self.address = stem.util.connection.expand_ipv6_address(self.address[1:-1].upper())
self._address_type = _address_type_to_int(AddressType.IPv6)
if addr_extra is None:
self._masked_bits = 128
elif addr_extra.isdigit():
# provided with a num_ip6_bits
self._masked_bits = int(addr_extra)
if self._masked_bits < 0 or self._masked_bits > 128:
raise ValueError('IPv6 masks must be in the range of 0-128 bits')
else:
raise ValueError("The '%s' isn't a number of bits: %s" % (addr_extra, rule))
else:
raise ValueError("'%s' isn't a wildcard, IPv4, or IPv6 address: %s" % (addrspec, rule))
def _apply_portspec(self, rule, portspec):
# Parses the portspec...
# portspec ::= "*" | port | port "-" port
# port ::= an integer between 1 and 65535, inclusive.
#
# Due to a tor bug the spec says that we should accept port of zero, but
# connections to port zero are never permitted.
if portspec == '*':
self.min_port, self.max_port = 1, 65535
elif portspec.isdigit():
# provided with a single port
if stem.util.connection.is_valid_port(portspec, allow_zero = True):
self.min_port = self.max_port = int(portspec)
else:
raise ValueError("'%s' isn't within a valid port range: %s" % (portspec, rule))
elif '-' in portspec:
# provided with a port range
port_comp = portspec.split('-', 1)
if stem.util.connection.is_valid_port(port_comp, allow_zero = True):
self.min_port = int(port_comp[0])
self.max_port = int(port_comp[1])
if self.min_port > self.max_port:
raise ValueError("Port range has a lower bound that's greater than its upper bound: %s" % rule)
else:
raise ValueError('Malformed port range: %s' % rule)
else:
raise ValueError("Port value isn't a wildcard, integer, or range: %s" % rule)
def __hash__(self):
if self._hash is None:
self._hash = stem.util._hash_attr(self, 'is_accept', 'address', 'min_port', 'max_port') * 1024 + hash(self.get_mask(False))
return self._hash
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, ExitPolicyRule) else False
def __ne__(self, other):
return not self == other
def _address_type_to_int(address_type):
return AddressType.index_of(address_type)
def _int_to_address_type(address_type_int):
return list(AddressType)[address_type_int]
class MicroExitPolicyRule(ExitPolicyRule):
"""
Lighter weight ExitPolicyRule derivative for microdescriptors.
"""
def __init__(self, is_accept, min_port, max_port):
self.is_accept = is_accept
self.address = None # wildcard address
self.min_port = min_port
self.max_port = max_port
self._skip_rule = False
def is_address_wildcard(self):
return True
def get_address_type(self):
return AddressType.WILDCARD
def get_mask(self, cache = True):
return None
def get_masked_bits(self):
return None
def __hash__(self):
return stem.util._hash_attr(self, 'is_accept', 'min_port', 'max_port', cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, MicroExitPolicyRule) else False
def __ne__(self, other):
return not self == other
DEFAULT_POLICY_RULES = tuple([ExitPolicyRule(rule) for rule in (
'reject *:25',
'reject *:119',
'reject *:135-139',
'reject *:445',
'reject *:563',
'reject *:1214',
'reject *:4661-4666',
'reject *:6346-6429',
'reject *:6699',
'reject *:6881-6999',
'accept *:*',
)])
stem-1.8.0/stem/descriptor/ 0000775 0001750 0001750 00000000000 13602232262 016336 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/descriptor/certificate.py 0000664 0001750 0001750 00000040746 13565322274 021220 0 ustar atagar atagar 0000000 0000000 # Copyright 2017-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for `Tor Ed25519 certificates
`_, which are
used to for a variety of purposes...
* validating the key used to sign server descriptors
* validating the key used to sign hidden service v3 descriptors
* signing and encrypting hidden service v3 indroductory points
.. versionadded:: 1.6.0
**Module Overview:**
::
Ed25519Certificate - Ed25519 signing key certificate
| +- Ed25519CertificateV1 - version 1 Ed25519 certificate
| |- is_expired - checks if certificate is presently expired
| |- signing_key - certificate signing key
| +- validate - validates a descriptor's signature
|
|- from_base64 - decodes a base64 encoded certificate
|- to_base64 - base64 encoding of this certificate
|
|- unpack - decodes a byte encoded certificate
+- pack - byte encoding of this certificate
Ed25519Extension - extension included within an Ed25519Certificate
.. data:: CertType (enum)
Purpose of Ed25519 certificate. For more information see...
* `cert-spec.txt `_ section A.1
* `rend-spec-v3.txt `_ appendix E
.. deprecated:: 1.8.0
Replaced with :data:`stem.client.datatype.CertType`
======================== ===========
CertType Description
======================== ===========
**SIGNING** signing key with an identity key
**LINK_CERT** TLS link certificate signed with ed25519 signing key
**AUTH** authentication key signed with ed25519 signing key
**HS_V3_DESC_SIGNING** hidden service v3 short-term descriptor signing key
**HS_V3_INTRO_AUTH** hidden service v3 introductory point authentication key
**HS_V3_INTRO_ENCRYPT** hidden service v3 introductory point encryption key
======================== ===========
.. data:: ExtensionType (enum)
Recognized exception types.
==================== ===========
ExtensionType Description
==================== ===========
**HAS_SIGNING_KEY** includes key used to sign the certificate
==================== ===========
.. data:: ExtensionFlag (enum)
Flags that can be assigned to Ed25519 certificate extensions.
====================== ===========
ExtensionFlag Description
====================== ===========
**AFFECTS_VALIDATION** extension affects whether the certificate is valid
**UNKNOWN** extension includes flags not yet recognized by stem
====================== ===========
"""
import base64
import binascii
import datetime
import hashlib
import re
import stem.descriptor.hidden_service
import stem.descriptor.server_descriptor
import stem.prereq
import stem.util
import stem.util.enum
import stem.util.str_tools
from stem.client.datatype import Field, Size, split
# TODO: Importing under an alternate name until we can deprecate our redundant
# CertType enum in Stem 2.x.
from stem.client.datatype import CertType as ClientCertType
ED25519_KEY_LENGTH = 32
ED25519_HEADER_LENGTH = 40
ED25519_SIGNATURE_LENGTH = 64
SIG_PREFIX_SERVER_DESC = b'Tor router descriptor signature v1'
SIG_PREFIX_HS_V3 = b'Tor onion service descriptor sig v3'
DEFAULT_EXPIRATION_HOURS = 54 # HSv3 certificate expiration of tor
CertType = stem.util.enum.UppercaseEnum(
'SIGNING',
'LINK_CERT',
'AUTH',
'HS_V3_DESC_SIGNING',
'HS_V3_INTRO_AUTH',
'HS_V3_INTRO_ENCRYPT',
)
ExtensionType = stem.util.enum.Enum(('HAS_SIGNING_KEY', 4),)
ExtensionFlag = stem.util.enum.UppercaseEnum('AFFECTS_VALIDATION', 'UNKNOWN')
class Ed25519Extension(Field):
"""
Extension within an Ed25519 certificate.
:var stem.descriptor.certificate.ExtensionType type: extension type
:var list flags: extension attribute flags
:var int flag_int: integer encoding of the extension attribute flags
:var bytes data: data the extension concerns
"""
def __init__(self, ext_type, flag_val, data):
self.type = ext_type
self.flags = []
self.flag_int = flag_val if flag_val else 0
self.data = data
if flag_val and flag_val % 2 == 1:
self.flags.append(ExtensionFlag.AFFECTS_VALIDATION)
flag_val -= 1
if flag_val:
self.flags.append(ExtensionFlag.UNKNOWN)
if ext_type == ExtensionType.HAS_SIGNING_KEY and len(data) != 32:
raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(data))
def pack(self):
encoded = bytearray()
encoded += Size.SHORT.pack(len(self.data))
encoded += Size.CHAR.pack(self.type)
encoded += Size.CHAR.pack(self.flag_int)
encoded += self.data
return bytes(encoded)
@staticmethod
def pop(content):
if len(content) < 4:
raise ValueError('Ed25519 extension is missing header fields')
data_size, content = Size.SHORT.pop(content)
ext_type, content = Size.CHAR.pop(content)
flags, content = Size.CHAR.pop(content)
data, content = split(content, data_size)
if len(data) != data_size:
raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (data_size, len(data)))
return Ed25519Extension(ext_type, flags, data), content
def __hash__(self):
return stem.util._hash_attr(self, 'type', 'flag_int', 'data', cache = True)
class Ed25519Certificate(object):
"""
Base class for an Ed25519 certificate.
:var int version: certificate format version
:var unicode encoded: base64 encoded ed25519 certificate
"""
def __init__(self, version):
self.version = version
self.encoded = None # TODO: remove in stem 2.x
@staticmethod
def unpack(content):
"""
Parses a byte encoded ED25519 certificate.
:param bytes content: encoded certificate
:returns: :class:`~stem.descriptor.certificate.Ed25519Certificate` subclsss
for the given certificate
:raises: **ValueError** if certificate is malformed
"""
version = Size.CHAR.pop(content)[0]
if version == 1:
return Ed25519CertificateV1.unpack(content)
else:
raise ValueError('Ed25519 certificate is version %i. Parser presently only supports version 1.' % version)
@staticmethod
def from_base64(content):
"""
Parses a base64 encoded ED25519 certificate.
:param str content: base64 encoded certificate
:returns: :class:`~stem.descriptor.certificate.Ed25519Certificate` subclsss
for the given certificate
:raises: **ValueError** if content is malformed
"""
content = stem.util.str_tools._to_unicode(content)
if content.startswith('-----BEGIN ED25519 CERT-----\n') and content.endswith('\n-----END ED25519 CERT-----'):
content = content[29:-27]
try:
decoded = base64.b64decode(content)
if not decoded:
raise TypeError('empty')
instance = Ed25519Certificate.unpack(decoded)
instance.encoded = content
return instance
except (TypeError, binascii.Error) as exc:
raise ValueError("Ed25519 certificate wasn't propoerly base64 encoded (%s):\n%s" % (exc, content))
def pack(self):
"""
Encoded byte representation of our certificate.
:returns: **bytes** for our encoded certificate representation
"""
raise NotImplementedError('Certificate encoding has not been implemented for %s' % type(self).__name__)
def to_base64(self, pem = False):
"""
Base64 encoded certificate data.
:param bool pem: include `PEM header/footer
`_, for more
information see `RFC 7468 `_
:returns: **unicode** for our encoded certificate representation
"""
encoded = b'\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(self.pack()), 64))
if pem:
encoded = b'-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % encoded
return stem.util.str_tools._to_unicode(encoded)
@staticmethod
def _from_descriptor(keyword, attribute):
def _parse(descriptor, entries):
value, block_type, block_contents = entries[keyword][0]
if not block_contents or block_type != 'ED25519 CERT':
raise ValueError("'%s' should be followed by a ED25519 CERT block, but was a %s" % (keyword, block_type))
setattr(descriptor, attribute, Ed25519Certificate.from_base64(block_contents))
return _parse
def __str__(self):
return self.to_base64(pem = True)
@staticmethod
def parse(content):
return Ed25519Certificate.from_base64(content) # TODO: drop this alias in stem 2.x
class Ed25519CertificateV1(Ed25519Certificate):
"""
Version 1 Ed25519 certificate, which are used for signing tor server
descriptors.
:var stem.client.datatype.CertType type: certificate purpose
:var int type_int: integer value of the certificate purpose
:var datetime expiration: expiration of the certificate
:var int key_type: format of the key
:var bytes key: key content
:var list extensions: :class:`~stem.descriptor.certificate.Ed25519Extension` in this certificate
:var bytes signature: certificate signature
:param bytes signature: pre-calculated certificate signature
:param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey signing_key: certificate signing key
"""
def __init__(self, cert_type = None, expiration = None, key_type = None, key = None, extensions = None, signature = None, signing_key = None):
super(Ed25519CertificateV1, self).__init__(1)
if cert_type is None:
raise ValueError('Certificate type is required')
elif key is None:
raise ValueError('Certificate key is required')
self.type, self.type_int = ClientCertType.get(cert_type)
self.expiration = expiration if expiration else datetime.datetime.utcnow() + datetime.timedelta(hours = DEFAULT_EXPIRATION_HOURS)
self.key_type = key_type if key_type else 1
self.key = stem.util._pubkey_bytes(key)
self.extensions = extensions if extensions else []
self.signature = signature
if signing_key:
calculated_sig = signing_key.sign(self.pack())
# if caller provides both signing key *and* signature then ensure they match
if self.signature and self.signature != calculated_sig:
raise ValueError("Signature calculated from its key (%s) mismatches '%s'" % (calculated_sig, self.signature))
self.signature = calculated_sig
if self.type in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE):
raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % self.type_int)
elif self.type == ClientCertType.ED25519_IDENTITY:
raise ValueError('Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.')
elif self.type == ClientCertType.UNKNOWN:
raise ValueError('Ed25519 certificate type %i is unrecognized' % self.type_int)
def pack(self):
encoded = bytearray()
encoded += Size.CHAR.pack(self.version)
encoded += Size.CHAR.pack(self.type_int)
encoded += Size.LONG.pack(int(stem.util.datetime_to_unix(self.expiration) / 3600))
encoded += Size.CHAR.pack(self.key_type)
encoded += self.key
encoded += Size.CHAR.pack(len(self.extensions))
for extension in self.extensions:
encoded += extension.pack()
if self.signature:
encoded += self.signature
return bytes(encoded)
@staticmethod
def unpack(content):
if len(content) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH:
raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(content), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH))
header, signature = split(content, len(content) - ED25519_SIGNATURE_LENGTH)
version, header = Size.CHAR.pop(header)
cert_type, header = Size.CHAR.pop(header)
expiration_hours, header = Size.LONG.pop(header)
key_type, header = Size.CHAR.pop(header)
key, header = split(header, ED25519_KEY_LENGTH)
extension_count, extension_data = Size.CHAR.pop(header)
if version != 1:
raise ValueError('Ed25519 v1 parser cannot read version %i certificates' % version)
extensions = []
for i in range(extension_count):
extension, extension_data = Ed25519Extension.pop(extension_data)
extensions.append(extension)
if extension_data:
raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(extension_data))
return Ed25519CertificateV1(cert_type, datetime.datetime.utcfromtimestamp(expiration_hours * 3600), key_type, key, extensions, signature)
def is_expired(self):
"""
Checks if this certificate is presently expired or not.
:returns: **True** if the certificate has expired, **False** otherwise
"""
return datetime.datetime.now() > self.expiration
def signing_key(self):
"""
Provides this certificate's signing key.
.. versionadded:: 1.8.0
:returns: **bytes** with the first signing key on the certificate, None if
not present
"""
for extension in self.extensions:
if extension.type == ExtensionType.HAS_SIGNING_KEY:
return extension.data
return None
def validate(self, descriptor):
"""
Validate our descriptor content matches its ed25519 signature. Supported
descriptor types include...
* :class:`~stem.descriptor.server_descriptor.RelayDescriptor`
* :class:`~stem.descriptor.hidden_service.HiddenServiceDescriptorV3`
:param stem.descriptor.__init__.Descriptor descriptor: descriptor to validate
:raises:
* **ValueError** if signing key or descriptor are invalid
* **TypeError** if descriptor type is unsupported
* **ImportError** if cryptography module or ed25519 support unavailable
"""
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Certificate validation requires the cryptography module and ed25519 support')
if isinstance(descriptor, stem.descriptor.server_descriptor.RelayDescriptor):
signed_content = hashlib.sha256(Ed25519CertificateV1._signed_content(descriptor)).digest()
signature = stem.util.str_tools._decode_b64(descriptor.ed25519_signature)
self._validate_server_desc_signing_key(descriptor)
elif isinstance(descriptor, stem.descriptor.hidden_service.HiddenServiceDescriptorV3):
signed_content = Ed25519CertificateV1._signed_content(descriptor)
signature = stem.util.str_tools._decode_b64(descriptor.signature)
else:
raise TypeError('Certificate validation only supported for server and hidden service descriptors, not %s' % type(descriptor).__name__)
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature
try:
key = Ed25519PublicKey.from_public_bytes(self.key)
key.verify(signature, signed_content)
except InvalidSignature:
raise ValueError('Descriptor Ed25519 certificate signature invalid (signature forged or corrupt)')
@staticmethod
def _signed_content(descriptor):
"""
Provides this descriptor's signing constant, appended with the portion of
the descriptor that's signed.
"""
if isinstance(descriptor, stem.descriptor.server_descriptor.RelayDescriptor):
prefix = SIG_PREFIX_SERVER_DESC
regex = b'(.+router-sig-ed25519 )'
elif isinstance(descriptor, stem.descriptor.hidden_service.HiddenServiceDescriptorV3):
prefix = SIG_PREFIX_HS_V3
regex = b'(.+)signature '
else:
raise ValueError('BUG: %s type unexpected' % type(descriptor).__name__)
match = re.search(regex, descriptor.get_bytes(), re.DOTALL)
if not match:
raise ValueError('Malformed descriptor missing signature line')
return prefix + match.group(1)
def _validate_server_desc_signing_key(self, descriptor):
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature
if descriptor.ed25519_master_key:
signing_key = base64.b64decode(stem.util.str_tools._to_bytes(descriptor.ed25519_master_key) + b'=')
else:
signing_key = self.signing_key()
if not signing_key:
raise ValueError('Server descriptor missing an ed25519 signing key')
try:
key = Ed25519PublicKey.from_public_bytes(signing_key)
key.verify(self.signature, base64.b64decode(stem.util.str_tools._to_bytes(self.encoded))[:-ED25519_SIGNATURE_LENGTH])
except InvalidSignature:
raise ValueError('Ed25519KeyCertificate signing key is invalid (signature forged or corrupt)')
stem-1.8.0/stem/descriptor/reader.py 0000664 0001750 0001750 00000045253 13501272761 020171 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Utilities for reading descriptors from local directories and archives. This is
mostly done through the :class:`~stem.descriptor.reader.DescriptorReader`
class, which is an iterator for the descriptor data in a series of
destinations. For example...
::
my_descriptors = [
'/tmp/server-descriptors-2012-03.tar.bz2',
'/tmp/archived_descriptors/',
]
# prints the contents of all the descriptor files
with DescriptorReader(my_descriptors) as reader:
for descriptor in reader:
print descriptor
This ignores files that cannot be processed due to read errors or unparsable
content. To be notified of skipped files you can register a listener with
:func:`~stem.descriptor.reader.DescriptorReader.register_skip_listener`.
The :class:`~stem.descriptor.reader.DescriptorReader` keeps track of the last
modified timestamps for descriptor files that it has read so it can skip
unchanged files if run again. This listing of processed files can also be
persisted and applied to other
:class:`~stem.descriptor.reader.DescriptorReader` instances. For example, the
following prints descriptors as they're changed over the course of a minute,
and picks up where it left off if run again...
::
reader = DescriptorReader(['/tmp/descriptor_data'])
try:
processed_files = load_processed_files('/tmp/used_descriptors')
reader.set_processed_files(processed_files)
except: pass # could not load, maybe this is the first run
start_time = time.time()
while (time.time() - start_time) < 60:
# prints any descriptors that have changed since last checked
with reader:
for descriptor in reader:
print descriptor
time.sleep(1)
save_processed_files('/tmp/used_descriptors', reader.get_processed_files())
**Module Overview:**
::
load_processed_files - Loads a listing of processed files
save_processed_files - Saves a listing of processed files
DescriptorReader - Iterator for descriptor data on the local file system
|- get_processed_files - provides the listing of files that we've processed
|- set_processed_files - sets our tracking of the files we have processed
|- register_read_listener - adds a listener for when files are read
|- register_skip_listener - adds a listener that's notified of skipped files
|- start - begins reading descriptor data
|- stop - stops reading descriptor data
|- __enter__ / __exit__ - manages the descriptor reader thread in the context
+- __iter__ - iterates over descriptor data in unread files
FileSkipped - Base exception for a file that was skipped
|- AlreadyRead - We've already read a file with this last modified timestamp
|- ParsingFailure - Contents can't be parsed as descriptor data
|- UnrecognizedType - File extension indicates non-descriptor data
+- ReadFailed - Wraps an error that was raised while reading the file
+- FileMissing - File does not exist
.. deprecated:: 1.8.0
This module will likely be removed in Stem 2.0 due to lack of usage. If you
use this modle please `let me know `_.
"""
import mimetypes
import os
import tarfile
import threading
try:
import queue
except ImportError:
import Queue as queue
import stem.descriptor
import stem.prereq
import stem.util
import stem.util.str_tools
import stem.util.system
# flag to indicate when the reader thread is out of descriptor files to read
FINISHED = 'DONE'
class FileSkipped(Exception):
"Base error when we can't provide descriptor data from a file."
class AlreadyRead(FileSkipped):
"""
Already read a file with this 'last modified' timestamp or later.
:param int last_modified: unix timestamp for when the file was last modified
:param int last_modified_when_read: unix timestamp for the modification time
when we last read this file
"""
def __init__(self, last_modified, last_modified_when_read):
super(AlreadyRead, self).__init__('File has already been read since it was last modified. modification time: %s, last read: %s' % (last_modified, last_modified_when_read))
self.last_modified = last_modified
self.last_modified_when_read = last_modified_when_read
class ParsingFailure(FileSkipped):
"""
File contents could not be parsed as descriptor data.
:param ValueError exception: issue that arose when parsing
"""
def __init__(self, parsing_exception):
super(ParsingFailure, self).__init__(parsing_exception)
self.exception = parsing_exception
class UnrecognizedType(FileSkipped):
"""
File doesn't contain descriptor data. This could either be due to its file
type or because it doesn't conform to a recognizable descriptor type.
:param tuple mime_type: the (type, encoding) tuple provided by mimetypes.guess_type()
"""
def __init__(self, mime_type):
super(UnrecognizedType, self).__init__('Unrecognized mime type: %s (%s)' % mime_type)
self.mime_type = mime_type
class ReadFailed(FileSkipped):
"""
An IOError occurred while trying to read the file.
:param IOError exception: issue that arose when reading the file, **None** if
this arose due to the file not being present
"""
def __init__(self, read_exception):
super(ReadFailed, self).__init__(read_exception)
self.exception = read_exception
class FileMissing(ReadFailed):
'File does not exist.'
def __init__(self):
super(FileMissing, self).__init__('File does not exist')
def load_processed_files(path):
"""
Loads a dictionary of 'path => last modified timestamp' mappings, as
persisted by :func:`~stem.descriptor.reader.save_processed_files`, from a
file.
:param str path: location to load the processed files dictionary from
:returns: **dict** of 'path (**str**) => last modified unix timestamp
(**int**)' mappings
:raises:
* **IOError** if unable to read the file
* **TypeError** if unable to parse the file's contents
"""
processed_files = {}
with open(path, 'rb') as input_file:
for line in input_file.readlines():
line = stem.util.str_tools._to_unicode(line.strip())
if not line:
continue # skip blank lines
if ' ' not in line:
raise TypeError('Malformed line: %s' % line)
path, timestamp = line.rsplit(' ', 1)
if not os.path.isabs(path):
raise TypeError("'%s' is not an absolute path" % path)
elif not timestamp.isdigit():
raise TypeError("'%s' is not an integer timestamp" % timestamp)
processed_files[path] = int(timestamp)
return processed_files
def save_processed_files(path, processed_files):
"""
Persists a dictionary of 'path => last modified timestamp' mappings (as
provided by the DescriptorReader's
:func:`~stem.descriptor.reader.DescriptorReader.get_processed_files` method)
so that they can be loaded later and applied to another
:class:`~stem.descriptor.reader.DescriptorReader`.
:param str path: location to save the processed files dictionary to
:param dict processed_files: 'path => last modified' mappings
:raises:
* **IOError** if unable to write to the file
* **TypeError** if processed_files is of the wrong type
"""
# makes the parent directory if it doesn't already exist
try:
path_dir = os.path.dirname(path)
if not os.path.exists(path_dir):
os.makedirs(path_dir)
except OSError as exc:
raise IOError(exc)
with open(path, 'w') as output_file:
for path, timestamp in list(processed_files.items()):
if not os.path.isabs(path):
raise TypeError('Only absolute paths are acceptable: %s' % path)
output_file.write('%s %i\n' % (path, timestamp))
class DescriptorReader(object):
"""
Iterator for the descriptor data on the local file system. This can process
text files, tarball archives (gzip or bzip2), or recurse directories.
By default this limits the number of descriptors that we'll read ahead before
waiting for our caller to fetch some of them. This is included to avoid
unbounded memory usage.
Our persistence_path argument is a convenient method to persist the listing
of files we have processed between runs, however it doesn't allow for error
handling. If you want that then use the
:func:`~stem.descriptor.reader.load_processed_files` and
:func:`~stem.descriptor.reader.save_processed_files` functions instead.
:param str,list target: path or list of paths for files or directories to be read from
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param bool follow_links: determines if we'll follow symlinks when traversing
directories (requires python 2.6)
:param int buffer_size: descriptors we'll buffer before waiting for some to
be read, this is unbounded if zero
:param str persistence_path: if set we will load and save processed file
listings from this path, errors are ignored
:param stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:param dict kwargs: additional arguments for the descriptor constructor
"""
def __init__(self, target, validate = False, follow_links = False, buffer_size = 100, persistence_path = None, document_handler = stem.descriptor.DocumentHandler.ENTRIES, **kwargs):
self._targets = [target] if stem.util._is_str(target) else target
# expand any relative paths we got
self._targets = list(map(os.path.abspath, self._targets))
self._validate = validate
self._follow_links = follow_links
self._persistence_path = persistence_path
self._document_handler = document_handler
self._kwargs = kwargs
self._read_listeners = []
self._skip_listeners = []
self._processed_files = {}
self._reader_thread = None
self._reader_thread_lock = threading.RLock()
self._iter_lock = threading.RLock()
self._iter_notice = threading.Event()
self._is_stopped = threading.Event()
self._is_stopped.set()
# Descriptors that we have read but not yet provided to the caller. A
# FINISHED entry is used by the reading thread to indicate the end.
self._unreturned_descriptors = queue.Queue(buffer_size)
if self._persistence_path:
try:
processed_files = load_processed_files(self._persistence_path)
self.set_processed_files(processed_files)
except:
pass
def get_processed_files(self):
"""
For each file that we have read descriptor data from this provides a
mapping of the form...
::
absolute path (str) => last modified unix timestamp (int)
This includes entries set through the
:func:`~stem.descriptor.reader.DescriptorReader.set_processed_files`
method. Each run resets this to only the files that were present during
that run.
:returns: **dict** with the absolute paths and unix timestamp for the last
modified times of the files we have processed
"""
# make sure that we only provide back absolute paths
return dict((os.path.abspath(k), v) for (k, v) in list(self._processed_files.items()))
def set_processed_files(self, processed_files):
"""
Sets the listing of the files we have processed. Most often this is used
with a newly created :class:`~stem.descriptor.reader.DescriptorReader` to
pre-populate the listing of descriptor files that we have seen.
:param dict processed_files: mapping of absolute paths (**str**) to unix
timestamps for the last modified time (**int**)
"""
self._processed_files = dict(processed_files)
def register_read_listener(self, listener):
"""
Registers a listener for when files are read. This is executed prior to
processing files. Listeners are expected to be of the form...
::
my_listener(path)
:param functor listener: functor to be notified when files are read
"""
self._read_listeners.append(listener)
def register_skip_listener(self, listener):
"""
Registers a listener for files that are skipped. This listener is expected
to be a functor of the form...
::
my_listener(path, exception)
:param functor listener: functor to be notified of files that are skipped
to read errors or because they couldn't be parsed as valid descriptor data
"""
self._skip_listeners.append(listener)
def get_buffered_descriptor_count(self):
"""
Provides the number of descriptors that are waiting to be iterated over.
This is limited to the buffer_size that we were constructed with.
:returns: **int** for the estimated number of currently enqueued
descriptors, this is not entirely reliable
"""
return self._unreturned_descriptors.qsize()
def start(self):
"""
Starts reading our descriptor files.
:raises: **ValueError** if we're already reading the descriptor files
"""
with self._reader_thread_lock:
if self._reader_thread:
raise ValueError('Already running, you need to call stop() first')
else:
self._is_stopped.clear()
self._reader_thread = threading.Thread(target = self._read_descriptor_files, name='Descriptor reader')
self._reader_thread.setDaemon(True)
self._reader_thread.start()
def stop(self):
"""
Stops further reading of descriptor files.
"""
with self._reader_thread_lock:
self._is_stopped.set()
self._iter_notice.set()
# clears our queue to unblock enqueue calls
try:
while True:
self._unreturned_descriptors.get_nowait()
except queue.Empty:
pass
self._reader_thread.join()
self._reader_thread = None
if self._persistence_path:
try:
processed_files = self.get_processed_files()
save_processed_files(self._persistence_path, processed_files)
except:
pass
def _read_descriptor_files(self):
new_processed_files = {}
remaining_files = list(self._targets)
while remaining_files and not self._is_stopped.is_set():
target = remaining_files.pop(0)
if not os.path.exists(target):
self._notify_skip_listeners(target, FileMissing())
continue
if os.path.isdir(target):
walker = os.walk(target, followlinks = self._follow_links)
self._handle_walker(walker, new_processed_files)
else:
self._handle_file(target, new_processed_files)
self._processed_files = new_processed_files
if not self._is_stopped.is_set():
self._unreturned_descriptors.put(FINISHED)
self._iter_notice.set()
def __iter__(self):
with self._iter_lock:
while not self._is_stopped.is_set():
try:
descriptor = self._unreturned_descriptors.get_nowait()
if descriptor == FINISHED:
break
else:
yield descriptor
except queue.Empty:
self._iter_notice.wait()
self._iter_notice.clear()
def _handle_walker(self, walker, new_processed_files):
for root, _, files in walker:
for filename in files:
self._handle_file(os.path.join(root, filename), new_processed_files)
# this can take a while if, say, we're including the root directory
if self._is_stopped.is_set():
return
def _handle_file(self, target, new_processed_files):
# This is a file. Register its last modified timestamp and check if
# it's a file that we should skip.
try:
last_modified = int(os.stat(target).st_mtime)
last_used = self._processed_files.get(target)
new_processed_files[target] = last_modified
except OSError as exc:
self._notify_skip_listeners(target, ReadFailed(exc))
return
if last_used and last_used >= last_modified:
self._notify_skip_listeners(target, AlreadyRead(last_modified, last_used))
return
# Block devices and such are never descriptors, and can cause us to block
# for quite a while so skipping anything that isn't a regular file.
if not os.path.isfile(target):
return
# The mimetypes module only checks the file extension. To actually
# check the content (like the 'file' command) we'd need something like
# pymagic (https://github.com/cloudburst/pymagic).
target_type = mimetypes.guess_type(target)
if target_type[0] in (None, 'text/plain'):
# either '.txt' or an unknown type
self._handle_descriptor_file(target, target_type)
elif stem.util.system.is_tarfile(target):
# handles gzip, bz2, and decompressed tarballs among others
self._handle_archive(target)
else:
self._notify_skip_listeners(target, UnrecognizedType(target_type))
def _handle_descriptor_file(self, target, mime_type):
try:
self._notify_read_listeners(target)
with open(target, 'rb') as target_file:
for desc in stem.descriptor.parse_file(target_file, validate = self._validate, document_handler = self._document_handler, **self._kwargs):
if self._is_stopped.is_set():
return
self._unreturned_descriptors.put(desc)
self._iter_notice.set()
except TypeError:
self._notify_skip_listeners(target, UnrecognizedType(mime_type))
except ValueError as exc:
self._notify_skip_listeners(target, ParsingFailure(exc))
except IOError as exc:
self._notify_skip_listeners(target, ReadFailed(exc))
def _handle_archive(self, target):
# TODO: When dropping python 2.6 support go back to using 'with' for
# tarfiles...
#
# http://bugs.python.org/issue7232
tar_file = None
try:
self._notify_read_listeners(target)
tar_file = tarfile.open(target)
for tar_entry in tar_file:
if tar_entry.isfile():
entry = tar_file.extractfile(tar_entry)
try:
for desc in stem.descriptor.parse_file(entry, validate = self._validate, document_handler = self._document_handler, **self._kwargs):
if self._is_stopped.is_set():
return
desc._set_path(os.path.abspath(target))
desc._set_archive_path(tar_entry.name)
self._unreturned_descriptors.put(desc)
self._iter_notice.set()
except TypeError as exc:
self._notify_skip_listeners(target, ParsingFailure(exc))
except ValueError as exc:
self._notify_skip_listeners(target, ParsingFailure(exc))
finally:
entry.close()
except IOError as exc:
self._notify_skip_listeners(target, ReadFailed(exc))
finally:
if tar_file:
tar_file.close()
def _notify_read_listeners(self, path):
for listener in self._read_listeners:
listener(path)
def _notify_skip_listeners(self, path, exception):
for listener in self._skip_listeners:
listener(path, exception)
def __enter__(self):
self.start()
return self
def __exit__(self, exit_type, value, traceback):
self.stop()
stem-1.8.0/stem/descriptor/networkstatus.py 0000664 0001750 0001750 00000234643 13601502033 021654 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Tor network status documents. This supports both the v2 and v3
`dir-spec `_.
Documents can be obtained from a few sources...
* The 'cached-consensus' file in Tor's data directory.
* Archived descriptors provided by `CollecTor
`_.
* Directory authorities and mirrors via their DirPort.
... and contain the following sections...
* document header
* list of :class:`stem.descriptor.networkstatus.DirectoryAuthority`
* list of :class:`stem.descriptor.router_status_entry.RouterStatusEntry`
* document footer
**For a great graphical overview see** `Jordan Wright's chart describing the
anatomy of the consensus
`_.
Of these, the router status entry section can be quite large (on the order of
hundreds of kilobytes). As such we provide a couple of methods for reading
network status documents through :func:`~stem.descriptor.__init__.parse_file`.
For more information see :func:`~stem.descriptor.__init__.DocumentHandler`...
::
from stem.descriptor import parse_file, DocumentHandler
with open('.tor/cached-consensus', 'rb') as consensus_file:
# Processes the routers as we read them in. The routers refer to a document
# with an unset 'routers' attribute.
for router in parse_file(consensus_file, 'network-status-consensus-3 1.0', document_handler = DocumentHandler.ENTRIES):
print router.nickname
**Module Overview:**
::
NetworkStatusDocument - Network status document
|- NetworkStatusDocumentV2 - Version 2 network status document
|- NetworkStatusDocumentV3 - Version 3 network status document
+- BridgeNetworkStatusDocument - Version 3 network status document for bridges
KeyCertificate - Certificate used to authenticate an authority
DocumentSignature - Signature of a document by a directory authority
DetachedSignature - Stand alone signature used when making the consensus
DirectoryAuthority - Directory authority as defined in a v3 network status document
"""
import collections
import datetime
import hashlib
import io
import stem.descriptor.router_status_entry
import stem.util.str_tools
import stem.util.tor_tools
import stem.version
from stem.descriptor import (
PGP_BLOCK_END,
Descriptor,
DigestHash,
DigestEncoding,
TypeAnnotation,
DocumentHandler,
_descriptor_content,
_descriptor_components,
_read_until_keywords,
_value,
_values,
_parse_simple_line,
_parse_if_present,
_parse_timestamp_line,
_parse_forty_character_hex,
_parse_protocol_line,
_parse_key_block,
_mappings_for,
_random_nickname,
_random_fingerprint,
_random_ipv4_address,
_random_date,
_random_crypto_blob,
)
from stem.descriptor.router_status_entry import (
RouterStatusEntryV2,
RouterStatusEntryBridgeV2,
RouterStatusEntryV3,
RouterStatusEntryMicroV3,
)
# Version 2 network status document fields, tuples of the form...
# (keyword, is_mandatory)
NETWORK_STATUS_V2_FIELDS = (
('network-status-version', True),
('dir-source', True),
('fingerprint', True),
('contact', True),
('dir-signing-key', True),
('client-versions', False),
('server-versions', False),
('published', True),
('dir-options', False),
('directory-signature', True),
)
# Network status document are either a 'vote' or 'consensus', with different
# mandatory fields for each. Both though require that their fields appear in a
# specific order. This is an ordered listing of the following...
#
# (field, in_votes, in_consensus, is_mandatory)
HEADER_STATUS_DOCUMENT_FIELDS = (
('network-status-version', True, True, True),
('vote-status', True, True, True),
('consensus-methods', True, False, False),
('consensus-method', False, True, False),
('published', True, False, True),
('valid-after', True, True, True),
('fresh-until', True, True, True),
('valid-until', True, True, True),
('voting-delay', True, True, True),
('client-versions', True, True, False),
('server-versions', True, True, False),
('package', True, True, False),
('known-flags', True, True, True),
('flag-thresholds', True, False, False),
('shared-rand-participate', True, False, False),
('shared-rand-commit', True, False, False),
('shared-rand-previous-value', True, True, False),
('shared-rand-current-value', True, True, False),
('bandwidth-file-headers', True, False, False),
('bandwidth-file-digest', True, False, False),
('recommended-client-protocols', True, True, False),
('recommended-relay-protocols', True, True, False),
('required-client-protocols', True, True, False),
('required-relay-protocols', True, True, False),
('params', True, True, False),
)
FOOTER_STATUS_DOCUMENT_FIELDS = (
('directory-footer', True, True, False),
('bandwidth-weights', False, True, False),
('directory-signature', True, True, True),
)
AUTH_START = 'dir-source'
ROUTERS_START = 'r'
FOOTER_START = 'directory-footer'
V2_FOOTER_START = 'directory-signature'
DEFAULT_PARAMS = {
'bwweightscale': 10000,
'cbtdisabled': 0,
'cbtnummodes': 3,
'cbtrecentcount': 20,
'cbtmaxtimeouts': 18,
'cbtmincircs': 100,
'cbtquantile': 80,
'cbtclosequantile': 95,
'cbttestfreq': 60,
'cbtmintimeout': 2000,
'cbtinitialtimeout': 60000,
'cbtlearntimeout': 180,
'cbtmaxopencircs': 10,
'UseOptimisticData': 1,
'Support022HiddenServices': 1,
'usecreatefast': 1,
'max-consensuses-age-to-cache-for-diff': 72,
'try-diff-for-consensus-newer-than': 72,
'onion-key-rotation-days': 28,
'onion-key-grace-period-days': 7,
'hs_service_max_rdv_failures': 2,
'circ_max_cell_queue_size': 50000,
'circpad_max_circ_queued_cells': 1000,
'HiddenServiceEnableIntroDoSDefense': 0,
}
# KeyCertificate fields, tuple is of the form...
# (keyword, is_mandatory)
KEY_CERTIFICATE_PARAMS = (
('dir-key-certificate-version', True),
('dir-address', False),
('fingerprint', True),
('dir-identity-key', True),
('dir-key-published', True),
('dir-key-expires', True),
('dir-signing-key', True),
('dir-key-crosscert', False),
('dir-key-certification', True),
)
# DetchedSignature fields, tuple is of the form...
# (keyword, is_mandatory, is_multiple)
DETACHED_SIGNATURE_PARAMS = (
('consensus-digest', True, False),
('valid-after', True, False),
('fresh-until', True, False),
('valid-until', True, False),
('additional-digest', False, True),
('additional-signature', False, True),
('directory-signature', False, True),
)
# all parameters are constrained to int32 range
MIN_PARAM, MAX_PARAM = -2147483648, 2147483647
PARAM_RANGE = {
'circwindow': (100, 1000),
'CircuitPriorityHalflifeMsec': (-1, MAX_PARAM),
'perconnbwrate': (-1, MAX_PARAM),
'perconnbwburst': (-1, MAX_PARAM),
'refuseunknownexits': (0, 1),
'bwweightscale': (1, MAX_PARAM),
'cbtdisabled': (0, 1),
'cbtnummodes': (1, 20),
'cbtrecentcount': (3, 1000),
'cbtmaxtimeouts': (3, 10000),
'cbtmincircs': (1, 10000),
'cbtquantile': (10, 99),
'cbtclosequantile': (MIN_PARAM, 99),
'cbttestfreq': (1, MAX_PARAM),
'cbtmintimeout': (500, MAX_PARAM),
'cbtlearntimeout': (10, 60000),
'cbtmaxopencircs': (0, 14),
'UseOptimisticData': (0, 1),
'Support022HiddenServices': (0, 1),
'usecreatefast': (0, 1),
'UseNTorHandshake': (0, 1),
'FastFlagMinThreshold': (4, MAX_PARAM),
'NumDirectoryGuards': (0, 10),
'NumEntryGuards': (1, 10),
'GuardLifetime': (2592000, 157766400), # min: 30 days, max: 1826 days
'NumNTorsPerTAP': (1, 100000),
'AllowNonearlyExtend': (0, 1),
'AuthDirNumSRVAgreements': (1, MAX_PARAM),
'max-consensuses-age-to-cache-for-diff': (0, 8192),
'try-diff-for-consensus-newer-than': (0, 8192),
'onion-key-rotation-days': (1, 90),
'onion-key-grace-period-days': (1, 90), # max is the highest onion-key-rotation-days
'hs_service_max_rdv_failures': (1, 10),
'circ_max_cell_queue_size': (1000, 4294967295),
'circpad_max_circ_queued_cells': (0, 50000),
'HiddenServiceEnableIntroDoSDefense': (0, 1),
}
class PackageVersion(collections.namedtuple('PackageVersion', ['name', 'version', 'url', 'digests'])):
"""
Latest recommended version of a package that's available.
:var str name: name of the package
:var str version: latest recommended version
:var str url: package's url
:var dict digests: mapping of digest types to their value
"""
class SharedRandomnessCommitment(collections.namedtuple('SharedRandomnessCommitment', ['version', 'algorithm', 'identity', 'commit', 'reveal'])):
"""
Directory authority's commitment for generating the next shared random value.
:var int version: shared randomness protocol version
:var str algorithm: hash algorithm used to make the commitment
:var str identity: authority's sha1 identity fingerprint
:var str commit: base64 encoded commitment hash to the shared random value
:var str reveal: base64 encoded commitment to the shared random value,
**None** of not provided
"""
class DocumentDigest(collections.namedtuple('DocumentDigest', ['flavor', 'algorithm', 'digest'])):
"""
Digest of a consensus document.
.. versionadded:: 1.8.0
:var str flavor: consensus type this digest is for (for example, 'microdesc')
:var str algorithm: hash algorithm used to make the digest
:var str digest: digest value of the consensus
"""
def _parse_file(document_file, document_type = None, validate = False, is_microdescriptor = False, document_handler = DocumentHandler.ENTRIES, **kwargs):
"""
Parses a network status and iterates over the RouterStatusEntry in it. The
document that these instances reference have an empty 'routers' attribute to
allow for limited memory usage.
:param file document_file: file with network status document content
:param class document_type: NetworkStatusDocument subclass
:param bool validate: checks the validity of the document's contents if
**True**, skips these checks otherwise
:param bool is_microdescriptor: **True** if this is for a microdescriptor
consensus, **False** otherwise
:param stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:param dict kwargs: additional arguments for the descriptor constructor
:returns: :class:`stem.descriptor.networkstatus.NetworkStatusDocument` object
:raises:
* **ValueError** if the document_version is unrecognized or the contents is
malformed and validate is **True**
* **IOError** if the file can't be read
"""
# we can't properly default this since NetworkStatusDocumentV3 isn't defined yet
if document_type is None:
document_type = NetworkStatusDocumentV3
if document_type == NetworkStatusDocumentV2:
document_type, router_type = NetworkStatusDocumentV2, RouterStatusEntryV2
elif document_type == NetworkStatusDocumentV3:
router_type = RouterStatusEntryMicroV3 if is_microdescriptor else RouterStatusEntryV3
elif document_type == BridgeNetworkStatusDocument:
document_type, router_type = BridgeNetworkStatusDocument, RouterStatusEntryBridgeV2
elif document_type == DetachedSignature:
yield document_type(document_file.read(), validate, **kwargs)
return
else:
raise ValueError("Document type %i isn't recognized (only able to parse v2, v3, and bridge)" % document_type)
if document_handler == DocumentHandler.DOCUMENT:
yield document_type(document_file.read(), validate, **kwargs)
return
# getting the document without the routers section
header = _read_until_keywords((ROUTERS_START, FOOTER_START, V2_FOOTER_START), document_file)
if header and header[0].startswith(b'@type'):
header = header[1:]
routers_start = document_file.tell()
_read_until_keywords((FOOTER_START, V2_FOOTER_START), document_file, skip = True)
routers_end = document_file.tell()
footer = document_file.readlines()
document_content = bytes.join(b'', header + footer)
if document_handler == DocumentHandler.BARE_DOCUMENT:
yield document_type(document_content, validate, **kwargs)
elif document_handler == DocumentHandler.ENTRIES:
desc_iterator = stem.descriptor.router_status_entry._parse_file(
document_file,
validate,
entry_class = router_type,
entry_keyword = ROUTERS_START,
start_position = routers_start,
end_position = routers_end,
extra_args = (document_type(document_content, validate),),
**kwargs
)
for desc in desc_iterator:
yield desc
else:
raise ValueError('Unrecognized document_handler: %s' % document_handler)
def _parse_file_key_certs(certificate_file, validate = False):
"""
Parses a file containing one or more authority key certificates.
:param file certificate_file: file with key certificates
:param bool validate: checks the validity of the certificate's contents if
**True**, skips these checks otherwise
:returns: iterator for :class:`stem.descriptor.networkstatus.KeyCertificate`
instances in the file
:raises:
* **ValueError** if the key certificates are invalid and validate is **True**
* **IOError** if the file can't be read
"""
while True:
keycert_content = _read_until_keywords('dir-key-certification', certificate_file)
# we've reached the 'router-signature', now include the pgp style block
block_end_prefix = PGP_BLOCK_END.split(' ', 1)[0]
keycert_content += _read_until_keywords(block_end_prefix, certificate_file, True)
if keycert_content:
yield stem.descriptor.networkstatus.KeyCertificate(bytes.join(b'', keycert_content), validate = validate)
else:
break # done parsing file
def _parse_file_detached_sigs(detached_signature_file, validate = False):
"""
Parses a file containing one or more detached signatures.
:param file detached_signature_file: file with detached signatures
:param bool validate: checks the validity of the detached signature's
contents if **True**, skips these checks otherwise
:returns: iterator for :class:`stem.descriptor.networkstatus.DetachedSignature`
instances in the file
:raises:
* **ValueError** if the detached signatures are invalid and validate is **True**
* **IOError** if the file can't be read
"""
while True:
detached_sig_content = _read_until_keywords('consensus-digest', detached_signature_file, ignore_first = True)
if detached_sig_content:
yield stem.descriptor.networkstatus.DetachedSignature(bytes.join(b'', detached_sig_content), validate = validate)
else:
break # done parsing file
class NetworkStatusDocument(Descriptor):
"""
Common parent for network status documents.
"""
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
"""
Digest of this descriptor's content. These are referenced by...
* **DetachedSignature**
* Referer: :class:`~stem.descriptor.networkstatus.DetachedSignature` **consensus_digest** attribute
* Format: **SHA1/HEX**
.. versionadded:: 1.8.0
:param stem.descriptor.DigestHash hash_type: digest hashing algorithm
:param stem.descriptor.DigestEncoding encoding: digest encoding
:returns: **hashlib.HASH** or **str** based on our encoding argument
"""
content = self._content_range(end = '\ndirectory-signature ')
if hash_type == DigestHash.SHA1:
return stem.descriptor._encode_digest(hashlib.sha1(content), encoding)
elif hash_type == DigestHash.SHA256:
return stem.descriptor._encode_digest(hashlib.sha256(content), encoding)
else:
raise NotImplementedError('Network status document digests are only available in sha1 and sha256, not %s' % hash_type)
def _parse_version_line(keyword, attribute, expected_version):
def _parse(descriptor, entries):
value = _value(keyword, entries)
if not value.isdigit():
raise ValueError('Document has a non-numeric version: %s %s' % (keyword, value))
setattr(descriptor, attribute, int(value))
if int(value) != expected_version:
raise ValueError("Expected a version %i document, but got version '%s' instead" % (expected_version, value))
return _parse
def _parse_dir_source_line(descriptor, entries):
value = _value('dir-source', entries)
dir_source_comp = value.split()
if len(dir_source_comp) < 3:
raise ValueError("The 'dir-source' line of a v2 network status document must have three values: dir-source %s" % value)
if not dir_source_comp[0]:
# https://trac.torproject.org/7055
raise ValueError("Authority's hostname can't be blank: dir-source %s" % value)
elif not stem.util.connection.is_valid_ipv4_address(dir_source_comp[1]):
raise ValueError("Authority's address isn't a valid IPv4 address: %s" % dir_source_comp[1])
elif not stem.util.connection.is_valid_port(dir_source_comp[2], allow_zero = True):
raise ValueError("Authority's DirPort is invalid: %s" % dir_source_comp[2])
descriptor.hostname = dir_source_comp[0]
descriptor.address = dir_source_comp[1]
descriptor.dir_port = None if dir_source_comp[2] == '0' else int(dir_source_comp[2])
def _parse_additional_digests(descriptor, entries):
digests = []
for val in _values('additional-digest', entries):
comp = val.split(' ')
if len(comp) < 3:
raise ValueError("additional-digest lines should be of the form 'additional-digest [flavor] [algname] [digest]' but was: %s" % val)
digests.append(DocumentDigest(*comp[:3]))
descriptor.additional_digests = digests
def _parse_additional_signatures(descriptor, entries):
signatures = []
for val, block_type, block_contents in entries['additional-signature']:
comp = val.split(' ')
if len(comp) < 4:
raise ValueError("additional-signature lines should be of the form 'additional-signature [flavor] [algname] [identity] [signing_key_digest]' but was: %s" % val)
elif not block_contents or block_type != 'SIGNATURE':
raise ValueError("'additional-signature' should be followed by a SIGNATURE block, but was a %s" % block_type)
signatures.append(DocumentSignature(comp[1], comp[2], comp[3], block_contents, flavor = comp[0], validate = True))
descriptor.additional_signatures = signatures
_parse_network_status_version_line = _parse_version_line('network-status-version', 'version', 2)
_parse_fingerprint_line = _parse_forty_character_hex('fingerprint', 'fingerprint')
_parse_contact_line = _parse_simple_line('contact', 'contact')
_parse_dir_signing_key_line = _parse_key_block('dir-signing-key', 'signing_key', 'RSA PUBLIC KEY')
_parse_client_versions_line = _parse_simple_line('client-versions', 'client_versions', func = lambda v: v.split(','))
_parse_server_versions_line = _parse_simple_line('server-versions', 'server_versions', func = lambda v: v.split(','))
_parse_published_line = _parse_timestamp_line('published', 'published')
_parse_dir_options_line = _parse_simple_line('dir-options', 'options', func = lambda v: v.split())
_parse_directory_signature_line = _parse_key_block('directory-signature', 'signature', 'SIGNATURE', value_attribute = 'signing_authority')
_parse_consensus_digest_line = _parse_simple_line('consensus-digest', 'consensus_digest')
class NetworkStatusDocumentV2(NetworkStatusDocument):
"""
Version 2 network status document. These have been deprecated and are no
longer generated by Tor.
:var dict routers: fingerprints to :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV2`
contained in the document
:var int version: **\\*** document version
:var str hostname: **\\*** hostname of the authority
:var str address: **\\*** authority's IP address
:var int dir_port: **\\*** authority's DirPort
:var str fingerprint: **\\*** authority's fingerprint
:var str contact: **\\*** authority's contact information
:var str signing_key: **\\*** authority's public signing key
:var list client_versions: list of recommended client tor version strings
:var list server_versions: list of recommended server tor version strings
:var datetime published: **\\*** time when the document was published
:var list options: **\\*** list of things that this authority decides
:var str signing_authority: **\\*** name of the authority signing the document
:var str signature: **\\*** authority's signature for the document
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
TYPE_ANNOTATION_NAME = 'network-status-2'
ATTRIBUTES = {
'version': (None, _parse_network_status_version_line),
'hostname': (None, _parse_dir_source_line),
'address': (None, _parse_dir_source_line),
'dir_port': (None, _parse_dir_source_line),
'fingerprint': (None, _parse_fingerprint_line),
'contact': (None, _parse_contact_line),
'signing_key': (None, _parse_dir_signing_key_line),
'client_versions': ([], _parse_client_versions_line),
'server_versions': ([], _parse_server_versions_line),
'published': (None, _parse_published_line),
'options': ([], _parse_dir_options_line),
'signing_authority': (None, _parse_directory_signature_line),
'signatures': (None, _parse_directory_signature_line),
}
PARSER_FOR_LINE = {
'network-status-version': _parse_network_status_version_line,
'dir-source': _parse_dir_source_line,
'fingerprint': _parse_fingerprint_line,
'contact': _parse_contact_line,
'dir-signing-key': _parse_dir_signing_key_line,
'client-versions': _parse_client_versions_line,
'server-versions': _parse_server_versions_line,
'published': _parse_published_line,
'dir-options': _parse_dir_options_line,
'directory-signature': _parse_directory_signature_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('network-status-version', '2'),
('dir-source', '%s %s 80' % (_random_ipv4_address(), _random_ipv4_address())),
('fingerprint', _random_fingerprint()),
('contact', 'arma at mit dot edu'),
('published', _random_date()),
('dir-signing-key', _random_crypto_blob('RSA PUBLIC KEY')),
), (
('directory-signature', 'moria2' + _random_crypto_blob('SIGNATURE')),
))
def __init__(self, raw_content, validate = False):
super(NetworkStatusDocumentV2, self).__init__(raw_content, lazy_load = not validate)
# Splitting the document from the routers. Unlike v3 documents we're not
# bending over backwards on the validation by checking the field order or
# that header/footer attributes aren't in the wrong section. This is a
# deprecated descriptor type - patches welcome if you want those checks.
document_file = io.BytesIO(raw_content)
document_content = bytes.join(b'', _read_until_keywords((ROUTERS_START, V2_FOOTER_START), document_file))
router_iter = stem.descriptor.router_status_entry._parse_file(
document_file,
validate,
entry_class = RouterStatusEntryV2,
entry_keyword = ROUTERS_START,
section_end_keywords = (V2_FOOTER_START,),
extra_args = (self,),
)
self.routers = dict((desc.fingerprint, desc) for desc in router_iter)
entries = _descriptor_components(document_content + b'\n' + document_file.read(), validate)
if validate:
self._check_constraints(entries)
self._parse(entries, validate)
# 'client-versions' and 'server-versions' are only required if 'Versions'
# is among the options
if 'Versions' in self.options and not ('client-versions' in entries and 'server-versions' in entries):
raise ValueError("Version 2 network status documents must have a 'client-versions' and 'server-versions' when 'Versions' is listed among its dir-options:\n%s" % str(self))
else:
self._entries = entries
def _check_constraints(self, entries):
required_fields = [field for (field, is_mandatory) in NETWORK_STATUS_V2_FIELDS if is_mandatory]
for keyword in required_fields:
if keyword not in entries:
raise ValueError("Network status document (v2) must have a '%s' line:\n%s" % (keyword, str(self)))
# all recognized fields can only appear once
single_fields = [field for (field, _) in NETWORK_STATUS_V2_FIELDS]
for keyword in single_fields:
if keyword in entries and len(entries[keyword]) > 1:
raise ValueError("Network status document (v2) can only have a single '%s' line, got %i:\n%s" % (keyword, len(entries[keyword]), str(self)))
if 'network-status-version' != list(entries.keys())[0]:
raise ValueError("Network status document (v2) are expected to start with a 'network-status-version' line:\n%s" % str(self))
def _parse_header_network_status_version_line(descriptor, entries):
# "network-status-version" version
value = _value('network-status-version', entries)
if ' ' in value:
version, flavor = value.split(' ', 1)
else:
version, flavor = value, 'ns'
if not version.isdigit():
raise ValueError('Network status document has a non-numeric version: network-status-version %s' % value)
descriptor.version = int(version)
descriptor.version_flavor = flavor
descriptor.is_microdescriptor = flavor == 'microdesc'
if descriptor.version != 3:
raise ValueError("Expected a version 3 network status document, got version '%s' instead" % descriptor.version)
def _parse_header_vote_status_line(descriptor, entries):
# "vote-status" type
#
# The consensus-method and consensus-methods fields are optional since
# they weren't included in version 1. Setting a default now that we
# know if we're a vote or not.
value = _value('vote-status', entries)
if value == 'consensus':
descriptor.is_consensus, descriptor.is_vote = True, False
elif value == 'vote':
descriptor.is_consensus, descriptor.is_vote = False, True
else:
raise ValueError("A network status document's vote-status line can only be 'consensus' or 'vote', got '%s' instead" % value)
def _parse_header_consensus_methods_line(descriptor, entries):
# "consensus-methods" IntegerList
if descriptor._lazy_loading and descriptor.is_vote:
descriptor.consensus_methods = [1]
value, consensus_methods = _value('consensus-methods', entries), []
for entry in value.split(' '):
if not entry.isdigit():
raise ValueError("A network status document's consensus-methods must be a list of integer values, but was '%s'" % value)
consensus_methods.append(int(entry))
descriptor.consensus_methods = consensus_methods
def _parse_header_consensus_method_line(descriptor, entries):
# "consensus-method" Integer
if descriptor._lazy_loading and descriptor.is_consensus:
descriptor.consensus_method = 1
value = _value('consensus-method', entries)
if not value.isdigit():
raise ValueError("A network status document's consensus-method must be an integer, but was '%s'" % value)
descriptor.consensus_method = int(value)
def _parse_header_voting_delay_line(descriptor, entries):
# "voting-delay" VoteSeconds DistSeconds
value = _value('voting-delay', entries)
value_comp = value.split(' ')
if len(value_comp) == 2 and value_comp[0].isdigit() and value_comp[1].isdigit():
descriptor.vote_delay = int(value_comp[0])
descriptor.dist_delay = int(value_comp[1])
else:
raise ValueError("A network status document's 'voting-delay' line must be a pair of integer values, but was '%s'" % value)
def _parse_versions_line(keyword, attribute):
def _parse(descriptor, entries):
value, entries = _value(keyword, entries), []
for entry in value.split(','):
try:
entries.append(stem.version._get_version(entry))
except ValueError:
raise ValueError("Network status document's '%s' line had '%s', which isn't a parsable tor version: %s %s" % (keyword, entry, keyword, value))
setattr(descriptor, attribute, entries)
return _parse
def _parse_header_flag_thresholds_line(descriptor, entries):
# "flag-thresholds" SP THRESHOLDS
value, thresholds = _value('flag-thresholds', entries).strip(), {}
for key, val in _mappings_for('flag-thresholds', value):
try:
if val.endswith('%'):
# opting for string manipulation rather than just
# 'float(entry_value) / 100' because floating point arithmetic
# will lose precision
thresholds[key] = float('0.' + val[:-1].replace('.', '', 1))
elif '.' in val:
thresholds[key] = float(val)
else:
thresholds[key] = int(val)
except ValueError:
raise ValueError("Network status document's 'flag-thresholds' line is expected to have float values, got: flag-thresholds %s" % value)
descriptor.flag_thresholds = thresholds
def _parse_header_parameters_line(descriptor, entries):
# "params" [Parameters]
# Parameter ::= Keyword '=' Int32
# Int32 ::= A decimal integer between -2147483648 and 2147483647.
# Parameters ::= Parameter | Parameters SP Parameter
if descriptor._lazy_loading:
descriptor.params = dict(DEFAULT_PARAMS) if descriptor._default_params else {}
value = _value('params', entries)
if value != '':
descriptor.params = _parse_int_mappings('params', value, True)
descriptor._check_params_constraints()
def _parse_directory_footer_line(descriptor, entries):
# nothing to parse, simply checking that we don't have a value
value = _value('directory-footer', entries)
if value:
raise ValueError("A network status document's 'directory-footer' line shouldn't have any content, got 'directory-footer %s'" % value)
def _parse_footer_directory_signature_line(descriptor, entries):
signatures = []
for sig_value, block_type, block_contents in entries['directory-signature']:
if sig_value.count(' ') not in (1, 2):
raise ValueError("Authority signatures in a network status document are expected to be of the form 'directory-signature [METHOD] FINGERPRINT KEY_DIGEST', received: %s" % sig_value)
if not block_contents or block_type != 'SIGNATURE':
raise ValueError("'directory-signature' should be followed by a SIGNATURE block, but was a %s" % block_type)
if sig_value.count(' ') == 1:
method = 'sha1' # default if none was provided
fingerprint, key_digest = sig_value.split(' ', 1)
else:
method, fingerprint, key_digest = sig_value.split(' ', 2)
signatures.append(DocumentSignature(method, fingerprint, key_digest, block_contents, validate = True))
descriptor.signatures = signatures
def _parse_package_line(descriptor, entries):
package_versions = []
for value, _, _ in entries['package']:
value_comp = value.split(' ', 3)
if len(value_comp) < 3:
raise ValueError("'package' must at least have a 'PackageName Version URL': %s" % value)
name, version, url = value_comp[:3]
digests = {}
if len(value_comp) == 4:
for key, val in _mappings_for('package', value_comp[3]):
digests[key] = val
package_versions.append(PackageVersion(name, version, url, digests))
descriptor.packages = package_versions
def _parsed_shared_rand_commit(descriptor, entries):
# "shared-rand-commit" Version AlgName Identity Commit [Reveal]
commitments = []
for value, _, _ in entries['shared-rand-commit']:
value_comp = value.split()
if len(value_comp) < 4:
raise ValueError("'shared-rand-commit' must at least have a 'Version AlgName Identity Commit': %s" % value)
version, algorithm, identity, commit = value_comp[:4]
reveal = value_comp[4] if len(value_comp) >= 5 else None
if not version.isdigit():
raise ValueError("The version on our 'shared-rand-commit' line wasn't an integer: %s" % value)
commitments.append(SharedRandomnessCommitment(int(version), algorithm, identity, commit, reveal))
descriptor.shared_randomness_commitments = commitments
def _parse_shared_rand_previous_value(descriptor, entries):
# "shared-rand-previous-value" NumReveals Value
value = _value('shared-rand-previous-value', entries)
value_comp = value.split(' ')
if len(value_comp) == 2 and value_comp[0].isdigit():
descriptor.shared_randomness_previous_reveal_count = int(value_comp[0])
descriptor.shared_randomness_previous_value = value_comp[1]
else:
raise ValueError("A network status document's 'shared-rand-previous-value' line must be a pair of values, the first an integer but was '%s'" % value)
def _parse_shared_rand_current_value(descriptor, entries):
# "shared-rand-current-value" NumReveals Value
value = _value('shared-rand-current-value', entries)
value_comp = value.split(' ')
if len(value_comp) == 2 and value_comp[0].isdigit():
descriptor.shared_randomness_current_reveal_count = int(value_comp[0])
descriptor.shared_randomness_current_value = value_comp[1]
else:
raise ValueError("A network status document's 'shared-rand-current-value' line must be a pair of values, the first an integer but was '%s'" % value)
def _parse_bandwidth_file_headers(descriptor, entries):
# "bandwidth-file-headers" KeyValues
# KeyValues ::= "" | KeyValue | KeyValues SP KeyValue
# KeyValue ::= Keyword '=' Value
# Value ::= ArgumentChar+
value = _value('bandwidth-file-headers', entries)
results = {}
for key, val in _mappings_for('bandwidth-file-headers', value):
results[key] = val
descriptor.bandwidth_file_headers = results
def _parse_bandwidth_file_digest(descriptor, entries):
# "bandwidth-file-digest" 1*(SP algorithm "=" digest)
value = _value('bandwidth-file-digest', entries)
results = {}
for key, val in _mappings_for('bandwidth-file-digest', value):
results[key] = val
descriptor.bandwidth_file_digest = results
_parse_header_valid_after_line = _parse_timestamp_line('valid-after', 'valid_after')
_parse_header_fresh_until_line = _parse_timestamp_line('fresh-until', 'fresh_until')
_parse_header_valid_until_line = _parse_timestamp_line('valid-until', 'valid_until')
_parse_header_client_versions_line = _parse_versions_line('client-versions', 'client_versions')
_parse_header_server_versions_line = _parse_versions_line('server-versions', 'server_versions')
_parse_header_known_flags_line = _parse_simple_line('known-flags', 'known_flags', func = lambda v: [entry for entry in v.split(' ') if entry])
_parse_footer_bandwidth_weights_line = _parse_simple_line('bandwidth-weights', 'bandwidth_weights', func = lambda v: _parse_int_mappings('bandwidth-weights', v, True))
_parse_shared_rand_participate_line = _parse_if_present('shared-rand-participate', 'is_shared_randomness_participate')
_parse_recommended_client_protocols_line = _parse_protocol_line('recommended-client-protocols', 'recommended_client_protocols')
_parse_recommended_relay_protocols_line = _parse_protocol_line('recommended-relay-protocols', 'recommended_relay_protocols')
_parse_required_client_protocols_line = _parse_protocol_line('required-client-protocols', 'required_client_protocols')
_parse_required_relay_protocols_line = _parse_protocol_line('required-relay-protocols', 'required_relay_protocols')
class NetworkStatusDocumentV3(NetworkStatusDocument):
"""
Version 3 network status document. This could be either a vote or consensus.
:var dict routers: fingerprint to :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3`
mapping for relays contained in the document
:var int version: **\\*** document version
:var str version_flavor: **\\*** flavor associated with the document (such as 'ns' or 'microdesc')
:var bool is_consensus: **\\*** **True** if the document is a consensus
:var bool is_vote: **\\*** **True** if the document is a vote
:var bool is_microdescriptor: **\\*** **True** if this is a microdescriptor
flavored document, **False** otherwise
:var datetime valid_after: **\\*** time when the consensus became valid
:var datetime fresh_until: **\\*** time when the next consensus should be produced
:var datetime valid_until: **\\*** time when this consensus becomes obsolete
:var int vote_delay: **\\*** number of seconds allowed for collecting votes
from all authorities
:var int dist_delay: **\\*** number of seconds allowed for collecting
signatures from all authorities
:var list client_versions: list of recommended client tor versions
:var list server_versions: list of recommended server tor versions
:var list packages: **\\*** list of :data:`~stem.descriptor.networkstatus.PackageVersion` entries
:var list known_flags: **\\*** list of :data:`~stem.Flag` for the router's flags
:var dict params: **\\*** dict of parameter(**str**) => value(**int**) mappings
:var list directory_authorities: **\\*** list of :class:`~stem.descriptor.networkstatus.DirectoryAuthority`
objects that have generated this document
:var list signatures: **\\*** :class:`~stem.descriptor.networkstatus.DocumentSignature`
of the authorities that have signed the document
**Consensus Attributes:**
:var int consensus_method: method version used to generate this consensus
:var dict bandwidth_weights: dict of weight(str) => value(int) mappings
:var int shared_randomness_current_reveal_count: number of commitments
used to generate the current shared random value
:var str shared_randomness_current_value: base64 encoded current shared
random value
:var int shared_randomness_previous_reveal_count: number of commitments
used to generate the last shared random value
:var str shared_randomness_previous_value: base64 encoded last shared random
value
**Vote Attributes:**
:var list consensus_methods: list of ints for the supported method versions
:var datetime published: time when the document was published
:var dict flag_thresholds: **\\*** mapping of internal performance thresholds used while making the vote, values are **ints** or **floats**
:var dict recommended_client_protocols: recommended protocols for clients
:var dict recommended_relay_protocols: recommended protocols for relays
:var dict required_client_protocols: required protocols for clients
:var dict required_relay_protocols: required protocols for relays
:var dict bandwidth_file_headers: headers from the bandwidth authority that
generated this vote
:var dict bandwidth_file_digest: hashes of the bandwidth authority file used
to generate this vote, this is a mapping of hash functions to their resulting
digest value
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as None if undefined
.. versionchanged:: 1.4.0
Added the packages attribute.
.. versionchanged:: 1.5.0
Added the is_shared_randomness_participate, shared_randomness_commitments,
shared_randomness_previous_reveal_count,
shared_randomness_previous_value,
shared_randomness_current_reveal_count, and
shared_randomness_current_value attributes.
.. versionchanged:: 1.6.0
Added the recommended_client_protocols, recommended_relay_protocols,
required_client_protocols, and required_relay_protocols attributes.
.. versionchanged:: 1.6.0
The is_shared_randomness_participate and shared_randomness_commitments
were misdocumented in the tor spec and as such never set. They're now an
attribute of votes in the **directory_authorities**.
.. versionchanged:: 1.7.0
The shared_randomness_current_reveal_count and
shared_randomness_previous_reveal_count attributes were undocumented and
not provided properly if retrieved before their shred_randomness_*_value
counterpart.
.. versionchanged:: 1.7.0
Added the bandwidth_file_headers attributbute.
.. versionchanged:: 1.8.0
Added the bandwidth_file_digest attributbute.
"""
ATTRIBUTES = {
'version': (None, _parse_header_network_status_version_line),
'version_flavor': ('ns', _parse_header_network_status_version_line),
'is_consensus': (True, _parse_header_vote_status_line),
'is_vote': (False, _parse_header_vote_status_line),
'is_microdescriptor': (False, _parse_header_network_status_version_line),
'consensus_methods': ([], _parse_header_consensus_methods_line),
'published': (None, _parse_published_line),
'consensus_method': (None, _parse_header_consensus_method_line),
'valid_after': (None, _parse_header_valid_after_line),
'fresh_until': (None, _parse_header_fresh_until_line),
'valid_until': (None, _parse_header_valid_until_line),
'vote_delay': (None, _parse_header_voting_delay_line),
'dist_delay': (None, _parse_header_voting_delay_line),
'client_versions': ([], _parse_header_client_versions_line),
'server_versions': ([], _parse_header_server_versions_line),
'packages': ([], _parse_package_line),
'known_flags': ([], _parse_header_known_flags_line),
'flag_thresholds': ({}, _parse_header_flag_thresholds_line),
'recommended_client_protocols': ({}, _parse_recommended_client_protocols_line),
'recommended_relay_protocols': ({}, _parse_recommended_relay_protocols_line),
'required_client_protocols': ({}, _parse_required_client_protocols_line),
'required_relay_protocols': ({}, _parse_required_relay_protocols_line),
'params': ({}, _parse_header_parameters_line),
'shared_randomness_previous_reveal_count': (None, _parse_shared_rand_previous_value),
'shared_randomness_previous_value': (None, _parse_shared_rand_previous_value),
'shared_randomness_current_reveal_count': (None, _parse_shared_rand_current_value),
'shared_randomness_current_value': (None, _parse_shared_rand_current_value),
'bandwidth_file_headers': ({}, _parse_bandwidth_file_headers),
'bandwidth_file_digest': ({}, _parse_bandwidth_file_digest),
'signatures': ([], _parse_footer_directory_signature_line),
'bandwidth_weights': ({}, _parse_footer_bandwidth_weights_line),
}
_HEADER_PARSER_FOR_LINE = {
'network-status-version': _parse_header_network_status_version_line,
'vote-status': _parse_header_vote_status_line,
'consensus-methods': _parse_header_consensus_methods_line,
'consensus-method': _parse_header_consensus_method_line,
'published': _parse_published_line,
'valid-after': _parse_header_valid_after_line,
'fresh-until': _parse_header_fresh_until_line,
'valid-until': _parse_header_valid_until_line,
'voting-delay': _parse_header_voting_delay_line,
'client-versions': _parse_header_client_versions_line,
'server-versions': _parse_header_server_versions_line,
'package': _parse_package_line,
'known-flags': _parse_header_known_flags_line,
'flag-thresholds': _parse_header_flag_thresholds_line,
'recommended-client-protocols': _parse_recommended_client_protocols_line,
'recommended-relay-protocols': _parse_recommended_relay_protocols_line,
'required-client-protocols': _parse_required_client_protocols_line,
'required-relay-protocols': _parse_required_relay_protocols_line,
'params': _parse_header_parameters_line,
'shared-rand-previous-value': _parse_shared_rand_previous_value,
'shared-rand-current-value': _parse_shared_rand_current_value,
'bandwidth-file-headers': _parse_bandwidth_file_headers,
'bandwidth-file-digest': _parse_bandwidth_file_digest,
}
_FOOTER_PARSER_FOR_LINE = {
'directory-footer': _parse_directory_footer_line,
'bandwidth-weights': _parse_footer_bandwidth_weights_line,
'directory-signature': _parse_footer_directory_signature_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False, authorities = None, routers = None):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
attr = {} if attr is None else dict(attr)
is_vote = attr.get('vote-status') == 'vote'
if is_vote:
extra_defaults = {'consensus-methods': '1 9', 'published': _random_date()}
else:
extra_defaults = {'consensus-method': '9'}
if is_vote and authorities is None:
authorities = [DirectoryAuthority.create(is_vote = is_vote)]
for k, v in extra_defaults.items():
if exclude and k in exclude:
continue # explicitly excluding this field
elif k not in attr:
attr[k] = v
desc_content = _descriptor_content(attr, exclude, (
('network-status-version', '3'),
('vote-status', 'consensus'),
('consensus-methods', None),
('consensus-method', None),
('published', None),
('valid-after', _random_date()),
('fresh-until', _random_date()),
('valid-until', _random_date()),
('voting-delay', '300 300'),
('client-versions', None),
('server-versions', None),
('package', None),
('known-flags', 'Authority BadExit Exit Fast Guard HSDir Named Running Stable Unnamed V2Dir Valid'),
('params', None),
), (
('directory-footer', ''),
('bandwidth-weights', None),
('directory-signature', '%s %s%s' % (_random_fingerprint(), _random_fingerprint(), _random_crypto_blob('SIGNATURE'))),
))
# inject the authorities and/or routers between the header and footer
if authorities:
if b'directory-footer' in desc_content:
footer_div = desc_content.find(b'\ndirectory-footer') + 1
elif b'directory-signature' in desc_content:
footer_div = desc_content.find(b'\ndirectory-signature') + 1
else:
if routers:
desc_content += b'\n'
footer_div = len(desc_content) + 1
authority_content = stem.util.str_tools._to_bytes('\n'.join([str(a) for a in authorities]) + '\n')
desc_content = desc_content[:footer_div] + authority_content + desc_content[footer_div:]
if routers:
if b'directory-footer' in desc_content:
footer_div = desc_content.find(b'\ndirectory-footer') + 1
elif b'directory-signature' in desc_content:
footer_div = desc_content.find(b'\ndirectory-signature') + 1
else:
if routers:
desc_content += b'\n'
footer_div = len(desc_content) + 1
router_content = stem.util.str_tools._to_bytes('\n'.join([str(r) for r in routers]) + '\n')
desc_content = desc_content[:footer_div] + router_content + desc_content[footer_div:]
return desc_content
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, authorities = None, routers = None):
return cls(cls.content(attr, exclude, sign, authorities, routers), validate = validate)
def __init__(self, raw_content, validate = False, default_params = True):
"""
Parse a v3 network status document.
:param str raw_content: raw network status document data
:param bool validate: **True** if the document is to be validated, **False** otherwise
:param bool default_params: includes defaults in our params dict, otherwise
it just contains values from the document
:raises: **ValueError** if the document is invalid
"""
super(NetworkStatusDocumentV3, self).__init__(raw_content, lazy_load = not validate)
document_file = io.BytesIO(raw_content)
# TODO: Tor misdocumented these as being in the header rather than the
# authority section. As such these have never been set but we need the
# attributes for stem 1.5 compatability. Drop these in 2.0.
self.is_shared_randomness_participate = False
self.shared_randomness_commitments = []
self._default_params = default_params
self._header(document_file, validate)
self.directory_authorities = tuple(stem.descriptor.router_status_entry._parse_file(
document_file,
validate,
entry_class = DirectoryAuthority,
entry_keyword = AUTH_START,
section_end_keywords = (ROUTERS_START, FOOTER_START, V2_FOOTER_START),
extra_args = (self.is_vote,),
))
if validate and self.is_vote and len(self.directory_authorities) != 1:
raise ValueError('Votes should only have an authority entry for the one that issued it, got %i: %s' % (len(self.directory_authorities), self.directory_authorities))
router_iter = stem.descriptor.router_status_entry._parse_file(
document_file,
validate,
entry_class = RouterStatusEntryMicroV3 if self.is_microdescriptor else RouterStatusEntryV3,
entry_keyword = ROUTERS_START,
section_end_keywords = (FOOTER_START, V2_FOOTER_START),
extra_args = (self,),
)
self.routers = dict((desc.fingerprint, desc) for desc in router_iter)
self._footer(document_file, validate)
def type_annotation(self):
if isinstance(self, BridgeNetworkStatusDocument):
return TypeAnnotation('bridge-network-status', 1, 0)
elif not self.is_microdescriptor:
return TypeAnnotation('network-status-consensus-3' if not self.is_vote else 'network-status-vote-3', 1, 0)
else:
# Directory authorities do not issue a 'microdescriptor consensus' vote,
# so unlike the above there isn't a 'network-status-microdesc-vote-3'
# counterpart here.
return TypeAnnotation('network-status-microdesc-consensus-3', 1, 0)
def is_valid(self):
"""
Checks if the current time is between this document's **valid_after** and
**valid_until** timestamps. To be valid means the information within this
document reflects the current network state.
.. versionadded:: 1.8.0
:returns: **True** if this consensus is presently valid and **False**
otherwise
"""
return self.valid_after < datetime.datetime.utcnow() < self.valid_until
def is_fresh(self):
"""
Checks if the current time is between this document's **valid_after** and
**fresh_until** timestamps. To be fresh means this should be the latest
consensus.
.. versionadded:: 1.8.0
:returns: **True** if this consensus is presently fresh and **False**
otherwise
"""
return self.valid_after < datetime.datetime.utcnow() < self.fresh_until
def validate_signatures(self, key_certs):
"""
Validates we're properly signed by the signing certificates.
.. versionadded:: 1.6.0
:param list key_certs: :class:`~stem.descriptor.networkstatus.KeyCertificates`
to validate the consensus against
:raises: **ValueError** if an insufficient number of valid signatures are present.
"""
# sha1 hash of the body and header
digest_content = self._content_range('network-status-version', 'directory-signature ')
local_digest = hashlib.sha1(digest_content).hexdigest().upper()
valid_digests, total_digests = 0, 0
required_digests = len(self.signatures) / 2.0
signing_keys = dict([(cert.fingerprint, cert.signing_key) for cert in key_certs])
for sig in self.signatures:
if sig.identity not in signing_keys:
continue
signed_digest = self._digest_for_signature(signing_keys[sig.identity], sig.signature)
total_digests += 1
if signed_digest == local_digest:
valid_digests += 1
if valid_digests < required_digests:
raise ValueError('Network Status Document has %i valid signatures out of %i total, needed %i' % (valid_digests, total_digests, required_digests))
def get_unrecognized_lines(self):
if self._lazy_loading:
self._parse(self._header_entries, False, parser_for_line = self._HEADER_PARSER_FOR_LINE)
self._parse(self._footer_entries, False, parser_for_line = self._FOOTER_PARSER_FOR_LINE)
self._lazy_loading = False
return super(NetworkStatusDocumentV3, self).get_unrecognized_lines()
def meets_consensus_method(self, method):
"""
Checks if we meet the given consensus-method. This works for both votes and
consensuses, checking our 'consensus-method' and 'consensus-methods'
entries.
:param int method: consensus-method to check for
:returns: **True** if we meet the given consensus-method, and **False** otherwise
"""
if self.consensus_method is not None:
return self.consensus_method >= method
elif self.consensus_methods is not None:
return bool([x for x in self.consensus_methods if x >= method])
else:
return False # malformed document
def _header(self, document_file, validate):
content = bytes.join(b'', _read_until_keywords((AUTH_START, ROUTERS_START, FOOTER_START), document_file))
entries = _descriptor_components(content, validate)
header_fields = [attr[0] for attr in HEADER_STATUS_DOCUMENT_FIELDS]
if validate:
# all known header fields can only appear once except
for keyword, values in list(entries.items()):
if len(values) > 1 and keyword in header_fields and keyword != 'package' and keyword != 'shared-rand-commit':
raise ValueError("Network status documents can only have a single '%s' line, got %i" % (keyword, len(values)))
if self._default_params:
self.params = dict(DEFAULT_PARAMS)
self._parse(entries, validate, parser_for_line = self._HEADER_PARSER_FOR_LINE)
# should only appear in consensus-method 7 or later
if not self.meets_consensus_method(7) and 'params' in list(entries.keys()):
raise ValueError("A network status document's 'params' line should only appear in consensus-method 7 or later")
_check_for_missing_and_disallowed_fields(self, entries, HEADER_STATUS_DOCUMENT_FIELDS)
# default consensus_method and consensus_methods based on if we're a consensus or vote
if self.is_consensus and not self.consensus_method:
self.consensus_method = 1
elif self.is_vote and not self.consensus_methods:
self.consensus_methods = [1]
else:
self._header_entries = entries
self._entries.update(entries)
def _footer(self, document_file, validate):
entries = _descriptor_components(document_file.read(), validate)
footer_fields = [attr[0] for attr in FOOTER_STATUS_DOCUMENT_FIELDS]
if validate:
for keyword, values in list(entries.items()):
# all known footer fields can only appear once except...
# * 'directory-signature' in a consensus
if len(values) > 1 and keyword in footer_fields:
if not (keyword == 'directory-signature' and self.is_consensus):
raise ValueError("Network status documents can only have a single '%s' line, got %i" % (keyword, len(values)))
self._parse(entries, validate, parser_for_line = self._FOOTER_PARSER_FOR_LINE)
# Check that the footer has the right initial line. Prior to consensus
# method 9 it's a 'directory-signature' and after that footers start with
# 'directory-footer'.
if entries:
if self.meets_consensus_method(9):
if list(entries.keys())[0] != 'directory-footer':
raise ValueError("Network status document's footer should start with a 'directory-footer' line in consensus-method 9 or later")
else:
if list(entries.keys())[0] != 'directory-signature':
raise ValueError("Network status document's footer should start with a 'directory-signature' line prior to consensus-method 9")
_check_for_missing_and_disallowed_fields(self, entries, FOOTER_STATUS_DOCUMENT_FIELDS)
else:
self._footer_entries = entries
self._entries.update(entries)
def _check_params_constraints(self):
"""
Checks that the params we know about are within their documented ranges.
"""
for key, value in self.params.items():
minimum, maximum = PARAM_RANGE.get(key, (MIN_PARAM, MAX_PARAM))
# there's a few dynamic parameter ranges
if key == 'cbtclosequantile':
minimum = self.params.get('cbtquantile', minimum)
elif key == 'cbtinitialtimeout':
minimum = self.params.get('cbtmintimeout', minimum)
if value < minimum or value > maximum:
raise ValueError("'%s' value on the params line must be in the range of %i - %i, was %i" % (key, minimum, maximum, value))
def _check_for_missing_and_disallowed_fields(document, entries, fields):
"""
Checks that we have mandatory fields for our type, and that we don't have
any fields exclusive to the other (ie, no vote-only fields appear in a
consensus or vice versa).
:param NetworkStatusDocumentV3 document: network status document
:param dict entries: ordered keyword/value mappings of the header or footer
:param list fields: expected field attributes (either
**HEADER_STATUS_DOCUMENT_FIELDS** or **FOOTER_STATUS_DOCUMENT_FIELDS**)
:raises: **ValueError** if we're missing mandatory fields or have fields we shouldn't
"""
missing_fields, disallowed_fields = [], []
for field, in_votes, in_consensus, mandatory in fields:
if mandatory and ((document.is_consensus and in_consensus) or (document.is_vote and in_votes)):
# mandatory field, check that we have it
if field not in entries.keys():
missing_fields.append(field)
elif (document.is_consensus and not in_consensus) or (document.is_vote and not in_votes):
# field we shouldn't have, check that we don't
if field in entries.keys():
disallowed_fields.append(field)
if missing_fields:
raise ValueError('Network status document is missing mandatory field: %s' % ', '.join(missing_fields))
if disallowed_fields:
raise ValueError("Network status document has fields that shouldn't appear in this document type or version: %s" % ', '.join(disallowed_fields))
def _parse_int_mappings(keyword, value, validate):
# Parse a series of 'key=value' entries, checking the following:
# - values are integers
# - keys are sorted in lexical order
results, seen_keys = {}, []
error_template = "Unable to parse network status document's '%s' line (%%s): %s'" % (keyword, value)
for key, val in _mappings_for(keyword, value):
if validate:
# parameters should be in ascending order by their key
for prior_key in seen_keys:
if prior_key > key:
raise ValueError(error_template % 'parameters must be sorted by their key')
try:
# the int() function accepts things like '+123', but we don't want to
if val.startswith('+'):
raise ValueError()
results[key] = int(val)
except ValueError:
raise ValueError(error_template % ("'%s' is a non-numeric value" % val))
seen_keys.append(key)
return results
def _parse_dirauth_source_line(descriptor, entries):
# "dir-source" nickname identity address IP dirport orport
value = _value('dir-source', entries)
dir_source_comp = value.split(' ')
if len(dir_source_comp) < 6:
raise ValueError("Authority entry's 'dir-source' line must have six values: dir-source %s" % value)
if not stem.util.tor_tools.is_valid_nickname(dir_source_comp[0].rstrip('-legacy')):
raise ValueError("Authority's nickname is invalid: %s" % dir_source_comp[0])
elif not stem.util.tor_tools.is_valid_fingerprint(dir_source_comp[1]):
raise ValueError("Authority's v3ident is invalid: %s" % dir_source_comp[1])
elif not dir_source_comp[2]:
# https://trac.torproject.org/7055
raise ValueError("Authority's hostname can't be blank: dir-source %s" % value)
elif not stem.util.connection.is_valid_ipv4_address(dir_source_comp[3]):
raise ValueError("Authority's address isn't a valid IPv4 address: %s" % dir_source_comp[3])
elif not stem.util.connection.is_valid_port(dir_source_comp[4], allow_zero = True):
raise ValueError("Authority's DirPort is invalid: %s" % dir_source_comp[4])
elif not stem.util.connection.is_valid_port(dir_source_comp[5]):
raise ValueError("Authority's ORPort is invalid: %s" % dir_source_comp[5])
descriptor.nickname = dir_source_comp[0]
descriptor.v3ident = dir_source_comp[1]
descriptor.hostname = dir_source_comp[2]
descriptor.address = dir_source_comp[3]
descriptor.dir_port = None if dir_source_comp[4] == '0' else int(dir_source_comp[4])
descriptor.or_port = int(dir_source_comp[5])
descriptor.is_legacy = descriptor.nickname.endswith('-legacy')
_parse_legacy_dir_key_line = _parse_forty_character_hex('legacy-dir-key', 'legacy_dir_key')
_parse_vote_digest_line = _parse_forty_character_hex('vote-digest', 'vote_digest')
class DirectoryAuthority(Descriptor):
"""
Directory authority information obtained from a v3 network status document.
Authorities can optionally use a legacy format. These are no longer found in
practice, but have the following differences...
* The authority's nickname ends with '-legacy'.
* There's no **contact** or **vote_digest** attribute.
:var str nickname: **\\*** authority's nickname
:var str v3ident: **\\*** identity key fingerprint used to sign votes and consensus
:var str hostname: **\\*** hostname of the authority
:var str address: **\\*** authority's IP address
:var int dir_port: **\\*** authority's DirPort
:var int or_port: **\\*** authority's ORPort
:var bool is_legacy: **\\*** if the authority's using the legacy format
:var str contact: contact information, this is included if is_legacy is **False**
**Consensus Attributes:**
:var str vote_digest: digest of the authority that contributed to the consensus, this is included if is_legacy is **False**
**Vote Attributes:**
:var str legacy_dir_key: fingerprint of and obsolete identity key
:var stem.descriptor.networkstatus.KeyCertificate key_certificate: **\\***
authority's key certificate
:var bool is_shared_randomness_participate: **\\*** **True** if this authority
participates in establishing a shared random value, **False** otherwise
:var list shared_randomness_commitments: **\\*** list of
:data:`~stem.descriptor.networkstatus.SharedRandomnessCommitment` entries
:var int shared_randomness_previous_reveal_count: number of commitments
used to generate the last shared random value
:var str shared_randomness_previous_value: base64 encoded last shared random
value
:var int shared_randomness_current_reveal_count: number of commitments
used to generate the current shared random value
:var str shared_randomness_current_value: base64 encoded current shared
random value
**\\*** mandatory attribute
.. versionchanged:: 1.4.0
Renamed our 'fingerprint' attribute to 'v3ident' (prior attribute exists
for backward compatability, but is deprecated).
.. versionchanged:: 1.6.0
Added the is_shared_randomness_participate, shared_randomness_commitments,
shared_randomness_previous_reveal_count,
shared_randomness_previous_value,
shared_randomness_current_reveal_count, and
shared_randomness_current_value attributes.
"""
ATTRIBUTES = {
'nickname': (None, _parse_dirauth_source_line),
'v3ident': (None, _parse_dirauth_source_line),
'hostname': (None, _parse_dirauth_source_line),
'address': (None, _parse_dirauth_source_line),
'dir_port': (None, _parse_dirauth_source_line),
'or_port': (None, _parse_dirauth_source_line),
'is_legacy': (False, _parse_dirauth_source_line),
'contact': (None, _parse_contact_line),
'vote_digest': (None, _parse_vote_digest_line),
'legacy_dir_key': (None, _parse_legacy_dir_key_line),
'is_shared_randomness_participate': (False, _parse_shared_rand_participate_line),
'shared_randomness_commitments': ([], _parsed_shared_rand_commit),
'shared_randomness_previous_reveal_count': (None, _parse_shared_rand_previous_value),
'shared_randomness_previous_value': (None, _parse_shared_rand_previous_value),
'shared_randomness_current_reveal_count': (None, _parse_shared_rand_current_value),
'shared_randomness_current_value': (None, _parse_shared_rand_current_value),
}
PARSER_FOR_LINE = {
'dir-source': _parse_dirauth_source_line,
'contact': _parse_contact_line,
'legacy-dir-key': _parse_legacy_dir_key_line,
'vote-digest': _parse_vote_digest_line,
'shared-rand-participate': _parse_shared_rand_participate_line,
'shared-rand-commit': _parsed_shared_rand_commit,
'shared-rand-previous-value': _parse_shared_rand_previous_value,
'shared-rand-current-value': _parse_shared_rand_current_value,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False, is_vote = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
attr = {} if attr is None else dict(attr)
# include mandatory 'vote-digest' if a consensus
if not is_vote and not ('vote-digest' in attr or (exclude and 'vote-digest' in exclude)):
attr['vote-digest'] = _random_fingerprint()
content = _descriptor_content(attr, exclude, (
('dir-source', '%s %s no.place.com %s 9030 9090' % (_random_nickname(), _random_fingerprint(), _random_ipv4_address())),
('contact', 'Mike Perry '),
))
if is_vote:
content += b'\n' + KeyCertificate.content()
return content
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, is_vote = False):
return cls(cls.content(attr, exclude, sign, is_vote), validate = validate, is_vote = is_vote)
def __init__(self, raw_content, validate = False, is_vote = False):
"""
Parse a directory authority entry in a v3 network status document.
:param str raw_content: raw directory authority entry information
:param bool validate: checks the validity of the content if True, skips
these checks otherwise
:param bool is_vote: True if this is for a vote, False if it's for a consensus
:raises: ValueError if the descriptor data is invalid
"""
super(DirectoryAuthority, self).__init__(raw_content, lazy_load = not validate)
content = stem.util.str_tools._to_unicode(raw_content)
# separate the directory authority entry from its key certificate
key_div = content.find('\ndir-key-certificate-version')
if key_div != -1:
self.key_certificate = KeyCertificate(content[key_div + 1:], validate)
content = content[:key_div + 1]
else:
self.key_certificate = None
entries = _descriptor_components(content, validate)
if validate and 'dir-source' != list(entries.keys())[0]:
raise ValueError("Authority entries are expected to start with a 'dir-source' line:\n%s" % (content))
# check that we have mandatory fields
if validate:
is_legacy, dir_source_entry = False, entries.get('dir-source')
if dir_source_entry:
is_legacy = dir_source_entry[0][0].split()[0].endswith('-legacy')
required_fields, excluded_fields = ['dir-source'], []
if not is_legacy:
required_fields += ['contact']
if is_vote:
if not self.key_certificate:
raise ValueError('Authority votes must have a key certificate:\n%s' % content)
excluded_fields += ['vote-digest']
elif not is_vote:
if self.key_certificate:
raise ValueError("Authority consensus entries shouldn't have a key certificate:\n%s" % content)
if not is_legacy:
required_fields += ['vote-digest']
excluded_fields += ['legacy-dir-key']
for keyword in required_fields:
if keyword not in entries:
raise ValueError("Authority entries must have a '%s' line:\n%s" % (keyword, content))
for keyword in entries:
if keyword in excluded_fields:
type_label = 'votes' if is_vote else 'consensus entries'
raise ValueError("Authority %s shouldn't have a '%s' line:\n%s" % (type_label, keyword, content))
# all known attributes can only appear at most once
for keyword, values in list(entries.items()):
if len(values) > 1 and keyword in ('dir-source', 'contact', 'legacy-dir-key', 'vote-digest'):
raise ValueError("Authority entries can only have a single '%s' line, got %i:\n%s" % (keyword, len(values), content))
self._parse(entries, validate)
else:
self._entries = entries
# TODO: Due to a bug we had a 'fingerprint' rather than 'v3ident' attribute
# for a long while. Keeping this around for backward compatability, but
# this will be dropped in stem's 2.0 release.
self.fingerprint = self.v3ident
def _parse_dir_address_line(descriptor, entries):
# "dir-address" IPPort
value = _value('dir-address', entries)
if ':' not in value:
raise ValueError("Key certificate's 'dir-address' is expected to be of the form ADDRESS:PORT: dir-address %s" % value)
address, dirport = value.rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError("Key certificate's address isn't a valid IPv4 address: dir-address %s" % value)
elif not stem.util.connection.is_valid_port(dirport):
raise ValueError("Key certificate's dirport is invalid: dir-address %s" % value)
descriptor.address = address
descriptor.dir_port = int(dirport)
_parse_dir_key_certificate_version_line = _parse_version_line('dir-key-certificate-version', 'version', 3)
_parse_dir_key_published_line = _parse_timestamp_line('dir-key-published', 'published')
_parse_dir_key_expires_line = _parse_timestamp_line('dir-key-expires', 'expires')
_parse_identity_key_line = _parse_key_block('dir-identity-key', 'identity_key', 'RSA PUBLIC KEY')
_parse_signing_key_line = _parse_key_block('dir-signing-key', 'signing_key', 'RSA PUBLIC KEY')
_parse_dir_key_crosscert_line = _parse_key_block('dir-key-crosscert', 'crosscert', 'ID SIGNATURE')
_parse_dir_key_certification_line = _parse_key_block('dir-key-certification', 'certification', 'SIGNATURE')
class KeyCertificate(Descriptor):
"""
Directory key certificate for a v3 network status document.
:var int version: **\\*** version of the key certificate
:var str address: authority's IP address
:var int dir_port: authority's DirPort
:var str fingerprint: **\\*** authority's fingerprint
:var str identity_key: **\\*** long term authority identity key
:var datetime published: **\\*** time when this key was generated
:var datetime expires: **\\*** time after which this key becomes invalid
:var str signing_key: **\\*** directory server's public signing key
:var str crosscert: signature made using certificate's signing key
:var str certification: **\\*** signature of this key certificate signed with
the identity key
**\\*** mandatory attribute
"""
TYPE_ANNOTATION_NAME = 'dir-key-certificate-3'
ATTRIBUTES = {
'version': (None, _parse_dir_key_certificate_version_line),
'address': (None, _parse_dir_address_line),
'dir_port': (None, _parse_dir_address_line),
'fingerprint': (None, _parse_fingerprint_line),
'identity_key': (None, _parse_identity_key_line),
'published': (None, _parse_dir_key_published_line),
'expires': (None, _parse_dir_key_expires_line),
'signing_key': (None, _parse_signing_key_line),
'crosscert': (None, _parse_dir_key_crosscert_line),
'certification': (None, _parse_dir_key_certification_line),
}
PARSER_FOR_LINE = {
'dir-key-certificate-version': _parse_dir_key_certificate_version_line,
'dir-address': _parse_dir_address_line,
'fingerprint': _parse_fingerprint_line,
'dir-key-published': _parse_dir_key_published_line,
'dir-key-expires': _parse_dir_key_expires_line,
'dir-identity-key': _parse_identity_key_line,
'dir-signing-key': _parse_signing_key_line,
'dir-key-crosscert': _parse_dir_key_crosscert_line,
'dir-key-certification': _parse_dir_key_certification_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('dir-key-certificate-version', '3'),
('fingerprint', _random_fingerprint()),
('dir-key-published', _random_date()),
('dir-key-expires', _random_date()),
('dir-identity-key', _random_crypto_blob('RSA PUBLIC KEY')),
('dir-signing-key', _random_crypto_blob('RSA PUBLIC KEY')),
), (
('dir-key-certification', _random_crypto_blob('SIGNATURE')),
))
def __init__(self, raw_content, validate = False):
super(KeyCertificate, self).__init__(raw_content, lazy_load = not validate)
entries = _descriptor_components(raw_content, validate)
if validate:
if 'dir-key-certificate-version' != list(entries.keys())[0]:
raise ValueError("Key certificates must start with a 'dir-key-certificate-version' line:\n%s" % (raw_content))
elif 'dir-key-certification' != list(entries.keys())[-1]:
raise ValueError("Key certificates must end with a 'dir-key-certification' line:\n%s" % (raw_content))
# check that we have mandatory fields and that our known fields only
# appear once
for keyword, is_mandatory in KEY_CERTIFICATE_PARAMS:
if is_mandatory and keyword not in entries:
raise ValueError("Key certificates must have a '%s' line:\n%s" % (keyword, raw_content))
entry_count = len(entries.get(keyword, []))
if entry_count > 1:
raise ValueError("Key certificates can only have a single '%s' line, got %i:\n%s" % (keyword, entry_count, raw_content))
self._parse(entries, validate)
else:
self._entries = entries
class DocumentSignature(object):
"""
Directory signature of a v3 network status document.
:var str method: algorithm used to make the signature
:var str identity: fingerprint of the authority that made the signature
:var str key_digest: digest of the signing key
:var str signature: document signature
:var str flavor: consensus type this signature is for (such as 'microdesc'),
**None** if for the standard consensus
:param bool validate: checks validity if **True**
:raises: **ValueError** if a validity check fails
"""
def __init__(self, method, identity, key_digest, signature, flavor = None, validate = False):
# Checking that these attributes are valid. Technically the key
# digest isn't a fingerprint, but it has the same characteristics.
if validate:
if not stem.util.tor_tools.is_valid_fingerprint(identity):
raise ValueError('Malformed fingerprint (%s) in the document signature' % identity)
if not stem.util.tor_tools.is_valid_fingerprint(key_digest):
raise ValueError('Malformed key digest (%s) in the document signature' % key_digest)
self.method = method
self.identity = identity
self.key_digest = key_digest
self.signature = signature
self.flavor = flavor
def _compare(self, other, method):
if not isinstance(other, DocumentSignature):
return False
for attr in ('method', 'identity', 'key_digest', 'signature', 'flavor'):
if getattr(self, attr) != getattr(other, attr):
return method(getattr(self, attr), getattr(other, attr))
return method(True, True) # we're equal
def __hash__(self):
return hash(str(self).strip())
def __eq__(self, other):
return self._compare(other, lambda s, o: s == o)
def __ne__(self, other):
return not self == other
def __lt__(self, other):
return self._compare(other, lambda s, o: s < o)
def __le__(self, other):
return self._compare(other, lambda s, o: s <= o)
class DetachedSignature(Descriptor):
"""
Stand alone signature of the consensus. These are exchanged between directory
authorities when determining the next hour's consensus.
Detached signatures are defined in section 3.10 of the dir-spec, and only
available to be downloaded for five minutes between minute 55 until the end
of the hour.
.. versionadded:: 1.8.0
:var str consensus_digest: **\\*** digest of the consensus being signed
:var datetime valid_after: **\\*** time when the consensus became valid
:var datetime fresh_until: **\\*** time when the next consensus should be produced
:var datetime valid_until: **\\*** time when this consensus becomes obsolete
:var list additional_digests: **\\***
:class:`~stem.descriptor.networkstatus.DocumentDigest` for additional
consensus flavors
:var list additional_signatures: **\\***
:class:`~stem.descriptor.networkstatus.DocumentSignature` for additional
consensus flavors
:var list signatures: **\\*** :class:`~stem.descriptor.networkstatus.DocumentSignature`
of the authorities that have signed the document
**\\*** mandatory attribute
"""
TYPE_ANNOTATION_NAME = 'detached-signature-3'
ATTRIBUTES = {
'consensus_digest': (None, _parse_consensus_digest_line),
'valid_after': (None, _parse_header_valid_after_line),
'fresh_until': (None, _parse_header_fresh_until_line),
'valid_until': (None, _parse_header_valid_until_line),
'additional_digests': ([], _parse_additional_digests),
'additional_signatures': ([], _parse_additional_signatures),
'signatures': ([], _parse_footer_directory_signature_line),
}
PARSER_FOR_LINE = {
'consensus-digest': _parse_consensus_digest_line,
'valid-after': _parse_header_valid_after_line,
'fresh-until': _parse_header_fresh_until_line,
'valid-until': _parse_header_valid_until_line,
'additional-digest': _parse_additional_digests,
'additional-signature': _parse_additional_signatures,
'directory-signature': _parse_footer_directory_signature_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('consensus-digest', '6D3CC0EFA408F228410A4A8145E1B0BB0670E442'),
('valid-after', _random_date()),
('fresh-until', _random_date()),
('valid-until', _random_date()),
))
def __init__(self, raw_content, validate = False):
super(DetachedSignature, self).__init__(raw_content, lazy_load = not validate)
entries = _descriptor_components(raw_content, validate)
if validate:
if 'consensus-digest' != list(entries.keys())[0]:
raise ValueError("Detached signatures must start with a 'consensus-digest' line:\n%s" % (raw_content))
# check that we have mandatory fields and certain fields only appear once
for keyword, is_mandatory, is_multiple in DETACHED_SIGNATURE_PARAMS:
if is_mandatory and keyword not in entries:
raise ValueError("Detached signatures must have a '%s' line:\n%s" % (keyword, raw_content))
entry_count = len(entries.get(keyword, []))
if not is_multiple and entry_count > 1:
raise ValueError("Detached signatures can only have a single '%s' line, got %i:\n%s" % (keyword, entry_count, raw_content))
self._parse(entries, validate)
else:
self._entries = entries
class BridgeNetworkStatusDocument(NetworkStatusDocument):
"""
Network status document containing bridges. This is only available through
the metrics site.
:var dict routers: fingerprint to :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3`
mapping for relays contained in the document
:var datetime published: time when the document was published
"""
TYPE_ANNOTATION_NAME = 'bridge-network-status'
def __init__(self, raw_content, validate = False):
super(BridgeNetworkStatusDocument, self).__init__(raw_content)
self.published = None
document_file = io.BytesIO(raw_content)
published_line = stem.util.str_tools._to_unicode(document_file.readline())
if published_line.startswith('published '):
published_line = published_line.split(' ', 1)[1].strip()
try:
self.published = stem.util.str_tools._parse_timestamp(published_line)
except ValueError:
if validate:
raise ValueError("Bridge network status document's 'published' time wasn't parsable: %s" % published_line)
elif validate:
raise ValueError("Bridge network status documents must start with a 'published' line:\n%s" % stem.util.str_tools._to_unicode(raw_content))
router_iter = stem.descriptor.router_status_entry._parse_file(
document_file,
validate,
entry_class = RouterStatusEntryV2,
extra_args = (self,),
)
self.routers = dict((desc.fingerprint, desc) for desc in router_iter)
stem-1.8.0/stem/descriptor/extrainfo_descriptor.py 0000664 0001750 0001750 00000127033 13530351613 023155 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Tor extra-info descriptors. These are published by relays whenever
their server descriptor is published and have a similar format. However, unlike
server descriptors these don't contain information that Tor clients require to
function and as such aren't fetched by default.
Defined in section 2.1.2 of the `dir-spec
`_,
extra-info descriptors contain interesting but non-vital information such as
usage statistics. Tor clients cannot request these documents for bridges.
Extra-info descriptors are available from a few sources...
* If you have 'DownloadExtraInfo 1' in your torrc...
* control port via 'GETINFO extra-info/digest/\\*' queries
* the 'cached-extrainfo' file in tor's data directory
* Archived descriptors provided by `CollecTor `_.
* Directory authorities and mirrors via their DirPort.
**Module Overview:**
::
ExtraInfoDescriptor - Tor extra-info descriptor.
|- RelayExtraInfoDescriptor - Extra-info descriptor for a relay.
|- BridgeExtraInfoDescriptor - Extra-info descriptor for a bridge.
|
+- digest - calculates the upper-case hex digest value for our content
.. data:: DirResponse (enum)
Enumeration for known statuses for ExtraInfoDescriptor's dir_*_responses.
=================== ===========
DirResponse Description
=================== ===========
**OK** network status requests that were answered
**NOT_ENOUGH_SIGS** network status wasn't signed by enough authorities
**UNAVAILABLE** requested network status was unavailable
**NOT_FOUND** requested network status was not found
**NOT_MODIFIED** network status unmodified since If-Modified-Since time
**BUSY** directory was busy
=================== ===========
.. data:: DirStat (enum)
Enumeration for known stats for ExtraInfoDescriptor's dir_*_direct_dl and
dir_*_tunneled_dl.
===================== ===========
DirStat Description
===================== ===========
**COMPLETE** requests that completed successfully
**TIMEOUT** requests that didn't complete within a ten minute timeout
**RUNNING** requests still in process when measurement's taken
**MIN** smallest rate at which a descriptor was downloaded in B/s
**MAX** largest rate at which a descriptor was downloaded in B/s
**D1-4** and **D6-9** rate of the slowest x/10 download rates in B/s
**Q1** and **Q3** rate of the slowest and fastest quarter download rates in B/s
**MD** median download rate in B/s
===================== ===========
"""
import functools
import hashlib
import re
import stem.prereq
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
from stem.descriptor import (
PGP_BLOCK_END,
Descriptor,
DigestHash,
DigestEncoding,
create_signing_key,
_descriptor_content,
_read_until_keywords,
_descriptor_components,
_value,
_values,
_parse_simple_line,
_parse_int_line,
_parse_timestamp_line,
_parse_forty_character_hex,
_parse_key_block,
_mappings_for,
_append_router_signature,
_random_nickname,
_random_fingerprint,
_random_date,
_random_crypto_blob,
)
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
# known statuses for dirreq-v2-resp and dirreq-v3-resp...
DirResponse = stem.util.enum.Enum(
('OK', 'ok'),
('NOT_ENOUGH_SIGS', 'not-enough-sigs'),
('UNAVAILABLE', 'unavailable'),
('NOT_FOUND', 'not-found'),
('NOT_MODIFIED', 'not-modified'),
('BUSY', 'busy'),
)
# known stats for dirreq-v2/3-direct-dl and dirreq-v2/3-tunneled-dl...
dir_stats = ['complete', 'timeout', 'running', 'min', 'max', 'q1', 'q3', 'md']
dir_stats += ['d%i' % i for i in range(1, 5)]
dir_stats += ['d%i' % i for i in range(6, 10)]
DirStat = stem.util.enum.Enum(*[(stat.upper(), stat) for stat in dir_stats])
# relay descriptors must have exactly one of the following
REQUIRED_FIELDS = (
'extra-info',
'published',
'router-signature',
)
# optional entries that can appear at most once
SINGLE_FIELDS = (
'read-history',
'write-history',
'geoip-db-digest',
'geoip6-db-digest',
'bridge-stats-end',
'bridge-ips',
'dirreq-stats-end',
'dirreq-v2-ips',
'dirreq-v3-ips',
'dirreq-v2-reqs',
'dirreq-v3-reqs',
'dirreq-v2-share',
'dirreq-v3-share',
'dirreq-v2-resp',
'dirreq-v3-resp',
'dirreq-v2-direct-dl',
'dirreq-v3-direct-dl',
'dirreq-v2-tunneled-dl',
'dirreq-v3-tunneled-dl',
'dirreq-read-history',
'dirreq-write-history',
'entry-stats-end',
'entry-ips',
'cell-stats-end',
'cell-processed-cells',
'cell-queued-cells',
'cell-time-in-queue',
'cell-circuits-per-decile',
'conn-bi-direct',
'exit-stats-end',
'exit-kibibytes-written',
'exit-kibibytes-read',
'exit-streams-opened',
)
_timestamp_re = re.compile('^(.*) \\(([0-9]+) s\\)( .*)?$')
_locale_re = re.compile('^[a-zA-Z0-9\\?]{2}$')
def _parse_file(descriptor_file, is_bridge = False, validate = False, **kwargs):
"""
Iterates over the extra-info descriptors in a file.
:param file descriptor_file: file with descriptor content
:param bool is_bridge: parses the file as being a bridge descriptor
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param dict kwargs: additional arguments for the descriptor constructor
:returns: iterator for :class:`~stem.descriptor.extrainfo_descriptor.ExtraInfoDescriptor`
instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is **True**
* **IOError** if the file can't be read
"""
while True:
if not is_bridge:
extrainfo_content = _read_until_keywords('router-signature', descriptor_file)
# we've reached the 'router-signature', now include the pgp style block
block_end_prefix = PGP_BLOCK_END.split(' ', 1)[0]
extrainfo_content += _read_until_keywords(block_end_prefix, descriptor_file, True)
else:
extrainfo_content = _read_until_keywords('router-digest', descriptor_file, True)
if extrainfo_content:
if extrainfo_content[0].startswith(b'@type'):
extrainfo_content = extrainfo_content[1:]
if is_bridge:
yield BridgeExtraInfoDescriptor(bytes.join(b'', extrainfo_content), validate, **kwargs)
else:
yield RelayExtraInfoDescriptor(bytes.join(b'', extrainfo_content), validate, **kwargs)
else:
break # done parsing file
def _parse_timestamp_and_interval(keyword, content):
"""
Parses a 'YYYY-MM-DD HH:MM:SS (NSEC s) *' entry.
:param str keyword: line's keyword
:param str content: line content to be parsed
:returns: **tuple** of the form (timestamp (**datetime**), interval
(**int**), remaining content (**str**))
:raises: **ValueError** if the content is malformed
"""
line = '%s %s' % (keyword, content)
content_match = _timestamp_re.match(content)
if not content_match:
raise ValueError('Malformed %s line: %s' % (keyword, line))
timestamp_str, interval, remainder = content_match.groups()
if remainder:
remainder = remainder[1:] # remove leading space
if not interval.isdigit():
raise ValueError("%s line's interval wasn't a number: %s" % (keyword, line))
try:
timestamp = stem.util.str_tools._parse_timestamp(timestamp_str)
return timestamp, int(interval), remainder
except ValueError:
raise ValueError("%s line's timestamp wasn't parsable: %s" % (keyword, line))
def _parse_extra_info_line(descriptor, entries):
# "extra-info" Nickname Fingerprint
value = _value('extra-info', entries)
extra_info_comp = value.split()
if len(extra_info_comp) < 2:
raise ValueError('Extra-info line must have two values: extra-info %s' % value)
elif not stem.util.tor_tools.is_valid_nickname(extra_info_comp[0]):
raise ValueError("Extra-info line entry isn't a valid nickname: %s" % extra_info_comp[0])
elif not stem.util.tor_tools.is_valid_fingerprint(extra_info_comp[1]):
raise ValueError('Tor relay fingerprints consist of forty hex digits: %s' % extra_info_comp[1])
descriptor.nickname = extra_info_comp[0]
descriptor.fingerprint = extra_info_comp[1]
def _parse_transport_line(descriptor, entries):
# "transport" transportname address:port [arglist]
# Everything after the transportname is scrubbed in published bridge
# descriptors, so we'll never see it in practice.
#
# These entries really only make sense for bridges, but have been seen
# on non-bridges in the wild when the relay operator configured it this
# way.
transports = {}
for value in _values('transport', entries):
name, address, port, args = None, None, None, None
if ' ' not in value:
# scrubbed
name = value
else:
# not scrubbed
value_comp = value.split()
if len(value_comp) < 1:
raise ValueError('Transport line is missing its transport name: transport %s' % value)
elif len(value_comp) < 2:
raise ValueError('Transport line is missing its address:port value: transport %s' % value)
elif ':' not in value_comp[1]:
raise ValueError("Transport line's address:port entry is missing a colon: transport %s" % value)
name = value_comp[0]
address, port_str = value_comp[1].rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address) or \
stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True):
raise ValueError('Transport line has a malformed address: transport %s' % value)
elif not stem.util.connection.is_valid_port(port_str):
raise ValueError('Transport line has a malformed port: transport %s' % value)
address.lstrip('[').rstrip(']')
port = int(port_str)
args = value_comp[2:] if len(value_comp) >= 3 else []
transports[name] = (address, port, args)
descriptor.transport = transports
def _parse_padding_counts_line(descriptor, entries):
# "padding-counts" YYYY-MM-DD HH:MM:SS (NSEC s) key=val key=val...
value = _value('padding-counts', entries)
timestamp, interval, remainder = _parse_timestamp_and_interval('padding-counts', value)
counts = {}
for k, v in _mappings_for('padding-counts', remainder, require_value = True):
counts[k] = int(v) if v.isdigit() else v
setattr(descriptor, 'padding_counts_end', timestamp)
setattr(descriptor, 'padding_counts_interval', interval)
setattr(descriptor, 'padding_counts', counts)
def _parse_dirreq_line(keyword, recognized_counts_attr, unrecognized_counts_attr, descriptor, entries):
value = _value(keyword, entries)
recognized_counts = {}
unrecognized_counts = {}
is_response_stats = keyword in ('dirreq-v2-resp', 'dirreq-v3-resp')
key_set = DirResponse if is_response_stats else DirStat
key_type = 'STATUS' if is_response_stats else 'STAT'
for status, count in _mappings_for(keyword, value, divider = ','):
if not count.isdigit():
raise ValueError('%s lines should contain %s=COUNT mappings: %s %s' % (keyword, key_type, keyword, value))
if status in key_set:
recognized_counts[status] = int(count)
else:
unrecognized_counts[status] = int(count)
setattr(descriptor, recognized_counts_attr, recognized_counts)
setattr(descriptor, unrecognized_counts_attr, unrecognized_counts)
def _parse_dirreq_share_line(keyword, attribute, descriptor, entries):
value = _value(keyword, entries)
if not value.endswith('%'):
raise ValueError('%s lines should be a percentage: %s %s' % (keyword, keyword, value))
elif float(value[:-1]) < 0:
raise ValueError('Negative percentage value: %s %s' % (keyword, value))
# bug means it might be above 100%: https://lists.torproject.org/pipermail/tor-dev/2012-June/003679.html
setattr(descriptor, attribute, float(value[:-1]) / 100)
def _parse_cell_line(keyword, attribute, descriptor, entries):
# "" num,...,num
value = _value(keyword, entries)
entries, exc = [], None
if value:
for entry in value.split(','):
try:
# Values should be positive but as discussed in ticket #5849
# there was a bug around this. It was fixed in tor 0.2.2.1.
entries.append(float(entry))
except ValueError:
exc = ValueError('Non-numeric entry in %s listing: %s %s' % (keyword, keyword, value))
setattr(descriptor, attribute, entries)
if exc:
raise exc
def _parse_timestamp_and_interval_line(keyword, end_attribute, interval_attribute, descriptor, entries):
# "" YYYY-MM-DD HH:MM:SS (NSEC s)
timestamp, interval, _ = _parse_timestamp_and_interval(keyword, _value(keyword, entries))
setattr(descriptor, end_attribute, timestamp)
setattr(descriptor, interval_attribute, interval)
def _parse_conn_bi_direct_line(descriptor, entries):
# "conn-bi-direct" YYYY-MM-DD HH:MM:SS (NSEC s) BELOW,READ,WRITE,BOTH
value = _value('conn-bi-direct', entries)
timestamp, interval, remainder = _parse_timestamp_and_interval('conn-bi-direct', value)
stats = remainder.split(',')
if len(stats) != 4 or not (stats[0].isdigit() and stats[1].isdigit() and stats[2].isdigit() and stats[3].isdigit()):
raise ValueError('conn-bi-direct line should end with four numeric values: conn-bi-direct %s' % value)
descriptor.conn_bi_direct_end = timestamp
descriptor.conn_bi_direct_interval = interval
descriptor.conn_bi_direct_below = int(stats[0])
descriptor.conn_bi_direct_read = int(stats[1])
descriptor.conn_bi_direct_write = int(stats[2])
descriptor.conn_bi_direct_both = int(stats[3])
def _parse_history_line(keyword, end_attribute, interval_attribute, values_attribute, descriptor, entries):
# "" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM...
value = _value(keyword, entries)
timestamp, interval, remainder = _parse_timestamp_and_interval(keyword, value)
history_values = []
if remainder:
try:
history_values = [int(entry) for entry in remainder.split(',')]
except ValueError:
raise ValueError('%s line has non-numeric values: %s %s' % (keyword, keyword, value))
setattr(descriptor, end_attribute, timestamp)
setattr(descriptor, interval_attribute, interval)
setattr(descriptor, values_attribute, history_values)
def _parse_port_count_line(keyword, attribute, descriptor, entries):
# "" port=N,port=N,...
value, port_mappings = _value(keyword, entries), {}
for port, stat in _mappings_for(keyword, value, divider = ','):
if (port != 'other' and not stem.util.connection.is_valid_port(port)) or not stat.isdigit():
raise ValueError('Entries in %s line should only be PORT=N entries: %s %s' % (keyword, keyword, value))
port = int(port) if port.isdigit() else port
port_mappings[port] = int(stat)
setattr(descriptor, attribute, port_mappings)
def _parse_geoip_to_count_line(keyword, attribute, descriptor, entries):
# "" CC=N,CC=N,...
#
# The maxmind geoip (https://www.maxmind.com/app/iso3166) has numeric
# locale codes for some special values, for instance...
# A1,"Anonymous Proxy"
# A2,"Satellite Provider"
# ??,"Unknown"
value, locale_usage = _value(keyword, entries), {}
for locale, count in _mappings_for(keyword, value, divider = ','):
if not _locale_re.match(locale) or not count.isdigit():
raise ValueError('Entries in %s line should only be CC=N entries: %s %s' % (keyword, keyword, value))
locale_usage[locale] = int(count)
setattr(descriptor, attribute, locale_usage)
def _parse_bridge_ip_versions_line(descriptor, entries):
value, ip_versions = _value('bridge-ip-versions', entries), {}
for protocol, count in _mappings_for('bridge-ip-versions', value, divider = ','):
if not count.isdigit():
raise stem.ProtocolError('IP protocol count was non-numeric (%s): bridge-ip-versions %s' % (count, value))
ip_versions[protocol] = int(count)
descriptor.ip_versions = ip_versions
def _parse_bridge_ip_transports_line(descriptor, entries):
value, ip_transports = _value('bridge-ip-transports', entries), {}
for protocol, count in _mappings_for('bridge-ip-transports', value, divider = ','):
if not count.isdigit():
raise stem.ProtocolError('Transport count was non-numeric (%s): bridge-ip-transports %s' % (count, value))
ip_transports[protocol] = int(count)
descriptor.ip_transports = ip_transports
def _parse_hs_stats(keyword, stat_attribute, extra_attribute, descriptor, entries):
# "" num key=val key=val...
value, stat, extra = _value(keyword, entries), None, {}
if value is None:
pass # not in the descriptor
elif value == '':
raise ValueError("'%s' line was blank" % keyword)
else:
if ' ' in value:
stat_value, remainder = value.split(' ', 1)
else:
stat_value, remainder = value, None
try:
stat = int(stat_value)
except ValueError:
raise ValueError("'%s' stat was non-numeric (%s): %s %s" % (keyword, stat_value, keyword, value))
for key, val in _mappings_for(keyword, remainder):
extra[key] = val
setattr(descriptor, stat_attribute, stat)
setattr(descriptor, extra_attribute, extra)
_parse_identity_ed25519_line = _parse_key_block('identity-ed25519', 'ed25519_certificate', 'ED25519 CERT')
_parse_master_key_ed25519_line = _parse_simple_line('master-key-ed25519', 'ed25519_certificate_hash')
_parse_geoip_db_digest_line = _parse_forty_character_hex('geoip-db-digest', 'geoip_db_digest')
_parse_geoip6_db_digest_line = _parse_forty_character_hex('geoip6-db-digest', 'geoip6_db_digest')
_parse_dirreq_v2_resp_line = functools.partial(_parse_dirreq_line, 'dirreq-v2-resp', 'dir_v2_responses', 'dir_v2_responses_unknown')
_parse_dirreq_v3_resp_line = functools.partial(_parse_dirreq_line, 'dirreq-v3-resp', 'dir_v3_responses', 'dir_v3_responses_unknown')
_parse_dirreq_v2_direct_dl_line = functools.partial(_parse_dirreq_line, 'dirreq-v2-direct-dl', 'dir_v2_direct_dl', 'dir_v2_direct_dl_unknown')
_parse_dirreq_v3_direct_dl_line = functools.partial(_parse_dirreq_line, 'dirreq-v3-direct-dl', 'dir_v3_direct_dl', 'dir_v3_direct_dl_unknown')
_parse_dirreq_v2_tunneled_dl_line = functools.partial(_parse_dirreq_line, 'dirreq-v2-tunneled-dl', 'dir_v2_tunneled_dl', 'dir_v2_tunneled_dl_unknown')
_parse_dirreq_v3_tunneled_dl_line = functools.partial(_parse_dirreq_line, 'dirreq-v3-tunneled-dl', 'dir_v3_tunneled_dl', 'dir_v3_tunneled_dl_unknown')
_parse_dirreq_v2_share_line = functools.partial(_parse_dirreq_share_line, 'dirreq-v2-share', 'dir_v2_share')
_parse_dirreq_v3_share_line = functools.partial(_parse_dirreq_share_line, 'dirreq-v3-share', 'dir_v3_share')
_parse_cell_processed_cells_line = functools.partial(_parse_cell_line, 'cell-processed-cells', 'cell_processed_cells')
_parse_cell_queued_cells_line = functools.partial(_parse_cell_line, 'cell-queued-cells', 'cell_queued_cells')
_parse_cell_time_in_queue_line = functools.partial(_parse_cell_line, 'cell-time-in-queue', 'cell_time_in_queue')
_parse_cell_circuits_per_decline_line = _parse_int_line('cell-circuits-per-decile', 'cell_circuits_per_decile', allow_negative = False)
_parse_published_line = _parse_timestamp_line('published', 'published')
_parse_geoip_start_time_line = _parse_timestamp_line('geoip-start-time', 'geoip_start_time')
_parse_cell_stats_end_line = functools.partial(_parse_timestamp_and_interval_line, 'cell-stats-end', 'cell_stats_end', 'cell_stats_interval')
_parse_entry_stats_end_line = functools.partial(_parse_timestamp_and_interval_line, 'entry-stats-end', 'entry_stats_end', 'entry_stats_interval')
_parse_exit_stats_end_line = functools.partial(_parse_timestamp_and_interval_line, 'exit-stats-end', 'exit_stats_end', 'exit_stats_interval')
_parse_bridge_stats_end_line = functools.partial(_parse_timestamp_and_interval_line, 'bridge-stats-end', 'bridge_stats_end', 'bridge_stats_interval')
_parse_dirreq_stats_end_line = functools.partial(_parse_timestamp_and_interval_line, 'dirreq-stats-end', 'dir_stats_end', 'dir_stats_interval')
_parse_read_history_line = functools.partial(_parse_history_line, 'read-history', 'read_history_end', 'read_history_interval', 'read_history_values')
_parse_write_history_line = functools.partial(_parse_history_line, 'write-history', 'write_history_end', 'write_history_interval', 'write_history_values')
_parse_dirreq_read_history_line = functools.partial(_parse_history_line, 'dirreq-read-history', 'dir_read_history_end', 'dir_read_history_interval', 'dir_read_history_values')
_parse_dirreq_write_history_line = functools.partial(_parse_history_line, 'dirreq-write-history', 'dir_write_history_end', 'dir_write_history_interval', 'dir_write_history_values')
_parse_exit_kibibytes_written_line = functools.partial(_parse_port_count_line, 'exit-kibibytes-written', 'exit_kibibytes_written')
_parse_exit_kibibytes_read_line = functools.partial(_parse_port_count_line, 'exit-kibibytes-read', 'exit_kibibytes_read')
_parse_exit_streams_opened_line = functools.partial(_parse_port_count_line, 'exit-streams-opened', 'exit_streams_opened')
_parse_hidden_service_stats_end_line = _parse_timestamp_line('hidserv-stats-end', 'hs_stats_end')
_parse_hidden_service_rend_relayed_cells_line = functools.partial(_parse_hs_stats, 'hidserv-rend-relayed-cells', 'hs_rend_cells', 'hs_rend_cells_attr')
_parse_hidden_service_dir_onions_seen_line = functools.partial(_parse_hs_stats, 'hidserv-dir-onions-seen', 'hs_dir_onions_seen', 'hs_dir_onions_seen_attr')
_parse_dirreq_v2_ips_line = functools.partial(_parse_geoip_to_count_line, 'dirreq-v2-ips', 'dir_v2_ips')
_parse_dirreq_v3_ips_line = functools.partial(_parse_geoip_to_count_line, 'dirreq-v3-ips', 'dir_v3_ips')
_parse_dirreq_v2_reqs_line = functools.partial(_parse_geoip_to_count_line, 'dirreq-v2-reqs', 'dir_v2_requests')
_parse_dirreq_v3_reqs_line = functools.partial(_parse_geoip_to_count_line, 'dirreq-v3-reqs', 'dir_v3_requests')
_parse_geoip_client_origins_line = functools.partial(_parse_geoip_to_count_line, 'geoip-client-origins', 'geoip_client_origins')
_parse_entry_ips_line = functools.partial(_parse_geoip_to_count_line, 'entry-ips', 'entry_ips')
_parse_bridge_ips_line = functools.partial(_parse_geoip_to_count_line, 'bridge-ips', 'bridge_ips')
_parse_router_sig_ed25519_line = _parse_simple_line('router-sig-ed25519', 'ed25519_signature')
_parse_router_digest_sha256_line = _parse_simple_line('router-digest-sha256', 'router_digest_sha256')
_parse_router_digest_line = _parse_forty_character_hex('router-digest', '_digest')
_parse_router_signature_line = _parse_key_block('router-signature', 'signature', 'SIGNATURE')
class ExtraInfoDescriptor(Descriptor):
"""
Extra-info descriptor document.
:var str nickname: **\\*** relay's nickname
:var str fingerprint: **\\*** identity key fingerprint
:var datetime published: **\\*** time in UTC when this descriptor was made
:var str geoip_db_digest: sha1 of the geoIP database file for IPv4 addresses
:var str geoip6_db_digest: sha1 of the geoIP database file for IPv6 addresses
:var dict transport: **\\*** mapping of transport methods to their (address,
port, args) tuple, these usually appear on bridges in which case all of
those are **None**
**Bi-directional connection usage:**
:var datetime conn_bi_direct_end: end of the sampling interval
:var int conn_bi_direct_interval: seconds per interval
:var int conn_bi_direct_below: connections that read/wrote less than 20 KiB
:var int conn_bi_direct_read: connections that read at least 10x more than wrote
:var int conn_bi_direct_write: connections that wrote at least 10x more than read
:var int conn_bi_direct_both: remaining connections
**Bytes read/written for relayed traffic:**
:var datetime read_history_end: end of the sampling interval
:var int read_history_interval: seconds per interval
:var list read_history_values: bytes read during each interval
:var datetime write_history_end: end of the sampling interval
:var int write_history_interval: seconds per interval
:var list write_history_values: bytes written during each interval
**Cell relaying statistics:**
:var datetime cell_stats_end: end of the period when stats were gathered
:var int cell_stats_interval: length in seconds of the interval
:var list cell_processed_cells: measurement of processed cells per circuit
:var list cell_queued_cells: measurement of queued cells per circuit
:var list cell_time_in_queue: mean enqueued time in milliseconds for cells
:var int cell_circuits_per_decile: mean number of circuits in a decile
**Directory Mirror Attributes:**
:var datetime dir_stats_end: end of the period when stats were gathered
:var int dir_stats_interval: length in seconds of the interval
:var dict dir_v2_ips: mapping of locales to rounded count of requester ips
:var dict dir_v3_ips: mapping of locales to rounded count of requester ips
:var float dir_v2_share: percent of total directory traffic it expects to serve
:var float dir_v3_share: percent of total directory traffic it expects to serve
:var dict dir_v2_requests: mapping of locales to rounded count of requests
:var dict dir_v3_requests: mapping of locales to rounded count of requests
:var dict dir_v2_responses: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirResponse` to their rounded count
:var dict dir_v3_responses: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirResponse` to their rounded count
:var dict dir_v2_responses_unknown: mapping of unrecognized statuses to their count
:var dict dir_v3_responses_unknown: mapping of unrecognized statuses to their count
:var dict dir_v2_direct_dl: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirStat` to measurement over DirPort
:var dict dir_v3_direct_dl: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirStat` to measurement over DirPort
:var dict dir_v2_direct_dl_unknown: mapping of unrecognized stats to their measurement
:var dict dir_v3_direct_dl_unknown: mapping of unrecognized stats to their measurement
:var dict dir_v2_tunneled_dl: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirStat` to measurement over ORPort
:var dict dir_v3_tunneled_dl: mapping of :data:`~stem.descriptor.extrainfo_descriptor.DirStat` to measurement over ORPort
:var dict dir_v2_tunneled_dl_unknown: mapping of unrecognized stats to their measurement
:var dict dir_v3_tunneled_dl_unknown: mapping of unrecognized stats to their measurement
**Bytes read/written for directory mirroring:**
:var datetime dir_read_history_end: end of the sampling interval
:var int dir_read_history_interval: seconds per interval
:var list dir_read_history_values: bytes read during each interval
:var datetime dir_write_history_end: end of the sampling interval
:var int dir_write_history_interval: seconds per interval
:var list dir_write_history_values: bytes read during each interval
**Guard Attributes:**
:var datetime entry_stats_end: end of the period when stats were gathered
:var int entry_stats_interval: length in seconds of the interval
:var dict entry_ips: mapping of locales to rounded count of unique user ips
**Exit Attributes:**
:var datetime exit_stats_end: end of the period when stats were gathered
:var int exit_stats_interval: length in seconds of the interval
:var dict exit_kibibytes_written: traffic per port (keys are ints or 'other')
:var dict exit_kibibytes_read: traffic per port (keys are ints or 'other')
:var dict exit_streams_opened: streams per port (keys are ints or 'other')
**Hidden Service Attributes:**
:var datetime hs_stats_end: end of the sampling interval
:var int hs_rend_cells: rounded count of the RENDEZVOUS1 cells seen
:var int hs_rend_cells_attr: **\\*** attributes provided for the hs_rend_cells
:var int hs_dir_onions_seen: rounded count of the identities seen
:var int hs_dir_onions_seen_attr: **\\*** attributes provided for the hs_dir_onions_seen
**Padding Count Attributes:**
:var dict padding_counts: **\\*** padding parameters
:var datetime padding_counts_end: end of the period when padding data is being collected
:var int padding_counts_interval: length in seconds of the interval
**Bridge Attributes:**
:var datetime bridge_stats_end: end of the period when stats were gathered
:var int bridge_stats_interval: length in seconds of the interval
:var dict bridge_ips: mapping of locales to rounded count of unique user ips
:var datetime geoip_start_time: replaced by bridge_stats_end (deprecated)
:var dict geoip_client_origins: replaced by bridge_ips (deprecated)
:var dict ip_versions: mapping of ip protocols to a rounded count for the number of users
:var dict ip_versions: mapping of ip transports to a count for the number of users
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
.. versionchanged:: 1.4.0
Added the hs_stats_end, hs_rend_cells, hs_rend_cells_attr,
hs_dir_onions_seen, and hs_dir_onions_seen_attr attributes.
.. versionchanged:: 1.6.0
Added the padding_counts, padding_counts_end, and padding_counts_interval
attributes.
"""
ATTRIBUTES = {
'nickname': (None, _parse_extra_info_line),
'fingerprint': (None, _parse_extra_info_line),
'published': (None, _parse_published_line),
'geoip_db_digest': (None, _parse_geoip_db_digest_line),
'geoip6_db_digest': (None, _parse_geoip6_db_digest_line),
'transport': ({}, _parse_transport_line),
'conn_bi_direct_end': (None, _parse_conn_bi_direct_line),
'conn_bi_direct_interval': (None, _parse_conn_bi_direct_line),
'conn_bi_direct_below': (None, _parse_conn_bi_direct_line),
'conn_bi_direct_read': (None, _parse_conn_bi_direct_line),
'conn_bi_direct_write': (None, _parse_conn_bi_direct_line),
'conn_bi_direct_both': (None, _parse_conn_bi_direct_line),
'read_history_end': (None, _parse_read_history_line),
'read_history_interval': (None, _parse_read_history_line),
'read_history_values': (None, _parse_read_history_line),
'write_history_end': (None, _parse_write_history_line),
'write_history_interval': (None, _parse_write_history_line),
'write_history_values': (None, _parse_write_history_line),
'cell_stats_end': (None, _parse_cell_stats_end_line),
'cell_stats_interval': (None, _parse_cell_stats_end_line),
'cell_processed_cells': (None, _parse_cell_processed_cells_line),
'cell_queued_cells': (None, _parse_cell_queued_cells_line),
'cell_time_in_queue': (None, _parse_cell_time_in_queue_line),
'cell_circuits_per_decile': (None, _parse_cell_circuits_per_decline_line),
'dir_stats_end': (None, _parse_dirreq_stats_end_line),
'dir_stats_interval': (None, _parse_dirreq_stats_end_line),
'dir_v2_ips': (None, _parse_dirreq_v2_ips_line),
'dir_v3_ips': (None, _parse_dirreq_v3_ips_line),
'dir_v2_share': (None, _parse_dirreq_v2_share_line),
'dir_v3_share': (None, _parse_dirreq_v3_share_line),
'dir_v2_requests': (None, _parse_dirreq_v2_reqs_line),
'dir_v3_requests': (None, _parse_dirreq_v3_reqs_line),
'dir_v2_responses': (None, _parse_dirreq_v2_resp_line),
'dir_v3_responses': (None, _parse_dirreq_v3_resp_line),
'dir_v2_responses_unknown': (None, _parse_dirreq_v2_resp_line),
'dir_v3_responses_unknown': (None, _parse_dirreq_v3_resp_line),
'dir_v2_direct_dl': (None, _parse_dirreq_v2_direct_dl_line),
'dir_v3_direct_dl': (None, _parse_dirreq_v3_direct_dl_line),
'dir_v2_direct_dl_unknown': (None, _parse_dirreq_v2_direct_dl_line),
'dir_v3_direct_dl_unknown': (None, _parse_dirreq_v3_direct_dl_line),
'dir_v2_tunneled_dl': (None, _parse_dirreq_v2_tunneled_dl_line),
'dir_v3_tunneled_dl': (None, _parse_dirreq_v3_tunneled_dl_line),
'dir_v2_tunneled_dl_unknown': (None, _parse_dirreq_v2_tunneled_dl_line),
'dir_v3_tunneled_dl_unknown': (None, _parse_dirreq_v3_tunneled_dl_line),
'dir_read_history_end': (None, _parse_dirreq_read_history_line),
'dir_read_history_interval': (None, _parse_dirreq_read_history_line),
'dir_read_history_values': (None, _parse_dirreq_read_history_line),
'dir_write_history_end': (None, _parse_dirreq_write_history_line),
'dir_write_history_interval': (None, _parse_dirreq_write_history_line),
'dir_write_history_values': (None, _parse_dirreq_write_history_line),
'entry_stats_end': (None, _parse_entry_stats_end_line),
'entry_stats_interval': (None, _parse_entry_stats_end_line),
'entry_ips': (None, _parse_entry_ips_line),
'exit_stats_end': (None, _parse_exit_stats_end_line),
'exit_stats_interval': (None, _parse_exit_stats_end_line),
'exit_kibibytes_written': (None, _parse_exit_kibibytes_written_line),
'exit_kibibytes_read': (None, _parse_exit_kibibytes_read_line),
'exit_streams_opened': (None, _parse_exit_streams_opened_line),
'hs_stats_end': (None, _parse_hidden_service_stats_end_line),
'hs_rend_cells': (None, _parse_hidden_service_rend_relayed_cells_line),
'hs_rend_cells_attr': ({}, _parse_hidden_service_rend_relayed_cells_line),
'hs_dir_onions_seen': (None, _parse_hidden_service_dir_onions_seen_line),
'hs_dir_onions_seen_attr': ({}, _parse_hidden_service_dir_onions_seen_line),
'padding_counts': ({}, _parse_padding_counts_line),
'padding_counts_end': (None, _parse_padding_counts_line),
'padding_counts_interval': (None, _parse_padding_counts_line),
'bridge_stats_end': (None, _parse_bridge_stats_end_line),
'bridge_stats_interval': (None, _parse_bridge_stats_end_line),
'bridge_ips': (None, _parse_bridge_ips_line),
'geoip_start_time': (None, _parse_geoip_start_time_line),
'geoip_client_origins': (None, _parse_geoip_client_origins_line),
'ip_versions': (None, _parse_bridge_ip_versions_line),
'ip_transports': (None, _parse_bridge_ip_transports_line),
}
PARSER_FOR_LINE = {
'extra-info': _parse_extra_info_line,
'geoip-db-digest': _parse_geoip_db_digest_line,
'geoip6-db-digest': _parse_geoip6_db_digest_line,
'transport': _parse_transport_line,
'cell-circuits-per-decile': _parse_cell_circuits_per_decline_line,
'dirreq-v2-resp': _parse_dirreq_v2_resp_line,
'dirreq-v3-resp': _parse_dirreq_v3_resp_line,
'dirreq-v2-direct-dl': _parse_dirreq_v2_direct_dl_line,
'dirreq-v3-direct-dl': _parse_dirreq_v3_direct_dl_line,
'dirreq-v2-tunneled-dl': _parse_dirreq_v2_tunneled_dl_line,
'dirreq-v3-tunneled-dl': _parse_dirreq_v3_tunneled_dl_line,
'dirreq-v2-share': _parse_dirreq_v2_share_line,
'dirreq-v3-share': _parse_dirreq_v3_share_line,
'cell-processed-cells': _parse_cell_processed_cells_line,
'cell-queued-cells': _parse_cell_queued_cells_line,
'cell-time-in-queue': _parse_cell_time_in_queue_line,
'published': _parse_published_line,
'geoip-start-time': _parse_geoip_start_time_line,
'cell-stats-end': _parse_cell_stats_end_line,
'entry-stats-end': _parse_entry_stats_end_line,
'exit-stats-end': _parse_exit_stats_end_line,
'bridge-stats-end': _parse_bridge_stats_end_line,
'dirreq-stats-end': _parse_dirreq_stats_end_line,
'conn-bi-direct': _parse_conn_bi_direct_line,
'read-history': _parse_read_history_line,
'write-history': _parse_write_history_line,
'dirreq-read-history': _parse_dirreq_read_history_line,
'dirreq-write-history': _parse_dirreq_write_history_line,
'exit-kibibytes-written': _parse_exit_kibibytes_written_line,
'exit-kibibytes-read': _parse_exit_kibibytes_read_line,
'exit-streams-opened': _parse_exit_streams_opened_line,
'hidserv-stats-end': _parse_hidden_service_stats_end_line,
'hidserv-rend-relayed-cells': _parse_hidden_service_rend_relayed_cells_line,
'hidserv-dir-onions-seen': _parse_hidden_service_dir_onions_seen_line,
'padding-counts': _parse_padding_counts_line,
'dirreq-v2-ips': _parse_dirreq_v2_ips_line,
'dirreq-v3-ips': _parse_dirreq_v3_ips_line,
'dirreq-v2-reqs': _parse_dirreq_v2_reqs_line,
'dirreq-v3-reqs': _parse_dirreq_v3_reqs_line,
'geoip-client-origins': _parse_geoip_client_origins_line,
'entry-ips': _parse_entry_ips_line,
'bridge-ips': _parse_bridge_ips_line,
'bridge-ip-versions': _parse_bridge_ip_versions_line,
'bridge-ip-transports': _parse_bridge_ip_transports_line,
}
def __init__(self, raw_contents, validate = False):
"""
Extra-info descriptor constructor. By default this validates the
descriptor's content as it's parsed. This validation can be disabled to
either improve performance or be accepting of malformed data.
:param str raw_contents: extra-info content provided by the relay
:param bool validate: checks the validity of the extra-info descriptor if
**True**, skips these checks otherwise
:raises: **ValueError** if the contents is malformed and validate is True
"""
super(ExtraInfoDescriptor, self).__init__(raw_contents, lazy_load = not validate)
entries = _descriptor_components(raw_contents, validate)
if validate:
for keyword in self._required_fields():
if keyword not in entries:
raise ValueError("Extra-info descriptor must have a '%s' entry" % keyword)
for keyword in self._required_fields() + SINGLE_FIELDS:
if keyword in entries and len(entries[keyword]) > 1:
raise ValueError("The '%s' entry can only appear once in an extra-info descriptor" % keyword)
expected_first_keyword = self._first_keyword()
if expected_first_keyword and expected_first_keyword != list(entries.keys())[0]:
raise ValueError("Extra-info descriptor must start with a '%s' entry" % expected_first_keyword)
expected_last_keyword = self._last_keyword()
if expected_last_keyword and expected_last_keyword != list(entries.keys())[-1]:
raise ValueError("Descriptor must end with a '%s' entry" % expected_last_keyword)
self._parse(entries, validate)
else:
self._entries = entries
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
"""
Digest of this descriptor's content. These are referenced by...
* **Server Descriptors**
* Referer: :class:`~stem.descriptor.server_descriptor.ServerDescriptor` **extra_info_digest** attribute
* Format: **SHA1/HEX**
* **Server Descriptors**
* Referer: :class:`~stem.descriptor.server_descriptor.ServerDescriptor` **extra_info_sha256_digest** attribute
* Format: **SHA256/BASE64**
.. versionchanged:: 1.8.0
Added the hash_type and encoding arguments.
:param stem.descriptor.DigestHash hash_type: digest hashing algorithm
:param stem.descriptor.DigestEncoding encoding: digest encoding
:returns: **hashlib.HASH** or **str** based on our encoding argument
"""
raise NotImplementedError('Unsupported Operation: this should be implemented by the ExtraInfoDescriptor subclass')
def _required_fields(self):
return REQUIRED_FIELDS
def _first_keyword(self):
return 'extra-info'
def _last_keyword(self):
return 'router-signature'
class RelayExtraInfoDescriptor(ExtraInfoDescriptor):
"""
Relay extra-info descriptor, constructed from data such as that provided by
'GETINFO extra-info/digest/\\*', cached descriptors, and metrics
(`specification `_).
:var ed25519_certificate str: base64 encoded ed25519 certificate
:var ed25519_signature str: signature of this document using ed25519
:var str signature: **\\*** signature for this extrainfo descriptor
**\\*** attribute is required when we're parsed with validation
.. versionchanged:: 1.5.0
Added the ed25519_certificate and ed25519_signature attributes.
"""
TYPE_ANNOTATION_NAME = 'extra-info'
ATTRIBUTES = dict(ExtraInfoDescriptor.ATTRIBUTES, **{
'ed25519_certificate': (None, _parse_identity_ed25519_line),
'ed25519_signature': (None, _parse_router_sig_ed25519_line),
'signature': (None, _parse_router_signature_line),
})
PARSER_FOR_LINE = dict(ExtraInfoDescriptor.PARSER_FOR_LINE, **{
'identity-ed25519': _parse_identity_ed25519_line,
'router-sig-ed25519': _parse_router_sig_ed25519_line,
'router-signature': _parse_router_signature_line,
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False, signing_key = None):
base_header = (
('extra-info', '%s %s' % (_random_nickname(), _random_fingerprint())),
('published', _random_date()),
)
if signing_key:
sign = True
if sign:
if attr and 'router-signature' in attr:
raise ValueError('Cannot sign the descriptor if a router-signature has been provided')
if signing_key is None:
signing_key = create_signing_key()
content = _descriptor_content(attr, exclude, base_header) + b'\nrouter-signature\n'
return _append_router_signature(content, signing_key.private)
else:
return _descriptor_content(attr, exclude, base_header, (
('router-signature', _random_crypto_blob('SIGNATURE')),
))
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, signing_key = None):
return cls(cls.content(attr, exclude, sign, signing_key), validate = validate)
@lru_cache()
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
if hash_type == DigestHash.SHA1:
# our digest is calculated from everything except our signature
content = self._content_range(end = '\nrouter-signature\n')
return stem.descriptor._encode_digest(hashlib.sha1(content), encoding)
elif hash_type == DigestHash.SHA256:
# Due to a tor bug sha256 digests are calculated from the
# whole descriptor rather than ommiting the signature...
#
# https://trac.torproject.org/projects/tor/ticket/28415
return stem.descriptor._encode_digest(hashlib.sha256(self.get_bytes()), encoding)
else:
raise NotImplementedError('Extrainfo descriptor digests are only available in sha1 and sha256, not %s' % hash_type)
class BridgeExtraInfoDescriptor(ExtraInfoDescriptor):
"""
Bridge extra-info descriptor (`bridge descriptor specification
`_)
:var str ed25519_certificate_hash: sha256 hash of the original identity-ed25519
:var str router_digest_sha256: sha256 digest of this document
.. versionchanged:: 1.5.0
Added the ed25519_certificate_hash and router_digest_sha256 attributes.
"""
TYPE_ANNOTATION_NAME = 'bridge-extra-info'
ATTRIBUTES = dict(ExtraInfoDescriptor.ATTRIBUTES, **{
'ed25519_certificate_hash': (None, _parse_master_key_ed25519_line),
'router_digest_sha256': (None, _parse_router_digest_sha256_line),
'_digest': (None, _parse_router_digest_line),
})
PARSER_FOR_LINE = dict(ExtraInfoDescriptor.PARSER_FOR_LINE, **{
'master-key-ed25519': _parse_master_key_ed25519_line,
'router-digest-sha256': _parse_router_digest_sha256_line,
'router-digest': _parse_router_digest_line,
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('extra-info', 'ec2bridgereaac65a3 %s' % _random_fingerprint()),
('published', _random_date()),
), (
('router-digest', _random_fingerprint()),
))
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
if hash_type == DigestHash.SHA1 and encoding == DigestEncoding.HEX:
return self._digest
elif hash_type == DigestHash.SHA256 and encoding == DigestEncoding.BASE64:
return self.router_digest_sha256
else:
raise NotImplementedError('Bridge extrainfo digests are only available as sha1/hex and sha256/base64, not %s/%s' % (hash_type, encoding))
def _required_fields(self):
excluded_fields = [
'router-signature',
]
included_fields = [
'router-digest',
]
return tuple(included_fields + [f for f in REQUIRED_FIELDS if f not in excluded_fields])
def _last_keyword(self):
return None
stem-1.8.0/stem/descriptor/hidden_service_descriptor.py 0000664 0001750 0001750 00000000261 13530351613 024122 0 ustar atagar atagar 0000000 0000000 # TODO: This module (hidden_service_descriptor) is a temporary alias for
# hidden_service. This alias will be removed in Stem 2.x.
from stem.descriptor.hidden_service import *
stem-1.8.0/stem/descriptor/collector.py 0000664 0001750 0001750 00000064725 13601507121 020712 0 ustar atagar atagar 0000000 0000000 # Copyright 2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Descriptor archives are available from `CollecTor
`_. If you need Tor's topology
at a prior point in time this is the place to go!
With CollecTor you can either read descriptors directly...
.. literalinclude:: /_static/example/collector_reading.py
:language: python
... or download the descriptors to disk and read them later.
.. literalinclude:: /_static/example/collector_caching.py
:language: python
::
get_instance - Provides a singleton CollecTor used for...
|- get_server_descriptors - published server descriptors
|- get_extrainfo_descriptors - published extrainfo descriptors
|- get_microdescriptors - published microdescriptors
|- get_consensus - published router status entries
|
|- get_key_certificates - authority key certificates
|- get_bandwidth_files - bandwidth authority heuristics
+- get_exit_lists - TorDNSEL exit list
File - Individual file residing within CollecTor
|- read - provides descriptors from this file
+- download - download this file to disk
CollecTor - Downloader for descriptors from CollecTor
|- get_server_descriptors - published server descriptors
|- get_extrainfo_descriptors - published extrainfo descriptors
|- get_microdescriptors - published microdescriptors
|- get_consensus - published router status entries
|
|- get_key_certificates - authority key certificates
|- get_bandwidth_files - bandwidth authority heuristics
|- get_exit_lists - TorDNSEL exit list
|
|- index - metadata for content available from CollecTor
+- files - files available from CollecTor
.. versionadded:: 1.8.0
"""
import base64
import binascii
import datetime
import hashlib
import json
import os
import re
import shutil
import tempfile
import time
import stem.descriptor
import stem.util.connection
import stem.util.str_tools
from stem.descriptor import Compression, DocumentHandler
COLLECTOR_URL = 'https://collector.torproject.org/'
REFRESH_INDEX_RATE = 3600 # get new index if cached copy is an hour old
SINGLETON_COLLECTOR = None
YEAR_DATE = re.compile('-(\\d{4})-(\\d{2})\\.')
SEC_DATE = re.compile('(\\d{4}-\\d{2}-\\d{2}-\\d{2}-\\d{2}-\\d{2})')
# distant future date so we can sort files without a timestamp at the end
FUTURE = datetime.datetime(9999, 1, 1)
def get_instance():
"""
Provides the singleton :class:`~stem.descriptor.collector.CollecTor`
used for this module's shorthand functions.
:returns: singleton :class:`~stem.descriptor.collector.CollecTor` instance
"""
global SINGLETON_COLLECTOR
if SINGLETON_COLLECTOR is None:
SINGLETON_COLLECTOR = CollecTor()
return SINGLETON_COLLECTOR
def get_server_descriptors(start = None, end = None, cache_to = None, bridge = False, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_server_descriptors`
on our singleton instance.
"""
for desc in get_instance().get_server_descriptors(start, end, cache_to, bridge, timeout, retries):
yield desc
def get_extrainfo_descriptors(start = None, end = None, cache_to = None, bridge = False, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_extrainfo_descriptors`
on our singleton instance.
"""
for desc in get_instance().get_extrainfo_descriptors(start, end, cache_to, bridge, timeout, retries):
yield desc
def get_microdescriptors(start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_microdescriptors`
on our singleton instance.
"""
for desc in get_instance().get_microdescriptors(start, end, cache_to, timeout, retries):
yield desc
def get_consensus(start = None, end = None, cache_to = None, document_handler = DocumentHandler.ENTRIES, version = 3, microdescriptor = False, bridge = False, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_consensus`
on our singleton instance.
"""
for desc in get_instance().get_consensus(start, end, cache_to, document_handler, version, microdescriptor, bridge, timeout, retries):
yield desc
def get_key_certificates(start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_key_certificates`
on our singleton instance.
"""
for desc in get_instance().get_key_certificates(start, end, cache_to, timeout, retries):
yield desc
def get_bandwidth_files(start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_bandwidth_files`
on our singleton instance.
"""
for desc in get_instance().get_bandwidth_files(start, end, cache_to, timeout, retries):
yield desc
def get_exit_lists(start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Shorthand for
:func:`~stem.descriptor.collector.CollecTor.get_exit_lists`
on our singleton instance.
"""
for desc in get_instance().get_exit_lists(start, end, cache_to, timeout, retries):
yield desc
class File(object):
"""
File within CollecTor.
:var str path: file path within collector
:var tuple types: descriptor types contained within this file
:var stem.descriptor.Compression compression: file compression, **None** if
this cannot be determined
:var int size: size of the file
:var str sha256: file's sha256 checksum
:var datetime start: first publication within the file, **None** if this
cannot be determined
:var datetime end: last publication within the file, **None** if this cannot
be determined
:var datetime last_modified: when the file was last modified
"""
def __init__(self, path, types, size, sha256, first_published, last_published, last_modified):
self.path = path
self.types = tuple(types) if types else ()
self.compression = File._guess_compression(path)
self.size = size
self.sha256 = sha256
self.last_modified = datetime.datetime.strptime(last_modified, '%Y-%m-%d %H:%M')
self._downloaded_to = None # location we last downloaded to
# Most descriptor types have publication time fields, but microdescriptors
# don't because these files lack timestamps to parse.
if first_published and last_published:
self.start = datetime.datetime.strptime(first_published, '%Y-%m-%d %H:%M')
self.end = datetime.datetime.strptime(last_published, '%Y-%m-%d %H:%M')
else:
self.start, self.end = File._guess_time_range(path)
def read(self, directory = None, descriptor_type = None, start = None, end = None, document_handler = DocumentHandler.ENTRIES, timeout = None, retries = 3):
"""
Provides descriptors from this archive. Descriptors are downloaded or read
from disk as follows...
* If this file has already been downloaded through
:func:`~stem.descriptor.collector.CollecTor.download' these descriptors
are read from disk.
* If a **directory** argument is provided and the file is already present
these descriptors are read from disk.
* If a **directory** argument is provided and the file is not present the
file is downloaded this location then read.
* If the file has neither been downloaded and no **directory** argument
is provided then the file is downloaded to a temporary directory that's
deleted after it is read.
:param str directory: destination to download into
:param str descriptor_type: `descriptor type
`_, this is
guessed if not provided
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse a :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:param int timeout: timeout when connection becomes idle, no timeout
applied if **None**
:param int retries: maximum attempts to impose
:returns: iterator for :class:`~stem.descriptor.__init__.Descriptor`
instances in the file
:raises:
* **ValueError** if unable to determine the descirptor type
* **TypeError** if we cannot parse this descriptor type
* :class:`~stem.DownloadFailed` if the download fails
"""
if descriptor_type is None:
# If archive contains multiple descriptor types the caller must provide a
# 'descriptor_type' argument so we can disambiguate. However, if only the
# version number varies we can probably simply pick one.
base_types = set([t.split(' ')[0] for t in self.types])
if not self.types:
raise ValueError("Unable to determine this file's descriptor type")
elif len(base_types) > 1:
raise ValueError("Unable to disambiguate file's descriptor type from among %s" % ', '.join(self.types))
else:
descriptor_type = self.types[0]
if directory is None:
if self._downloaded_to and os.path.exists(self._downloaded_to):
directory = os.path.dirname(self._downloaded_to)
else:
# TODO: The following can be replaced with simpler usage of
# tempfile.TemporaryDirectory when we drop python 2.x support.
tmp_directory = tempfile.mkdtemp()
for desc in self.read(tmp_directory, descriptor_type, start, end, document_handler, timeout, retries):
yield desc
shutil.rmtree(tmp_directory)
return
path = self.download(directory, True, timeout, retries)
# Archives can contain multiple descriptor types, so parsing everything and
# filtering to what we're after.
for desc in stem.descriptor.parse_file(path, document_handler = document_handler):
if descriptor_type is None or descriptor_type.startswith(desc.type_annotation().name):
# TODO: This can filter server and extrainfo times, but other
# descriptor types may use other attribute names.
published = getattr(desc, 'published', None)
if published:
if start and published < start:
continue
elif end and published > end:
continue
yield desc
def download(self, directory, decompress = True, timeout = None, retries = 3, overwrite = False):
"""
Downloads this file to the given location. If a file already exists this is
a no-op.
:param str directory: destination to download into
:param bool decompress: decompress written file
:param int timeout: timeout when connection becomes idle, no timeout
applied if **None**
:param int retries: maximum attempts to impose
:param bool overwrite: if this file exists but mismatches CollecTor's
checksum then overwrites if **True**, otherwise rases an exception
:returns: **str** with the path we downloaded to
:raises:
* :class:`~stem.DownloadFailed` if the download fails
* **IOError** if a mismatching file exists and **overwrite** is **False**
"""
filename = self.path.split('/')[-1]
if self.compression != Compression.PLAINTEXT and decompress:
filename = filename.rsplit('.', 1)[0]
directory = os.path.expanduser(directory)
path = os.path.join(directory, filename)
if not os.path.exists(directory):
os.makedirs(directory)
# check if this file already exists with the correct checksum
if os.path.exists(path):
with open(path) as prior_file:
expected_hash = binascii.hexlify(base64.b64decode(self.sha256))
actual_hash = hashlib.sha256(prior_file.read()).hexdigest()
if expected_hash == actual_hash:
return path # nothing to do, we already have the file
elif not overwrite:
raise IOError("%s already exists but mismatches CollecTor's checksum (expected: %s, actual: %s)" % (path, expected_hash, actual_hash))
response = stem.util.connection.download(COLLECTOR_URL + self.path, timeout, retries)
if decompress:
response = self.compression.decompress(response)
with open(path, 'wb') as output_file:
output_file.write(response)
self._downloaded_to = path
return path
@staticmethod
def _guess_compression(path):
"""
Determine file comprssion from CollecTor's filename.
"""
for compression in (Compression.LZMA, Compression.BZ2, Compression.GZIP):
if path.endswith(compression.extension):
return compression
return Compression.PLAINTEXT
@staticmethod
def _guess_time_range(path):
"""
Attemt to determine the (start, end) time range from CollecTor's filename.
This provides (None, None) if this cannot be determined.
"""
year_match = YEAR_DATE.search(path)
if year_match:
year, month = map(int, year_match.groups())
start = datetime.datetime(year, month, 1)
if month < 12:
return (start, datetime.datetime(year, month + 1, 1))
else:
return (start, datetime.datetime(year + 1, 1, 1))
sec_match = SEC_DATE.search(path)
if sec_match:
# Descriptors in the 'recent/*' section have filenames with second level
# granularity. Not quite sure why, but since consensus documents are
# published hourly we'll use that as the delta here.
start = datetime.datetime.strptime(sec_match.group(1), '%Y-%m-%d-%H-%M-%S')
return (start, start + datetime.timedelta(seconds = 3600))
return (None, None)
class CollecTor(object):
"""
Downloader for descriptors from CollecTor. The contents of CollecTor are
provided in `an index `_
that's fetched as required.
:var int retries: number of times to attempt the request if downloading it
fails
:var float timeout: duration before we'll time out our request
"""
def __init__(self, retries = 2, timeout = None):
self.retries = retries
self.timeout = timeout
self._cached_index = None
self._cached_files = None
self._cached_index_at = 0
def get_server_descriptors(self, start = None, end = None, cache_to = None, bridge = False, timeout = None, retries = 3):
"""
Provides server descriptors published during the given time range, sorted
oldest to newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param bool bridge: standard descriptors if **False**, bridge if **True**
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.server_descriptor.ServerDescriptor` for the
given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
desc_type = 'server-descriptor' if not bridge else 'bridge-server-descriptor'
for f in self.files(desc_type, start, end):
for desc in f.read(cache_to, desc_type, start, end, timeout = timeout, retries = retries):
yield desc
def get_extrainfo_descriptors(self, start = None, end = None, cache_to = None, bridge = False, timeout = None, retries = 3):
"""
Provides extrainfo descriptors published during the given time range,
sorted oldest to newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param bool bridge: standard descriptors if **False**, bridge if **True**
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.extrainfo_descriptor.RelayExtraInfoDescriptor`
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
desc_type = 'extra-info' if not bridge else 'bridge-extra-info'
for f in self.files(desc_type, start, end):
for desc in f.read(cache_to, desc_type, start, end, timeout = timeout, retries = retries):
yield desc
def get_microdescriptors(self, start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Provides microdescriptors estimated to be published during the given time
range, sorted oldest to newest. Unlike server/extrainfo descriptors,
microdescriptors change very infrequently...
::
"Microdescriptors are expected to be relatively static and only change
about once per week." -dir-spec section 3.3
CollecTor archives only contain microdescriptors that *change*, so hourly
tarballs often contain very few. Microdescriptors also do not contain
their publication timestamp, so this is estimated.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.microdescriptor.Microdescriptor
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
for f in self.files('microdescriptor', start, end):
for desc in f.read(cache_to, 'microdescriptor', start, end, timeout = timeout, retries = retries):
yield desc
def get_consensus(self, start = None, end = None, cache_to = None, document_handler = DocumentHandler.ENTRIES, version = 3, microdescriptor = False, bridge = False, timeout = None, retries = 3):
"""
Provides consensus router status entries published during the given time
range, sorted oldest to newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse a :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:param int version: consensus variant to retrieve (versions 2 or 3)
:param bool microdescriptor: provides the microdescriptor consensus if
**True**, standard consensus otherwise
:param bool bridge: standard descriptors if **False**, bridge if **True**
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.router_status_entry.RouterStatusEntry`
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
if version == 3 and not microdescriptor and not bridge:
desc_type = 'network-status-consensus-3'
elif version == 3 and microdescriptor and not bridge:
desc_type = 'network-status-microdesc-consensus-3'
elif version == 2 and not microdescriptor and not bridge:
desc_type = 'network-status-2'
elif bridge:
desc_type = 'bridge-network-status'
else:
if microdescriptor and version != 3:
raise ValueError('Only v3 microdescriptors are available (not version %s)' % version)
else:
raise ValueError('Only v2 and v3 router status entries are available (not version %s)' % version)
for f in self.files(desc_type, start, end):
for desc in f.read(cache_to, desc_type, start, end, document_handler, timeout = timeout, retries = retries):
yield desc
def get_key_certificates(self, start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Directory authority key certificates for the given time range,
sorted oldest to newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.networkstatus.KeyCertificate
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
for f in self.files('dir-key-certificate-3', start, end):
for desc in f.read(cache_to, 'dir-key-certificate-3', start, end, timeout = timeout, retries = retries):
yield desc
def get_bandwidth_files(self, start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
Bandwidth authority heuristics for the given time range, sorted oldest to
newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.bandwidth_file.BandwidthFile
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
for f in self.files('bandwidth-file', start, end):
for desc in f.read(cache_to, 'bandwidth-file', start, end, timeout = timeout, retries = retries):
yield desc
def get_exit_lists(self, start = None, end = None, cache_to = None, timeout = None, retries = 3):
"""
`TorDNSEL exit lists `_
for the given time range, sorted oldest to newest.
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:param str cache_to: directory to cache archives into, if an archive is
available here it is not downloaded
:param int timeout: timeout for downloading each individual archive when
the connection becomes idle, no timeout applied if **None**
:param int retries: maximum attempts to impose on a per-archive basis
:returns: **iterator** of
:class:`~stem.descriptor.tordnsel.TorDNSEL
for the given time range
:raises: :class:`~stem.DownloadFailed` if the download fails
"""
for f in self.files('tordnsel', start, end):
for desc in f.read(cache_to, 'tordnsel', start, end, timeout = timeout, retries = retries):
yield desc
def index(self, compression = 'best'):
"""
Provides the archives available in CollecTor.
:param descriptor.Compression compression: compression type to
download from, if undefiled we'll use the best decompression available
:returns: **dict** with the archive contents
:raises:
If unable to retrieve the index this provide...
* **ValueError** if json is malformed
* **IOError** if unable to decompress
* :class:`~stem.DownloadFailed` if the download fails
"""
if not self._cached_index or time.time() - self._cached_index_at >= REFRESH_INDEX_RATE:
if compression == 'best':
for option in (Compression.LZMA, Compression.BZ2, Compression.GZIP, Compression.PLAINTEXT):
if option.available:
compression = option
break
elif compression is None:
compression = Compression.PLAINTEXT
extension = compression.extension if compression != Compression.PLAINTEXT else ''
url = COLLECTOR_URL + 'index/index.json' + extension
response = compression.decompress(stem.util.connection.download(url, self.timeout, self.retries))
self._cached_index = json.loads(stem.util.str_tools._to_unicode(response))
self._cached_index_at = time.time()
return self._cached_index
def files(self, descriptor_type = None, start = None, end = None):
"""
Provides files CollecTor presently has, sorted oldest to newest.
:param str descriptor_type: descriptor type or prefix to retrieve
:param datetime.datetime start: publication time to begin with
:param datetime.datetime end: publication time to end with
:returns: **list** of :class:`~stem.descriptor.collector.File`
:raises:
If unable to retrieve the index this provide...
* **ValueError** if json is malformed
* **IOError** if unable to decompress
* :class:`~stem.DownloadFailed` if the download fails
"""
if not self._cached_files or time.time() - self._cached_index_at >= REFRESH_INDEX_RATE:
self._cached_files = sorted(CollecTor._files(self.index(), []), key = lambda x: x.start if x.start else FUTURE)
matches = []
for f in self._cached_files:
if start and (f.end is None or f.end < start):
continue # only contains descriptors before time range
elif end and (f.start is None or f.start > end):
continue # only contains descriptors after time range
if descriptor_type is None or any([desc_type.startswith(descriptor_type) for desc_type in f.types]):
matches.append(f)
return matches
@staticmethod
def _files(val, path):
"""
Recursively provies files within the index.
:param dict val: index hash
:param list path: path we've transversed into
:returns: **list** of :class:`~stem.descriptor.collector.File`
"""
if not isinstance(val, dict):
return [] # leaf node without any files
files = []
for k, v in val.items():
if k == 'files':
for attr in v:
file_path = '/'.join(path + [attr.get('path')])
files.append(File(file_path, attr.get('types'), attr.get('size'), attr.get('sha256'), attr.get('first_published'), attr.get('last_published'), attr.get('last_modified')))
elif k == 'directories':
for attr in v:
files.extend(CollecTor._files(attr, path + [attr.get('path')]))
return files
stem-1.8.0/stem/descriptor/export.py 0000664 0001750 0001750 00000010104 13501272761 020233 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Toolkit for exporting descriptors to other formats.
**Module Overview:**
::
export_csv - Exports descriptors to a CSV
export_csv_file - Writes exported CSV output to a file
.. deprecated:: 1.7.0
This module will likely be removed in Stem 2.0 due to lack of usage. If you
use this modle please `let me know `_.
"""
import csv
try:
from cStringIO import StringIO
except ImportError:
from io import StringIO
import stem.descriptor
import stem.prereq
class _ExportDialect(csv.excel):
lineterminator = '\n'
def export_csv(descriptors, included_fields = (), excluded_fields = (), header = True):
"""
Provides a newline separated CSV for one or more descriptors. If simply
provided with descriptors then the CSV contains all of its attributes,
labeled with a header row. Either 'included_fields' or 'excluded_fields' can
be used for more granular control over its attributes and the order.
:param Descriptor,list descriptors: either a
:class:`~stem.descriptor.Descriptor` or list of descriptors to be exported
:param list included_fields: attributes to include in the csv
:param list excluded_fields: attributes to exclude from the csv
:param bool header: if **True** then the first line will be a comma separated
list of the attribute names (**only supported in python 2.7 and higher**)
:returns: **str** of the CSV for the descriptors, one per line
:raises: **ValueError** if descriptors contain more than one descriptor type
"""
output_buffer = StringIO()
export_csv_file(output_buffer, descriptors, included_fields, excluded_fields, header)
return output_buffer.getvalue()
def export_csv_file(output_file, descriptors, included_fields = (), excluded_fields = (), header = True):
"""
Similar to :func:`stem.descriptor.export.export_csv`, except that the CSV is
written directly to a file.
:param file output_file: file to be written to
:param Descriptor,list descriptors: either a
:class:`~stem.descriptor.Descriptor` or list of descriptors to be exported
:param list included_fields: attributes to include in the csv
:param list excluded_fields: attributes to exclude from the csv
:param bool header: if **True** then the first line will be a comma separated
list of the attribute names (**only supported in python 2.7 and higher**)
:returns: **str** of the CSV for the descriptors, one per line
:raises: **ValueError** if descriptors contain more than one descriptor type
"""
if isinstance(descriptors, stem.descriptor.Descriptor):
descriptors = (descriptors,)
if not descriptors:
return
descriptor_type = type(descriptors[0])
descriptor_type_label = descriptor_type.__name__
included_fields = list(included_fields)
# If the user didn't specify the fields to include then export everything,
# ordered alphabetically. If they did specify fields then make sure that
# they exist.
desc_attr = sorted(vars(descriptors[0]).keys())
if included_fields:
for field in included_fields:
if field not in desc_attr:
raise ValueError("%s does not have a '%s' attribute, valid fields are: %s" % (descriptor_type_label, field, ', '.join(desc_attr)))
else:
included_fields = [attr for attr in desc_attr if not attr.startswith('_')]
for field in excluded_fields:
try:
included_fields.remove(field)
except ValueError:
pass
writer = csv.DictWriter(output_file, included_fields, dialect = _ExportDialect(), extrasaction='ignore')
if header and not stem.prereq._is_python_26():
writer.writeheader()
for desc in descriptors:
if not isinstance(desc, stem.descriptor.Descriptor):
raise ValueError('Unable to export a descriptor CSV since %s is not a descriptor.' % type(desc).__name__)
elif descriptor_type != type(desc):
raise ValueError('To export a descriptor CSV all of the descriptors must be of the same type. First descriptor was a %s but we later got a %s.' % (descriptor_type_label, type(desc)))
writer.writerow(vars(desc))
stem-1.8.0/stem/descriptor/router_status_entry.py 0000664 0001750 0001750 00000060456 13564354230 023076 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for router status entries, the information for individual routers
within a network status document. This information is provided from a few
sources...
* control port via 'GETINFO ns/\\*' and 'GETINFO md/\\*' queries
* router entries in a network status document, like the cached-consensus
**Module Overview:**
::
RouterStatusEntry - Common parent for router status entries
|- RouterStatusEntryV2 - Entry for a network status v2 document
| +- RouterStatusEntryBridgeV2 - Entry for a bridge flavored v2 document
|
|- RouterStatusEntryV3 - Entry for a network status v3 document
+- RouterStatusEntryMicroV3 - Entry for a microdescriptor flavored v3 document
"""
import binascii
import io
import stem.exit_policy
import stem.prereq
import stem.util.str_tools
from stem.descriptor import (
KEYWORD_LINE,
Descriptor,
_descriptor_content,
_value,
_values,
_descriptor_components,
_parse_protocol_line,
_read_until_keywords,
_random_nickname,
_random_ipv4_address,
_random_date,
)
_parse_pr_line = _parse_protocol_line('pr', 'protocols')
def _parse_file(document_file, validate, entry_class, entry_keyword = 'r', start_position = None, end_position = None, section_end_keywords = (), extra_args = ()):
"""
Reads a range of the document_file containing some number of entry_class
instances. We deliminate the entry_class entries by the keyword on their
first line (entry_keyword). When finished the document is left at the
end_position.
Either an end_position or section_end_keywords must be provided.
:param file document_file: file with network status document content
:param bool validate: checks the validity of the document's contents if
**True**, skips these checks otherwise
:param class entry_class: class to construct instance for
:param str entry_keyword: first keyword for the entry instances
:param int start_position: start of the section, default is the current position
:param int end_position: end of the section
:param tuple section_end_keywords: keyword(s) that deliminate the end of the
section if no end_position was provided
:param tuple extra_args: extra arguments for the entry_class (after the
content and validate flag)
:returns: iterator over entry_class instances
:raises:
* **ValueError** if the contents is malformed and validate is **True**
* **IOError** if the file can't be read
"""
if start_position:
document_file.seek(start_position)
else:
start_position = document_file.tell()
# check if we're starting at the end of the section (ie, there's no entries to read)
if section_end_keywords:
first_keyword = None
line_match = KEYWORD_LINE.match(stem.util.str_tools._to_unicode(document_file.readline()))
if line_match:
first_keyword = line_match.groups()[0]
document_file.seek(start_position)
if first_keyword in section_end_keywords:
return
while end_position is None or document_file.tell() < end_position:
desc_lines, ending_keyword = _read_until_keywords(
(entry_keyword,) + section_end_keywords,
document_file,
ignore_first = True,
end_position = end_position,
include_ending_keyword = True
)
desc_content = bytes.join(b'', desc_lines)
if desc_content:
yield entry_class(desc_content, validate, *extra_args)
# check if we stopped at the end of the section
if ending_keyword in section_end_keywords:
break
else:
break
def _parse_r_line(descriptor, entries):
# Parses a RouterStatusEntry's 'r' line. They're very nearly identical for
# all current entry types (v2, v3, and microdescriptor v3) with one little
# wrinkle: only the microdescriptor flavor excludes a 'digest' field.
#
# For v2 and v3 router status entries:
# "r" nickname identity digest publication IP ORPort DirPort
# example: r mauer BD7xbfsCFku3+tgybEZsg8Yjhvw itcuKQ6PuPLJ7m/Oi928WjO2j8g 2012-06-22 13:19:32 80.101.105.103 9001 0
#
# For v3 microdescriptor router status entries:
# "r" nickname identity publication IP ORPort DirPort
# example: r Konata ARIJF2zbqirB9IwsW0mQznccWww 2012-09-24 13:40:40 69.64.48.168 9001 9030
value = _value('r', entries)
include_digest = not isinstance(descriptor, RouterStatusEntryMicroV3)
r_comp = value.split(' ')
# inject a None for the digest to normalize the field positioning
if not include_digest:
r_comp.insert(2, None)
if len(r_comp) < 8:
expected_field_count = 'eight' if include_digest else 'seven'
raise ValueError("%s 'r' line must have %s values: r %s" % (descriptor._name(), expected_field_count, value))
if not stem.util.tor_tools.is_valid_nickname(r_comp[0]):
raise ValueError("%s nickname isn't valid: %s" % (descriptor._name(), r_comp[0]))
elif not stem.util.connection.is_valid_ipv4_address(r_comp[5]):
raise ValueError("%s address isn't a valid IPv4 address: %s" % (descriptor._name(), r_comp[5]))
elif not stem.util.connection.is_valid_port(r_comp[6]):
raise ValueError('%s ORPort is invalid: %s' % (descriptor._name(), r_comp[6]))
elif not stem.util.connection.is_valid_port(r_comp[7], allow_zero = True):
raise ValueError('%s DirPort is invalid: %s' % (descriptor._name(), r_comp[7]))
descriptor.nickname = r_comp[0]
descriptor.fingerprint = _base64_to_hex(r_comp[1])
if include_digest:
descriptor.digest = _base64_to_hex(r_comp[2])
descriptor.address = r_comp[5]
descriptor.or_port = int(r_comp[6])
descriptor.dir_port = None if r_comp[7] == '0' else int(r_comp[7])
try:
published = '%s %s' % (r_comp[3], r_comp[4])
descriptor.published = stem.util.str_tools._parse_timestamp(published)
except ValueError:
raise ValueError("Publication time time wasn't parsable: r %s" % value)
def _parse_a_line(descriptor, entries):
# "a" SP address ":" portlist
# example: a [2001:888:2133:0:82:94:251:204]:9001
or_addresses = []
for value in _values('a', entries):
if ':' not in value:
raise ValueError("%s 'a' line must be of the form '[address]:[ports]': a %s" % (descriptor._name(), value))
address, port = value.rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address) and not stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True):
raise ValueError("%s 'a' line must start with an IPv6 address: a %s" % (descriptor._name(), value))
if stem.util.connection.is_valid_port(port):
or_addresses.append((address.lstrip('[').rstrip(']'), int(port), stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True)))
else:
raise ValueError("%s 'a' line had an invalid port (%s): a %s" % (descriptor._name(), port, value))
descriptor.or_addresses = or_addresses
def _parse_s_line(descriptor, entries):
# "s" Flags
# example: s Named Running Stable Valid
value = _value('s', entries)
flags = [] if value == '' else value.split(' ')
descriptor.flags = flags
for flag in flags:
if flags.count(flag) > 1:
raise ValueError('%s had duplicate flags: s %s' % (descriptor._name(), value))
elif flag == '':
raise ValueError("%s had extra whitespace on its 's' line: s %s" % (descriptor._name(), value))
def _parse_v_line(descriptor, entries):
# "v" version
# example: v Tor 0.2.2.35
#
# The spec says that if this starts with "Tor " then what follows is a
# tor version. If not then it has "upgraded to a more sophisticated
# protocol versioning system".
value = _value('v', entries)
descriptor.version_line = value
if value.startswith('Tor '):
try:
descriptor.version = stem.version._get_version(value[4:])
except ValueError as exc:
raise ValueError('%s has a malformed tor version (%s): v %s' % (descriptor._name(), exc, value))
def _parse_w_line(descriptor, entries):
# "w" "Bandwidth=" INT ["Measured=" INT] ["Unmeasured=1"]
# example: w Bandwidth=7980
value = _value('w', entries)
w_comp = value.split(' ')
if len(w_comp) < 1:
raise ValueError("%s 'w' line is blank: w %s" % (descriptor._name(), value))
elif not w_comp[0].startswith('Bandwidth='):
raise ValueError("%s 'w' line needs to start with a 'Bandwidth=' entry: w %s" % (descriptor._name(), value))
bandwidth = None
measured = None
is_unmeasured = False
unrecognized_bandwidth_entries = []
for w_entry in w_comp:
if '=' in w_entry:
w_key, w_value = w_entry.split('=', 1)
else:
w_key, w_value = w_entry, None
if w_key == 'Bandwidth':
if not (w_value and w_value.isdigit()):
raise ValueError("%s 'Bandwidth=' entry needs to have a numeric value: w %s" % (descriptor._name(), value))
bandwidth = int(w_value)
elif w_key == 'Measured':
if not (w_value and w_value.isdigit()):
raise ValueError("%s 'Measured=' entry needs to have a numeric value: w %s" % (descriptor._name(), value))
measured = int(w_value)
elif w_key == 'Unmeasured':
if w_value != '1':
raise ValueError("%s 'Unmeasured=' should only have the value of '1': w %s" % (descriptor._name(), value))
is_unmeasured = True
else:
unrecognized_bandwidth_entries.append(w_entry)
descriptor.bandwidth = bandwidth
descriptor.measured = measured
descriptor.is_unmeasured = is_unmeasured
descriptor.unrecognized_bandwidth_entries = unrecognized_bandwidth_entries
def _parse_p_line(descriptor, entries):
# "p" ("accept" / "reject") PortList
#
# examples:
#
# p accept 80,110,143,443,993,995,6660-6669,6697,7000-7001
# p reject 1-65535
value = _value('p', entries)
try:
descriptor.exit_policy = stem.exit_policy.MicroExitPolicy(value)
except ValueError as exc:
raise ValueError('%s exit policy is malformed (%s): p %s' % (descriptor._name(), exc, value))
def _parse_id_line(descriptor, entries):
# "id" "ed25519" ed25519-identity
#
# examples:
#
# id ed25519 none
# id ed25519 8RH34kO07Pp+XYwzdoATVyCibIvmbslUjRkAm7J4IA8
value = _value('id', entries)
if value:
if descriptor.document and not descriptor.document.is_vote:
raise ValueError("%s 'id' line should only appear in votes: id %s" % (descriptor._name(), value))
value_comp = value.split()
if len(value_comp) >= 2:
descriptor.identifier_type = value_comp[0]
descriptor.identifier = value_comp[1]
else:
raise ValueError("'id' lines should contain both the key type and digest: id %s" % value)
def _parse_m_line(descriptor, entries):
# "m" methods 1*(algorithm "=" digest)
# example: m 8,9,10,11,12 sha256=g1vx9si329muxV3tquWIXXySNOIwRGMeAESKs/v4DWs
all_hashes = []
for value in _values('m', entries):
m_comp = value.split(' ')
if not (descriptor.document and descriptor.document.is_vote):
vote_status = 'vote' if descriptor.document else ''
raise ValueError("%s 'm' line should only appear in votes (appeared in a %s): m %s" % (descriptor._name(), vote_status, value))
elif len(m_comp) < 1:
raise ValueError("%s 'm' line needs to start with a series of methods: m %s" % (descriptor._name(), value))
try:
methods = [int(entry) for entry in m_comp[0].split(',')]
except ValueError:
raise ValueError('%s microdescriptor methods should be a series of comma separated integers: m %s' % (descriptor._name(), value))
hashes = {}
for entry in m_comp[1:]:
if '=' not in entry:
raise ValueError("%s can only have a series of 'algorithm=digest' mappings after the methods: m %s" % (descriptor._name(), value))
hash_name, digest = entry.split('=', 1)
hashes[hash_name] = digest
all_hashes.append((methods, hashes))
descriptor.microdescriptor_hashes = all_hashes
def _parse_microdescriptor_m_line(descriptor, entries):
# "m" digest
# example: m aiUklwBrua82obG5AsTX+iEpkjQA2+AQHxZ7GwMfY70
descriptor.microdescriptor_digest = _value('m', entries)
# TODO: drop the following in stem 2.x
descriptor.digest = _base64_to_hex(_value('m', entries), check_if_fingerprint = False)
def _base64_to_hex(identity, check_if_fingerprint = True):
"""
Decodes a base64 value to hex. For example...
::
>>> _base64_to_hex('p1aag7VwarGxqctS7/fS0y5FU+s')
'A7569A83B5706AB1B1A9CB52EFF7D2D32E4553EB'
:param str identity: encoded fingerprint from the consensus
:param bool check_if_fingerprint: asserts that the result is a fingerprint if **True**
:returns: **str** with the uppercase hex encoding of the relay's fingerprint
:raises: **ValueError** if the result isn't a valid fingerprint
"""
try:
identity_decoded = stem.util.str_tools._decode_b64(stem.util.str_tools._to_bytes(identity))
except (TypeError, binascii.Error):
raise ValueError("Unable to decode identity string '%s'" % identity)
fingerprint = binascii.hexlify(identity_decoded).upper()
if stem.prereq.is_python_3():
fingerprint = stem.util.str_tools._to_unicode(fingerprint)
if check_if_fingerprint:
if not stem.util.tor_tools.is_valid_fingerprint(fingerprint):
raise ValueError("Decoded '%s' to be '%s', which isn't a valid fingerprint" % (identity, fingerprint))
return fingerprint
class RouterStatusEntry(Descriptor):
"""
Information about an individual router stored within a network status
document. This is the common parent for concrete status entry types.
:var stem.descriptor.networkstatus.NetworkStatusDocument document: **\\*** document that this descriptor came from
:var str nickname: **\\*** router's nickname
:var str fingerprint: **\\*** router's fingerprint
:var datetime published: **\\*** router's publication
:var str address: **\\*** router's IP address
:var int or_port: **\\*** router's ORPort
:var int dir_port: **\\*** router's DirPort
:var list flags: **\\*** list of :data:`~stem.Flag` associated with the relay
:var stem.version.Version version: parsed version of tor, this is **None** if
the relay's using a new versioning scheme
:var str version_line: versioning information reported by the relay
"""
ATTRIBUTES = {
'nickname': (None, _parse_r_line),
'fingerprint': (None, _parse_r_line),
'published': (None, _parse_r_line),
'address': (None, _parse_r_line),
'or_port': (None, _parse_r_line),
'dir_port': (None, _parse_r_line),
'flags': (None, _parse_s_line),
'version_line': (None, _parse_v_line),
'version': (None, _parse_v_line),
}
PARSER_FOR_LINE = {
'r': _parse_r_line,
's': _parse_s_line,
'v': _parse_v_line,
}
@classmethod
def from_str(cls, content, **kwargs):
# Router status entries don't have their own @type annotation, so to make
# our subclass from_str() work we need to do the type inferencing ourself.
if cls == RouterStatusEntry:
raise NotImplementedError('Please use the from_str() method from RouterStatusEntry subclasses, not RouterStatusEntry itself')
elif 'descriptor_type' in kwargs:
raise ValueError("Router status entries don't have their own @type annotation. As such providing a 'descriptor_type' argument with RouterStatusEntry.from_str() does not work. Please drop the 'descriptor_type' argument when using this these subclasses' from_str() method.")
is_multiple = kwargs.pop('multiple', False)
validate = kwargs.pop('validate', False)
results = list(_parse_file(io.BytesIO(stem.util.str_tools._to_bytes(content)), validate, cls, **kwargs))
if is_multiple:
return results
elif len(results) == 1:
return results[0]
else:
raise ValueError("Descriptor.from_str() expected a single descriptor, but had %i instead. Please include 'multiple = True' if you want a list of results instead." % len(results))
def __init__(self, content, validate = False, document = None):
"""
Parse a router descriptor in a network status document.
:param str content: router descriptor content to be parsed
:param NetworkStatusDocument document: document this descriptor came from
:param bool validate: checks the validity of the content if **True**, skips
these checks otherwise
:raises: **ValueError** if the descriptor data is invalid
"""
super(RouterStatusEntry, self).__init__(content, lazy_load = not validate)
self.document = document
entries = _descriptor_components(content, validate)
if validate:
for keyword in self._required_fields():
if keyword not in entries:
raise ValueError("%s must have a '%s' line:\n%s" % (self._name(True), keyword, str(self)))
for keyword in self._single_fields():
if keyword in entries and len(entries[keyword]) > 1:
raise ValueError("%s can only have a single '%s' line, got %i:\n%s" % (self._name(True), keyword, len(entries[keyword]), str(self)))
if 'r' != list(entries.keys())[0]:
raise ValueError("%s are expected to start with a 'r' line:\n%s" % (self._name(True), str(self)))
self._parse(entries, validate)
else:
self._entries = entries
def _name(self, is_plural = False):
"""
Name for this descriptor type.
"""
return 'Router status entries' if is_plural else 'Router status entry'
def _required_fields(self):
"""
Provides lines that must appear in the descriptor.
"""
return ()
def _single_fields(self):
"""
Provides lines that can only appear in the descriptor once.
"""
return ()
class RouterStatusEntryV2(RouterStatusEntry):
"""
Information about an individual router stored within a version 2 network
status document.
:var str digest: **\\*** router's upper-case hex digest
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
TYPE_ANNOTATION_NAME = 'network-status-consensus-2'
ATTRIBUTES = dict(RouterStatusEntry.ATTRIBUTES, **{
'digest': (None, _parse_r_line),
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('r', '%s p1aag7VwarGxqctS7/fS0y5FU+s oQZFLYe9e4A7bOkWKR7TaNxb0JE %s %s 9001 0' % (_random_nickname(), _random_date(), _random_ipv4_address())),
))
def _name(self, is_plural = False):
return 'Router status entries (v2)' if is_plural else 'Router status entry (v2)'
def _required_fields(self):
return ('r')
def _single_fields(self):
return ('r', 's', 'v')
class RouterStatusEntryBridgeV2(RouterStatusEntryV2):
"""
Information about an individual router stored within a bridge flavored
version 2 network status document.
.. versionadded:: 1.8.0
"""
TYPE_ANNOTATION_NAME = 'bridge-network-status'
class RouterStatusEntryV3(RouterStatusEntry):
"""
Information about an individual router stored within a version 3 network
status document.
:var list or_addresses: **\\*** relay's OR addresses, this is a tuple listing
of the form (address (**str**), port (**int**), is_ipv6 (**bool**))
:var str identifier_type: identity digest key type
:var str identifier: base64 encoded identity digest
:var str digest: **\\*** router's upper-case hex digest
:var int bandwidth: bandwidth measured to be available by the relay, this is
an arbitrary units (currently kilobytes per second) heuristic generated by
the Bandwidth authoritites to weight relay selection
:var int measured: *bandwidth* vote provided by a bandwidth authority
:var bool is_unmeasured: *bandwidth* measurement isn't based on three or more
measurements
:var list unrecognized_bandwidth_entries: **\\*** bandwidth weighting
information that isn't yet recognized
:var stem.exit_policy.MicroExitPolicy exit_policy: router's exit policy
:var dict protocols: mapping of protocols to their supported versions
:var list microdescriptor_hashes: **\\*** tuples of two values, the list of
consensus methods for generating a set of digests and the 'algorithm =>
digest' mappings
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
.. versionchanged:: 1.5.0
Added the identifier and identifier_type attributes.
.. versionchanged:: 1.6.0
Added the protocols attribute.
"""
TYPE_ANNOTATION_NAME = 'network-status-consensus-3'
ATTRIBUTES = dict(RouterStatusEntry.ATTRIBUTES, **{
'digest': (None, _parse_r_line),
'or_addresses': ([], _parse_a_line),
'identifier_type': (None, _parse_id_line),
'identifier': (None, _parse_id_line),
'bandwidth': (None, _parse_w_line),
'measured': (None, _parse_w_line),
'is_unmeasured': (False, _parse_w_line),
'unrecognized_bandwidth_entries': ([], _parse_w_line),
'exit_policy': (None, _parse_p_line),
'protocols': ({}, _parse_pr_line),
'microdescriptor_hashes': ([], _parse_m_line),
})
PARSER_FOR_LINE = dict(RouterStatusEntry.PARSER_FOR_LINE, **{
'a': _parse_a_line,
'w': _parse_w_line,
'p': _parse_p_line,
'pr': _parse_pr_line,
'id': _parse_id_line,
'm': _parse_m_line,
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('r', '%s p1aag7VwarGxqctS7/fS0y5FU+s oQZFLYe9e4A7bOkWKR7TaNxb0JE %s %s 9001 0' % (_random_nickname(), _random_date(), _random_ipv4_address())),
('s', 'Fast Named Running Stable Valid'),
))
def _name(self, is_plural = False):
return 'Router status entries (v3)' if is_plural else 'Router status entry (v3)'
def _required_fields(self):
return ('r', 's')
def _single_fields(self):
return ('r', 's', 'v', 'w', 'p', 'pr')
class RouterStatusEntryMicroV3(RouterStatusEntry):
"""
Information about an individual router stored within a microdescriptor
flavored network status document.
:var list or_addresses: **\\*** relay's OR addresses, this is a tuple listing
of the form (address (**str**), port (**int**), is_ipv6 (**bool**))
:var int bandwidth: bandwidth claimed by the relay (in kb/s)
:var int measured: bandwidth measured to be available by the relay
:var bool is_unmeasured: bandwidth measurement isn't based on three or more
measurements
:var list unrecognized_bandwidth_entries: **\\*** bandwidth weighting
information that isn't yet recognized
:var dict protocols: mapping of protocols to their supported versions
:var str digest: **\\*** router's hex encoded digest of our corresponding
microdescriptor (**deprecated**, use microdescriptor_digest instead)
:var str microdescriptor_digest: **\\*** router's base64 encoded digest of our corresponding microdescriptor
.. versionchanged:: 1.6.0
Added the protocols attribute.
.. versionchanged:: 1.7.0
Added the or_addresses attribute.
.. versionchanged:: 1.7.0
Added the microdescriptor_digest attribute to replace our now deprecated digest attribute.
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
TYPE_ANNOTATION_NAME = 'network-status-microdesc-consensus-3'
ATTRIBUTES = dict(RouterStatusEntry.ATTRIBUTES, **{
'or_addresses': ([], _parse_a_line),
'bandwidth': (None, _parse_w_line),
'measured': (None, _parse_w_line),
'is_unmeasured': (False, _parse_w_line),
'unrecognized_bandwidth_entries': ([], _parse_w_line),
'protocols': ({}, _parse_pr_line),
'microdescriptor_digest': (None, _parse_microdescriptor_m_line),
'digest': (None, _parse_microdescriptor_m_line),
})
PARSER_FOR_LINE = dict(RouterStatusEntry.PARSER_FOR_LINE, **{
'a': _parse_a_line,
'w': _parse_w_line,
'm': _parse_microdescriptor_m_line,
'pr': _parse_pr_line,
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('r', '%s ARIJF2zbqirB9IwsW0mQznccWww %s %s 9001 9030' % (_random_nickname(), _random_date(), _random_ipv4_address())),
('m', 'aiUklwBrua82obG5AsTX+iEpkjQA2+AQHxZ7GwMfY70'),
('s', 'Fast Guard HSDir Named Running Stable V2Dir Valid'),
))
def _name(self, is_plural = False):
return 'Router status entries (micro v3)' if is_plural else 'Router status entry (micro v3)'
def _required_fields(self):
return ('r', 's', 'm')
def _single_fields(self):
return ('r', 's', 'v', 'w', 'm', 'pr')
stem-1.8.0/stem/descriptor/tordnsel.py 0000664 0001750 0001750 00000007620 13501272761 020555 0 ustar atagar atagar 0000000 0000000 # Copyright 2013-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for `TorDNSEL `_
exit list files.
::
TorDNSEL - Exit list provided by TorDNSEL
"""
import stem.util.connection
import stem.util.str_tools
import stem.util.tor_tools
from stem.descriptor import (
Descriptor,
_read_until_keywords,
_descriptor_components,
)
def _parse_file(tordnsel_file, validate = False, **kwargs):
"""
Iterates over a tordnsel file.
:returns: iterator for :class:`~stem.descriptor.tordnsel.TorDNSEL`
instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is **True**
* **IOError** if the file can't be read
"""
# skip content prior to the first ExitNode
_read_until_keywords('ExitNode', tordnsel_file, skip = True)
while True:
contents = _read_until_keywords('ExitAddress', tordnsel_file)
contents += _read_until_keywords('ExitNode', tordnsel_file)
if contents:
yield TorDNSEL(bytes.join(b'', contents), validate, **kwargs)
else:
break # done parsing file
class TorDNSEL(Descriptor):
"""
TorDNSEL descriptor (`exitlist specification
`_)
:var str fingerprint: **\\*** authority's fingerprint
:var datetime published: **\\*** time in UTC when this descriptor was made
:var datetime last_status: **\\*** time in UTC when the relay was seen in a v2 network status
:var list exit_addresses: **\\*** list of (str address, datetime date) tuples consisting of the found IPv4 exit address and the time
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
TYPE_ANNOTATION_NAME = 'tordnsel'
def __init__(self, raw_contents, validate):
super(TorDNSEL, self).__init__(raw_contents)
raw_contents = stem.util.str_tools._to_unicode(raw_contents)
entries = _descriptor_components(raw_contents, validate)
self.fingerprint = None
self.published = None
self.last_status = None
self.exit_addresses = []
self._parse(entries, validate)
def _parse(self, entries, validate):
for keyword, values in list(entries.items()):
value, block_type, block_content = values[0]
if validate and block_content:
raise ValueError('Unexpected block content: %s' % block_content)
if keyword == 'ExitNode':
if validate and not stem.util.tor_tools.is_valid_fingerprint(value):
raise ValueError('Tor relay fingerprints consist of forty hex digits: %s' % value)
self.fingerprint = value
elif keyword == 'Published':
try:
self.published = stem.util.str_tools._parse_timestamp(value)
except ValueError:
if validate:
raise ValueError("Published time wasn't parsable: %s" % value)
elif keyword == 'LastStatus':
try:
self.last_status = stem.util.str_tools._parse_timestamp(value)
except ValueError:
if validate:
raise ValueError("LastStatus time wasn't parsable: %s" % value)
elif keyword == 'ExitAddress':
for value, block_type, block_content in values:
address, date = value.split(' ', 1)
if validate:
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError("ExitAddress isn't a valid IPv4 address: %s" % address)
elif block_content:
raise ValueError('Unexpected block content: %s' % block_content)
try:
date = stem.util.str_tools._parse_timestamp(date)
self.exit_addresses.append((address, date))
except ValueError:
if validate:
raise ValueError("ExitAddress found time wasn't parsable: %s" % value)
elif validate:
raise ValueError('Unrecognized keyword: %s' % keyword)
stem-1.8.0/stem/descriptor/__init__.py 0000664 0001750 0001750 00000156516 13565322274 020500 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Package for parsing and processing descriptor data.
**Module Overview:**
::
parse_file - Parses the descriptors in a file.
create_signing_key - Cretes a signing key that can be used for creating descriptors.
Compression - method of descriptor decompression
Descriptor - Common parent for all descriptor file types.
| |- content - creates the text of a new descriptor
| |- create - creates a new descriptor
| +- from_str - provides a parsed descriptor for the given string
|
|- type_annotation - provides our @type annotation
|- get_path - location of the descriptor on disk if it came from a file
|- get_archive_path - location of the descriptor within the archive it came from
|- get_bytes - similar to str(), but provides our original bytes content
|- get_unrecognized_lines - unparsed descriptor content
+- __str__ - string that the descriptor was made from
.. data:: DigestHash (enum)
.. versionadded:: 1.8.0
Hash function used by tor for descriptor digests.
=========== ===========
DigestHash Description
=========== ===========
SHA1 SHA1 hash
SHA256 SHA256 hash
=========== ===========
.. data:: DigestEncoding (enum)
.. versionadded:: 1.8.0
Encoding of descriptor digests.
================= ===========
DigestEncoding Description
================= ===========
RAW hash object
HEX uppercase hexidecimal encoding
BASE64 base64 encoding `without trailing '=' padding `_
================= ===========
.. data:: DocumentHandler (enum)
Ways in which we can parse a
:class:`~stem.descriptor.networkstatus.NetworkStatusDocument`.
Both **ENTRIES** and **BARE_DOCUMENT** have a 'thin' document, which doesn't
have a populated **routers** attribute. This allows for lower memory usage
and upfront runtime. However, if read time and memory aren't a concern then
**DOCUMENT** can provide you with a fully populated document.
Handlers don't change the fact that most methods that provide
descriptors return an iterator. In the case of **DOCUMENT** and
**BARE_DOCUMENT** that iterator would have just a single item -
the document itself.
Simple way to handle this is to call **next()** to get the iterator's one and
only value...
::
import stem.descriptor.remote
from stem.descriptor import DocumentHandler
consensus = next(stem.descriptor.remote.get_consensus(
document_handler = DocumentHandler.BARE_DOCUMENT,
)
=================== ===========
DocumentHandler Description
=================== ===========
**ENTRIES** Iterates over the contained :class:`~stem.descriptor.router_status_entry.RouterStatusEntry`. Each has a reference to the bare document it came from (through its **document** attribute).
**DOCUMENT** :class:`~stem.descriptor.networkstatus.NetworkStatusDocument` with the :class:`~stem.descriptor.router_status_entry.RouterStatusEntry` it contains (through its **routers** attribute).
**BARE_DOCUMENT** :class:`~stem.descriptor.networkstatus.NetworkStatusDocument` **without** a reference to its contents (the :class:`~stem.descriptor.router_status_entry.RouterStatusEntry` are unread).
=================== ===========
"""
import base64
import codecs
import collections
import copy
import io
import os
import random
import re
import string
import tarfile
import stem.prereq
import stem.util
import stem.util.enum
import stem.util.str_tools
import stem.util.system
try:
# added in python 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
__all__ = [
'bandwidth_file',
'certificate',
'collector',
'export',
'extrainfo_descriptor',
'hidden_service',
'microdescriptor',
'networkstatus',
'reader',
'remote',
'router_status_entry',
'server_descriptor',
'tordnsel',
'Descriptor',
'parse_file',
]
UNSEEKABLE_MSG = """\
File object isn't seekable. Try using Descriptor.from_str() instead:
content = my_file.read()
parsed_descriptors = stem.descriptor.Descriptor.from_str(content)
"""
KEYWORD_CHAR = 'a-zA-Z0-9-'
WHITESPACE = ' \t'
KEYWORD_LINE = re.compile('^([%s]+)(?:[%s]+(.*))?$' % (KEYWORD_CHAR, WHITESPACE))
SPECIFIC_KEYWORD_LINE = '^(%%s)(?:[%s]+(.*))?$' % WHITESPACE
PGP_BLOCK_START = re.compile('^-----BEGIN ([%s%s]+)-----$' % (KEYWORD_CHAR, WHITESPACE))
PGP_BLOCK_END = '-----END %s-----'
EMPTY_COLLECTION = ([], {}, set())
DIGEST_TYPE_INFO = b'\x00\x01'
DIGEST_PADDING = b'\xFF'
DIGEST_SEPARATOR = b'\x00'
CRYPTO_BLOB = """
MIGJAoGBAJv5IIWQ+WDWYUdyA/0L8qbIkEVH/cwryZWoIaPAzINfrw1WfNZGtBmg
skFtXhOHHqTRN4GPPrZsAIUOQGzQtGb66IQgT4tO/pj+P6QmSCCdTfhvGfgTCsC+
WPi4Fl2qryzTb3QO5r5x7T8OsG2IBUET1bLQzmtbC560SYR49IvVAgMBAAE=
"""
DigestHash = stem.util.enum.UppercaseEnum(
'SHA1',
'SHA256',
)
DigestEncoding = stem.util.enum.UppercaseEnum(
'RAW',
'HEX',
'BASE64',
)
DocumentHandler = stem.util.enum.UppercaseEnum(
'ENTRIES',
'DOCUMENT',
'BARE_DOCUMENT',
)
class _Compression(object):
"""
Compression method supported by CollecTor.
:var bool available: **True** if this method of decryption is available,
**False** otherwise
:var str encoding: `http 'Accept-Encoding' parameter `_
:var str extension: file extension of this compression
.. versionadded:: 1.8.0
"""
def __init__(self, name, module, encoding, extension, decompression_func):
if module is None:
self._module = None
self.available = True
else:
# Compression modules are optional. Usually gzip and bz2 are available,
# but they might be missing if compiling python yourself. As for lzma it
# was added in python 3.3.
try:
self._module = __import__(module)
self.available = True
except ImportError:
self._module = None
self.available = False
self.extension = extension
self.encoding = encoding
self._name = name
self._module_name = module
self._decompression_func = decompression_func
def decompress(self, content):
"""
Decompresses the given content via this method.
:param bytes content: content to be decompressed
:returns: **bytes** with the decompressed content
:raises:
If unable to decompress this provide...
* **IOError** if content isn't compressed with this
* **ImportError** if this method if decompression is unavalable
"""
if not self.available:
if self._name == 'zstd':
raise ImportError('Decompressing zstd data requires https://pypi.org/project/zstandard/')
elif self._name == 'lzma':
raise ImportError('Decompressing lzma data requires https://docs.python.org/3/library/lzma.html')
else:
raise ImportError("'%s' decompression module is unavailable" % self._module_name)
try:
return self._decompression_func(self._module, content)
except Exception as exc:
raise IOError('Failed to decompress as %s: %s' % (self, exc))
def __str__(self):
return self._name
def _zstd_decompress(module, content):
output_buffer = io.BytesIO()
with module.ZstdDecompressor().write_to(output_buffer) as decompressor:
decompressor.write(content)
return output_buffer.getvalue()
Compression = stem.util.enum.Enum(
('PLAINTEXT', _Compression('plaintext', None, 'identity', '.txt', lambda module, content: content)),
('GZIP', _Compression('gzip', 'zlib', 'gzip', '.gz', lambda module, content: module.decompress(content, module.MAX_WBITS | 32))),
('BZ2', _Compression('bzip2', 'bz2', 'bzip2', '.bz2', lambda module, content: module.decompress(content))),
('LZMA', _Compression('lzma', 'lzma', 'x-tor-lzma', '.xz', lambda module, content: module.decompress(content))),
('ZSTD', _Compression('zstd', 'zstd', 'x-zstd', '.zst', _zstd_decompress)),
)
class TypeAnnotation(collections.namedtuple('TypeAnnotation', ['name', 'major_version', 'minor_version'])):
"""
`Tor metrics type annotation
`_. The
string representation is the header annotation, for example "@type
server-descriptor 1.0".
.. versionadded:: 1.8.0
:var str name: name of the descriptor type
:var int major_version: major version number
:var int minor_version: minor version number
"""
def __str__(self):
return '@type %s %s.%s' % (self.name, self.major_version, self.minor_version)
class SigningKey(collections.namedtuple('SigningKey', ['private', 'public', 'public_digest'])):
"""
Key used by relays to sign their server and extrainfo descriptors.
.. versionadded:: 1.6.0
:var cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey private: private key
:var cryptography.hazmat.backends.openssl.rsa._RSAPublicKey public: public key
:var bytes public_digest: block that can be used for the a server descrptor's 'signing-key' field
"""
def parse_file(descriptor_file, descriptor_type = None, validate = False, document_handler = DocumentHandler.ENTRIES, normalize_newlines = None, **kwargs):
"""
Simple function to read the descriptor contents from a file, providing an
iterator for its :class:`~stem.descriptor.__init__.Descriptor` contents.
If you don't provide a **descriptor_type** argument then this automatically
tries to determine the descriptor type based on the following...
* The @type annotation on the first line. These are generally only found in
the `CollecTor archives `_.
* The filename if it matches something from tor's data directory. For
instance, tor's 'cached-descriptors' contains server descriptors.
This is a handy function for simple usage, but if you're reading multiple
descriptor files you might want to consider the
:class:`~stem.descriptor.reader.DescriptorReader`.
Descriptor types include the following, including further minor versions (ie.
if we support 1.1 then we also support everything from 1.0 and most things
from 1.2, but not 2.0)...
========================================= =====
Descriptor Type Class
========================================= =====
server-descriptor 1.0 :class:`~stem.descriptor.server_descriptor.RelayDescriptor`
extra-info 1.0 :class:`~stem.descriptor.extrainfo_descriptor.RelayExtraInfoDescriptor`
microdescriptor 1.0 :class:`~stem.descriptor.microdescriptor.Microdescriptor`
directory 1.0 **unsupported**
network-status-2 1.0 :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV2` (with a :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV2`)
dir-key-certificate-3 1.0 :class:`~stem.descriptor.networkstatus.KeyCertificate`
network-status-consensus-3 1.0 :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` (with a :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3`)
network-status-vote-3 1.0 :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` (with a :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3`)
network-status-microdesc-consensus-3 1.0 :class:`~stem.descriptor.router_status_entry.RouterStatusEntryMicroV3` (with a :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3`)
bridge-network-status 1.0 :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` (with a :class:`~stem.descriptor.networkstatus.BridgeNetworkStatusDocument`)
bridge-server-descriptor 1.0 :class:`~stem.descriptor.server_descriptor.BridgeDescriptor`
bridge-extra-info 1.1 or 1.2 :class:`~stem.descriptor.extrainfo_descriptor.BridgeExtraInfoDescriptor`
torperf 1.0 **unsupported**
bridge-pool-assignment 1.0 **unsupported**
tordnsel 1.0 :class:`~stem.descriptor.tordnsel.TorDNSEL`
hidden-service-descriptor 1.0 :class:`~stem.descriptor.hidden_service.HiddenServiceDescriptorV2`
========================================= =====
If you're using **python 3** then beware that the open() function defaults to
using text mode. **Binary mode** is strongly suggested because it's both
faster (by my testing by about 33x) and doesn't do universal newline
translation which can make us misparse the document.
::
my_descriptor_file = open(descriptor_path, 'rb')
:param str,file,tarfile descriptor_file: path or opened file with the descriptor contents
:param str descriptor_type: `descriptor type `_, this is guessed if not provided
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse the :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:param bool normalize_newlines: converts windows newlines (CRLF), this is the
default when reading data directories on windows
:param dict kwargs: additional arguments for the descriptor constructor
:returns: iterator for :class:`~stem.descriptor.__init__.Descriptor` instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is True
* **TypeError** if we can't match the contents of the file to a descriptor type
* **IOError** if unable to read from the descriptor_file
"""
# Delegate to a helper if this is a path or tarfile.
handler = None
if stem.util._is_str(descriptor_file):
if stem.util.system.is_tarfile(descriptor_file):
handler = _parse_file_for_tar_path
else:
handler = _parse_file_for_path
elif isinstance(descriptor_file, tarfile.TarFile):
handler = _parse_file_for_tarfile
if handler:
for desc in handler(descriptor_file, descriptor_type, validate, document_handler, **kwargs):
yield desc
return
# Not all files are seekable. If unseekable then advising the user.
#
# Python 3.x adds an io.seekable() method, but not an option with python 2.x
# so using an experimental call to tell() to determine this.
try:
descriptor_file.tell()
except IOError:
raise IOError(UNSEEKABLE_MSG)
# The tor descriptor specifications do not provide a reliable method for
# identifying a descriptor file's type and version so we need to guess
# based on its filename. Metrics descriptors, however, can be identified
# by an annotation on their first line...
# https://trac.torproject.org/5651
initial_position = descriptor_file.tell()
first_line = stem.util.str_tools._to_unicode(descriptor_file.readline().strip())
metrics_header_match = re.match('^@type (\\S+) (\\d+).(\\d+)$', first_line)
if not metrics_header_match:
descriptor_file.seek(initial_position)
descriptor_path = getattr(descriptor_file, 'name', None)
filename = '' if descriptor_path is None else os.path.basename(descriptor_file.name)
def parse(descriptor_file):
if normalize_newlines:
descriptor_file = NewlineNormalizer(descriptor_file)
if descriptor_type is not None:
descriptor_type_match = re.match('^(\\S+) (\\d+).(\\d+)$', descriptor_type)
if descriptor_type_match:
desc_type, major_version, minor_version = descriptor_type_match.groups()
return _parse_metrics_file(desc_type, int(major_version), int(minor_version), descriptor_file, validate, document_handler, **kwargs)
else:
raise ValueError("The descriptor_type must be of the form ' .'")
elif metrics_header_match:
# Metrics descriptor handling
desc_type, major_version, minor_version = metrics_header_match.groups()
return _parse_metrics_file(desc_type, int(major_version), int(minor_version), descriptor_file, validate, document_handler, **kwargs)
else:
# Cached descriptor handling. These contain multiple descriptors per file.
if normalize_newlines is None and stem.util.system.is_windows():
descriptor_file = NewlineNormalizer(descriptor_file)
if filename == 'cached-descriptors' or filename == 'cached-descriptors.new':
return stem.descriptor.server_descriptor._parse_file(descriptor_file, validate = validate, **kwargs)
elif filename == 'cached-extrainfo' or filename == 'cached-extrainfo.new':
return stem.descriptor.extrainfo_descriptor._parse_file(descriptor_file, validate = validate, **kwargs)
elif filename == 'cached-microdescs' or filename == 'cached-microdescs.new':
return stem.descriptor.microdescriptor._parse_file(descriptor_file, validate = validate, **kwargs)
elif filename == 'cached-consensus':
return stem.descriptor.networkstatus._parse_file(descriptor_file, validate = validate, document_handler = document_handler, **kwargs)
elif filename == 'cached-microdesc-consensus':
return stem.descriptor.networkstatus._parse_file(descriptor_file, is_microdescriptor = True, validate = validate, document_handler = document_handler, **kwargs)
else:
raise TypeError("Unable to determine the descriptor's type. filename: '%s', first line: '%s'" % (filename, first_line))
for desc in parse(descriptor_file):
if descriptor_path is not None:
desc._set_path(os.path.abspath(descriptor_path))
yield desc
def _parse_file_for_path(descriptor_file, *args, **kwargs):
with open(descriptor_file, 'rb') as desc_file:
for desc in parse_file(desc_file, *args, **kwargs):
yield desc
def _parse_file_for_tar_path(descriptor_file, *args, **kwargs):
# TODO: use 'with' for tarfile after dropping python 2.6 support
tar_file = tarfile.open(descriptor_file)
try:
for desc in parse_file(tar_file, *args, **kwargs):
desc._set_path(os.path.abspath(descriptor_file))
yield desc
finally:
if tar_file:
tar_file.close()
def _parse_file_for_tarfile(descriptor_file, *args, **kwargs):
for tar_entry in descriptor_file:
if tar_entry.isfile():
entry = descriptor_file.extractfile(tar_entry)
if tar_entry.size == 0:
continue
try:
for desc in parse_file(entry, *args, **kwargs):
desc._set_archive_path(entry.name)
yield desc
finally:
entry.close()
def _parse_metrics_file(descriptor_type, major_version, minor_version, descriptor_file, validate, document_handler, **kwargs):
# Parses descriptor files from metrics, yielding individual descriptors. This
# throws a TypeError if the descriptor_type or version isn't recognized.
if descriptor_type == stem.descriptor.server_descriptor.RelayDescriptor.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.server_descriptor._parse_file(descriptor_file, is_bridge = False, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.server_descriptor.BridgeDescriptor.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.server_descriptor._parse_file(descriptor_file, is_bridge = True, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.extrainfo_descriptor.RelayExtraInfoDescriptor.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.extrainfo_descriptor._parse_file(descriptor_file, is_bridge = False, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.microdescriptor.Microdescriptor.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.microdescriptor._parse_file(descriptor_file, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.extrainfo_descriptor.BridgeExtraInfoDescriptor.TYPE_ANNOTATION_NAME and major_version == 1:
# version 1.1 introduced a 'transport' field...
# https://trac.torproject.org/6257
for desc in stem.descriptor.extrainfo_descriptor._parse_file(descriptor_file, is_bridge = True, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.networkstatus.NetworkStatusDocumentV2.TYPE_ANNOTATION_NAME and major_version == 1:
document_type = stem.descriptor.networkstatus.NetworkStatusDocumentV2
for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, validate = validate, document_handler = document_handler, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.networkstatus.KeyCertificate.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.networkstatus._parse_file_key_certs(descriptor_file, validate = validate, **kwargs):
yield desc
elif descriptor_type in ('network-status-consensus-3', 'network-status-vote-3') and major_version == 1:
document_type = stem.descriptor.networkstatus.NetworkStatusDocumentV3
for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, validate = validate, document_handler = document_handler, **kwargs):
yield desc
elif descriptor_type == 'network-status-microdesc-consensus-3' and major_version == 1:
document_type = stem.descriptor.networkstatus.NetworkStatusDocumentV3
for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, is_microdescriptor = True, validate = validate, document_handler = document_handler, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.networkstatus.BridgeNetworkStatusDocument.TYPE_ANNOTATION_NAME and major_version == 1:
document_type = stem.descriptor.networkstatus.BridgeNetworkStatusDocument
for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, validate = validate, document_handler = document_handler, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.networkstatus.DetachedSignature.TYPE_ANNOTATION_NAME and major_version == 1:
document_type = stem.descriptor.networkstatus.DetachedSignature
for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, validate = validate, document_handler = document_handler, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.tordnsel.TorDNSEL.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.tordnsel._parse_file(descriptor_file, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.hidden_service.HiddenServiceDescriptorV2.TYPE_ANNOTATION_NAME and major_version == 1:
desc_type = stem.descriptor.hidden_service.HiddenServiceDescriptorV2
for desc in stem.descriptor.hidden_service._parse_file(descriptor_file, desc_type, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.hidden_service.HiddenServiceDescriptorV3.TYPE_ANNOTATION_NAME and major_version == 1:
desc_type = stem.descriptor.hidden_service.HiddenServiceDescriptorV3
for desc in stem.descriptor.hidden_service._parse_file(descriptor_file, desc_type, validate = validate, **kwargs):
yield desc
elif descriptor_type == stem.descriptor.bandwidth_file.BandwidthFile.TYPE_ANNOTATION_NAME and major_version == 1:
for desc in stem.descriptor.bandwidth_file._parse_file(descriptor_file, validate = validate, **kwargs):
yield desc
else:
raise TypeError("Unrecognized metrics descriptor format. type: '%s', version: '%i.%i'" % (descriptor_type, major_version, minor_version))
def _descriptor_content(attr = None, exclude = (), header_template = (), footer_template = ()):
"""
Constructs a minimal descriptor with the given attributes. The content we
provide back is of the form...
* header_template (with matching attr filled in)
* unused attr entries
* footer_template (with matching attr filled in)
So for instance...
::
_descriptor_content(
attr = {'nickname': 'caerSidi', 'contact': 'atagar'},
header_template = (
('nickname', 'foobar'),
('fingerprint', '12345'),
),
)
... would result in...
::
nickname caerSidi
fingerprint 12345
contact atagar
:param dict attr: keyword/value mappings to be included in the descriptor
:param list exclude: mandatory keywords to exclude from the descriptor
:param tuple header_template: key/value pairs for mandatory fields before unrecognized content
:param tuple footer_template: key/value pairs for mandatory fields after unrecognized content
:returns: bytes with the requested descriptor content
"""
header_content, footer_content = [], []
attr = {} if attr is None else OrderedDict(attr) # shallow copy since we're destructive
for content, template in ((header_content, header_template),
(footer_content, footer_template)):
for keyword, value in template:
if keyword in exclude:
continue
value = stem.util.str_tools._to_unicode(attr.pop(keyword, value))
if value is None:
continue
elif isinstance(value, (tuple, list)):
for v in value:
content.append('%s %s' % (keyword, v))
elif value == '':
content.append(keyword)
elif value.startswith('\n'):
# some values like crypto follow the line instead
content.append('%s%s' % (keyword, value))
else:
content.append('%s %s' % (keyword, value))
remainder = []
for k, v in attr.items():
if isinstance(v, (tuple, list)):
remainder += ['%s %s' % (k, entry) for entry in v]
else:
remainder.append('%s %s' % (k, v))
return stem.util.str_tools._to_bytes('\n'.join(header_content + remainder + footer_content))
def _value(line, entries):
return entries[line][0][0]
def _values(line, entries):
return [entry[0] for entry in entries[line]]
def _parse_simple_line(keyword, attribute, func = None):
def _parse(descriptor, entries):
value = _value(keyword, entries)
setattr(descriptor, attribute, func(value) if func else value)
return _parse
def _parse_if_present(keyword, attribute):
return lambda descriptor, entries: setattr(descriptor, attribute, keyword in entries)
def _parse_bytes_line(keyword, attribute):
def _parse(descriptor, entries):
line_match = re.search(stem.util.str_tools._to_bytes('^(opt )?%s(?:[%s]+(.*))?$' % (keyword, WHITESPACE)), descriptor.get_bytes(), re.MULTILINE)
result = None
if line_match:
value = line_match.groups()[1]
result = b'' if value is None else value
setattr(descriptor, attribute, result)
return _parse
def _parse_int_line(keyword, attribute, allow_negative = True):
def _parse(descriptor, entries):
value = _value(keyword, entries)
try:
int_val = int(value)
except ValueError:
raise ValueError('%s must have a numeric value: %s' % (keyword, value))
if not allow_negative and int_val < 0:
raise ValueError('%s must have a positive value: %s' % (keyword, value))
setattr(descriptor, attribute, int_val)
return _parse
def _parse_timestamp_line(keyword, attribute):
# "" YYYY-MM-DD HH:MM:SS
def _parse(descriptor, entries):
value = _value(keyword, entries)
try:
setattr(descriptor, attribute, stem.util.str_tools._parse_timestamp(value))
except ValueError:
raise ValueError("Timestamp on %s line wasn't parsable: %s %s" % (keyword, keyword, value))
return _parse
def _parse_forty_character_hex(keyword, attribute):
# format of fingerprints, sha1 digests, etc
def _parse(descriptor, entries):
value = _value(keyword, entries)
if not stem.util.tor_tools.is_hex_digits(value, 40):
raise ValueError('%s line had an invalid value (should be 40 hex characters): %s %s' % (keyword, keyword, value))
setattr(descriptor, attribute, value)
return _parse
def _parse_protocol_line(keyword, attribute):
def _parse(descriptor, entries):
# parses 'protocol' entries like: Cons=1-2 Desc=1-2 DirCache=1 HSDir=1
value = _value(keyword, entries)
protocols = OrderedDict()
for k, v in _mappings_for(keyword, value):
versions = []
if not v:
continue
for entry in v.split(','):
if '-' in entry:
min_value, max_value = entry.split('-', 1)
else:
min_value = max_value = entry
if not min_value.isdigit() or not max_value.isdigit():
raise ValueError('Protocol values should be a number or number range, but was: %s %s' % (keyword, value))
versions += range(int(min_value), int(max_value) + 1)
protocols[k] = versions
setattr(descriptor, attribute, protocols)
return _parse
def _parse_key_block(keyword, attribute, expected_block_type, value_attribute = None):
def _parse(descriptor, entries):
value, block_type, block_contents = entries[keyword][0]
if not block_contents or block_type != expected_block_type:
raise ValueError("'%s' should be followed by a %s block, but was a %s" % (keyword, expected_block_type, block_type))
setattr(descriptor, attribute, block_contents)
if value_attribute:
setattr(descriptor, value_attribute, value)
return _parse
def _mappings_for(keyword, value, require_value = False, divider = ' '):
"""
Parses an attribute as a series of 'key=value' mappings. Unlike _parse_*
functions this is a helper, returning the attribute value rather than setting
a descriptor field. This way parsers can perform additional validations.
:param str keyword: descriptor field being parsed
:param str value: 'attribute => values' mappings to parse
:param str divider: separator between the key/value mappings
:param bool require_value: validates that values are not empty
:returns: **generator** with the key/value of the map attribute
:raises: **ValueError** if descriptor content is invalid
"""
if value is None:
return # no descripoter value to process
elif value == '':
return # descriptor field was present, but blank
for entry in value.split(divider):
if '=' not in entry:
raise ValueError("'%s' should be a series of 'key=value' pairs but was: %s" % (keyword, value))
k, v = entry.split('=', 1)
if require_value and not v:
raise ValueError("'%s' line's %s mapping had a blank value: %s" % (keyword, k, value))
yield k, v
def _copy(default):
if default is None or isinstance(default, (bool, stem.exit_policy.ExitPolicy)):
return default # immutable
elif default in EMPTY_COLLECTION:
return type(default)() # collection construction tad faster than copy
else:
return copy.copy(default)
def _encode_digest(hash_value, encoding):
"""
Encodes a hash value with the given HashEncoding.
"""
if encoding == DigestEncoding.RAW:
return hash_value
elif encoding == DigestEncoding.HEX:
return stem.util.str_tools._to_unicode(hash_value.hexdigest().upper())
elif encoding == DigestEncoding.BASE64:
return stem.util.str_tools._to_unicode(base64.b64encode(hash_value.digest()).rstrip(b'='))
elif encoding not in DigestEncoding:
raise ValueError('Digest encodings should be among our DigestEncoding enumeration (%s), not %s' % (', '.join(DigestEncoding), encoding))
else:
raise NotImplementedError('BUG: stem.descriptor._encode_digest should recognize all DigestEncoding, lacked %s' % encoding)
class Descriptor(object):
"""
Common parent for all types of descriptors.
"""
ATTRIBUTES = {} # mapping of 'attribute' => (default_value, parsing_function)
PARSER_FOR_LINE = {} # line keyword to its associated parsing function
TYPE_ANNOTATION_NAME = None
def __init__(self, contents, lazy_load = False):
self._path = None
self._archive_path = None
self._raw_contents = contents
self._lazy_loading = lazy_load
self._entries = {}
self._hash = None
self._unrecognized_lines = []
@classmethod
def from_str(cls, content, **kwargs):
"""
Provides a :class:`~stem.descriptor.__init__.Descriptor` for the given content.
To parse a descriptor we must know its type. There are three ways to
convey this...
::
# use a descriptor_type argument
desc = Descriptor.from_str(content, descriptor_type = 'server-descriptor 1.0')
# prefixing the content with a "@type" annotation
desc = Descriptor.from_str('@type server-descriptor 1.0\\n' + content)
# use this method from a subclass
desc = stem.descriptor.server_descriptor.RelayDescriptor.from_str(content)
.. versionadded:: 1.8.0
:param str,bytes content: string to construct the descriptor from
:param bool multiple: if provided with **True** this provides a list of
descriptors rather than a single one
:param dict kwargs: additional arguments for :func:`~stem.descriptor.__init__.parse_file`
:returns: :class:`~stem.descriptor.__init__.Descriptor` subclass for the
given content, or a **list** of descriptors if **multiple = True** is
provided
:raises:
* **ValueError** if the contents is malformed and validate is True
* **TypeError** if we can't match the contents of the file to a descriptor type
* **IOError** if unable to read from the descriptor_file
"""
if 'descriptor_type' not in kwargs and cls.TYPE_ANNOTATION_NAME is not None:
kwargs['descriptor_type'] = str(TypeAnnotation(cls.TYPE_ANNOTATION_NAME, 1, 0))[6:]
is_multiple = kwargs.pop('multiple', False)
results = list(parse_file(io.BytesIO(stem.util.str_tools._to_bytes(content)), **kwargs))
if is_multiple:
return results
elif len(results) == 1:
return results[0]
else:
raise ValueError("Descriptor.from_str() expected a single descriptor, but had %i instead. Please include 'multiple = True' if you want a list of results instead." % len(results))
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
"""
Creates descriptor content with the given attributes. Mandatory fields are
filled with dummy information unless data is supplied. This doesn't yet
create a valid signature.
.. versionadded:: 1.6.0
:param dict attr: keyword/value mappings to be included in the descriptor
:param list exclude: mandatory keywords to exclude from the descriptor, this
results in an invalid descriptor
:param bool sign: includes cryptographic signatures and digests if True
:returns: **str** with the content of a descriptor
:raises:
* **ImportError** if cryptography is unavailable and sign is True
* **NotImplementedError** if not implemented for this descriptor type
"""
# TODO: drop the 'sign' argument in stem 2.x (only a few subclasses use this)
raise NotImplementedError("The create and content methods haven't been implemented for %s" % cls.__name__)
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False):
"""
Creates a descriptor with the given attributes. Mandatory fields are filled
with dummy information unless data is supplied. This doesn't yet create a
valid signature.
.. versionadded:: 1.6.0
:param dict attr: keyword/value mappings to be included in the descriptor
:param list exclude: mandatory keywords to exclude from the descriptor, this
results in an invalid descriptor
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param bool sign: includes cryptographic signatures and digests if True
:returns: :class:`~stem.descriptor.Descriptor` subclass
:raises:
* **ValueError** if the contents is malformed and validate is True
* **ImportError** if cryptography is unavailable and sign is True
* **NotImplementedError** if not implemented for this descriptor type
"""
return cls(cls.content(attr, exclude, sign), validate = validate)
def type_annotation(self):
"""
Provides the `Tor metrics annotation
`_ of this
descriptor type. For example, "@type server-descriptor 1.0" for server
descriptors.
Please note that the version number component is specific to CollecTor,
and for the moment hardcode as 1.0. This may change in the future.
.. versionadded:: 1.8.0
:returns: :class:`~stem.descriptor.TypeAnnotation` with our type information
"""
# TODO: populate this from the archive instead if available (so we have correct version numbers)
if self.TYPE_ANNOTATION_NAME is not None:
return TypeAnnotation(self.TYPE_ANNOTATION_NAME, 1, 0)
else:
raise NotImplementedError('%s does not have a @type annotation' % type(self).__name__)
def get_path(self):
"""
Provides the absolute path that we loaded this descriptor from.
:returns: **str** with the absolute path of the descriptor source
"""
return self._path
def get_archive_path(self):
"""
If this descriptor came from an archive then provides its path within the
archive. This is only set if the descriptor came from a
:class:`~stem.descriptor.reader.DescriptorReader`, and is **None** if this
descriptor didn't come from an archive.
:returns: **str** with the descriptor's path within the archive
"""
return self._archive_path
def get_bytes(self):
"""
Provides the ASCII **bytes** of the descriptor. This only differs from
**str()** if you're running python 3.x, in which case **str()** provides a
**unicode** string.
:returns: **bytes** for the descriptor's contents
"""
return stem.util.str_tools._to_bytes(self._raw_contents)
def get_unrecognized_lines(self):
"""
Provides a list of lines that were either ignored or had data that we did
not know how to process. This is most common due to new descriptor fields
that this library does not yet know how to process. Patches welcome!
:returns: **list** of lines of unrecognized content
"""
if self._lazy_loading:
# we need to go ahead and parse the whole document to figure this out
self._parse(self._entries, False)
self._lazy_loading = False
return list(self._unrecognized_lines)
def _parse(self, entries, validate, parser_for_line = None):
"""
Parses a series of 'keyword => (value, pgp block)' mappings and applies
them as attributes.
:param dict entries: descriptor contents to be applied
:param bool validate: checks the validity of descriptor content if True
:param dict parsers: mapping of lines to the function for parsing it
:raises: **ValueError** if an error occurs in validation
"""
if parser_for_line is None:
parser_for_line = self.PARSER_FOR_LINE
for keyword, values in list(entries.items()):
try:
if keyword in parser_for_line:
parser_for_line[keyword](self, entries)
else:
for value, block_type, block_contents in values:
line = '%s %s' % (keyword, value)
if block_contents:
line += '\n%s' % block_contents
self._unrecognized_lines.append(line)
except ValueError:
if validate:
raise
def _set_path(self, path):
self._path = path
def _set_archive_path(self, path):
self._archive_path = path
def _name(self, is_plural = False):
return str(type(self))
def _digest_for_signature(self, signing_key, signature):
"""
Provides the signed digest we should have given this key and signature.
:param str signing_key: key block used to make this signature
:param str signature: signed digest for this descriptor content
:returns: the digest string encoded in uppercase hex
:raises: ValueError if unable to provide a validly signed digest
"""
if not stem.prereq.is_crypto_available():
raise ValueError('Generating the signed digest requires the cryptography module')
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import load_der_public_key
from cryptography.utils import int_to_bytes, int_from_bytes
key = load_der_public_key(_bytes_for_block(signing_key), default_backend())
modulus = key.public_numbers().n
public_exponent = key.public_numbers().e
sig_as_bytes = _bytes_for_block(signature)
sig_as_long = int_from_bytes(sig_as_bytes, byteorder='big') # convert signature to an int
blocksize = len(sig_as_bytes) # 256B for NetworkStatusDocuments, 128B for others
# use the public exponent[e] & the modulus[n] to decrypt the int
decrypted_int = pow(sig_as_long, public_exponent, modulus)
# convert the int to a byte array
decrypted_bytes = int_to_bytes(decrypted_int, blocksize)
############################################################################
# The decrypted bytes should have a structure exactly along these lines.
# 1 byte - [null '\x00']
# 1 byte - [block type identifier '\x01'] - Should always be 1
# N bytes - [padding '\xFF' ]
# 1 byte - [separator '\x00' ]
# M bytes - [message]
# Total - 128 bytes
# More info here http://www.ietf.org/rfc/rfc2313.txt
# esp the Notes in section 8.1
############################################################################
try:
if decrypted_bytes.index(DIGEST_TYPE_INFO) != 0:
raise ValueError('Verification failed, identifier missing')
except ValueError:
raise ValueError('Verification failed, malformed data')
try:
identifier_offset = 2
# find the separator
seperator_index = decrypted_bytes.index(DIGEST_SEPARATOR, identifier_offset)
except ValueError:
raise ValueError('Verification failed, seperator not found')
digest_hex = codecs.encode(decrypted_bytes[seperator_index + 1:], 'hex_codec')
return stem.util.str_tools._to_unicode(digest_hex.upper())
def _content_range(self, start = None, end = None):
"""
Provides the descriptor content inclusively between two substrings.
:param bytes start: start of the content range to get
:param bytes end: end of the content range to get
:raises: ValueError if either the start or end substring are not within our content
"""
content = self.get_bytes()
start_index, end_index = None, None
if start is not None:
start_index = content.find(stem.util.str_tools._to_bytes(start))
if start_index == -1:
raise ValueError("'%s' is not present within our descriptor content" % start)
if end is not None:
end_index = content.find(stem.util.str_tools._to_bytes(end), start_index)
if end_index == -1:
raise ValueError("'%s' is not present within our descriptor content" % end)
end_index += len(end) # make the ending index inclusive
return content[start_index:end_index]
def __getattr__(self, name):
# We can't use standard hasattr() since it calls this function, recursing.
# Doing so works since it stops recursing after several dozen iterations
# (not sure why), but horrible in terms of performance.
def has_attr(attr):
try:
super(Descriptor, self).__getattribute__(attr)
return True
except:
return False
# If an attribute we should have isn't present it means either...
#
# a. we still need to lazy load this
# b. we read the whole descriptor but it wasn't present, so needs the default
if name in self.ATTRIBUTES and not has_attr(name):
default, parsing_function = self.ATTRIBUTES[name]
if self._lazy_loading:
try:
parsing_function(self, self._entries)
except (ValueError, KeyError):
# Set defaults for anything the parsing function should've covered.
# Despite having a validation failure some attributes might be set in
# which case we keep them.
for attr_name, (attr_default, attr_parser) in self.ATTRIBUTES.items():
if parsing_function == attr_parser and not has_attr(attr_name):
setattr(self, attr_name, _copy(attr_default))
else:
setattr(self, name, _copy(default))
return super(Descriptor, self).__getattribute__(name)
def __str__(self):
if stem.prereq.is_python_3():
return stem.util.str_tools._to_unicode(self._raw_contents)
else:
return self._raw_contents
def _compare(self, other, method):
if type(self) != type(other):
return False
return method(str(self).strip(), str(other).strip())
def __hash__(self):
if self._hash is None:
self._hash = hash(str(self).strip())
return self._hash
def __eq__(self, other):
return self._compare(other, lambda s, o: s == o)
def __ne__(self, other):
return not self == other
def __lt__(self, other):
return self._compare(other, lambda s, o: s < o)
def __le__(self, other):
return self._compare(other, lambda s, o: s <= o)
class NewlineNormalizer(object):
"""
File wrapper that normalizes CRLF line endings.
"""
def __init__(self, wrapped_file):
self._wrapped_file = wrapped_file
self.name = getattr(wrapped_file, 'name', None)
def read(self, *args):
return self._wrapped_file.read(*args).replace(b'\r\n', b'\n')
def readline(self, *args):
return self._wrapped_file.readline(*args).replace(b'\r\n', b'\n')
def readlines(self, *args):
return [line.rstrip(b'\r') for line in self._wrapped_file.readlines(*args)]
def seek(self, *args):
return self._wrapped_file.seek(*args)
def tell(self, *args):
return self._wrapped_file.tell(*args)
def _read_until_keywords(keywords, descriptor_file, inclusive = False, ignore_first = False, skip = False, end_position = None, include_ending_keyword = False):
"""
Reads from the descriptor file until we get to one of the given keywords or reach the
end of the file.
:param str,list keywords: keyword(s) we want to read until
:param file descriptor_file: file with the descriptor content
:param bool inclusive: includes the line with the keyword if True
:param bool ignore_first: doesn't check if the first line read has one of the
given keywords
:param bool skip: skips buffering content, returning None
:param int end_position: end if we reach this point in the file
:param bool include_ending_keyword: provides the keyword we broke on if **True**
:returns: **list** with the lines until we find one of the keywords, this is
a two value tuple with the ending keyword if include_ending_keyword is
**True**
"""
content = None if skip else []
ending_keyword = None
if stem.util._is_str(keywords):
keywords = (keywords,)
if ignore_first:
first_line = descriptor_file.readline()
if first_line and content is not None:
content.append(first_line)
keyword_match = re.compile(SPECIFIC_KEYWORD_LINE % '|'.join(keywords))
while True:
last_position = descriptor_file.tell()
if end_position and last_position >= end_position:
break
line = descriptor_file.readline()
if not line:
break # EOF
line_match = keyword_match.match(stem.util.str_tools._to_unicode(line))
if line_match:
ending_keyword = line_match.groups()[0]
if not inclusive:
descriptor_file.seek(last_position)
elif content is not None:
content.append(line)
break
elif content is not None:
content.append(line)
if include_ending_keyword:
return (content, ending_keyword)
else:
return content
def _bytes_for_block(content):
"""
Provides the base64 decoded content of a pgp-style block.
:param str content: block to be decoded
:returns: decoded block content
:raises: **TypeError** if this isn't base64 encoded content
"""
# strip the '-----BEGIN RSA PUBLIC KEY-----' header and footer
content = ''.join(content.split('\n')[1:-1])
return base64.b64decode(stem.util.str_tools._to_bytes(content))
def _get_pseudo_pgp_block(remaining_contents):
"""
Checks if given contents begins with a pseudo-Open-PGP-style block and, if
so, pops it off and provides it back to the caller.
:param list remaining_contents: lines to be checked for a public key block
:returns: **tuple** of the (block_type, content) or None if it doesn't exist
:raises: **ValueError** if the contents starts with a key block but it's
malformed (for instance, if it lacks an ending line)
"""
if not remaining_contents:
return None # nothing left
block_match = PGP_BLOCK_START.match(remaining_contents[0])
if block_match:
block_type = block_match.groups()[0]
block_lines = []
end_line = PGP_BLOCK_END % block_type
while True:
if not remaining_contents:
raise ValueError("Unterminated pgp style block (looking for '%s'):\n%s" % (end_line, '\n'.join(block_lines)))
line = remaining_contents.pop(0)
block_lines.append(line)
if line == end_line:
return (block_type, '\n'.join(block_lines))
else:
return None
def create_signing_key(private_key = None):
"""
Serializes a signing key if we have one. Otherwise this creates a new signing
key we can use to create descriptors.
.. versionadded:: 1.6.0
:param cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey private_key: private key
:returns: :class:`~stem.descriptor.__init__.SigningKey` that can be used to
create descriptors
:raises: **ImportError** if the cryptography module is unavailable
"""
if not stem.prereq.is_crypto_available():
raise ImportError('Signing requires the cryptography module')
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
if private_key is None:
private_key = rsa.generate_private_key(
public_exponent = 65537,
key_size = 1024,
backend = default_backend(),
)
# When signing the cryptography module includes a constant indicating
# the hash algorithm used. Tor doesn't. This causes signature
# validation failures and unfortunately cryptography have no nice way
# of excluding these so we need to mock out part of their internals...
#
# https://github.com/pyca/cryptography/issues/3713
def no_op(*args, **kwargs):
return 1
private_key._backend._lib.EVP_PKEY_CTX_set_signature_md = no_op
private_key._backend.openssl_assert = no_op
public_key = private_key.public_key()
public_digest = b'\n' + public_key.public_bytes(
encoding = serialization.Encoding.PEM,
format = serialization.PublicFormat.PKCS1,
).strip()
return SigningKey(private_key, public_key, public_digest)
def _append_router_signature(content, private_key):
"""
Appends a router signature to a server or extrainfo descriptor.
:param bytes content: descriptor content up through 'router-signature\\n'
:param cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey private_key:
private relay signing key
:returns: **bytes** with the signed descriptor content
"""
if not stem.prereq.is_crypto_available():
raise ImportError('Signing requires the cryptography module')
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
signature = base64.b64encode(private_key.sign(content, padding.PKCS1v15(), hashes.SHA1()))
return content + b'\n'.join([b'-----BEGIN SIGNATURE-----'] + stem.util.str_tools._split_by_length(signature, 64) + [b'-----END SIGNATURE-----\n'])
def _random_nickname():
return ('Unnamed%i' % random.randint(0, 100000000000000))[:19]
def _random_fingerprint():
return ('%040x' % random.randrange(16 ** 40)).upper()
def _random_ipv4_address():
return '%i.%i.%i.%i' % (random.randint(0, 255), random.randint(0, 255), random.randint(0, 255), random.randint(0, 255))
def _random_date():
return '%i-%02i-%02i %02i:%02i:%02i' % (random.randint(2000, 2015), random.randint(1, 12), random.randint(1, 20), random.randint(0, 23), random.randint(0, 59), random.randint(0, 59))
def _random_crypto_blob(block_type = None):
"""
Provides a random string that can be used for crypto blocks.
"""
random_base64 = stem.util.str_tools._to_unicode(base64.b64encode(os.urandom(140)))
crypto_blob = '\n'.join(stem.util.str_tools._split_by_length(random_base64, 64))
if block_type:
return '\n-----BEGIN %s-----\n%s\n-----END %s-----' % (block_type, crypto_blob, block_type)
else:
return crypto_blob
def _descriptor_components(raw_contents, validate, extra_keywords = (), non_ascii_fields = ()):
"""
Initial breakup of the server descriptor contents to make parsing easier.
A descriptor contains a series of 'keyword lines' which are simply a keyword
followed by an optional value. Lines can also be followed by a signature
block.
To get a sub-listing with just certain keywords use extra_keywords. This can
be useful if we care about their relative ordering with respect to each
other. For instance, we care about the ordering of 'accept' and 'reject'
entries because this influences the resulting exit policy, but for everything
else in server descriptors the order does not matter.
:param str raw_contents: descriptor content provided by the relay
:param bool validate: checks the validity of the descriptor's content if
True, skips these checks otherwise
:param list extra_keywords: entity keywords to put into a separate listing
with ordering intact
:param list non_ascii_fields: fields containing non-ascii content
:returns:
**collections.OrderedDict** with the 'keyword => (value, pgp key) entries'
mappings. If a extra_keywords was provided then this instead provides a two
value tuple, the second being a list of those entries.
"""
if isinstance(raw_contents, bytes):
raw_contents = stem.util.str_tools._to_unicode(raw_contents)
entries = OrderedDict()
extra_entries = [] # entries with a keyword in extra_keywords
remaining_lines = raw_contents.split('\n')
while remaining_lines:
line = remaining_lines.pop(0)
# V2 network status documents explicitly can contain blank lines...
#
# "Implementations MAY insert blank lines for clarity between sections;
# these blank lines are ignored."
#
# ... and server descriptors end with an extra newline. But other documents
# don't say how blank lines should be handled so globally ignoring them.
if not line:
continue
# Some lines have an 'opt ' for backward compatibility. They should be
# ignored. This prefix is being removed in...
# https://trac.torproject.org/projects/tor/ticket/5124
if line.startswith('opt '):
line = line[4:]
line_match = KEYWORD_LINE.match(line)
if not line_match:
if not validate:
continue
raise ValueError('Line contains invalid characters: %s' % line)
keyword, value = line_match.groups()
if value is None:
value = ''
try:
block_attr = _get_pseudo_pgp_block(remaining_lines)
if block_attr:
block_type, block_contents = block_attr
else:
block_type, block_contents = None, None
except ValueError:
if not validate:
continue
raise
if validate and keyword not in non_ascii_fields:
try:
value.encode('ascii')
except UnicodeError:
replaced = ''.join([(char if char in string.printable else '?') for char in value])
raise ValueError("'%s' line had non-ascii content: %s" % (keyword, replaced))
if keyword in extra_keywords:
extra_entries.append('%s %s' % (keyword, value))
else:
entries.setdefault(keyword, []).append((value, block_type, block_contents))
if extra_keywords:
return entries, extra_entries
else:
return entries
# importing at the end to avoid circular dependencies on our Descriptor class
import stem.descriptor.bandwidth_file
import stem.descriptor.extrainfo_descriptor
import stem.descriptor.hidden_service
import stem.descriptor.microdescriptor
import stem.descriptor.networkstatus
import stem.descriptor.server_descriptor
import stem.descriptor.tordnsel
stem-1.8.0/stem/descriptor/server_descriptor.py 0000664 0001750 0001750 00000126641 13564354230 022475 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Tor server descriptors, which contains the infrequently changing
information about a Tor relay (contact information, exit policy, public keys,
etc). This information is provided from a few sources...
* The control port via 'GETINFO desc/\\*' queries.
* The 'cached-descriptors' file in Tor's data directory.
* Archived descriptors provided by `CollecTor `_.
* Directory authorities and mirrors via their DirPort.
**Module Overview:**
::
ServerDescriptor - Tor server descriptor.
|- RelayDescriptor - Server descriptor for a relay.
| +- make_router_status_entry - Creates a router status entry for this descriptor.
|
|- BridgeDescriptor - Scrubbed server descriptor for a bridge.
| |- is_scrubbed - checks if our content has been properly scrubbed
| +- get_scrubbing_issues - description of issues with our scrubbing
|
|- digest - calculates the upper-case hex digest value for our content
|- get_annotations - dictionary of content prior to the descriptor entry
+- get_annotation_lines - lines that provided the annotations
.. data:: BridgeDistribution (enum)
Preferred method of distributing this relay if a bridge.
.. versionadded:: 1.6.0
===================== ===========
BridgeDistribution Description
===================== ===========
**ANY** No proference, BridgeDB will pick how the bridge is distributed.
**HTTPS** Provided via the `web interface `_.
**EMAIL** Provided in response to emails to bridges@torproject.org.
**MOAT** Provided in interactive menus within Tor Browser.
**HYPHAE** Provided via a cryptographic invitation-based system.
===================== ===========
"""
import base64
import binascii
import functools
import hashlib
import re
import stem.descriptor.certificate
import stem.descriptor.extrainfo_descriptor
import stem.exit_policy
import stem.prereq
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
import stem.util.tor_tools
import stem.version
from stem.descriptor.router_status_entry import RouterStatusEntryV3
from stem.descriptor import (
PGP_BLOCK_END,
Descriptor,
DigestHash,
DigestEncoding,
create_signing_key,
_descriptor_content,
_descriptor_components,
_read_until_keywords,
_bytes_for_block,
_value,
_values,
_parse_simple_line,
_parse_int_line,
_parse_if_present,
_parse_bytes_line,
_parse_timestamp_line,
_parse_forty_character_hex,
_parse_protocol_line,
_parse_key_block,
_append_router_signature,
_random_nickname,
_random_ipv4_address,
_random_date,
_random_crypto_blob,
)
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
# relay descriptors must have exactly one of the following
REQUIRED_FIELDS = (
'router',
'bandwidth',
'published',
'onion-key',
'signing-key',
'router-signature',
)
# optional entries that can appear at most once
SINGLE_FIELDS = (
'identity-ed25519',
'master-key-ed25519',
'platform',
'fingerprint',
'hibernating',
'uptime',
'contact',
'read-history',
'write-history',
'eventdns',
'bridge-distribution-request',
'family',
'caches-extra-info',
'extra-info-digest',
'hidden-service-dir',
'protocols',
'allow-single-hop-exits',
'tunnelled-dir-server',
'proto',
'onion-key-crosscert',
'ntor-onion-key',
'ntor-onion-key-crosscert',
'router-sig-ed25519',
)
BridgeDistribution = stem.util.enum.Enum(
('ANY', 'any'),
('HTTPS', 'https'),
('EMAIL', 'email'),
('MOAT', 'moat'),
('HYPHAE', 'hyphae'),
)
DEFAULT_IPV6_EXIT_POLICY = stem.exit_policy.MicroExitPolicy('reject 1-65535')
REJECT_ALL_POLICY = stem.exit_policy.ExitPolicy('reject *:*')
DEFAULT_BRIDGE_DISTRIBUTION = 'any'
def _truncated_b64encode(content):
return stem.util.str_tools._to_unicode(base64.b64encode(content).rstrip(b'='))
def _parse_file(descriptor_file, is_bridge = False, validate = False, **kwargs):
"""
Iterates over the server descriptors in a file.
:param file descriptor_file: file with descriptor content
:param bool is_bridge: parses the file as being a bridge descriptor
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param dict kwargs: additional arguments for the descriptor constructor
:returns: iterator for ServerDescriptor instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is True
* **IOError** if the file can't be read
"""
# Handler for relay descriptors
#
# Cached descriptors consist of annotations followed by the descriptor
# itself. For instance...
#
# @downloaded-at 2012-03-14 16:31:05
# @source "145.53.65.130"
# router caerSidi 71.35.143.157 9001 0 0
# platform Tor 0.2.1.30 on Linux x86_64
#
# router-signature
# -----BEGIN SIGNATURE-----
#
# -----END SIGNATURE-----
#
# Metrics descriptor files are the same, but lack any annotations. The
# following simply does the following...
#
# - parse as annotations until we get to 'router'
# - parse as descriptor content until we get to 'router-signature' followed
# by the end of the signature block
# - construct a descriptor and provide it back to the caller
#
# Any annotations after the last server descriptor is ignored (never provided
# to the caller).
while True:
annotations = _read_until_keywords('router', descriptor_file)
annotations = map(bytes.strip, annotations) # strip newlines
annotations = map(stem.util.str_tools._to_unicode, annotations) # convert to unicode
annotations = list(filter(lambda x: x != '', annotations)) # drop any blanks
if not is_bridge:
descriptor_content = _read_until_keywords('router-signature', descriptor_file)
# we've reached the 'router-signature', now include the pgp style block
block_end_prefix = PGP_BLOCK_END.split(' ', 1)[0]
descriptor_content += _read_until_keywords(block_end_prefix, descriptor_file, True)
else:
descriptor_content = _read_until_keywords('router-digest', descriptor_file, True)
if descriptor_content:
if descriptor_content[0].startswith(b'@type'):
descriptor_content = descriptor_content[1:]
descriptor_text = bytes.join(b'', descriptor_content)
if is_bridge:
yield BridgeDescriptor(descriptor_text, validate, annotations, **kwargs)
else:
yield RelayDescriptor(descriptor_text, validate, annotations, **kwargs)
else:
if validate and annotations:
raise ValueError('Content conform to being a server descriptor:\n%s' % '\n'.join(annotations))
break # done parsing descriptors
def _parse_router_line(descriptor, entries):
# "router" nickname address ORPort SocksPort DirPort
value = _value('router', entries)
router_comp = value.split()
if len(router_comp) < 5:
raise ValueError('Router line must have five values: router %s' % value)
elif not stem.util.tor_tools.is_valid_nickname(router_comp[0]):
raise ValueError("Router line entry isn't a valid nickname: %s" % router_comp[0])
elif not stem.util.connection.is_valid_ipv4_address(router_comp[1]):
raise ValueError("Router line entry isn't a valid IPv4 address: %s" % router_comp[1])
elif not stem.util.connection.is_valid_port(router_comp[2], allow_zero = True):
raise ValueError("Router line's ORPort is invalid: %s" % router_comp[2])
elif not stem.util.connection.is_valid_port(router_comp[3], allow_zero = True):
raise ValueError("Router line's SocksPort is invalid: %s" % router_comp[3])
elif not stem.util.connection.is_valid_port(router_comp[4], allow_zero = True):
raise ValueError("Router line's DirPort is invalid: %s" % router_comp[4])
descriptor.nickname = router_comp[0]
descriptor.address = router_comp[1]
descriptor.or_port = int(router_comp[2])
descriptor.socks_port = None if router_comp[3] == '0' else int(router_comp[3])
descriptor.dir_port = None if router_comp[4] == '0' else int(router_comp[4])
def _parse_bandwidth_line(descriptor, entries):
# "bandwidth" bandwidth-avg bandwidth-burst bandwidth-observed
value = _value('bandwidth', entries)
bandwidth_comp = value.split()
if len(bandwidth_comp) < 3:
raise ValueError('Bandwidth line must have three values: bandwidth %s' % value)
elif not bandwidth_comp[0].isdigit():
raise ValueError("Bandwidth line's average rate isn't numeric: %s" % bandwidth_comp[0])
elif not bandwidth_comp[1].isdigit():
raise ValueError("Bandwidth line's burst rate isn't numeric: %s" % bandwidth_comp[1])
elif not bandwidth_comp[2].isdigit():
raise ValueError("Bandwidth line's observed rate isn't numeric: %s" % bandwidth_comp[2])
descriptor.average_bandwidth = int(bandwidth_comp[0])
descriptor.burst_bandwidth = int(bandwidth_comp[1])
descriptor.observed_bandwidth = int(bandwidth_comp[2])
def _parse_platform_line(descriptor, entries):
# "platform" string
_parse_bytes_line('platform', 'platform')(descriptor, entries)
# The platform attribute was set earlier. This line can contain any
# arbitrary data, but tor seems to report its version followed by the
# os like the following...
#
# platform Tor 0.2.2.35 (git-73ff13ab3cc9570d) on Linux x86_64
#
# There's no guarantee that we'll be able to pick these out the
# version, but might as well try to save our caller the effort.
value = _value('platform', entries)
platform_match = re.match('^(?:node-)?Tor (\\S*).* on (.*)$', value)
if platform_match:
version_str, descriptor.operating_system = platform_match.groups()
try:
descriptor.tor_version = stem.version._get_version(version_str)
except ValueError:
pass
def _parse_fingerprint_line(descriptor, entries):
# This is forty hex digits split into space separated groups of four.
# Checking that we match this pattern.
value = _value('fingerprint', entries)
fingerprint = value.replace(' ', '')
for grouping in value.split(' '):
if len(grouping) != 4:
raise ValueError('Fingerprint line should have groupings of four hex digits: %s' % value)
if not stem.util.tor_tools.is_valid_fingerprint(fingerprint):
raise ValueError('Tor relay fingerprints consist of forty hex digits: %s' % value)
descriptor.fingerprint = fingerprint
def _parse_extrainfo_digest_line(descriptor, entries):
value = _value('extra-info-digest', entries)
digest_comp = value.split(' ')
if not stem.util.tor_tools.is_hex_digits(digest_comp[0], 40):
raise ValueError('extra-info-digest should be 40 hex characters: %s' % digest_comp[0])
descriptor.extra_info_digest = digest_comp[0]
descriptor.extra_info_sha256_digest = digest_comp[1] if len(digest_comp) >= 2 else None
def _parse_hibernating_line(descriptor, entries):
# "hibernating" 0|1 (in practice only set if one)
value = _value('hibernating', entries)
if value not in ('0', '1'):
raise ValueError('Hibernating line had an invalid value, must be zero or one: %s' % value)
descriptor.hibernating = value == '1'
def _parse_protocols_line(descriptor, entries):
value = _value('protocols', entries)
protocols_match = re.match('^Link (.*) Circuit (.*)$', value)
if not protocols_match:
raise ValueError('Protocols line did not match the expected pattern: protocols %s' % value)
link_versions, circuit_versions = protocols_match.groups()
descriptor.link_protocols = link_versions.split(' ')
descriptor.circuit_protocols = circuit_versions.split(' ')
def _parse_or_address_line(descriptor, entries):
all_values = _values('or-address', entries)
or_addresses = []
for entry in all_values:
line = 'or-address %s' % entry
if ':' not in entry:
raise ValueError('or-address line missing a colon: %s' % line)
address, port = entry.rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address) and not stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True):
raise ValueError('or-address line has a malformed address: %s' % line)
if not stem.util.connection.is_valid_port(port):
raise ValueError('or-address line has a malformed port: %s' % line)
or_addresses.append((address.lstrip('[').rstrip(']'), int(port), stem.util.connection.is_valid_ipv6_address(address, allow_brackets = True)))
descriptor.or_addresses = or_addresses
def _parse_history_line(keyword, history_end_attribute, history_interval_attribute, history_values_attribute, descriptor, entries):
value = _value(keyword, entries)
timestamp, interval, remainder = stem.descriptor.extrainfo_descriptor._parse_timestamp_and_interval(keyword, value)
try:
if remainder:
history_values = [int(entry) for entry in remainder.split(',')]
else:
history_values = []
except ValueError:
raise ValueError('%s line has non-numeric values: %s %s' % (keyword, keyword, value))
setattr(descriptor, history_end_attribute, timestamp)
setattr(descriptor, history_interval_attribute, interval)
setattr(descriptor, history_values_attribute, history_values)
def _parse_exit_policy(descriptor, entries):
if hasattr(descriptor, '_unparsed_exit_policy'):
if descriptor._unparsed_exit_policy and stem.util.str_tools._to_unicode(descriptor._unparsed_exit_policy[0]) == 'reject *:*':
descriptor.exit_policy = REJECT_ALL_POLICY
else:
descriptor.exit_policy = stem.exit_policy.ExitPolicy(*descriptor._unparsed_exit_policy)
del descriptor._unparsed_exit_policy
def _parse_identity_ed25519_line(descriptor, entries):
# TODO: replace this with Ed25519Certificate._from_descriptor() in stem 2.x
_parse_key_block('identity-ed25519', 'ed25519_certificate', 'ED25519 CERT')(descriptor, entries)
if descriptor.ed25519_certificate:
descriptor.certificate = stem.descriptor.certificate.Ed25519Certificate.from_base64(descriptor.ed25519_certificate)
_parse_master_key_ed25519_line = _parse_simple_line('master-key-ed25519', 'ed25519_master_key')
_parse_master_key_ed25519_for_hash_line = _parse_simple_line('master-key-ed25519', 'ed25519_certificate_hash')
_parse_contact_line = _parse_bytes_line('contact', 'contact')
_parse_published_line = _parse_timestamp_line('published', 'published')
_parse_read_history_line = functools.partial(_parse_history_line, 'read-history', 'read_history_end', 'read_history_interval', 'read_history_values')
_parse_write_history_line = functools.partial(_parse_history_line, 'write-history', 'write_history_end', 'write_history_interval', 'write_history_values')
_parse_ipv6_policy_line = _parse_simple_line('ipv6-policy', 'exit_policy_v6', func = lambda v: stem.exit_policy.MicroExitPolicy(v))
_parse_allow_single_hop_exits_line = _parse_if_present('allow-single-hop-exits', 'allow_single_hop_exits')
_parse_tunneled_dir_server_line = _parse_if_present('tunnelled-dir-server', 'allow_tunneled_dir_requests')
_parse_proto_line = _parse_protocol_line('proto', 'protocols')
_parse_hidden_service_dir_line = _parse_if_present('hidden-service-dir', 'is_hidden_service_dir')
_parse_caches_extra_info_line = _parse_if_present('caches-extra-info', 'extra_info_cache')
_parse_bridge_distribution_request_line = _parse_simple_line('bridge-distribution-request', 'bridge_distribution')
_parse_family_line = _parse_simple_line('family', 'family', func = lambda v: set(v.split(' ')))
_parse_eventdns_line = _parse_simple_line('eventdns', 'eventdns', func = lambda v: v == '1')
_parse_onion_key_line = _parse_key_block('onion-key', 'onion_key', 'RSA PUBLIC KEY')
_parse_onion_key_crosscert_line = _parse_key_block('onion-key-crosscert', 'onion_key_crosscert', 'CROSSCERT')
_parse_signing_key_line = _parse_key_block('signing-key', 'signing_key', 'RSA PUBLIC KEY')
_parse_router_signature_line = _parse_key_block('router-signature', 'signature', 'SIGNATURE')
_parse_ntor_onion_key_line = _parse_simple_line('ntor-onion-key', 'ntor_onion_key')
_parse_ntor_onion_key_crosscert_line = _parse_key_block('ntor-onion-key-crosscert', 'ntor_onion_key_crosscert', 'ED25519 CERT', 'ntor_onion_key_crosscert_sign')
_parse_router_sig_ed25519_line = _parse_simple_line('router-sig-ed25519', 'ed25519_signature')
_parse_router_digest_sha256_line = _parse_simple_line('router-digest-sha256', 'router_digest_sha256')
_parse_router_digest_line = _parse_forty_character_hex('router-digest', '_digest')
# TODO: We need to be tolerant of negative uptimes to accommodate a past tor
# bug...
#
# Changes in version 0.1.2.7-alpha - 2007-02-06
# - If our system clock jumps back in time, don't publish a negative
# uptime in the descriptor. Also, don't let the global rate limiting
# buckets go absurdly negative.
#
# After parsing all of the attributes we'll double check that negative
# uptimes only occurred prior to this fix.
_parse_uptime_line = _parse_int_line('uptime', 'uptime', allow_negative = True)
class ServerDescriptor(Descriptor):
"""
Common parent for server descriptors.
:var str nickname: **\\*** relay's nickname
:var str fingerprint: identity key fingerprint
:var datetime published: **\\*** time in UTC when this descriptor was made
:var str address: **\\*** IPv4 address of the relay
:var int or_port: **\\*** port used for relaying
:var int socks_port: **\\*** port used as client (**deprecated**, always **None**)
:var int dir_port: **\\*** port used for descriptor mirroring
:var bytes platform: line with operating system and tor version
:var stem.version.Version tor_version: version of tor
:var str operating_system: operating system
:var int uptime: uptime when published in seconds
:var bytes contact: contact information
:var stem.exit_policy.ExitPolicy exit_policy: **\\*** stated exit policy
:var stem.exit_policy.MicroExitPolicy exit_policy_v6: **\\*** exit policy for IPv6
:var BridgeDistribution bridge_distribution: **\\*** preferred method of providing this relay's
address if a bridge
:var set family: **\\*** nicknames or fingerprints of declared family
:var int average_bandwidth: **\\*** average rate it's willing to relay in bytes/s
:var int burst_bandwidth: **\\*** burst rate it's willing to relay in bytes/s
:var int observed_bandwidth: **\\*** estimated capacity based on usage in bytes/s
:var list link_protocols: link protocols supported by the relay
:var list circuit_protocols: circuit protocols supported by the relay
:var bool is_hidden_service_dir: **\\*** indicates if the relay serves hidden
service descriptors
:var bool hibernating: **\\*** hibernating when published
:var bool allow_single_hop_exits: **\\*** flag if single hop exiting is allowed
:var bool allow_tunneled_dir_requests: **\\*** flag if tunneled directory
requests are accepted
:var bool extra_info_cache: **\\*** flag if a mirror for extra-info documents
:var str extra_info_digest: upper-case hex encoded digest of our extra-info document
:var str extra_info_sha256_digest: base64 encoded sha256 digest of our extra-info document
:var bool eventdns: flag for evdns backend (**deprecated**, always unset)
:var str ntor_onion_key: base64 key used to encrypt EXTEND in the ntor protocol
:var list or_addresses: **\\*** alternative for our address/or_port
attributes, each entry is a tuple of the form (address (**str**), port
(**int**), is_ipv6 (**bool**))
:var dict protocols: mapping of protocols to their supported versions
**Deprecated**, moved to extra-info descriptor...
:var datetime read_history_end: end of the sampling interval
:var int read_history_interval: seconds per interval
:var list read_history_values: bytes read during each interval
:var datetime write_history_end: end of the sampling interval
:var int write_history_interval: seconds per interval
:var list write_history_values: bytes written during each interval
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
.. versionchanged:: 1.5.0
Added the allow_tunneled_dir_requests attribute.
.. versionchanged:: 1.6.0
Added the extra_info_sha256_digest, protocols, and bridge_distribution
attributes.
.. versionchanged:: 1.7.0
Added the is_hidden_service_dir attribute.
.. versionchanged:: 1.7.0
Deprecated the hidden_service_dir field, it's never been populated
(:spec:`43c2f78`). This field will be removed in Stem 2.0.
"""
ATTRIBUTES = {
'nickname': (None, _parse_router_line),
'fingerprint': (None, _parse_fingerprint_line),
'contact': (None, _parse_contact_line),
'published': (None, _parse_published_line),
'exit_policy': (None, _parse_exit_policy),
'address': (None, _parse_router_line),
'or_port': (None, _parse_router_line),
'socks_port': (None, _parse_router_line),
'dir_port': (None, _parse_router_line),
'platform': (None, _parse_platform_line),
'tor_version': (None, _parse_platform_line),
'operating_system': (None, _parse_platform_line),
'uptime': (None, _parse_uptime_line),
'exit_policy_v6': (DEFAULT_IPV6_EXIT_POLICY, _parse_ipv6_policy_line),
'bridge_distribution': (DEFAULT_BRIDGE_DISTRIBUTION, _parse_bridge_distribution_request_line),
'family': (set(), _parse_family_line),
'average_bandwidth': (None, _parse_bandwidth_line),
'burst_bandwidth': (None, _parse_bandwidth_line),
'observed_bandwidth': (None, _parse_bandwidth_line),
'link_protocols': (None, _parse_protocols_line),
'circuit_protocols': (None, _parse_protocols_line),
'is_hidden_service_dir': (False, _parse_hidden_service_dir_line),
'hibernating': (False, _parse_hibernating_line),
'allow_single_hop_exits': (False, _parse_allow_single_hop_exits_line),
'allow_tunneled_dir_requests': (False, _parse_tunneled_dir_server_line),
'protocols': ({}, _parse_proto_line),
'extra_info_cache': (False, _parse_caches_extra_info_line),
'extra_info_digest': (None, _parse_extrainfo_digest_line),
'extra_info_sha256_digest': (None, _parse_extrainfo_digest_line),
'eventdns': (None, _parse_eventdns_line),
'ntor_onion_key': (None, _parse_ntor_onion_key_line),
'or_addresses': ([], _parse_or_address_line),
'read_history_end': (None, _parse_read_history_line),
'read_history_interval': (None, _parse_read_history_line),
'read_history_values': (None, _parse_read_history_line),
'write_history_end': (None, _parse_write_history_line),
'write_history_interval': (None, _parse_write_history_line),
'write_history_values': (None, _parse_write_history_line),
}
PARSER_FOR_LINE = {
'router': _parse_router_line,
'bandwidth': _parse_bandwidth_line,
'platform': _parse_platform_line,
'published': _parse_published_line,
'fingerprint': _parse_fingerprint_line,
'contact': _parse_contact_line,
'hibernating': _parse_hibernating_line,
'extra-info-digest': _parse_extrainfo_digest_line,
'hidden-service-dir': _parse_hidden_service_dir_line,
'uptime': _parse_uptime_line,
'protocols': _parse_protocols_line,
'ntor-onion-key': _parse_ntor_onion_key_line,
'or-address': _parse_or_address_line,
'read-history': _parse_read_history_line,
'write-history': _parse_write_history_line,
'ipv6-policy': _parse_ipv6_policy_line,
'allow-single-hop-exits': _parse_allow_single_hop_exits_line,
'tunnelled-dir-server': _parse_tunneled_dir_server_line,
'proto': _parse_proto_line,
'caches-extra-info': _parse_caches_extra_info_line,
'bridge-distribution-request': _parse_bridge_distribution_request_line,
'family': _parse_family_line,
'eventdns': _parse_eventdns_line,
}
def __init__(self, raw_contents, validate = False, annotations = None):
"""
Server descriptor constructor, created from an individual relay's
descriptor content (as provided by 'GETINFO desc/*', cached descriptors,
and metrics).
By default this validates the descriptor's content as it's parsed. This
validation can be disables to either improve performance or be accepting of
malformed data.
:param str raw_contents: descriptor content provided by the relay
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param list annotations: lines that appeared prior to the descriptor
:raises: **ValueError** if the contents is malformed and validate is True
"""
super(ServerDescriptor, self).__init__(raw_contents, lazy_load = not validate)
self._annotation_lines = annotations if annotations else []
# A descriptor contains a series of 'keyword lines' which are simply a
# keyword followed by an optional value. Lines can also be followed by a
# signature block.
#
# We care about the ordering of 'accept' and 'reject' entries because this
# influences the resulting exit policy, but for everything else the order
# does not matter so breaking it into key / value pairs.
entries, self._unparsed_exit_policy = _descriptor_components(stem.util.str_tools._to_unicode(raw_contents), validate, extra_keywords = ('accept', 'reject'), non_ascii_fields = ('contact', 'platform'))
# TODO: Remove the following field in Stem 2.0. It has never been populated...
#
# https://gitweb.torproject.org/torspec.git/commit/?id=43c2f78
self.hidden_service_dir = ['2']
if validate:
self._parse(entries, validate)
_parse_exit_policy(self, entries)
# if we have a negative uptime and a tor version that shouldn't exhibit
# this bug then fail validation
if validate and self.uptime and self.tor_version:
if self.uptime < 0 and self.tor_version >= stem.version.Version('0.1.2.7'):
raise ValueError("Descriptor for version '%s' had a negative uptime value: %i" % (self.tor_version, self.uptime))
self._check_constraints(entries)
else:
self._entries = entries
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
"""
Digest of this descriptor's content. These are referenced by...
* **Consensus**
* Referer: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` **digest** attribute
* Format: **SHA1/BASE64**
.. versionchanged:: 1.8.0
Added the hash_type and encoding arguments.
:param stem.descriptor.DigestHash hash_type: digest hashing algorithm
:param stem.descriptor.DigestEncoding encoding: digest encoding
:returns: **hashlib.HASH** or **str** based on our encoding argument
"""
raise NotImplementedError('Unsupported Operation: this should be implemented by the ServerDescriptor subclass')
@lru_cache()
def get_annotations(self):
"""
Provides content that appeared prior to the descriptor. If this comes from
the cached-descriptors file then this commonly contains content like...
::
@downloaded-at 2012-03-18 21:18:29
@source "173.254.216.66"
.. deprecated:: 1.8.0
Users very rarely read from cached descriptor files any longer. This
method will be removed in Stem 2.x. If you have some need for us to keep
this please `let me know
`_.
:returns: **dict** with the key/value pairs in our annotations
"""
annotation_dict = {}
for line in self._annotation_lines:
if ' ' in line:
key, value = line.split(' ', 1)
annotation_dict[key] = value
else:
annotation_dict[line] = None
return annotation_dict
def get_annotation_lines(self):
"""
Provides the lines of content that appeared prior to the descriptor. This
is the same as the
:func:`~stem.descriptor.server_descriptor.ServerDescriptor.get_annotations`
results, but with the unparsed lines and ordering retained.
.. deprecated:: 1.8.0
Users very rarely read from cached descriptor files any longer. This
method will be removed in Stem 2.x. If you have some need for us to keep
this please `let me know
`_.
:returns: **list** with the lines of annotation that came before this descriptor
"""
return self._annotation_lines
def _check_constraints(self, entries):
"""
Does a basic check that the entries conform to this descriptor type's
constraints.
:param dict entries: keyword => (value, pgp key) entries
:raises: **ValueError** if an issue arises in validation
"""
for keyword in self._required_fields():
if keyword not in entries:
raise ValueError("Descriptor must have a '%s' entry" % keyword)
for keyword in self._single_fields():
if keyword in entries and len(entries[keyword]) > 1:
raise ValueError("The '%s' entry can only appear once in a descriptor" % keyword)
expected_first_keyword = self._first_keyword()
if expected_first_keyword and expected_first_keyword != list(entries.keys())[0]:
raise ValueError("Descriptor must start with a '%s' entry" % expected_first_keyword)
expected_last_keyword = self._last_keyword()
if expected_last_keyword and expected_last_keyword != list(entries.keys())[-1]:
raise ValueError("Descriptor must end with a '%s' entry" % expected_last_keyword)
if 'identity-ed25519' in entries.keys():
if 'router-sig-ed25519' not in entries.keys():
raise ValueError('Descriptor must have router-sig-ed25519 entry to accompany identity-ed25519')
elif 'router-sig-ed25519' not in list(entries.keys())[-2:]:
raise ValueError("Descriptor must have 'router-sig-ed25519' as the next-to-last entry")
if not self.exit_policy:
raise ValueError("Descriptor must have at least one 'accept' or 'reject' entry")
# Constraints that the descriptor must meet to be valid. These can be None if
# not applicable.
def _required_fields(self):
return REQUIRED_FIELDS
def _single_fields(self):
return REQUIRED_FIELDS + SINGLE_FIELDS
def _first_keyword(self):
return 'router'
def _last_keyword(self):
return 'router-signature'
class RelayDescriptor(ServerDescriptor):
"""
Server descriptor (`descriptor specification
`_)
:var stem.certificate.Ed25519Certificate certificate: ed25519 certificate
:var str ed25519_certificate: base64 encoded ed25519 certificate
:var str ed25519_master_key: base64 encoded master key for our ed25519 certificate
:var str ed25519_signature: signature of this document using ed25519
:var str onion_key: **\\*** key used to encrypt EXTEND cells
:var str onion_key_crosscert: signature generated using the onion_key
:var str ntor_onion_key_crosscert: signature generated using the ntor-onion-key
:var str ntor_onion_key_crosscert_sign: sign of the corresponding ed25519 public key
:var str signing_key: **\\*** relay's long-term identity key
:var str signature: **\\*** signature for this descriptor
**\\*** attribute is required when we're parsed with validation
.. versionchanged:: 1.5.0
Added the ed25519_certificate, ed25519_master_key, ed25519_signature,
onion_key_crosscert, ntor_onion_key_crosscert, and
ntor_onion_key_crosscert_sign attributes.
.. versionchanged:: 1.6.0
Moved from the deprecated `pycrypto
`_ module to `cryptography
`_ for validating signatures.
.. versionchanged:: 1.6.0
Added the certificate attribute.
.. deprecated:: 1.6.0
Our **ed25519_certificate** is deprecated in favor of our new
**certificate** attribute. The base64 encoded certificate is available via
the certificate's **encoded** attribute.
.. versionchanged:: 1.6.0
Added the **skip_crypto_validation** constructor argument.
"""
TYPE_ANNOTATION_NAME = 'server-descriptor'
ATTRIBUTES = dict(ServerDescriptor.ATTRIBUTES, **{
'certificate': (None, _parse_identity_ed25519_line),
'ed25519_certificate': (None, _parse_identity_ed25519_line),
'ed25519_master_key': (None, _parse_master_key_ed25519_line),
'ed25519_signature': (None, _parse_router_sig_ed25519_line),
'onion_key': (None, _parse_onion_key_line),
'onion_key_crosscert': (None, _parse_onion_key_crosscert_line),
'ntor_onion_key_crosscert': (None, _parse_ntor_onion_key_crosscert_line),
'ntor_onion_key_crosscert_sign': (None, _parse_ntor_onion_key_crosscert_line),
'signing_key': (None, _parse_signing_key_line),
'signature': (None, _parse_router_signature_line),
})
PARSER_FOR_LINE = dict(ServerDescriptor.PARSER_FOR_LINE, **{
'identity-ed25519': _parse_identity_ed25519_line,
'master-key-ed25519': _parse_master_key_ed25519_line,
'router-sig-ed25519': _parse_router_sig_ed25519_line,
'onion-key': _parse_onion_key_line,
'onion-key-crosscert': _parse_onion_key_crosscert_line,
'ntor-onion-key-crosscert': _parse_ntor_onion_key_crosscert_line,
'signing-key': _parse_signing_key_line,
'router-signature': _parse_router_signature_line,
})
def __init__(self, raw_contents, validate = False, annotations = None, skip_crypto_validation = False):
super(RelayDescriptor, self).__init__(raw_contents, validate, annotations)
if validate:
if self.fingerprint:
key_hash = hashlib.sha1(_bytes_for_block(self.signing_key)).hexdigest()
if key_hash != self.fingerprint.lower():
raise ValueError('Fingerprint does not match the hash of our signing key (fingerprint: %s, signing key hash: %s)' % (self.fingerprint.lower(), key_hash))
if not skip_crypto_validation and stem.prereq.is_crypto_available():
signed_digest = self._digest_for_signature(self.signing_key, self.signature)
if signed_digest != self.digest():
raise ValueError('Decrypted digest does not match local digest (calculated: %s, local: %s)' % (signed_digest, self.digest()))
if self.onion_key_crosscert and stem.prereq.is_crypto_available():
onion_key_crosscert_digest = self._digest_for_signature(self.onion_key, self.onion_key_crosscert)
if onion_key_crosscert_digest != self._onion_key_crosscert_digest():
raise ValueError('Decrypted onion-key-crosscert digest does not match local digest (calculated: %s, local: %s)' % (onion_key_crosscert_digest, self._onion_key_crosscert_digest()))
if stem.prereq.is_crypto_available(ed25519 = True) and self.certificate:
self.certificate.validate(self)
@classmethod
def content(cls, attr = None, exclude = (), sign = False, signing_key = None, exit_policy = None):
if signing_key:
sign = True
if attr is None:
attr = {}
if exit_policy is None:
exit_policy = REJECT_ALL_POLICY
base_header = [
('router', '%s %s 9001 0 0' % (_random_nickname(), _random_ipv4_address())),
('published', _random_date()),
('bandwidth', '153600 256000 104590'),
] + [
tuple(line.split(' ', 1)) for line in str(exit_policy).splitlines()
] + [
('onion-key', _random_crypto_blob('RSA PUBLIC KEY')),
('signing-key', _random_crypto_blob('RSA PUBLIC KEY')),
]
if sign:
if attr and 'signing-key' in attr:
raise ValueError('Cannot sign the descriptor if a signing-key has been provided')
elif attr and 'router-signature' in attr:
raise ValueError('Cannot sign the descriptor if a router-signature has been provided')
if signing_key is None:
signing_key = create_signing_key()
if 'fingerprint' not in attr:
fingerprint = hashlib.sha1(_bytes_for_block(stem.util.str_tools._to_unicode(signing_key.public_digest.strip()))).hexdigest().upper()
attr['fingerprint'] = ' '.join(stem.util.str_tools._split_by_length(fingerprint, 4))
attr['signing-key'] = signing_key.public_digest
content = _descriptor_content(attr, exclude, base_header) + b'\nrouter-signature\n'
return _append_router_signature(content, signing_key.private)
else:
return _descriptor_content(attr, exclude, base_header, (
('router-sig-ed25519', None),
('router-signature', _random_crypto_blob('SIGNATURE')),
))
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, signing_key = None, exit_policy = None):
return cls(cls.content(attr, exclude, sign, signing_key, exit_policy), validate = validate, skip_crypto_validation = not sign)
@lru_cache()
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
"""
Provides the digest of our descriptor's content.
:returns: the digest string encoded in uppercase hex
:raises: ValueError if the digest cannot be calculated
"""
content = self._content_range(start = 'router', end = '\nrouter-signature\n')
if hash_type == DigestHash.SHA1:
return stem.descriptor._encode_digest(hashlib.sha1(content), encoding)
elif hash_type == DigestHash.SHA256:
return stem.descriptor._encode_digest(hashlib.sha256(content), encoding)
else:
raise NotImplementedError('Server descriptor digests are only available in sha1 and sha256, not %s' % hash_type)
def make_router_status_entry(self):
"""
Provides a RouterStatusEntryV3 for this descriptor content.
.. versionadded:: 1.6.0
:returns: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3`
that would be in the consensus
"""
if not self.fingerprint:
raise ValueError('Server descriptor lacks a fingerprint. This is an optional field, but required to make a router status entry.')
attr = {
'r': ' '.join([
self.nickname,
_truncated_b64encode(binascii.unhexlify(stem.util.str_tools._to_bytes(self.fingerprint))),
_truncated_b64encode(binascii.unhexlify(stem.util.str_tools._to_bytes(self.digest()))),
self.published.strftime('%Y-%m-%d %H:%M:%S'),
self.address,
str(self.or_port),
str(self.dir_port) if self.dir_port else '0',
]),
'w': 'Bandwidth=%i' % self.average_bandwidth,
'p': self.exit_policy.summary().replace(', ', ','),
}
if self.tor_version:
attr['v'] = 'Tor %s' % self.tor_version
if self.or_addresses:
attr['a'] = ['%s:%s' % (addr, port) for addr, port, _ in self.or_addresses]
if self.certificate:
attr['id'] = 'ed25519 %s' % _truncated_b64encode(self.certificate.key)
return RouterStatusEntryV3.create(attr)
@lru_cache()
def _onion_key_crosscert_digest(self):
"""
Provides the digest of the onion-key-crosscert data. This consists of the
RSA identity key sha1 and ed25519 identity key.
:returns: **unicode** digest encoded in uppercase hex
:raises: ValueError if the digest cannot be calculated
"""
signing_key_digest = hashlib.sha1(_bytes_for_block(self.signing_key)).digest()
data = signing_key_digest + base64.b64decode(stem.util.str_tools._to_bytes(self.ed25519_master_key) + b'=')
return stem.util.str_tools._to_unicode(binascii.hexlify(data).upper())
def _check_constraints(self, entries):
super(RelayDescriptor, self)._check_constraints(entries)
if self.ed25519_certificate:
if not self.onion_key_crosscert:
raise ValueError("Descriptor must have a 'onion-key-crosscert' when identity-ed25519 is present")
elif not self.ed25519_signature:
raise ValueError("Descriptor must have a 'router-sig-ed25519' when identity-ed25519 is present")
class BridgeDescriptor(ServerDescriptor):
"""
Bridge descriptor (`bridge descriptor specification
`_)
:var str ed25519_certificate_hash: sha256 hash of the original identity-ed25519
:var str router_digest_sha256: sha256 digest of this document
.. versionchanged:: 1.5.0
Added the ed25519_certificate_hash and router_digest_sha256 attributes.
Also added ntor_onion_key (previously this only belonged to unsanitized
descriptors).
"""
TYPE_ANNOTATION_NAME = 'bridge-server-descriptor'
ATTRIBUTES = dict(ServerDescriptor.ATTRIBUTES, **{
'ed25519_certificate_hash': (None, _parse_master_key_ed25519_for_hash_line),
'router_digest_sha256': (None, _parse_router_digest_sha256_line),
'_digest': (None, _parse_router_digest_line),
})
PARSER_FOR_LINE = dict(ServerDescriptor.PARSER_FOR_LINE, **{
'master-key-ed25519': _parse_master_key_ed25519_for_hash_line,
'router-digest-sha256': _parse_router_digest_sha256_line,
'router-digest': _parse_router_digest_line,
})
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('router', '%s %s 9001 0 0' % (_random_nickname(), _random_ipv4_address())),
('router-digest', '006FD96BA35E7785A6A3B8B75FE2E2435A13BDB4'),
('published', _random_date()),
('bandwidth', '409600 819200 5120'),
('reject', '*:*'),
))
def digest(self, hash_type = DigestHash.SHA1, encoding = DigestEncoding.HEX):
if hash_type == DigestHash.SHA1 and encoding == DigestEncoding.HEX:
return self._digest
else:
raise NotImplementedError('Bridge server descriptor digests are only available as sha1/hex, not %s/%s' % (hash_type, encoding))
def is_scrubbed(self):
"""
Checks if we've been properly scrubbed in accordance with the `bridge
descriptor specification
`_.
Validation is a moving target so this may not be fully up to date.
:returns: **True** if we're scrubbed, **False** otherwise
"""
return self.get_scrubbing_issues() == []
@lru_cache()
def get_scrubbing_issues(self):
"""
Provides issues with our scrubbing.
:returns: **list** of strings which describe issues we have with our
scrubbing, this list is empty if we're properly scrubbed
"""
issues = []
if not self.address.startswith('10.'):
issues.append("Router line's address should be scrubbed to be '10.x.x.x': %s" % self.address)
if self.contact and self.contact != 'somebody':
issues.append("Contact line should be scrubbed to be 'somebody', but instead had '%s'" % self.contact)
for address, _, is_ipv6 in self.or_addresses:
if not is_ipv6 and not address.startswith('10.'):
issues.append("or-address line's address should be scrubbed to be '10.x.x.x': %s" % address)
elif is_ipv6 and not address.startswith('fd9f:2e19:3bcf::'):
# TODO: this check isn't quite right because we aren't checking that
# the next grouping of hex digits contains 1-2 digits
issues.append("or-address line's address should be scrubbed to be 'fd9f:2e19:3bcf::xx:xxxx': %s" % address)
for line in self.get_unrecognized_lines():
if line.startswith('onion-key '):
issues.append('Bridge descriptors should have their onion-key scrubbed: %s' % line)
elif line.startswith('signing-key '):
issues.append('Bridge descriptors should have their signing-key scrubbed: %s' % line)
elif line.startswith('router-signature '):
issues.append('Bridge descriptors should have their signature scrubbed: %s' % line)
return issues
def _required_fields(self):
# bridge required fields are the same as a relay descriptor, minus items
# excluded according to the format page
excluded_fields = [
'onion-key',
'signing-key',
'router-signature',
]
included_fields = [
'router-digest',
]
return tuple(included_fields + [f for f in REQUIRED_FIELDS if f not in excluded_fields])
def _single_fields(self):
return self._required_fields() + SINGLE_FIELDS
def _last_keyword(self):
return None
stem-1.8.0/stem/descriptor/bandwidth_file.py 0000664 0001750 0001750 00000026704 13501272761 021672 0 ustar atagar atagar 0000000 0000000 # Copyright 2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Bandwidth Authority metrics as described in Tor's
`bandwidth-file-spec `_.
**Module Overview:**
::
BandwidthFile - Tor bandwidth authority measurements.
.. versionadded:: 1.8.0
"""
import datetime
import io
import time
import stem.util.str_tools
from stem.descriptor import (
_mappings_for,
Descriptor,
)
try:
# added in python 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
# Four character dividers are allowed for backward compatability, but five is
# preferred.
HEADER_DIV = b'====='
HEADER_DIV_ALT = b'===='
class RecentStats(object):
"""
Statistical information collected over the last 'data_period' (by default
five days).
:var int consensus_count: number of consensuses published during this period
:var int prioritized_relays: number of relays prioritized to be measured
:var int prioritized_relay_lists: number of times a set of relays were
prioritized to be measured
:var int measurement_attempts: number of relay measurements we attempted
:var int measurement_failures: number of measurement attempts that failed
:var RelayFailures relay_failures: number of relays we failed to measure
"""
def __init__(self):
self.consensus_count = None
self.prioritized_relays = None
self.prioritized_relay_lists = None
self.measurement_attempts = None
self.measurement_failures = None
self.relay_failures = RelayFailures()
class RelayFailures(object):
"""
Summary of the number of relays we were unable to measure.
:var int no_measurement: number of relays that did not have any successful
measurements
:var int insuffient_period: number of relays whos measurements were collected
over a period that was too small (1 day by default)
:var int insufficient_measurements: number of relays we did not collect
enough measurements for (2 by default)
:var int stale: number of relays whos latest measurement is too old (5 days
by default)
"""
def __init__(self):
self.no_measurement = None
self.insuffient_period = None
self.insufficient_measurements = None
self.stale = None
# Converts header attributes to a given type. Malformed fields should be
# ignored according to the spec.
def _str(val):
return val # already a str
def _int(val):
return int(val) if (val and val.isdigit()) else None
def _date(val):
try:
return stem.util.str_tools._parse_iso_timestamp(val)
except ValueError:
return None # not an iso formatted date
def _csv(val):
return list(map(lambda v: v.strip(), val.split(','))) if val is not None else None
# mapping of attributes => (header, type)
HEADER_ATTR = {
# version 1.1.0 introduced headers
'version': ('version', _str),
'software': ('software', _str),
'software_version': ('software_version', _str),
'earliest_bandwidth': ('earliest_bandwidth', _date),
'latest_bandwidth': ('latest_bandwidth', _date),
'created_at': ('file_created', _date),
'generated_at': ('generator_started', _date),
# version 1.2.0 additions
'consensus_size': ('number_consensus_relays', _int),
'eligible_count': ('number_eligible_relays', _int),
'eligible_percent': ('percent_eligible_relays', _int),
'min_count': ('minimum_number_eligible_relays', _int),
'min_percent': ('minimum_percent_eligible_relays', _int),
# version 1.3.0 additions
'scanner_country': ('scanner_country', _str),
'destinations_countries': ('destinations_countries', _csv),
# version 1.4.0 additions
'time_to_report_half_network': ('time_to_report_half_network', _int),
'recent_stats.consensus_count': ('recent_consensus_count', _int),
'recent_stats.prioritized_relay_lists': ('recent_priority_list_count', _int),
'recent_stats.prioritized_relays': ('recent_priority_relay_count', _int),
'recent_stats.measurement_attempts': ('recent_measurement_attempt_count', _int),
'recent_stats.measurement_failures': ('recent_measurement_failure_count', _int),
'recent_stats.relay_failures.no_measurement': ('recent_measurements_excluded_error_count', _int),
'recent_stats.relay_failures.insuffient_period': ('recent_measurements_excluded_near_count', _int),
'recent_stats.relay_failures.insufficient_measurements': ('recent_measurements_excluded_few_count', _int),
'recent_stats.relay_failures.stale': ('recent_measurements_excluded_old_count', _int),
}
HEADER_DEFAULT = {
'version': '1.0.0', # version field was added in 1.1.0
}
def _parse_file(descriptor_file, validate = False, **kwargs):
"""
Iterates over the bandwidth authority metrics in a file.
:param file descriptor_file: file with descriptor content
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param dict kwargs: additional arguments for the descriptor constructor
:returns: :class:`stem.descriptor.bandwidth_file.BandwidthFile` object
:raises:
* **ValueError** if the contents is malformed and validate is **True**
* **IOError** if the file can't be read
"""
yield BandwidthFile(descriptor_file.read(), validate, **kwargs)
def _parse_header(descriptor, entries):
header = OrderedDict()
content = io.BytesIO(descriptor.get_bytes())
content.readline() # skip the first line, which should be the timestamp
index = 1
version_index = None
while True:
line = content.readline().strip()
if not line:
break # end of the content
elif line in (HEADER_DIV, HEADER_DIV_ALT):
break # end of header
elif not header and b'node_id=' in line:
break # version 1.0 doesn't have any headers
if b'=' in line:
key, value = stem.util.str_tools._to_unicode(line).split('=', 1)
header[key] = value
if key == 'version':
version_index = index
else:
raise ValueError("Header expected to be key=value pairs, but had '%s'" % line)
index += 1
descriptor.header = header
descriptor.recent_stats = RecentStats()
for full_attr, (keyword, cls) in HEADER_ATTR.items():
obj = descriptor
for attr in full_attr.split('.')[:-1]:
obj = getattr(obj, attr)
setattr(obj, full_attr.split('.')[-1], cls(header.get(keyword, HEADER_DEFAULT.get(full_attr))))
if version_index is not None and version_index != 1:
raise ValueError("The 'version' header must be in the second position")
def _parse_timestamp(descriptor, entries):
first_line = io.BytesIO(descriptor.get_bytes()).readline().strip()
if first_line.isdigit():
descriptor.timestamp = datetime.datetime.utcfromtimestamp(int(first_line))
else:
raise ValueError("First line should be a unix timestamp, but was '%s'" % first_line)
def _parse_body(descriptor, entries):
# In version 1.0.0 the body is everything after the first line. Otherwise
# it's everything after the header's divider.
content = io.BytesIO(descriptor.get_bytes())
if descriptor.version == '1.0.0':
content.readline() # skip the first line
else:
while content.readline().strip() not in ('', HEADER_DIV, HEADER_DIV_ALT):
pass # skip the header
measurements = {}
for line in content.readlines():
line = stem.util.str_tools._to_unicode(line.strip())
attr = dict(_mappings_for('measurement', line))
fingerprint = attr.get('node_id', '').lstrip('$') # bwauths prefix fingerprints with '$'
if not fingerprint:
raise ValueError("Every meaurement must include 'node_id': %s" % line)
elif fingerprint in measurements:
raise ValueError('Relay %s is listed multiple times. It should only be present once.' % fingerprint)
measurements[fingerprint] = attr
descriptor.measurements = measurements
class BandwidthFile(Descriptor):
"""
Tor bandwidth authority measurements.
:var dict measurements: **\\*** mapping of relay fingerprints to their
bandwidth measurement metadata
:var dict header: **\\*** header metadata
:var datetime timestamp: **\\*** time when these metrics were published
:var str version: **\\*** document format version
:var str software: application that generated these metrics
:var str software_version: version of the application that generated these metrics
:var datetime earliest_bandwidth: time of the first sampling
:var datetime latest_bandwidth: time of the last sampling
:var datetime created_at: time when this file was created
:var datetime generated_at: time when collection of these metrics started
:var int consensus_size: number of relays in the consensus
:var int eligible_count: relays with enough measurements to be included
:var int eligible_percent: percentage of consensus with enough measurements
:var int min_count: minimum eligible relays for results to be provided
:var int min_percent: minimum measured percentage of the consensus
:var str scanner_country: country code where this scan took place
:var list destinations_countries: all country codes that were scanned
:var int time_to_report_half_network: estimated number of seconds required to
measure half the network, given recent measurements
:var RecentStats recent_stats: statistical information collected over the
last 'data_period' (by default five days)
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
TYPE_ANNOTATION_NAME = 'bandwidth-file'
ATTRIBUTES = {
'timestamp': (None, _parse_timestamp),
'header': ({}, _parse_header),
'measurements': ({}, _parse_body),
}
ATTRIBUTES.update(dict([(k, (None, _parse_header)) for k in HEADER_ATTR.keys()]))
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
"""
Creates descriptor content with the given attributes. This descriptor type
differs somewhat from others and treats our attr/exclude attributes as
follows...
* 'timestamp' is a reserved key for our mandatory header unix timestamp.
* 'content' is a reserved key for our bandwidth measurement lines.
* All other keys are treated as header fields.
For example...
::
BandwidthFile.content({
'timestamp': '12345',
'version': '1.2.0',
'content': [],
})
"""
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
header = OrderedDict(attr) if attr is not None else OrderedDict()
timestamp = header.pop('timestamp', str(int(time.time())))
content = header.pop('content', [])
version = header.get('version', HEADER_DEFAULT.get('version'))
lines = []
if 'timestamp' not in exclude:
lines.append(stem.util.str_tools._to_bytes(timestamp))
if version == '1.0.0' and header:
raise ValueError('Headers require BandwidthFile version 1.1 or later')
elif version != '1.0.0':
# ensure 'version' is the second header
if 'version' not in exclude:
lines.append(stem.util.str_tools._to_bytes('version=%s' % header.pop('version')))
for k, v in header.items():
lines.append(stem.util.str_tools._to_bytes('%s=%s' % (k, v)))
lines.append(HEADER_DIV)
for measurement in content:
lines.append(stem.util.str_tools._to_bytes(measurement))
return b'\n'.join(lines)
def __init__(self, raw_content, validate = False):
super(BandwidthFile, self).__init__(raw_content, lazy_load = not validate)
if validate:
_parse_timestamp(self, None)
_parse_header(self, None)
_parse_body(self, None)
stem-1.8.0/stem/descriptor/remote.py 0000664 0001750 0001750 00000121304 13526063314 020211 0 ustar atagar atagar 0000000 0000000 # Copyright 2013-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Module for remotely retrieving descriptors from directory authorities and
mirrors. This is the simplest method for getting current tor descriptor
information...
::
import stem.descriptor.remote
for desc in stem.descriptor.remote.get_server_descriptors():
if desc.exit_policy.is_exiting_allowed():
print(' %s (%s)' % (desc.nickname, desc.fingerprint))
More custom downloading behavior can be done through the
:class:`~stem.descriptor.remote.DescriptorDownloader` class, which issues
:class:`~stem.descriptor.remote.Query` instances to get you descriptor
content. For example...
::
from stem.descriptor.remote import DescriptorDownloader
downloader = DescriptorDownloader(
use_mirrors = True,
timeout = 10,
)
query = downloader.get_server_descriptors()
print('Exit Relays:')
try:
for desc in query.run():
if desc.exit_policy.is_exiting_allowed():
print(' %s (%s)' % (desc.nickname, desc.fingerprint))
print
print('Query took %0.2f seconds' % query.runtime)
except Exception as exc:
print('Unable to retrieve the server descriptors: %s' % exc)
::
get_instance - Provides a singleton DescriptorDownloader used for...
|- their_server_descriptor - provides the server descriptor of the relay we download from
|- get_server_descriptors - provides present server descriptors
|- get_extrainfo_descriptors - provides present extrainfo descriptors
|- get_microdescriptors - provides present microdescriptors with the given digests
|- get_consensus - provides the present consensus or router status entries
|- get_bandwidth_file - provides bandwidth heuristics used to make the next consensus
+- get_detached_signatures - authority signatures used to make the next consensus
Query - Asynchronous request to download tor descriptors
|- start - issues the query if it isn't already running
+- run - blocks until the request is finished and provides the results
DescriptorDownloader - Configurable class for issuing queries
|- use_directory_mirrors - use directory mirrors to download future descriptors
|- their_server_descriptor - provides the server descriptor of the relay we download from
|- get_server_descriptors - provides present server descriptors
|- get_extrainfo_descriptors - provides present extrainfo descriptors
|- get_microdescriptors - provides present microdescriptors with the given digests
|- get_consensus - provides the present consensus or router status entries
|- get_vote - provides an authority's vote for the next consensus
|- get_key_certificates - provides present authority key certificates
|- get_bandwidth_file - provides bandwidth heuristics used to make the next consensus
|- get_detached_signatures - authority signatures used to make the next consensus
+- query - request an arbitrary descriptor resource
.. versionadded:: 1.1.0
.. data:: MAX_FINGERPRINTS
Maximum number of descriptors that can requested at a time by their
fingerprints.
.. data:: MAX_MICRODESCRIPTOR_HASHES
Maximum number of microdescriptors that can requested at a time by their
hashes.
.. data:: Compression (enum)
Compression when downloading descriptors.
.. versionadded:: 1.7.0
=============== ===========
Compression Description
=============== ===========
**PLAINTEXT** Uncompressed data.
**GZIP** `GZip compression `_.
**ZSTD** `Zstandard compression `_, this requires the `zstandard module `_.
**LZMA** `LZMA compression `_, this requires the 'lzma module `_.
=============== ===========
"""
import io
import random
import socket
import sys
import threading
import time
import stem
import stem.client
import stem.descriptor
import stem.descriptor.networkstatus
import stem.directory
import stem.prereq
import stem.util.enum
import stem.util.tor_tools
from stem.util import log, str_tools
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
# TODO: remove in stem 2.x, replaced with stem.descriptor.Compression
Compression = stem.util.enum.Enum(
('PLAINTEXT', 'identity'),
('GZIP', 'gzip'), # can also be 'deflate'
('ZSTD', 'x-zstd'),
('LZMA', 'x-tor-lzma'),
)
COMPRESSION_MIGRATION = {
'identity': stem.descriptor.Compression.PLAINTEXT,
'gzip': stem.descriptor.Compression.GZIP,
'x-zstd': stem.descriptor.Compression.ZSTD,
'x-tor-lzma': stem.descriptor.Compression.LZMA,
}
# Tor has a limited number of descriptors we can fetch explicitly by their
# fingerprint or hashes due to a limit on the url length by squid proxies.
MAX_FINGERPRINTS = 96
MAX_MICRODESCRIPTOR_HASHES = 90
SINGLETON_DOWNLOADER = None
# Detached signatures do *not* have a specified type annotation. But our
# parsers expect that all descriptors have a type. As such making one up.
# This may change in the future if these ever get an official @type.
#
# https://trac.torproject.org/projects/tor/ticket/28615
DETACHED_SIGNATURE_TYPE = 'detached-signature'
# Some authorities intentionally break their DirPort to discourage DOS. In
# particular they throttle the rate to such a degree that requests can take
# hours to complete. Unfortunately Python's socket timeouts only kick in
# when we stop receiving data, so these 'sandtraps' cause our downloads to
# hang pretty much indefinitely.
#
# Best we can do is simply avoid attempting to use them in the first place.
DIR_PORT_BLACKLIST = ('tor26', 'Serge')
def get_instance():
"""
Provides the singleton :class:`~stem.descriptor.remote.DescriptorDownloader`
used for this module's shorthand functions.
.. versionadded:: 1.5.0
:returns: singleton :class:`~stem.descriptor.remote.DescriptorDownloader` instance
"""
global SINGLETON_DOWNLOADER
if SINGLETON_DOWNLOADER is None:
SINGLETON_DOWNLOADER = DescriptorDownloader()
return SINGLETON_DOWNLOADER
def their_server_descriptor(**query_args):
"""
Provides the server descriptor of the relay we're downloading from.
.. versionadded:: 1.7.0
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the server descriptors
"""
return get_instance().their_server_descriptor(**query_args)
def get_server_descriptors(fingerprints = None, **query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_server_descriptors`
on our singleton instance.
.. versionadded:: 1.5.0
"""
return get_instance().get_server_descriptors(fingerprints, **query_args)
def get_extrainfo_descriptors(fingerprints = None, **query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_extrainfo_descriptors`
on our singleton instance.
.. versionadded:: 1.5.0
"""
return get_instance().get_extrainfo_descriptors(fingerprints, **query_args)
def get_microdescriptors(hashes, **query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_microdescriptors`
on our singleton instance.
.. versionadded:: 1.8.0
"""
return get_instance().get_microdescriptors(hashes, **query_args)
def get_consensus(authority_v3ident = None, microdescriptor = False, **query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_consensus`
on our singleton instance.
.. versionadded:: 1.5.0
"""
return get_instance().get_consensus(authority_v3ident, microdescriptor, **query_args)
def get_bandwidth_file(**query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_bandwidth_file`
on our singleton instance.
.. versionadded:: 1.8.0
"""
return get_instance().get_bandwidth_file(**query_args)
def get_detached_signatures(**query_args):
"""
Shorthand for
:func:`~stem.descriptor.remote.DescriptorDownloader.get_detached_signatures`
on our singleton instance.
.. versionadded:: 1.8.0
"""
return get_instance().get_detached_signatures(**query_args)
class Query(object):
"""
Asynchronous request for descriptor content from a directory authority or
mirror. These can either be made through the
:class:`~stem.descriptor.remote.DescriptorDownloader` or directly for more
advanced usage.
To block on the response and get results either call
:func:`~stem.descriptor.remote.Query.run` or iterate over the Query. The
:func:`~stem.descriptor.remote.Query.run` method pass along any errors that
arise...
::
from stem.descriptor.remote import Query
query = Query(
'/tor/server/all',
timeout = 30,
)
print('Current relays:')
try:
for desc in Query('/tor/server/all', 'server-descriptor 1.0').run():
print(desc.fingerprint)
except Exception as exc:
print('Unable to retrieve the server descriptors: %s' % exc)
... while iterating fails silently...
::
print('Current relays:')
for desc in Query('/tor/server/all', 'server-descriptor 1.0'):
print(desc.fingerprint)
In either case exceptions are available via our 'error' attribute.
Tor provides quite a few different descriptor resources via its directory
protocol (see section 4.2 and later of the `dir-spec
`_).
Commonly useful ones include...
=============================================== ===========
Resource Description
=============================================== ===========
/tor/server/all all present server descriptors
/tor/server/fp/++ server descriptors with the given fingerprints
/tor/extra/all all present extrainfo descriptors
/tor/extra/fp/++ extrainfo descriptors with the given fingerprints
/tor/micro/d/- microdescriptors with the given hashes
/tor/status-vote/current/consensus present consensus
/tor/status-vote/current/consensus-microdesc present microdescriptor consensus
/tor/status-vote/next/bandwidth bandwidth authority heuristics for the next consenus
/tor/status-vote/next/consensus-signatures detached signature, used for making the next consenus
/tor/keys/all key certificates for the authorities
/tor/keys/fp/+ key certificates for specific authorities
=============================================== ===========
**ZSTD** compression requires `zstandard
`_, and **LZMA** requires the `lzma
module `_.
For legacy reasons if our resource has a '.z' suffix then our **compression**
argument is overwritten with Compression.GZIP.
.. versionchanged:: 1.7.0
Added support for downloading from ORPorts.
.. versionchanged:: 1.7.0
Added the compression argument.
.. versionchanged:: 1.7.0
Added the reply_headers attribute.
The class this provides changed between Python versions. In python2
this was called httplib.HTTPMessage, whereas in python3 the class was
renamed to http.client.HTTPMessage.
.. versionchanged:: 1.7.0
Endpoints are now expected to be :class:`~stem.DirPort` or
:class:`~stem.ORPort` instances. Usage of tuples for this
argument is deprecated and will be removed in the future.
.. versionchanged:: 1.7.0
Avoid downloading from tor26. This directory authority throttles its
DirPort to such an extent that requests either time out or take on the
order of minutes.
.. versionchanged:: 1.7.0
Avoid downloading from Bifroest. This is the bridge authority so it
doesn't vote in the consensus, and apparently times out frequently.
.. versionchanged:: 1.8.0
Serge has replaced Bifroest as our bridge authority. Avoiding descriptor
downloads from it instead.
.. versionchanged:: 1.8.0
Defaulting to gzip compression rather than plaintext downloads.
.. versionchanged:: 1.8.0
Using :class:`~stem.descriptor.__init__.Compression` for our compression
argument, usage of strings or this module's Compression enum is deprecated
and will be removed in stem 2.x.
:var str resource: resource being fetched, such as '/tor/server/all'
:var str descriptor_type: type of descriptors being fetched (for options see
:func:`~stem.descriptor.__init__.parse_file`), this is guessed from the
resource if **None**
:var list endpoints: :class:`~stem.DirPort` or :class:`~stem.ORPort` of the
authority or mirror we're querying, this uses authorities if undefined
:var list compression: list of :data:`stem.descriptor.Compression`
we're willing to accept, when none are mutually supported downloads fall
back to Compression.PLAINTEXT
:var int retries: number of times to attempt the request if downloading it
fails
:var bool fall_back_to_authority: when retrying request issues the last
request to a directory authority if **True**
:var str content: downloaded descriptor content
:var Exception error: exception if a problem occured
:var bool is_done: flag that indicates if our request has finished
:var float start_time: unix timestamp when we first started running
:var http.client.HTTPMessage reply_headers: headers provided in the response,
**None** if we haven't yet made our request
:var float runtime: time our query took, this is **None** if it's not yet
finished
:var bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:var stem.descriptor.__init__.DocumentHandler document_handler: method in
which to parse a :class:`~stem.descriptor.networkstatus.NetworkStatusDocument`
:var dict kwargs: additional arguments for the descriptor constructor
Following are only applicable when downloading from a
:class:`~stem.DirPort`...
:var float timeout: duration before we'll time out our request
:var str download_url: last url used to download the descriptor, this is
unset until we've actually made a download attempt
:param bool start: start making the request when constructed (default is **True**)
:param bool block: only return after the request has been completed, this is
the same as running **query.run(True)** (default is **False**)
"""
def __init__(self, resource, descriptor_type = None, endpoints = None, compression = (Compression.GZIP,), retries = 2, fall_back_to_authority = False, timeout = None, start = True, block = False, validate = False, document_handler = stem.descriptor.DocumentHandler.ENTRIES, **kwargs):
if not resource.startswith('/'):
raise ValueError("Resources should start with a '/': %s" % resource)
if resource.endswith('.z'):
compression = [Compression.GZIP]
resource = resource[:-2]
elif not compression:
compression = [Compression.PLAINTEXT]
else:
if isinstance(compression, str):
compression = [compression] # caller provided only a single option
if Compression.ZSTD in compression and not stem.prereq.is_zstd_available():
compression.remove(Compression.ZSTD)
if Compression.LZMA in compression and not stem.prereq.is_lzma_available():
compression.remove(Compression.LZMA)
if not compression:
compression = [Compression.PLAINTEXT]
# TODO: Normalize from our old compression enum to
# stem.descriptor.Compression. This will get removed in Stem 2.x.
new_compression = []
for legacy_compression in compression:
if isinstance(legacy_compression, stem.descriptor._Compression):
new_compression.append(legacy_compression)
elif legacy_compression in COMPRESSION_MIGRATION:
new_compression.append(COMPRESSION_MIGRATION[legacy_compression])
else:
raise ValueError("'%s' (%s) is not a recognized type of compression" % (legacy_compression, type(legacy_compression).__name__))
if descriptor_type:
self.descriptor_type = descriptor_type
else:
self.descriptor_type = _guess_descriptor_type(resource)
self.endpoints = []
if endpoints:
for endpoint in endpoints:
if isinstance(endpoint, tuple) and len(endpoint) == 2:
self.endpoints.append(stem.DirPort(endpoint[0], endpoint[1])) # TODO: remove this in stem 2.0
elif isinstance(endpoint, (stem.ORPort, stem.DirPort)):
self.endpoints.append(endpoint)
else:
raise ValueError("Endpoints must be an stem.ORPort, stem.DirPort, or two value tuple. '%s' is a %s." % (endpoint, type(endpoint).__name__))
self.resource = resource
self.compression = new_compression
self.retries = retries
self.fall_back_to_authority = fall_back_to_authority
self.content = None
self.error = None
self.is_done = False
self.download_url = None
self.start_time = None
self.timeout = timeout
self.runtime = None
self.validate = validate
self.document_handler = document_handler
self.reply_headers = None
self.kwargs = kwargs
self._downloader_thread = None
self._downloader_thread_lock = threading.RLock()
if start:
self.start()
if block:
self.run(True)
def start(self):
"""
Starts downloading the scriptors if we haven't started already.
"""
with self._downloader_thread_lock:
if self._downloader_thread is None:
self._downloader_thread = threading.Thread(
name = 'Descriptor query',
target = self._download_descriptors,
args = (self.retries, self.timeout)
)
self._downloader_thread.setDaemon(True)
self._downloader_thread.start()
def run(self, suppress = False):
"""
Blocks until our request is complete then provides the descriptors. If we
haven't yet started our request then this does so.
:param bool suppress: avoids raising exceptions if **True**
:returns: list for the requested :class:`~stem.descriptor.__init__.Descriptor` instances
:raises:
Using the iterator can fail with the following if **suppress** is
**False**...
* **ValueError** if the descriptor contents is malformed
* :class:`~stem.DownloadTimeout` if our request timed out
* :class:`~stem.DownloadFailed` if our request fails
"""
return list(self._run(suppress))
def _run(self, suppress):
with self._downloader_thread_lock:
self.start()
self._downloader_thread.join()
if self.error:
if suppress:
return
raise self.error
else:
if self.content is None:
if suppress:
return
raise ValueError('BUG: _download_descriptors() finished without either results or an error')
try:
# TODO: special handling until we have an official detatched
# signature @type...
#
# https://trac.torproject.org/projects/tor/ticket/28615
if self.descriptor_type.startswith(DETACHED_SIGNATURE_TYPE):
results = stem.descriptor.networkstatus._parse_file_detached_sigs(
io.BytesIO(self.content),
validate = self.validate,
)
else:
results = stem.descriptor.parse_file(
io.BytesIO(self.content),
self.descriptor_type,
validate = self.validate,
document_handler = self.document_handler,
**self.kwargs
)
for desc in results:
yield desc
except ValueError as exc:
self.error = exc # encountered a parsing error
if suppress:
return
raise self.error
def __iter__(self):
for desc in self._run(True):
yield desc
def _pick_endpoint(self, use_authority = False):
"""
Provides an endpoint to query. If we have multiple endpoints then one
is picked at random.
:param bool use_authority: ignores our endpoints and uses a directory
authority instead
:returns: :class:`stem.Endpoint` for the location to be downloaded
from by this request
"""
if use_authority or not self.endpoints:
picked = random.choice([auth for auth in stem.directory.Authority.from_cache().values() if auth.nickname not in DIR_PORT_BLACKLIST])
return stem.DirPort(picked.address, picked.dir_port)
else:
return random.choice(self.endpoints)
def _download_descriptors(self, retries, timeout):
try:
self.start_time = time.time()
endpoint = self._pick_endpoint(use_authority = retries == 0 and self.fall_back_to_authority)
if isinstance(endpoint, stem.ORPort):
downloaded_from = 'ORPort %s:%s (resource %s)' % (endpoint.address, endpoint.port, self.resource)
self.content, self.reply_headers = _download_from_orport(endpoint, self.compression, self.resource)
elif isinstance(endpoint, stem.DirPort):
self.download_url = 'http://%s:%i/%s' % (endpoint.address, endpoint.port, self.resource.lstrip('/'))
downloaded_from = self.download_url
self.content, self.reply_headers = _download_from_dirport(self.download_url, self.compression, timeout)
else:
raise ValueError("BUG: endpoints can only be ORPorts or DirPorts, '%s' was a %s" % (endpoint, type(endpoint).__name__))
self.runtime = time.time() - self.start_time
log.trace('Descriptors retrieved from %s in %0.2fs' % (downloaded_from, self.runtime))
except:
exc = sys.exc_info()[1]
if timeout is not None:
timeout -= time.time() - self.start_time
if retries > 0 and (timeout is None or timeout > 0):
log.debug("Unable to download descriptors from '%s' (%i retries remaining): %s" % (self.download_url, retries, exc))
return self._download_descriptors(retries - 1, timeout)
else:
log.debug("Unable to download descriptors from '%s': %s" % (self.download_url, exc))
self.error = exc
finally:
self.is_done = True
class DescriptorDownloader(object):
"""
Configurable class that issues :class:`~stem.descriptor.remote.Query`
instances on your behalf.
:param bool use_mirrors: downloads the present consensus and uses the directory
mirrors to fetch future requests, this fails silently if the consensus
cannot be downloaded
:param default_args: default arguments for the
:class:`~stem.descriptor.remote.Query` constructor
"""
def __init__(self, use_mirrors = False, **default_args):
self._default_args = default_args
self._endpoints = None
if use_mirrors:
try:
start_time = time.time()
self.use_directory_mirrors()
log.debug('Retrieved directory mirrors (took %0.2fs)' % (time.time() - start_time))
except Exception as exc:
log.debug('Unable to retrieve directory mirrors: %s' % exc)
def use_directory_mirrors(self):
"""
Downloads the present consensus and configures ourselves to use directory
mirrors, in addition to authorities.
:returns: :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3`
from which we got the directory mirrors
:raises: **Exception** if unable to determine the directory mirrors
"""
directories = [auth for auth in stem.directory.Authority.from_cache().values() if auth.nickname not in DIR_PORT_BLACKLIST]
new_endpoints = set([(directory.address, directory.dir_port) for directory in directories])
consensus = list(self.get_consensus(document_handler = stem.descriptor.DocumentHandler.DOCUMENT).run())[0]
for desc in consensus.routers.values():
if stem.Flag.V2DIR in desc.flags and desc.dir_port:
new_endpoints.add((desc.address, desc.dir_port))
# we need our endpoints to be a list rather than set for random.choice()
self._endpoints = list(new_endpoints)
return consensus
def their_server_descriptor(self, **query_args):
"""
Provides the server descriptor of the relay we're downloading from.
.. versionadded:: 1.7.0
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the server descriptors
"""
return self.query('/tor/server/authority', **query_args)
def get_server_descriptors(self, fingerprints = None, **query_args):
"""
Provides the server descriptors with the given fingerprints. If no
fingerprints are provided then this returns all descriptors known
by the relay.
:param str,list fingerprints: fingerprint or list of fingerprints to be
retrieved, gets all descriptors if **None**
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the server descriptors
:raises: **ValueError** if we request more than 96 descriptors by their
fingerprints (this is due to a limit on the url length by squid proxies).
"""
resource = '/tor/server/all'
if isinstance(fingerprints, str):
fingerprints = [fingerprints]
if fingerprints:
if len(fingerprints) > MAX_FINGERPRINTS:
raise ValueError('Unable to request more than %i descriptors at a time by their fingerprints' % MAX_FINGERPRINTS)
resource = '/tor/server/fp/%s' % '+'.join(fingerprints)
return self.query(resource, **query_args)
def get_extrainfo_descriptors(self, fingerprints = None, **query_args):
"""
Provides the extrainfo descriptors with the given fingerprints. If no
fingerprints are provided then this returns all descriptors in the present
consensus.
:param str,list fingerprints: fingerprint or list of fingerprints to be
retrieved, gets all descriptors if **None**
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the extrainfo descriptors
:raises: **ValueError** if we request more than 96 descriptors by their
fingerprints (this is due to a limit on the url length by squid proxies).
"""
resource = '/tor/extra/all'
if isinstance(fingerprints, str):
fingerprints = [fingerprints]
if fingerprints:
if len(fingerprints) > MAX_FINGERPRINTS:
raise ValueError('Unable to request more than %i descriptors at a time by their fingerprints' % MAX_FINGERPRINTS)
resource = '/tor/extra/fp/%s' % '+'.join(fingerprints)
return self.query(resource, **query_args)
def get_microdescriptors(self, hashes, **query_args):
"""
Provides the microdescriptors with the given hashes. To get these see the
**microdescriptor_digest** attribute of
:class:`~stem.descriptor.router_status_entry.RouterStatusEntryMicroV3`.
Note that these are only provided via the **microdescriptor consensus**.
For exampe...
::
>>> import stem.descriptor.remote
>>> consensus = stem.descriptor.remote.get_consensus(microdescriptor = True).run()
>>> my_router_status_entry = list(filter(lambda desc: desc.nickname == 'caersidi', consensus))[0]
>>> print(my_router_status_entry.microdescriptor_digest)
IQI5X2A5p0WVN/MgwncqOaHF2f0HEGFEaxSON+uKRhU
>>> my_microdescriptor = stem.descriptor.remote.get_microdescriptors([my_router_status_entry.microdescriptor_digest]).run()[0]
>>> print(my_microdescriptor)
onion-key
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAOJo9yyVgG8ksEHQibqPIEbLieI6rh1EACRPiDiV21YObb+9QEHaR3Cf
FNAzDbGhbvADLBB7EzuViL8w+eXQUOaIsJRdymh/wuUJ78bv5oEIJhthKq/Uqa4P
wKHXSZixwAHfy8NASTX3kxu9dAHWU3Owb+4W4lR2hYM0ZpoYYkThAgMBAAE=
-----END RSA PUBLIC KEY-----
ntor-onion-key kWOHNd+2uBlMpcIUbbpFLiq/rry66Ep6MlwmNpwzcBg=
id ed25519 xE/GeYImYAIB0RbzJXFL8kDLpDrj/ydCuCdvOgC4F/4
:param str,list hashes: microdescriptor hash or list of hashes to be
retrieved
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the microdescriptors
:raises: **ValueError** if we request more than 92 microdescriptors by their
hashes (this is due to a limit on the url length by squid proxies).
"""
if isinstance(hashes, str):
hashes = [hashes]
if len(hashes) > MAX_MICRODESCRIPTOR_HASHES:
raise ValueError('Unable to request more than %i microdescriptors at a time by their hashes' % MAX_MICRODESCRIPTOR_HASHES)
return self.query('/tor/micro/d/%s' % '-'.join(hashes), **query_args)
def get_consensus(self, authority_v3ident = None, microdescriptor = False, **query_args):
"""
Provides the present router status entries.
.. versionchanged:: 1.5.0
Added the microdescriptor argument.
:param str authority_v3ident: fingerprint of the authority key for which
to get the consensus, see `'v3ident' in tor's config.c
`_
for the values.
:param bool microdescriptor: provides the microdescriptor consensus if
**True**, standard consensus otherwise
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the router status
entries
"""
if microdescriptor:
resource = '/tor/status-vote/current/consensus-microdesc'
else:
resource = '/tor/status-vote/current/consensus'
if authority_v3ident:
resource += '/%s' % authority_v3ident
consensus_query = self.query(resource, **query_args)
# if we're performing validation then check that it's signed by the
# authority key certificates
if consensus_query.validate and consensus_query.document_handler == stem.descriptor.DocumentHandler.DOCUMENT and stem.prereq.is_crypto_available():
consensus = list(consensus_query.run())[0]
key_certs = self.get_key_certificates(**query_args).run()
consensus.validate_signatures(key_certs)
return consensus_query
def get_vote(self, authority, **query_args):
"""
Provides the present vote for a given directory authority.
:param stem.directory.Authority authority: authority for which to retrieve a vote for
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the router status
entries
"""
resource = '/tor/status-vote/current/authority'
if 'endpoint' not in query_args:
query_args['endpoints'] = [(authority.address, authority.dir_port)]
return self.query(resource, **query_args)
def get_key_certificates(self, authority_v3idents = None, **query_args):
"""
Provides the key certificates for authorities with the given fingerprints.
If no fingerprints are provided then this returns all present key
certificates.
:param str authority_v3idents: fingerprint or list of fingerprints of the
authority keys, see `'v3ident' in tor's config.c
`_
for the values.
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the key certificates
:raises: **ValueError** if we request more than 96 key certificates by
their identity fingerprints (this is due to a limit on the url length by
squid proxies).
"""
resource = '/tor/keys/all'
if isinstance(authority_v3idents, str):
authority_v3idents = [authority_v3idents]
if authority_v3idents:
if len(authority_v3idents) > MAX_FINGERPRINTS:
raise ValueError('Unable to request more than %i key certificates at a time by their identity fingerprints' % MAX_FINGERPRINTS)
resource = '/tor/keys/fp/%s' % '+'.join(authority_v3idents)
return self.query(resource, **query_args)
def get_bandwidth_file(self, **query_args):
"""
Provides the bandwidth authority heuristics used to make the next
consensus.
.. versionadded:: 1.8.0
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the bandwidth
authority heuristics
"""
return self.query('/tor/status-vote/next/bandwidth', **query_args)
def get_detached_signatures(self, **query_args):
"""
Provides the detached signatures that will be used to make the next
consensus. Please note that **these are only available during minutes 55-60
each hour**. If requested during minutes 0-55 tor will not service these
requests, and this will fail with a 404.
For example...
::
import stem.descriptor.remote
detached_sigs = stem.descriptor.remote.get_detached_signatures().run()[0]
for i, sig in enumerate(detached_sigs.signatures):
print('Signature %i is from %s' % (i + 1, sig.identity))
**When available (minutes 55-60 of the hour)**
::
% python demo.py
Signature 1 is from 0232AF901C31A04EE9848595AF9BB7620D4C5B2E
Signature 2 is from 14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4
Signature 3 is from 23D15D965BC35114467363C165C4F724B64B4F66
...
**When unavailable (minutes 0-55 of the hour)**
::
% python demo.py
Traceback (most recent call last):
File "demo.py", line 3, in
detached_sigs = stem.descriptor.remote.get_detached_signatures().run()[0]
File "/home/atagar/Desktop/stem/stem/descriptor/remote.py", line 533, in run
return list(self._run(suppress))
File "/home/atagar/Desktop/stem/stem/descriptor/remote.py", line 544, in _run
raise self.error
stem.DownloadFailed: Failed to download from http://154.35.175.225:80/tor/status-vote/next/consensus-signatures (HTTPError): Not found
.. versionadded:: 1.8.0
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the detached
signatures
"""
return self.query('/tor/status-vote/next/consensus-signatures', **query_args)
def query(self, resource, **query_args):
"""
Issues a request for the given resource.
.. versionchanged:: 1.7.0
The **fall_back_to_authority** default when using this method is now
**False**, like the :class:`~stem.descriptor.Query` class.
:param str resource: resource being fetched, such as '/tor/server/all'
:param query_args: additional arguments for the
:class:`~stem.descriptor.remote.Query` constructor
:returns: :class:`~stem.descriptor.remote.Query` for the descriptors
:raises: **ValueError** if resource is clearly invalid or the descriptor
type can't be determined when 'descriptor_type' is **None**
"""
args = dict(self._default_args)
args.update(query_args)
if 'endpoints' not in args:
args['endpoints'] = self._endpoints
return Query(resource, **args)
def _download_from_orport(endpoint, compression, resource):
"""
Downloads descriptors from the given orport. Payload is just like an http
response (headers and all)...
::
HTTP/1.0 200 OK
Date: Mon, 23 Apr 2018 18:43:47 GMT
Content-Type: text/plain
X-Your-Address-Is: 216.161.254.25
Content-Encoding: identity
Expires: Wed, 25 Apr 2018 18:43:47 GMT
router dannenberg 193.23.244.244 443 0 80
identity-ed25519
... rest of the descriptor content...
:param stem.ORPort endpoint: endpoint to download from
:param list compression: compression methods for the request
:param str resource: descriptor resource to download
:returns: two value tuple of the form (data, reply_headers)
:raises:
* :class:`stem.ProtocolError` if not a valid descriptor response
* :class:`stem.SocketError` if unable to establish a connection
"""
link_protocols = endpoint.link_protocols if endpoint.link_protocols else [3]
with stem.client.Relay.connect(endpoint.address, endpoint.port, link_protocols) as relay:
with relay.create_circuit() as circ:
request = '\r\n'.join((
'GET %s HTTP/1.0' % resource,
'Accept-Encoding: %s' % ', '.join(map(lambda c: c.encoding, compression)),
'User-Agent: %s' % stem.USER_AGENT,
)) + '\r\n\r\n'
response = circ.directory(request, stream_id = 1)
first_line, data = response.split(b'\r\n', 1)
header_data, body_data = data.split(b'\r\n\r\n', 1)
if not first_line.startswith(b'HTTP/1.0 2'):
raise stem.ProtocolError("Response should begin with HTTP success, but was '%s'" % str_tools._to_unicode(first_line))
headers = {}
for line in str_tools._to_unicode(header_data).splitlines():
if ': ' not in line:
raise stem.ProtocolError("'%s' is not a HTTP header:\n\n%s" % line)
key, value = line.split(': ', 1)
headers[key] = value
return _decompress(body_data, headers.get('Content-Encoding')), headers
def _download_from_dirport(url, compression, timeout):
"""
Downloads descriptors from the given url.
:param str url: dirport url from which to download from
:param list compression: compression methods for the request
:param float timeout: duration before we'll time out our request
:returns: two value tuple of the form (data, reply_headers)
:raises:
* :class:`~stem.DownloadTimeout` if our request timed out
* :class:`~stem.DownloadFailed` if our request fails
"""
try:
response = urllib.urlopen(
urllib.Request(
url,
headers = {
'Accept-Encoding': ', '.join(map(lambda c: c.encoding, compression)),
'User-Agent': stem.USER_AGENT,
}
),
timeout = timeout,
)
except socket.timeout as exc:
raise stem.DownloadTimeout(url, exc, sys.exc_info()[2], timeout)
except:
exc, stacktrace = sys.exc_info()[1:3]
raise stem.DownloadFailed(url, exc, stacktrace)
return _decompress(response.read(), response.headers.get('Content-Encoding')), response.headers
def _decompress(data, encoding):
"""
Decompresses descriptor data.
Tor doesn't include compression headers. As such when using gzip we
need to include '32' for automatic header detection...
https://stackoverflow.com/questions/3122145/zlib-error-error-3-while-decompressing-incorrect-header-check/22310760#22310760
... and with zstd we need to use the streaming API.
:param bytes data: data we received
:param str encoding: 'Content-Encoding' header of the response
:raises:
* **ValueError** if encoding is unrecognized
* **ImportError** if missing the decompression module
"""
if encoding == 'deflate':
return stem.descriptor.Compression.GZIP.decompress(data)
for compression in stem.descriptor.Compression:
if encoding == compression.encoding:
return compression.decompress(data)
raise ValueError("'%s' isn't a recognized type of encoding" % encoding)
def _guess_descriptor_type(resource):
# Attempts to determine the descriptor type based on the resource url. This
# raises a ValueError if the resource isn't recognized.
if resource.startswith('/tor/server/'):
return 'server-descriptor 1.0'
elif resource.startswith('/tor/extra/'):
return 'extra-info 1.0'
elif resource.startswith('/tor/micro/'):
return 'microdescriptor 1.0'
elif resource.startswith('/tor/keys/'):
return 'dir-key-certificate-3 1.0'
elif resource.startswith('/tor/status-vote/'):
# The following resource urls can be for the present consensus
# (/tor/status-vote/current/*) or the next (/tor/status-vote/next/*).
if resource.endswith('/consensus') or resource.endswith('/authority'):
return 'network-status-consensus-3 1.0'
elif resource.endswith('/consensus-microdesc'):
return 'network-status-microdesc-consensus-3 1.0'
elif resource.endswith('/consensus-signatures'):
return '%s 1.0' % DETACHED_SIGNATURE_TYPE
elif stem.util.tor_tools.is_valid_fingerprint(resource.split('/')[-1]):
return 'network-status-consensus-3 1.0'
elif resource.endswith('/bandwidth'):
return 'bandwidth-file 1.0'
raise ValueError("Unable to determine the descriptor type for '%s'" % resource)
def get_authorities():
"""
Provides cached Tor directory authority information. The directory
information hardcoded into Tor and occasionally changes, so the information
this provides might not necessarily match your version of tor.
.. deprecated:: 1.7.0
Use stem.directory.Authority.from_cache() instead.
:returns: **dict** of **str** nicknames to :class:`~stem.directory.Authority` instances
"""
return DirectoryAuthority.from_cache()
# TODO: drop aliases in stem 2.0
Directory = stem.directory.Directory
DirectoryAuthority = stem.directory.Authority
FallbackDirectory = stem.directory.Fallback
stem-1.8.0/stem/descriptor/hidden_service.py 0000664 0001750 0001750 00000157657 13601502033 021703 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Tor hidden service descriptors as described in Tor's `version 2
`_ and
`version 3 `_
rend-spec.
Unlike other descriptor types these describe a hidden service rather than a
relay. They're created by the service, and can only be fetched via relays with
the HSDir flag.
These are only available through the Controller's
:func:`~stem.control.Controller.get_hidden_service_descriptor` method.
**Module Overview:**
::
BaseHiddenServiceDescriptor - Common parent for hidden service descriptors
|- HiddenServiceDescriptorV2 - Version 2 hidden service descriptor
+- HiddenServiceDescriptorV3 - Version 3 hidden service descriptor
|- address_from_identity_key - convert an identity key to address
|- identity_key_from_address - convert an address to identity key
+- decrypt - decrypt and parse encrypted layers
OuterLayer - First encrypted layer of a hidden service v3 descriptor
InnerLayer - Second encrypted layer of a hidden service v3 descriptor
.. versionadded:: 1.4.0
"""
import base64
import binascii
import collections
import datetime
import hashlib
import io
import os
import struct
import time
import stem.client.datatype
import stem.descriptor.certificate
import stem.prereq
import stem.util
import stem.util.connection
import stem.util.str_tools
import stem.util.tor_tools
from stem.client.datatype import CertType
from stem.descriptor.certificate import ExtensionType, Ed25519Extension, Ed25519Certificate, Ed25519CertificateV1
from stem.descriptor import (
PGP_BLOCK_END,
Descriptor,
_descriptor_content,
_descriptor_components,
_read_until_keywords,
_bytes_for_block,
_value,
_values,
_parse_simple_line,
_parse_if_present,
_parse_int_line,
_parse_timestamp_line,
_parse_key_block,
_random_date,
_random_crypto_blob,
)
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
try:
from cryptography.hazmat.backends.openssl.backend import backend
X25519_AVAILABLE = hasattr(backend, 'x25519_supported') and backend.x25519_supported()
except ImportError:
X25519_AVAILABLE = False
REQUIRED_V2_FIELDS = (
'rendezvous-service-descriptor',
'version',
'permanent-key',
'secret-id-part',
'publication-time',
'protocol-versions',
'signature',
)
REQUIRED_V3_FIELDS = (
'hs-descriptor',
'descriptor-lifetime',
'descriptor-signing-key-cert',
'revision-counter',
'superencrypted',
'signature',
)
INTRODUCTION_POINTS_ATTR = {
'identifier': None,
'address': None,
'port': None,
'onion_key': None,
'service_key': None,
'intro_authentication': [],
}
# introduction-point fields that can only appear once
SINGLE_INTRODUCTION_POINT_FIELDS = [
'introduction-point',
'ip-address',
'onion-port',
'onion-key',
'service-key',
]
BASIC_AUTH = 1
STEALTH_AUTH = 2
CHECKSUM_CONSTANT = b'.onion checksum'
SALT_LEN = 16
MAC_LEN = 32
S_KEY_LEN = 32
S_IV_LEN = 16
class DecryptionFailure(Exception):
"""
Failure to decrypt the hidden service descriptor's introduction-points.
"""
# TODO: rename in stem 2.x (add 'V2' and drop plural)
class IntroductionPoints(collections.namedtuple('IntroductionPoints', INTRODUCTION_POINTS_ATTR.keys())):
"""
Introduction point for a v2 hidden service.
:var str identifier: hash of this introduction point's identity key
:var str address: address of this introduction point
:var int port: port where this introduction point is listening
:var str onion_key: public key for communicating with this introduction point
:var str service_key: public key for communicating with this hidden service
:var list intro_authentication: tuples of the form (auth_type, auth_data) for
establishing a connection
"""
class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_specifiers', 'onion_key_raw', 'auth_key_cert', 'enc_key_raw', 'enc_key_cert', 'legacy_key_raw', 'legacy_key_cert'])):
"""
Introduction point for a v3 hidden service.
.. versionadded:: 1.8.0
:var list link_specifiers: :class:`~stem.client.datatype.LinkSpecifier` where this service is reachable
:var unicode onion_key_raw: base64 ntor introduction point public key
:var stem.descriptor.certificate.Ed25519Certificate auth_key_cert: cross-certifier of the signing key with the auth key
:var unicode enc_key_raw: base64 introduction request encryption key
:var stem.descriptor.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key
:var str legacy_key_raw: base64 legacy introduction point RSA public key
:var str legacy_key_cert: base64 cross-certifier of the signing key by the legacy key
"""
@staticmethod
def parse(content):
"""
Parses an introduction point from its descriptor content.
:param str content: descriptor content to parse
:returns: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` for the descriptor content
:raises: **ValueError** if descriptor content is malformed
"""
entry = _descriptor_components(content, False)
link_specifiers = IntroductionPointV3._parse_link_specifiers(_value('introduction-point', entry))
onion_key_line = _value('onion-key', entry)
onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None
_, block_type, auth_key_cert = entry['auth-key'][0]
auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert)
if block_type != 'ED25519 CERT':
raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type)
enc_key_line = _value('enc-key', entry)
enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None
_, block_type, enc_key_cert = entry['enc-key-cert'][0]
enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert)
if block_type != 'ED25519 CERT':
raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type)
legacy_key = entry['legacy-key'][0][2] if 'legacy-key' in entry else None
legacy_key_cert = entry['legacy-key-cert'][0][2] if 'legacy-key-cert' in entry else None
return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, legacy_key, legacy_key_cert)
@staticmethod
def create_for_address(address, port, expiration = None, onion_key = None, enc_key = None, auth_key = None, signing_key = None):
"""
Simplified constructor for a single address/port link specifier.
:param str address: IPv4 or IPv6 address where the service is reachable
:param int port: port where the service is reachable
:param datetime.datetime expiration: when certificates should expire
:param str onion_key: encoded, X25519PublicKey, or X25519PrivateKey onion key
:param str enc_key: encoded, X25519PublicKey, or X25519PrivateKey encryption key
:param str auth_key: encoded, Ed25519PublicKey, or Ed25519PrivateKey authentication key
:param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey signing_key: service signing key
:returns: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` with these attributes
:raises: **ValueError** if the address, port, or keys are malformed
"""
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Introduction point creation requires the cryptography module ed25519 support')
elif not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' is an invalid port" % port)
if stem.util.connection.is_valid_ipv4_address(address):
link_specifiers = [stem.client.datatype.LinkByIPv4(address, port)]
elif stem.util.connection.is_valid_ipv6_address(address):
link_specifiers = [stem.client.datatype.LinkByIPv6(address, port)]
else:
raise ValueError("'%s' is not a valid IPv4 or IPv6 address" % address)
return IntroductionPointV3.create_for_link_specifiers(link_specifiers, expiration = None, onion_key = None, enc_key = None, auth_key = None, signing_key = None)
@staticmethod
def create_for_link_specifiers(link_specifiers, expiration = None, onion_key = None, enc_key = None, auth_key = None, signing_key = None):
"""
Simplified constructor. For more sophisticated use cases you can use this
as a template for how introduction points are properly created.
:param list link_specifiers: series of stem.client.datatype.LinkSpecifier where the service is reachable
:param datetime.datetime expiration: when certificates should expire
:param str onion_key: encoded, X25519PublicKey, or X25519PrivateKey onion key
:param str enc_key: encoded, X25519PublicKey, or X25519PrivateKey encryption key
:param str auth_key: encoded, Ed25519PublicKey, or Ed25519PrivateKey authentication key
:param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey signing_key: service signing key
:returns: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` with these attributes
:raises: **ValueError** if the address, port, or keys are malformed
"""
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Introduction point creation requires the cryptography module ed25519 support')
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
if expiration is None:
expiration = datetime.datetime.utcnow() + datetime.timedelta(hours = stem.descriptor.certificate.DEFAULT_EXPIRATION_HOURS)
onion_key = stem.util.str_tools._to_unicode(base64.b64encode(stem.util._pubkey_bytes(onion_key if onion_key else X25519PrivateKey.generate())))
enc_key = stem.util.str_tools._to_unicode(base64.b64encode(stem.util._pubkey_bytes(enc_key if enc_key else X25519PrivateKey.generate())))
auth_key = stem.util._pubkey_bytes(auth_key if auth_key else Ed25519PrivateKey.generate())
signing_key = signing_key if signing_key else Ed25519PrivateKey.generate()
extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, stem.util._pubkey_bytes(signing_key))]
auth_key_cert = Ed25519CertificateV1(CertType.HS_V3_INTRO_AUTH, expiration, 1, auth_key, extensions, signing_key = signing_key)
enc_key_cert = Ed25519CertificateV1(CertType.HS_V3_NTOR_ENC, expiration, 1, auth_key, extensions, signing_key = signing_key)
return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, None, None)
def encode(self):
"""
Descriptor representation of this introduction point.
:returns: **str** for our descriptor representation
"""
lines = []
link_count = stem.client.datatype.Size.CHAR.pack(len(self.link_specifiers))
link_specifiers = link_count + b''.join([l.pack() for l in self.link_specifiers])
lines.append('introduction-point %s' % stem.util.str_tools._to_unicode(base64.b64encode(link_specifiers)))
lines.append('onion-key ntor %s' % self.onion_key_raw)
lines.append('auth-key\n' + self.auth_key_cert.to_base64(pem = True))
if self.enc_key_raw:
lines.append('enc-key ntor %s' % self.enc_key_raw)
lines.append('enc-key-cert\n' + self.enc_key_cert.to_base64(pem = True))
if self.legacy_key_raw:
lines.append('legacy-key\n' + self.legacy_key_raw)
if self.legacy_key_cert:
lines.append('legacy-key-cert\n' + self.legacy_key_cert)
return '\n'.join(lines)
def onion_key(self):
"""
Provides our ntor introduction point public key.
:returns: ntor :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey`
:raises:
* **ImportError** if required the cryptography module is unavailable
* **EnvironmentError** if OpenSSL x25519 unsupported
"""
return IntroductionPointV3._key_as(self.onion_key_raw, x25519 = True)
def auth_key(self):
"""
Provides our authentication certificate's public key.
:returns: :class:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey`
:raises:
* **ImportError** if required the cryptography module is unavailable
* **EnvironmentError** if OpenSSL x25519 unsupported
"""
return IntroductionPointV3._key_as(self.auth_key_cert.key, ed25519 = True)
def enc_key(self):
"""
Provides our encryption key.
:returns: encryption :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey`
:raises:
* **ImportError** if required the cryptography module is unavailable
* **EnvironmentError** if OpenSSL x25519 unsupported
"""
return IntroductionPointV3._key_as(self.enc_key_raw, x25519 = True)
def legacy_key(self):
"""
Provides our legacy introduction point public key.
:returns: legacy :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey`
:raises:
* **ImportError** if required the cryptography module is unavailable
* **EnvironmentError** if OpenSSL x25519 unsupported
"""
return IntroductionPointV3._key_as(self.legacy_key_raw, x25519 = True)
@staticmethod
def _key_as(value, x25519 = False, ed25519 = False):
if value is None or (not x25519 and not ed25519):
return value
elif not stem.prereq.is_crypto_available():
raise ImportError('cryptography module unavailable')
if x25519:
if not X25519_AVAILABLE:
# without this the cryptography raises...
# cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.
raise EnvironmentError('OpenSSL x25519 unsupported')
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey
return X25519PublicKey.from_public_bytes(base64.b64decode(value))
if ed25519:
if not stem.prereq.is_crypto_available(ed25519 = True):
raise EnvironmentError('cryptography ed25519 unsupported')
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
return Ed25519PublicKey.from_public_bytes(value)
@staticmethod
def _parse_link_specifiers(content):
try:
content = base64.b64decode(content)
except Exception as exc:
raise ValueError('Unable to base64 decode introduction point (%s): %s' % (exc, content))
link_specifiers = []
count, content = stem.client.datatype.Size.CHAR.pop(content)
for i in range(count):
link_specifier, content = stem.client.datatype.LinkSpecifier.pop(content)
link_specifiers.append(link_specifier)
if content:
raise ValueError('Introduction point had excessive data (%s)' % content)
return link_specifiers
def __hash__(self):
if not hasattr(self, '_hash'):
self._hash = hash(self.encode())
return self._hash
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, IntroductionPointV3) else False
def __ne__(self, other):
return not self == other
class AuthorizedClient(object):
"""
Client authorized to use a v3 hidden service.
.. versionadded:: 1.8.0
:var str id: base64 encoded client id
:var str iv: base64 encoded randomized initialization vector
:var str cookie: base64 encoded authentication cookie
"""
def __init__(self, id = None, iv = None, cookie = None):
self.id = stem.util.str_tools._to_unicode(id if id else base64.b64encode(os.urandom(8)).rstrip(b'='))
self.iv = stem.util.str_tools._to_unicode(iv if iv else base64.b64encode(os.urandom(16)).rstrip(b'='))
self.cookie = stem.util.str_tools._to_unicode(cookie if cookie else base64.b64encode(os.urandom(16)).rstrip(b'='))
def __hash__(self):
return stem.util._hash_attr(self, 'id', 'iv', 'cookie', cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, AuthorizedClient) else False
def __ne__(self, other):
return not self == other
def _parse_file(descriptor_file, desc_type = None, validate = False, **kwargs):
"""
Iterates over the hidden service descriptors in a file.
:param file descriptor_file: file with descriptor content
:param class desc_type: BaseHiddenServiceDescriptor subclass
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param dict kwargs: additional arguments for the descriptor constructor
:returns: iterator for :class:`~stem.descriptor.hidden_service.HiddenServiceDescriptorV2`
instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is **True**
* **IOError** if the file can't be read
"""
if desc_type is None:
desc_type = HiddenServiceDescriptorV2
# Hidden service v3 ends with a signature line, whereas v2 has a pgp style
# block following it.
while True:
descriptor_content = _read_until_keywords('signature', descriptor_file, True)
if desc_type == HiddenServiceDescriptorV2:
block_end_prefix = PGP_BLOCK_END.split(' ', 1)[0]
descriptor_content += _read_until_keywords(block_end_prefix, descriptor_file, True)
if descriptor_content:
if descriptor_content[0].startswith(b'@type'):
descriptor_content = descriptor_content[1:]
yield desc_type(bytes.join(b'', descriptor_content), validate, **kwargs)
else:
break # done parsing file
def _decrypt_layer(encrypted_block, constant, revision_counter, subcredential, blinded_key):
if encrypted_block.startswith('-----BEGIN MESSAGE-----\n') and encrypted_block.endswith('\n-----END MESSAGE-----'):
encrypted_block = encrypted_block[24:-22]
try:
encrypted = base64.b64decode(encrypted_block)
except:
raise ValueError('Unable to decode encrypted block as base64')
if len(encrypted) < SALT_LEN + MAC_LEN:
raise ValueError('Encrypted block malformed (only %i bytes)' % len(encrypted))
salt = encrypted[:SALT_LEN]
ciphertext = encrypted[SALT_LEN:-MAC_LEN]
expected_mac = encrypted[-MAC_LEN:]
cipher, mac_for = _layer_cipher(constant, revision_counter, subcredential, blinded_key, salt)
if expected_mac != mac_for(ciphertext):
raise ValueError('Malformed mac (expected %s, but was %s)' % (expected_mac, mac_for(ciphertext)))
decryptor = cipher.decryptor()
plaintext = decryptor.update(ciphertext) + decryptor.finalize()
return stem.util.str_tools._to_unicode(plaintext)
def _encrypt_layer(plaintext, constant, revision_counter, subcredential, blinded_key):
salt = os.urandom(16)
cipher, mac_for = _layer_cipher(constant, revision_counter, subcredential, blinded_key, salt)
encryptor = cipher.encryptor()
ciphertext = encryptor.update(plaintext) + encryptor.finalize()
encoded = base64.b64encode(salt + ciphertext + mac_for(ciphertext))
return b'-----BEGIN MESSAGE-----\n%s\n-----END MESSAGE-----' % b'\n'.join(stem.util.str_tools._split_by_length(encoded, 64))
def _layer_cipher(constant, revision_counter, subcredential, blinded_key, salt):
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
kdf = hashlib.shake_256(blinded_key + subcredential + struct.pack('>Q', revision_counter) + salt + constant)
keys = kdf.digest(S_KEY_LEN + S_IV_LEN + MAC_LEN)
secret_key = keys[:S_KEY_LEN]
secret_iv = keys[S_KEY_LEN:S_KEY_LEN + S_IV_LEN]
mac_key = keys[S_KEY_LEN + S_IV_LEN:]
cipher = Cipher(algorithms.AES(secret_key), modes.CTR(secret_iv), default_backend())
mac_prefix = struct.pack('>Q', len(mac_key)) + mac_key + struct.pack('>Q', len(salt)) + salt
return cipher, lambda ciphertext: hashlib.sha3_256(mac_prefix + ciphertext).digest()
def _parse_protocol_versions_line(descriptor, entries):
value = _value('protocol-versions', entries)
try:
versions = [int(entry) for entry in value.split(',')]
except ValueError:
raise ValueError('protocol-versions line has non-numeric versoins: protocol-versions %s' % value)
for v in versions:
if v <= 0:
raise ValueError('protocol-versions must be positive integers: %s' % value)
descriptor.protocol_versions = versions
def _parse_introduction_points_line(descriptor, entries):
_, block_type, block_contents = entries['introduction-points'][0]
if not block_contents or block_type != 'MESSAGE':
raise ValueError("'introduction-points' should be followed by a MESSAGE block, but was a %s" % block_type)
descriptor.introduction_points_encoded = block_contents
descriptor.introduction_points_auth = [] # field was never implemented in tor (#15190)
try:
descriptor.introduction_points_content = _bytes_for_block(block_contents)
except TypeError:
raise ValueError("'introduction-points' isn't base64 encoded content:\n%s" % block_contents)
def _parse_v3_outer_clients(descriptor, entries):
# "auth-client" client-id iv encrypted-cookie
clients = {}
for value in _values('auth-client', entries):
value_comp = value.split()
if len(value_comp) < 3:
raise ValueError('auth-client should have a client-id, iv, and cookie: auth-client %s' % value)
clients[value_comp[0]] = AuthorizedClient(value_comp[0], value_comp[1], value_comp[2])
descriptor.clients = clients
def _parse_v3_inner_formats(descriptor, entries):
value, formats = _value('create2-formats', entries), []
for entry in value.split(' '):
if not entry.isdigit():
raise ValueError("create2-formats should only contain integers, but was '%s'" % value)
formats.append(int(entry))
descriptor.formats = formats
def _parse_v3_introduction_points(descriptor, entries):
if hasattr(descriptor, '_unparsed_introduction_points'):
introduction_points = []
remaining = descriptor._unparsed_introduction_points
while remaining:
div = remaining.find(b'\nintroduction-point ', 10)
content, remaining = (remaining[:div], remaining[div + 1:]) if div != -1 else (remaining, '')
introduction_points.append(IntroductionPointV3.parse(content))
descriptor.introduction_points = introduction_points
del descriptor._unparsed_introduction_points
_parse_v2_version_line = _parse_int_line('version', 'version', allow_negative = False)
_parse_rendezvous_service_descriptor_line = _parse_simple_line('rendezvous-service-descriptor', 'descriptor_id')
_parse_permanent_key_line = _parse_key_block('permanent-key', 'permanent_key', 'RSA PUBLIC KEY')
_parse_secret_id_part_line = _parse_simple_line('secret-id-part', 'secret_id_part')
_parse_publication_time_line = _parse_timestamp_line('publication-time', 'published')
_parse_v2_signature_line = _parse_key_block('signature', 'signature', 'SIGNATURE')
_parse_v3_version_line = _parse_int_line('hs-descriptor', 'version', allow_negative = False)
_parse_lifetime_line = _parse_int_line('descriptor-lifetime', 'lifetime', allow_negative = False)
_parse_signing_cert = Ed25519Certificate._from_descriptor('descriptor-signing-key-cert', 'signing_cert')
_parse_revision_counter_line = _parse_int_line('revision-counter', 'revision_counter', allow_negative = False)
_parse_superencrypted_line = _parse_key_block('superencrypted', 'superencrypted', 'MESSAGE')
_parse_v3_signature_line = _parse_simple_line('signature', 'signature')
_parse_v3_outer_auth_type = _parse_simple_line('desc-auth-type', 'auth_type')
_parse_v3_outer_ephemeral_key = _parse_simple_line('desc-auth-ephemeral-key', 'ephemeral_key')
_parse_v3_outer_encrypted = _parse_key_block('encrypted', 'encrypted', 'MESSAGE')
_parse_v3_inner_intro_auth = _parse_simple_line('intro-auth-required', 'intro_auth', func = lambda v: v.split(' '))
_parse_v3_inner_single_service = _parse_if_present('single-onion-service', 'is_single_service')
class BaseHiddenServiceDescriptor(Descriptor):
"""
Hidden service descriptor.
.. versionadded:: 1.8.0
"""
# TODO: rename this class to HiddenServiceDescriptor in stem 2.x
class HiddenServiceDescriptorV2(BaseHiddenServiceDescriptor):
"""
Version 2 hidden service descriptor.
:var str descriptor_id: **\\*** identifier for this descriptor, this is a base32 hash of several fields
:var int version: **\\*** hidden service descriptor version
:var str permanent_key: **\\*** long term key of the hidden service
:var str secret_id_part: **\\*** hash of the time period, cookie, and replica
values so our descriptor_id can be validated
:var datetime published: **\\*** time in UTC when this descriptor was made
:var list protocol_versions: **\\*** list of **int** versions that are supported when establishing a connection
:var str introduction_points_encoded: raw introduction points blob
:var list introduction_points_auth: **\\*** tuples of the form
(auth_method, auth_data) for our introduction_points_content
(**deprecated**, always **[]**)
:var bytes introduction_points_content: decoded introduction-points content
without authentication data, if using cookie authentication this is
encrypted
:var str signature: signature of the descriptor content
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
.. versionchanged:: 1.6.0
Moved from the deprecated `pycrypto
`_ module to `cryptography
`_ for validating signatures.
.. versionchanged:: 1.6.0
Added the **skip_crypto_validation** constructor argument.
"""
TYPE_ANNOTATION_NAME = 'hidden-service-descriptor'
ATTRIBUTES = {
'descriptor_id': (None, _parse_rendezvous_service_descriptor_line),
'version': (None, _parse_v2_version_line),
'permanent_key': (None, _parse_permanent_key_line),
'secret_id_part': (None, _parse_secret_id_part_line),
'published': (None, _parse_publication_time_line),
'protocol_versions': ([], _parse_protocol_versions_line),
'introduction_points_encoded': (None, _parse_introduction_points_line),
'introduction_points_auth': ([], _parse_introduction_points_line),
'introduction_points_content': (None, _parse_introduction_points_line),
'signature': (None, _parse_v2_signature_line),
}
PARSER_FOR_LINE = {
'rendezvous-service-descriptor': _parse_rendezvous_service_descriptor_line,
'version': _parse_v2_version_line,
'permanent-key': _parse_permanent_key_line,
'secret-id-part': _parse_secret_id_part_line,
'publication-time': _parse_publication_time_line,
'protocol-versions': _parse_protocol_versions_line,
'introduction-points': _parse_introduction_points_line,
'signature': _parse_v2_signature_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('rendezvous-service-descriptor', 'y3olqqblqw2gbh6phimfuiroechjjafa'),
('version', '2'),
('permanent-key', _random_crypto_blob('RSA PUBLIC KEY')),
('secret-id-part', 'e24kgecavwsznj7gpbktqsiwgvngsf4e'),
('publication-time', _random_date()),
('protocol-versions', '2,3'),
('introduction-points', '\n-----BEGIN MESSAGE-----\n-----END MESSAGE-----'),
), (
('signature', _random_crypto_blob('SIGNATURE')),
))
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False):
return cls(cls.content(attr, exclude, sign), validate = validate, skip_crypto_validation = not sign)
def __init__(self, raw_contents, validate = False, skip_crypto_validation = False):
super(HiddenServiceDescriptorV2, self).__init__(raw_contents, lazy_load = not validate)
entries = _descriptor_components(raw_contents, validate, non_ascii_fields = ('introduction-points'))
if validate:
for keyword in REQUIRED_V2_FIELDS:
if keyword not in entries:
raise ValueError("Hidden service descriptor must have a '%s' entry" % keyword)
elif keyword in entries and len(entries[keyword]) > 1:
raise ValueError("The '%s' entry can only appear once in a hidden service descriptor" % keyword)
if 'rendezvous-service-descriptor' != list(entries.keys())[0]:
raise ValueError("Hidden service descriptor must start with a 'rendezvous-service-descriptor' entry")
elif 'signature' != list(entries.keys())[-1]:
raise ValueError("Hidden service descriptor must end with a 'signature' entry")
self._parse(entries, validate)
if not skip_crypto_validation and stem.prereq.is_crypto_available():
signed_digest = self._digest_for_signature(self.permanent_key, self.signature)
digest_content = self._content_range('rendezvous-service-descriptor ', '\nsignature\n')
content_digest = hashlib.sha1(digest_content).hexdigest().upper()
if signed_digest != content_digest:
raise ValueError('Decrypted digest does not match local digest (calculated: %s, local: %s)' % (signed_digest, content_digest))
else:
self._entries = entries
@lru_cache()
def introduction_points(self, authentication_cookie = None):
"""
Provided this service's introduction points.
:returns: **list** of :class:`~stem.descriptor.hidden_service.IntroductionPoints`
:raises:
* **ValueError** if the our introduction-points is malformed
* **DecryptionFailure** if unable to decrypt this field
"""
content = self.introduction_points_content
if not content:
return []
elif authentication_cookie:
if not stem.prereq.is_crypto_available():
raise DecryptionFailure('Decrypting introduction-points requires the cryptography module')
try:
authentication_cookie = stem.util.str_tools._decode_b64(authentication_cookie)
except TypeError as exc:
raise DecryptionFailure('authentication_cookie must be a base64 encoded string (%s)' % exc)
authentication_type = int(binascii.hexlify(content[0:1]), 16)
if authentication_type == BASIC_AUTH:
content = HiddenServiceDescriptorV2._decrypt_basic_auth(content, authentication_cookie)
elif authentication_type == STEALTH_AUTH:
content = HiddenServiceDescriptorV2._decrypt_stealth_auth(content, authentication_cookie)
else:
raise DecryptionFailure("Unrecognized authentication type '%s', currently we only support basic auth (%s) and stealth auth (%s)" % (authentication_type, BASIC_AUTH, STEALTH_AUTH))
if not content.startswith(b'introduction-point '):
raise DecryptionFailure('Unable to decrypt the introduction-points, maybe this is the wrong key?')
elif not content.startswith(b'introduction-point '):
raise DecryptionFailure('introduction-points content is encrypted, you need to provide its authentication_cookie')
return HiddenServiceDescriptorV2._parse_introduction_points(content)
@staticmethod
def _decrypt_basic_auth(content, authentication_cookie):
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
try:
client_blocks = int(binascii.hexlify(content[1:2]), 16)
except ValueError:
raise DecryptionFailure("When using basic auth the content should start with a number of blocks but wasn't a hex digit: %s" % binascii.hexlify(content[1:2]))
# parse the client id and encrypted session keys
client_entries_length = client_blocks * 16 * 20
client_entries = content[2:2 + client_entries_length]
client_keys = [(client_entries[i:i + 4], client_entries[i + 4:i + 20]) for i in range(0, client_entries_length, 4 + 16)]
iv = content[2 + client_entries_length:2 + client_entries_length + 16]
encrypted = content[2 + client_entries_length + 16:]
client_id = hashlib.sha1(authentication_cookie + iv).digest()[:4]
for entry_id, encrypted_session_key in client_keys:
if entry_id != client_id:
continue # not the session key for this client
# try decrypting the session key
cipher = Cipher(algorithms.AES(authentication_cookie), modes.CTR(b'\x00' * len(iv)), default_backend())
decryptor = cipher.decryptor()
session_key = decryptor.update(encrypted_session_key) + decryptor.finalize()
# attempt to decrypt the intro points with the session key
cipher = Cipher(algorithms.AES(session_key), modes.CTR(iv), default_backend())
decryptor = cipher.decryptor()
decrypted = decryptor.update(encrypted) + decryptor.finalize()
# check if the decryption looks correct
if decrypted.startswith(b'introduction-point '):
return decrypted
return content # nope, unable to decrypt the content
@staticmethod
def _decrypt_stealth_auth(content, authentication_cookie):
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
# byte 1 = authentication type, 2-17 = input vector, 18 on = encrypted content
iv, encrypted = content[1:17], content[17:]
cipher = Cipher(algorithms.AES(authentication_cookie), modes.CTR(iv), default_backend())
decryptor = cipher.decryptor()
return decryptor.update(encrypted) + decryptor.finalize()
@staticmethod
def _parse_introduction_points(content):
"""
Provides the parsed list of IntroductionPoints for the unencrypted content.
"""
introduction_points = []
content_io = io.BytesIO(content)
while True:
content = b''.join(_read_until_keywords('introduction-point', content_io, ignore_first = True))
if not content:
break # reached the end
attr = dict(INTRODUCTION_POINTS_ATTR)
entries = _descriptor_components(content, False)
for keyword, values in list(entries.items()):
value, block_type, block_contents = values[0]
if keyword in SINGLE_INTRODUCTION_POINT_FIELDS and len(values) > 1:
raise ValueError("'%s' can only appear once in an introduction-point block, but appeared %i times" % (keyword, len(values)))
if keyword == 'introduction-point':
attr['identifier'] = value
elif keyword == 'ip-address':
if not stem.util.connection.is_valid_ipv4_address(value):
raise ValueError("'%s' is an invalid IPv4 address" % value)
attr['address'] = value
elif keyword == 'onion-port':
if not stem.util.connection.is_valid_port(value):
raise ValueError("'%s' is an invalid port" % value)
attr['port'] = int(value)
elif keyword == 'onion-key':
attr['onion_key'] = block_contents
elif keyword == 'service-key':
attr['service_key'] = block_contents
elif keyword == 'intro-authentication':
auth_entries = []
for auth_value, _, _ in values:
if ' ' not in auth_value:
raise ValueError("We expected 'intro-authentication [auth_type] [auth_data]', but had '%s'" % auth_value)
auth_type, auth_data = auth_value.split(' ')[:2]
auth_entries.append((auth_type, auth_data))
introduction_points.append(IntroductionPoints(**attr))
return introduction_points
class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor):
"""
Version 3 hidden service descriptor.
:var int version: **\\*** hidden service descriptor version
:var int lifetime: **\\*** minutes after publication this descriptor is valid
:var stem.descriptor.certificate.Ed25519Certificate signing_cert: **\\*** cross-certifier for the short-term descriptor signing key
:var int revision_counter: **\\*** descriptor revision number
:var str superencrypted: **\\*** encrypted HS-DESC-ENC payload
:var str signature: **\\*** signature of this descriptor
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
.. versionadded:: 1.8.0
"""
# TODO: requested this @type on https://trac.torproject.org/projects/tor/ticket/31481
TYPE_ANNOTATION_NAME = 'hidden-service-descriptor-3'
ATTRIBUTES = {
'version': (None, _parse_v3_version_line),
'lifetime': (None, _parse_lifetime_line),
'signing_cert': (None, _parse_signing_cert),
'revision_counter': (None, _parse_revision_counter_line),
'superencrypted': (None, _parse_superencrypted_line),
'signature': (None, _parse_v3_signature_line),
}
PARSER_FOR_LINE = {
'hs-descriptor': _parse_v3_version_line,
'descriptor-lifetime': _parse_lifetime_line,
'descriptor-signing-key-cert': _parse_signing_cert,
'revision-counter': _parse_revision_counter_line,
'superencrypted': _parse_superencrypted_line,
'signature': _parse_v3_signature_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False, inner_layer = None, outer_layer = None, identity_key = None, signing_key = None, signing_cert = None, revision_counter = None, blinding_nonce = None):
"""
Hidden service v3 descriptors consist of three parts:
* InnerLayer, which most notably contain introduction points where the
service can be reached.
* OuterLayer, which encrypts the InnerLayer among other paremters.
* HiddenServiceDescriptorV3, which contains the OuterLayer and plaintext
parameters.
Construction through this method can supply any or none of these, with
omitted parameters populated with randomized defaults.
Ed25519 key blinding adds an additional ~20 ms, and as such is disabled by
default. To blind with a random nonce simply call...
::
HiddenServiceDescriptorV3.create(blinding_nonce = os.urandom(32))
:param dict attr: keyword/value mappings to be included in plaintext descriptor
:param list exclude: mandatory keywords to exclude from the descriptor, this
results in an invalid descriptor
:param bool sign: includes cryptographic signatures and digests if True
:param stem.descriptor.hidden_service.InnerLayer inner_layer: inner
encrypted layer
:param stem.descriptor.hidden_service.OuterLayer outer_layer: outer
encrypted layer
:param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey
identity_key: service identity key
:param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey
signing_key: service signing key
:param stem.descriptor.Ed25519CertificateV1 signing_cert: certificate
signing this descriptor
:param int revision_counter: descriptor revision number
:param bytes blinding_nonce: 32 byte blinding factor to derive the blinding key
:returns: **str** with the content of a descriptor
:raises:
* **ValueError** if parameters are malformed
* **ImportError** if cryptography is unavailable
"""
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Hidden service descriptor creation requires cryptography version 2.6')
elif not stem.prereq._is_sha3_available():
raise ImportError('Hidden service descriptor creation requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)')
elif blinding_nonce and len(blinding_nonce) != 32:
raise ValueError('Blinding nonce must be 32 bytes, but was %i' % len(blinding_nonce))
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
inner_layer = inner_layer if inner_layer else InnerLayer.create(exclude = exclude)
identity_key = identity_key if identity_key else Ed25519PrivateKey.generate()
signing_key = signing_key if signing_key else Ed25519PrivateKey.generate()
revision_counter = revision_counter if revision_counter else int(time.time())
blinded_key = _blinded_pubkey(identity_key, blinding_nonce) if blinding_nonce else b'a' * 32
subcredential = HiddenServiceDescriptorV3._subcredential(identity_key, blinded_key)
custom_sig = attr.pop('signature') if (attr and 'signature' in attr) else None
if not outer_layer:
outer_layer = OuterLayer.create(
exclude = exclude,
inner_layer = inner_layer,
revision_counter = revision_counter,
subcredential = subcredential,
blinded_key = blinded_key,
)
if not signing_cert:
extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, blinded_key)]
signing_cert = Ed25519CertificateV1(cert_type = CertType.HS_V3_DESC_SIGNING, key = signing_key, extensions = extensions)
signing_cert.signature = _blinded_sign(signing_cert.pack(), identity_key, blinded_key, blinding_nonce) if blinding_nonce else b'b' * 64
desc_content = _descriptor_content(attr, exclude, (
('hs-descriptor', '3'),
('descriptor-lifetime', '180'),
('descriptor-signing-key-cert', '\n' + signing_cert.to_base64(pem = True)),
('revision-counter', str(revision_counter)),
('superencrypted', b'\n' + outer_layer._encrypt(revision_counter, subcredential, blinded_key)),
), ()) + b'\n'
if custom_sig:
desc_content += b'signature %s' % stem.util.str_tools._to_bytes(custom_sig)
elif 'signature' not in exclude:
sig_content = stem.descriptor.certificate.SIG_PREFIX_HS_V3 + desc_content
desc_content += b'signature %s' % base64.b64encode(signing_key.sign(sig_content)).rstrip(b'=')
return desc_content
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, inner_layer = None, outer_layer = None, identity_key = None, signing_key = None, signing_cert = None, revision_counter = None, blinding_nonce = None):
return cls(cls.content(attr, exclude, sign, inner_layer, outer_layer, identity_key, signing_key, signing_cert, revision_counter, blinding_nonce), validate = validate)
def __init__(self, raw_contents, validate = False):
super(HiddenServiceDescriptorV3, self).__init__(raw_contents, lazy_load = not validate)
self._inner_layer = None
entries = _descriptor_components(raw_contents, validate)
if validate:
for keyword in REQUIRED_V3_FIELDS:
if keyword not in entries:
raise ValueError("Hidden service descriptor must have a '%s' entry" % keyword)
elif keyword in entries and len(entries[keyword]) > 1:
raise ValueError("The '%s' entry can only appear once in a hidden service descriptor" % keyword)
if 'hs-descriptor' != list(entries.keys())[0]:
raise ValueError("Hidden service descriptor must start with a 'hs-descriptor' entry")
elif 'signature' != list(entries.keys())[-1]:
raise ValueError("Hidden service descriptor must end with a 'signature' entry")
self._parse(entries, validate)
if self.signing_cert and stem.prereq.is_crypto_available(ed25519 = True):
self.signing_cert.validate(self)
else:
self._entries = entries
def decrypt(self, onion_address):
"""
Decrypt this descriptor. Hidden serice descriptors contain two encryption
layers (:class:`~stem.descriptor.hidden_service.OuterLayer` and
:class:`~stem.descriptor.hidden_service.InnerLayer`).
:param str onion_address: hidden service address this descriptor is from
:returns: :class:`~stem.descriptor.hidden_service.InnerLayer` with our
decrypted content
:raises:
* **ImportError** if required cryptography or sha3 module is unavailable
* **ValueError** if unable to decrypt or validation fails
"""
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Hidden service descriptor decryption requires cryptography version 2.6')
elif not stem.prereq._is_sha3_available():
raise ImportError('Hidden service descriptor decryption requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)')
if self._inner_layer is None:
blinded_key = self.signing_cert.signing_key() if self.signing_cert else None
if not blinded_key:
raise ValueError('No signing key is present')
identity_public_key = HiddenServiceDescriptorV3.identity_key_from_address(onion_address)
subcredential = HiddenServiceDescriptorV3._subcredential(identity_public_key, blinded_key)
outer_layer = OuterLayer._decrypt(self.superencrypted, self.revision_counter, subcredential, blinded_key)
self._inner_layer = InnerLayer._decrypt(outer_layer, self.revision_counter, subcredential, blinded_key)
return self._inner_layer
@staticmethod
def address_from_identity_key(key, suffix = True):
"""
Converts a hidden service identity key into its address. This accepts all
key formats (private, public, or public bytes).
:param Ed25519PublicKey,Ed25519PrivateKey,bytes key: hidden service identity key
:param bool suffix: includes the '.onion' suffix if true, excluded otherwise
:returns: **unicode** hidden service address
:raises: **ImportError** if sha3 unsupported
"""
if not stem.prereq._is_sha3_available():
raise ImportError('Hidden service address conversion requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)')
key = stem.util._pubkey_bytes(key) # normalize key into bytes
version = stem.client.datatype.Size.CHAR.pack(3)
checksum = hashlib.sha3_256(CHECKSUM_CONSTANT + key + version).digest()[:2]
onion_address = base64.b32encode(key + checksum + version)
return stem.util.str_tools._to_unicode(onion_address + b'.onion' if suffix else onion_address).lower()
@staticmethod
def identity_key_from_address(onion_address):
"""
Converts a hidden service address into its public identity key.
:param str onion_address: hidden service address
:returns: **bytes** for the hidden service's public identity key
:raises:
* **ImportError** if sha3 unsupported
* **ValueError** if address malformed or checksum is invalid
"""
if not stem.prereq._is_sha3_available():
raise ImportError('Hidden service address conversion requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)')
if onion_address.endswith('.onion'):
onion_address = onion_address[:-6]
if not stem.util.tor_tools.is_valid_hidden_service_address(onion_address, version = 3):
raise ValueError("'%s.onion' isn't a valid hidden service v3 address" % onion_address)
# onion_address = base32(PUBKEY | CHECKSUM | VERSION) + '.onion'
# CHECKSUM = H('.onion checksum' | PUBKEY | VERSION)[:2]
decoded_address = base64.b32decode(onion_address.upper())
pubkey = decoded_address[:32]
expected_checksum = decoded_address[32:34]
version = decoded_address[34:35]
checksum = hashlib.sha3_256(CHECKSUM_CONSTANT + pubkey + version).digest()[:2]
if expected_checksum != checksum:
checksum_str = stem.util.str_tools._to_unicode(binascii.hexlify(checksum))
expected_checksum_str = stem.util.str_tools._to_unicode(binascii.hexlify(expected_checksum))
raise ValueError('Bad checksum (expected %s but was %s)' % (expected_checksum_str, checksum_str))
return pubkey
@staticmethod
def _subcredential(identity_key, blinded_key):
# credential = H('credential' | public-identity-key)
# subcredential = H('subcredential' | credential | blinded-public-key)
credential = hashlib.sha3_256(b'credential%s' % stem.util._pubkey_bytes(identity_key)).digest()
return hashlib.sha3_256(b'subcredential%s%s' % (credential, blinded_key)).digest()
class OuterLayer(Descriptor):
"""
Initial encryped layer of a hidden service v3 descriptor (`spec
`_).
.. versionadded:: 1.8.0
:var str auth_type: **\\*** encryption scheme used for descriptor authorization
:var str ephemeral_key: **\\*** base64 encoded x25519 public key
:var dict clients: **\\*** mapping of authorized client ids to their
:class:`~stem.descriptor.hidden_service.AuthorizedClient`
:var str encrypted: **\\*** encrypted descriptor inner layer
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
ATTRIBUTES = {
'auth_type': (None, _parse_v3_outer_auth_type),
'ephemeral_key': (None, _parse_v3_outer_ephemeral_key),
'clients': ({}, _parse_v3_outer_clients),
'encrypted': (None, _parse_v3_outer_encrypted),
}
PARSER_FOR_LINE = {
'desc-auth-type': _parse_v3_outer_auth_type,
'desc-auth-ephemeral-key': _parse_v3_outer_ephemeral_key,
'auth-client': _parse_v3_outer_clients,
'encrypted': _parse_v3_outer_encrypted,
}
@staticmethod
def _decrypt(encrypted, revision_counter, subcredential, blinded_key):
plaintext = _decrypt_layer(encrypted, b'hsdir-superencrypted-data', revision_counter, subcredential, blinded_key)
return OuterLayer(plaintext)
def _encrypt(self, revision_counter, subcredential, blinded_key):
# Spec mandated padding: "Before encryption the plaintext is padded with
# NUL bytes to the nearest multiple of 10k bytes."
content = self.get_bytes() + b'\x00' * (len(self.get_bytes()) % 10000)
# encrypt back into a hidden service descriptor's 'superencrypted' field
return _encrypt_layer(content, b'hsdir-superencrypted-data', revision_counter, subcredential, blinded_key)
@classmethod
def content(cls, attr = None, exclude = (), validate = True, sign = False, inner_layer = None, revision_counter = None, authorized_clients = None, subcredential = None, blinded_key = None):
if not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Hidden service layer creation requires cryptography version 2.6')
elif not stem.prereq._is_sha3_available():
raise ImportError('Hidden service layer creation requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)')
elif authorized_clients and 'auth-client' in attr:
raise ValueError('Authorized clients cannot be specified through both attr and authorized_clients')
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
inner_layer = inner_layer if inner_layer else InnerLayer.create()
revision_counter = revision_counter if revision_counter else 1
blinded_key = blinded_key if blinded_key else stem.util._pubkey_bytes(Ed25519PrivateKey.generate())
subcredential = subcredential if subcredential else HiddenServiceDescriptorV3._subcredential(Ed25519PrivateKey.generate(), blinded_key)
if not authorized_clients:
authorized_clients = []
if attr and 'auth-client' in attr:
pass # caller is providing raw auth-client lines through the attr
else:
for i in range(16):
authorized_clients.append(AuthorizedClient())
return _descriptor_content(attr, exclude, [
('desc-auth-type', 'x25519'),
('desc-auth-ephemeral-key', base64.b64encode(stem.util._pubkey_bytes(X25519PrivateKey.generate()))),
] + [
('auth-client', '%s %s %s' % (c.id, c.iv, c.cookie)) for c in authorized_clients
], (
('encrypted', b'\n' + inner_layer._encrypt(revision_counter, subcredential, blinded_key)),
))
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, inner_layer = None, revision_counter = None, authorized_clients = None, subcredential = None, blinded_key = None):
return cls(cls.content(attr, exclude, validate, sign, inner_layer, revision_counter, authorized_clients, subcredential, blinded_key), validate = validate)
def __init__(self, content, validate = False):
content = stem.util.str_tools._to_bytes(content).rstrip(b'\x00') # strip null byte padding
super(OuterLayer, self).__init__(content, lazy_load = not validate)
entries = _descriptor_components(content, validate)
if validate:
self._parse(entries, validate)
else:
self._entries = entries
class InnerLayer(Descriptor):
"""
Second encryped layer of a hidden service v3 descriptor (`spec
`_).
.. versionadded:: 1.8.0
:var stem.descriptor.hidden_service.OuterLayer outer: enclosing encryption layer
:var list formats: **\\*** recognized CREATE2 cell formats
:var list intro_auth: **\\*** introduction-layer authentication types
:var bool is_single_service: **\\*** **True** if this is a `single onion service `_, **False** otherwise
:var list introduction_points: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` where this service is reachable
**\\*** attribute is either required when we're parsed with validation or has
a default value, others are left as **None** if undefined
"""
ATTRIBUTES = {
'formats': ([], _parse_v3_inner_formats),
'intro_auth': ([], _parse_v3_inner_intro_auth),
'is_single_service': (False, _parse_v3_inner_single_service),
'introduction_points': ([], _parse_v3_introduction_points),
}
PARSER_FOR_LINE = {
'create2-formats': _parse_v3_inner_formats,
'intro-auth-required': _parse_v3_inner_intro_auth,
'single-onion-service': _parse_v3_inner_single_service,
}
@staticmethod
def _decrypt(outer_layer, revision_counter, subcredential, blinded_key):
plaintext = _decrypt_layer(outer_layer.encrypted, b'hsdir-encrypted-data', revision_counter, subcredential, blinded_key)
return InnerLayer(plaintext, validate = True, outer_layer = outer_layer)
def _encrypt(self, revision_counter, subcredential, blinded_key):
# encrypt back into an outer layer's 'encrypted' field
return _encrypt_layer(self.get_bytes(), b'hsdir-encrypted-data', revision_counter, subcredential, blinded_key)
@classmethod
def content(cls, attr = None, exclude = (), sign = False, introduction_points = None):
if introduction_points:
suffix = '\n' + '\n'.join(map(IntroductionPointV3.encode, introduction_points))
else:
suffix = ''
return _descriptor_content(attr, exclude, (
('create2-formats', '2'),
)) + stem.util.str_tools._to_bytes(suffix)
@classmethod
def create(cls, attr = None, exclude = (), validate = True, sign = False, introduction_points = None):
return cls(cls.content(attr, exclude, sign, introduction_points), validate = validate)
def __init__(self, content, validate = False, outer_layer = None):
super(InnerLayer, self).__init__(content, lazy_load = not validate)
self.outer = outer_layer
# inner layer begins with a few header fields, followed by any
# number of introduction-points
content = stem.util.str_tools._to_bytes(content)
div = content.find(b'\nintroduction-point ')
if div != -1:
self._unparsed_introduction_points = content[div + 1:]
content = content[:div]
else:
self._unparsed_introduction_points = None
entries = _descriptor_components(content, validate)
if validate:
self._parse(entries, validate)
_parse_v3_introduction_points(self, entries)
else:
self._entries = entries
def _blinded_pubkey(identity_key, blinding_nonce):
from stem.util import ed25519
mult = 2 ** (ed25519.b - 2) + sum(2 ** i * ed25519.bit(blinding_nonce, i) for i in range(3, ed25519.b - 2))
P = ed25519.decodepoint(stem.util._pubkey_bytes(identity_key))
return ed25519.encodepoint(ed25519.scalarmult(P, mult))
def _blinded_sign(msg, identity_key, blinded_key, blinding_nonce):
from cryptography.hazmat.primitives import serialization
from stem.util import ed25519
identity_key_bytes = identity_key.private_bytes(
encoding = serialization.Encoding.Raw,
format = serialization.PrivateFormat.Raw,
encryption_algorithm = serialization.NoEncryption(),
)
# pad private identity key into an ESK (encrypted secret key)
h = ed25519.H(identity_key_bytes)
a = 2 ** (ed25519.b - 2) + sum(2 ** i * ed25519.bit(h, i) for i in range(3, ed25519.b - 2))
k = b''.join([h[i:i + 1] for i in range(ed25519.b // 8, ed25519.b // 4)])
esk = ed25519.encodeint(a) + k
# blind the ESK with this nonce
mult = 2 ** (ed25519.b - 2) + sum(2 ** i * ed25519.bit(blinding_nonce, i) for i in range(3, ed25519.b - 2))
s = ed25519.decodeint(esk[:32])
s_prime = (s * mult) % ed25519.l
k = esk[32:]
k_prime = ed25519.H(b'Derive temporary signing key hash input' + k)[:32]
blinded_esk = ed25519.encodeint(s_prime) + k_prime
# finally, sign the message
a = ed25519.decodeint(blinded_esk[:32])
r = ed25519.Hint(b''.join([blinded_esk[i:i + 1] for i in range(ed25519.b // 8, ed25519.b // 4)]) + msg)
R = ed25519.scalarmult(ed25519.B, r)
S = (r + ed25519.Hint(ed25519.encodepoint(R) + blinded_key + msg) * a) % ed25519.l
return ed25519.encodepoint(R) + ed25519.encodeint(S)
# TODO: drop this alias in stem 2.x
HiddenServiceDescriptor = HiddenServiceDescriptorV2
stem-1.8.0/stem/descriptor/microdescriptor.py 0000664 0001750 0001750 00000027015 13501272761 022133 0 ustar atagar atagar 0000000 0000000 # Copyright 2013-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parsing for Tor microdescriptors, which contain a distilled version of a
relay's server descriptor. As of Tor version 0.2.3.3-alpha Tor no longer
downloads server descriptors by default, opting for microdescriptors instead.
Unlike most descriptor documents these aren't available on the metrics site
(since they don't contain any information that the server descriptors don't).
The limited information in microdescriptors make them rather clunky to use
compared with server descriptors. For instance microdescriptors lack the
relay's fingerprint, making it difficut to use them to look up the relay's
other descriptors.
To do so you need to match the microdescriptor's digest against its
corresponding router status entry. For added fun as of this writing the
controller doesn't even surface those router status entries
(:trac:`7953`).
For instance, here's an example that prints the nickname and fingerprints of
the exit relays.
::
import os
from stem.control import Controller
from stem.descriptor import parse_file
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
exit_digests = set()
data_dir = controller.get_conf('DataDirectory')
for desc in controller.get_microdescriptors():
if desc.exit_policy.is_exiting_allowed():
exit_digests.add(desc.digest)
print 'Exit Relays:'
for desc in parse_file(os.path.join(data_dir, 'cached-microdesc-consensus')):
if desc.digest in exit_digests:
print ' %s (%s)' % (desc.nickname, desc.fingerprint)
Doing the same is trivial with server descriptors...
::
from stem.descriptor import parse_file
print 'Exit Relays:'
for desc in parse_file('/home/atagar/.tor/cached-descriptors'):
if desc.exit_policy.is_exiting_allowed():
print ' %s (%s)' % (desc.nickname, desc.fingerprint)
**Module Overview:**
::
Microdescriptor - Tor microdescriptor.
"""
import hashlib
import stem.exit_policy
import stem.prereq
from stem.descriptor import (
Descriptor,
DigestHash,
DigestEncoding,
_descriptor_content,
_descriptor_components,
_read_until_keywords,
_values,
_parse_simple_line,
_parse_protocol_line,
_parse_key_block,
_random_crypto_blob,
)
from stem.descriptor.router_status_entry import (
_parse_a_line,
_parse_p_line,
)
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
REQUIRED_FIELDS = (
'onion-key',
)
SINGLE_FIELDS = (
'onion-key',
'ntor-onion-key',
'family',
'p',
'p6',
'pr',
)
def _parse_file(descriptor_file, validate = False, **kwargs):
"""
Iterates over the microdescriptors in a file.
:param file descriptor_file: file with descriptor content
:param bool validate: checks the validity of the descriptor's content if
**True**, skips these checks otherwise
:param dict kwargs: additional arguments for the descriptor constructor
:returns: iterator for Microdescriptor instances in the file
:raises:
* **ValueError** if the contents is malformed and validate is True
* **IOError** if the file can't be read
"""
while True:
annotations = _read_until_keywords('onion-key', descriptor_file)
# read until we reach an annotation or onion-key line
descriptor_lines = []
# read the onion-key line, done if we're at the end of the document
onion_key_line = descriptor_file.readline()
if onion_key_line:
descriptor_lines.append(onion_key_line)
else:
break
while True:
last_position = descriptor_file.tell()
line = descriptor_file.readline()
if not line:
break # EOF
elif line.startswith(b'@') or line.startswith(b'onion-key'):
descriptor_file.seek(last_position)
break
else:
descriptor_lines.append(line)
if descriptor_lines:
if descriptor_lines[0].startswith(b'@type'):
descriptor_lines = descriptor_lines[1:]
# strip newlines from annotations
annotations = list(map(bytes.strip, annotations))
descriptor_text = bytes.join(b'', descriptor_lines)
yield Microdescriptor(descriptor_text, validate, annotations, **kwargs)
else:
break # done parsing descriptors
def _parse_id_line(descriptor, entries):
identities = {}
for entry in _values('id', entries):
entry_comp = entry.split()
if len(entry_comp) >= 2:
key_type, key_value = entry_comp[0], entry_comp[1]
if key_type in identities:
raise ValueError("There can only be one 'id' line per a key type, but '%s' appeared multiple times" % key_type)
descriptor.identifier_type = key_type
descriptor.identifier = key_value
identities[key_type] = key_value
else:
raise ValueError("'id' lines should contain both the key type and digest: id %s" % entry)
descriptor.identifiers = identities
_parse_onion_key_line = _parse_key_block('onion-key', 'onion_key', 'RSA PUBLIC KEY')
_parse_ntor_onion_key_line = _parse_simple_line('ntor-onion-key', 'ntor_onion_key')
_parse_family_line = _parse_simple_line('family', 'family', func = lambda v: v.split(' '))
_parse_p6_line = _parse_simple_line('p6', 'exit_policy_v6', func = lambda v: stem.exit_policy.MicroExitPolicy(v))
_parse_pr_line = _parse_protocol_line('pr', 'protocols')
class Microdescriptor(Descriptor):
"""
Microdescriptor (`descriptor specification
`_)
:var str onion_key: **\\*** key used to encrypt EXTEND cells
:var str ntor_onion_key: base64 key used to encrypt EXTEND in the ntor protocol
:var list or_addresses: **\\*** alternative for our address/or_port attributes, each
entry is a tuple of the form (address (**str**), port (**int**), is_ipv6
(**bool**))
:var list family: **\\*** nicknames or fingerprints of declared family
:var stem.exit_policy.MicroExitPolicy exit_policy: **\\*** relay's exit policy
:var stem.exit_policy.MicroExitPolicy exit_policy_v6: **\\*** exit policy for IPv6
:var hash identifiers: mapping of key types (like rsa1024 or ed25519) to
their base64 encoded identity, this is only used for collision prevention
(:trac:`11743`)
:var dict protocols: mapping of protocols to their supported versions
:var str identifier: base64 encoded identity digest (**deprecated**, use
identifiers instead)
:var str identifier_type: identity digest key type (**deprecated**, use
identifiers instead)
**\\*** attribute is required when we're parsed with validation
.. versionchanged:: 1.1.0
Added the identifier and identifier_type attributes.
.. versionchanged:: 1.5.0
Added the identifiers attribute, and deprecated identifier and
identifier_type since the field can now appear multiple times.
.. versionchanged:: 1.6.0
Added the protocols attribute.
.. versionchanged:: 1.8.0
Replaced our **digest** attribute with a much more flexible **digest()**
method. Unfortunately I cannot do this in a backward compatible way
because of the name conflict. The old digest had multiple problems (for
instance, being hex rather than base64 encoded), so hopefully no one was
using it. Very sorry if this causes trouble for anyone.
"""
TYPE_ANNOTATION_NAME = 'microdescriptor'
ATTRIBUTES = {
'onion_key': (None, _parse_onion_key_line),
'ntor_onion_key': (None, _parse_ntor_onion_key_line),
'or_addresses': ([], _parse_a_line),
'family': ([], _parse_family_line),
'exit_policy': (stem.exit_policy.MicroExitPolicy('reject 1-65535'), _parse_p_line),
'exit_policy_v6': (None, _parse_p6_line),
'identifier_type': (None, _parse_id_line), # deprecated in favor of identifiers
'identifier': (None, _parse_id_line), # deprecated in favor of identifiers
'identifiers': ({}, _parse_id_line),
'protocols': ({}, _parse_pr_line),
}
PARSER_FOR_LINE = {
'onion-key': _parse_onion_key_line,
'ntor-onion-key': _parse_ntor_onion_key_line,
'a': _parse_a_line,
'family': _parse_family_line,
'p': _parse_p_line,
'p6': _parse_p6_line,
'pr': _parse_pr_line,
'id': _parse_id_line,
}
@classmethod
def content(cls, attr = None, exclude = (), sign = False):
if sign:
raise NotImplementedError('Signing of %s not implemented' % cls.__name__)
return _descriptor_content(attr, exclude, (
('onion-key', _random_crypto_blob('RSA PUBLIC KEY')),
))
def __init__(self, raw_contents, validate = False, annotations = None):
super(Microdescriptor, self).__init__(raw_contents, lazy_load = not validate)
self._annotation_lines = annotations if annotations else []
entries = _descriptor_components(raw_contents, validate)
if validate:
self._parse(entries, validate)
self._check_constraints(entries)
else:
self._entries = entries
def digest(self, hash_type = DigestHash.SHA256, encoding = DigestEncoding.BASE64):
"""
Digest of this microdescriptor. These are referenced by...
* **Microdescriptor Consensus**
* Referer: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryMicroV3` **digest** attribute
* Format: **SHA256/BASE64**
.. versionadded:: 1.8.0
:param stem.descriptor.DigestHash hash_type: digest hashing algorithm
:param stem.descriptor.DigestEncoding encoding: digest encoding
:returns: **hashlib.HASH** or **str** based on our encoding argument
"""
if hash_type == DigestHash.SHA1:
return stem.descriptor._encode_digest(hashlib.sha1(self.get_bytes()), encoding)
elif hash_type == DigestHash.SHA256:
return stem.descriptor._encode_digest(hashlib.sha256(self.get_bytes()), encoding)
else:
raise NotImplementedError('Microdescriptor digests are only available in sha1 and sha256, not %s' % hash_type)
@lru_cache()
def get_annotations(self):
"""
Provides content that appeared prior to the descriptor. If this comes from
the cached-microdescs then this commonly contains content like...
::
@last-listed 2013-02-24 00:18:30
:returns: **dict** with the key/value pairs in our annotations
"""
annotation_dict = {}
for line in self._annotation_lines:
if b' ' in line:
key, value = line.split(b' ', 1)
annotation_dict[key] = value
else:
annotation_dict[line] = None
return annotation_dict
def get_annotation_lines(self):
"""
Provides the lines of content that appeared prior to the descriptor. This
is the same as the
:func:`~stem.descriptor.microdescriptor.Microdescriptor.get_annotations`
results, but with the unparsed lines and ordering retained.
:returns: **list** with the lines of annotation that came before this descriptor
"""
return self._annotation_lines
def _check_constraints(self, entries):
"""
Does a basic check that the entries conform to this descriptor type's
constraints.
:param dict entries: keyword => (value, pgp key) entries
:raises: **ValueError** if an issue arises in validation
"""
for keyword in REQUIRED_FIELDS:
if keyword not in entries:
raise ValueError("Microdescriptor must have a '%s' entry" % keyword)
for keyword in SINGLE_FIELDS:
if keyword in entries and len(entries[keyword]) > 1:
raise ValueError("The '%s' entry can only appear once in a microdescriptor" % keyword)
if 'onion-key' != list(entries.keys())[0]:
raise ValueError("Microdescriptor must start with a 'onion-key' entry")
def _name(self, is_plural = False):
return 'microdescriptors' if is_plural else 'microdescriptor'
stem-1.8.0/stem/version.py 0000664 0001750 0001750 00000034761 13600526326 016237 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Tor versioning information and requirements for its features. These can be
easily parsed and compared, for instance...
::
>>> from stem.version import get_system_tor_version, Requirement
>>> my_version = get_system_tor_version()
>>> print(my_version)
0.2.1.30
>>> my_version >= Requirement.TORRC_CONTROL_SOCKET
True
**Module Overview:**
::
get_system_tor_version - gets the version of our system's tor installation
Version - Tor versioning information
.. data:: Requirement (enum)
Enumerations for the version requirements of features.
.. deprecated:: 1.6.0
Requirement entries belonging to tor versions which have been obsolete for
at least six months will be removed when we break backward compatibility
in the 2.x stem release.
===================================== ===========
Requirement Description
===================================== ===========
**AUTH_SAFECOOKIE** SAFECOOKIE authentication method
**DESCRIPTOR_COMPRESSION** `Expanded compression support for ZSTD and LZMA `_
**DORMANT_MODE** **DORMANT** and **ACTIVE** :data:`~stem.Signal`
**DROPGUARDS** DROPGUARDS requests
**EVENT_AUTHDIR_NEWDESCS** AUTHDIR_NEWDESC events
**EVENT_BUILDTIMEOUT_SET** BUILDTIMEOUT_SET events
**EVENT_CIRC_MINOR** CIRC_MINOR events
**EVENT_CLIENTS_SEEN** CLIENTS_SEEN events
**EVENT_CONF_CHANGED** CONF_CHANGED events
**EVENT_DESCCHANGED** DESCCHANGED events
**EVENT_GUARD** GUARD events
**EVENT_HS_DESC_CONTENT** HS_DESC_CONTENT events
**EVENT_NETWORK_LIVENESS** NETWORK_LIVENESS events
**EVENT_NEWCONSENSUS** NEWCONSENSUS events
**EVENT_NS** NS events
**EVENT_SIGNAL** SIGNAL events
**EVENT_STATUS** STATUS_GENERAL, STATUS_CLIENT, and STATUS_SERVER events
**EVENT_STREAM_BW** STREAM_BW events
**EVENT_TRANSPORT_LAUNCHED** TRANSPORT_LAUNCHED events
**EVENT_CONN_BW** CONN_BW events
**EVENT_CIRC_BW** CIRC_BW events
**EVENT_CELL_STATS** CELL_STATS events
**EVENT_TB_EMPTY** TB_EMPTY events
**EVENT_HS_DESC** HS_DESC events
**EXTENDCIRCUIT_PATH_OPTIONAL** EXTENDCIRCUIT queries can omit the path if the circuit is zero
**FEATURE_EXTENDED_EVENTS** 'EXTENDED_EVENTS' optional feature
**FEATURE_VERBOSE_NAMES** 'VERBOSE_NAMES' optional feature
**GETINFO_CONFIG_TEXT** 'GETINFO config-text' query
**GETINFO_GEOIP_AVAILABLE** 'GETINFO ip-to-country/ipv4-available' query and its ipv6 counterpart
**GETINFO_MICRODESCRIPTORS** 'GETINFO md/all' query
**GETINFO_UPTIME** 'GETINFO uptime' query
**HIDDEN_SERVICE_V3** Support for v3 hidden services
**HSFETCH** HSFETCH requests
**HSFETCH_V3** HSFETCH for version 3 hidden services
**HSPOST** HSPOST requests
**ADD_ONION** ADD_ONION and DEL_ONION requests
**ADD_ONION_BASIC_AUTH** ADD_ONION supports basic authentication
**ADD_ONION_NON_ANONYMOUS** ADD_ONION supports non-anonymous mode
**ADD_ONION_MAX_STREAMS** ADD_ONION support for MaxStreamsCloseCircuit
**LOADCONF** LOADCONF requests
**MICRODESCRIPTOR_IS_DEFAULT** Tor gets microdescriptors by default rather than server descriptors
**SAVECONF_FORCE** Added the 'FORCE' flag to SAVECONF
**TAKEOWNERSHIP** TAKEOWNERSHIP requests
**TORRC_CONTROL_SOCKET** 'ControlSocket ' config option
**TORRC_PORT_FORWARDING** 'PortForwarding' config option
**TORRC_DISABLE_DEBUGGER_ATTACHMENT** 'DisableDebuggerAttachment' config option
**TORRC_VIA_STDIN** Allow torrc options via 'tor -f -' (:trac:`13865`)
===================================== ===========
"""
import os
import re
import stem.prereq
import stem.util
import stem.util.enum
import stem.util.system
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
# cache for the get_system_tor_version function
VERSION_CACHE = {}
VERSION_PATTERN = re.compile(r'^([0-9]+)\.([0-9]+)\.([0-9]+)(\.[0-9]+)?(-\S*)?(( \(\S*\))*)$')
def get_system_tor_version(tor_cmd = 'tor'):
"""
Queries tor for its version. This is os dependent, only working on linux,
osx, and bsd.
:param str tor_cmd: command used to run tor
:returns: :class:`~stem.version.Version` provided by the tor command
:raises: **IOError** if unable to query or parse the version
"""
if tor_cmd not in VERSION_CACHE:
version_cmd = '%s --version' % tor_cmd
try:
version_output = stem.util.system.call(version_cmd)
except OSError as exc:
# make the error message nicer if this is due to tor being unavialable
if 'No such file or directory' in str(exc):
if os.path.isabs(tor_cmd):
exc = "Unable to check tor's version. '%s' doesn't exist." % tor_cmd
else:
exc = "Unable to run '%s'. Maybe tor isn't in your PATH?" % version_cmd
raise IOError(exc)
for line in version_output:
# output example:
# Oct 21 07:19:27.438 [notice] Tor v0.2.1.30. This is experimental software. Do not rely on it for strong anonymity. (Running on Linux i686)
# Tor version 0.2.1.30.
if line.startswith('Tor version ') and line.endswith('.'):
try:
version_str = line[12:-1]
VERSION_CACHE[tor_cmd] = Version(version_str)
break
except ValueError as exc:
raise IOError(exc)
if tor_cmd not in VERSION_CACHE:
raise IOError("'%s' didn't provide a parseable version:\n\n%s" % (version_cmd, '\n'.join(version_output)))
return VERSION_CACHE[tor_cmd]
@lru_cache()
def _get_version(version_str):
return Version(version_str)
class Version(object):
"""
Comparable tor version. These are constructed from strings that conform to
the 'new' style in the `tor version-spec
`_,
such as "0.1.4" or "0.2.2.23-alpha (git-7dcd105be34a4f44)".
.. versionchanged:: 1.6.0
Added all_extra parameter.
:var int major: major version
:var int minor: minor version
:var int micro: micro version
:var int patch: patch level (**None** if undefined)
:var str status: status tag such as 'alpha' or 'beta-dev' (**None** if undefined)
:var str extra: first extra information without its parentheses such as
'git-8be6058d8f31e578' (**None** if undefined)
:var list all_extra: all extra information entries, without their parentheses
:var str git_commit: git commit id (**None** if it wasn't provided)
:param str version_str: version to be parsed
:raises: **ValueError** if input isn't a valid tor version
"""
def __init__(self, version_str):
self.version_str = version_str
version_parts = VERSION_PATTERN.match(version_str)
if version_parts:
major, minor, micro, patch, status, extra_str, _ = version_parts.groups()
# The patch and status matches are optional (may be None) and have an extra
# proceeding period or dash if they exist. Stripping those off.
if patch:
patch = int(patch[1:])
if status:
status = status[1:]
self.major = int(major)
self.minor = int(minor)
self.micro = int(micro)
self.patch = patch
self.status = status
self.all_extra = [entry[1:-1] for entry in extra_str.strip().split()] if extra_str else []
self.extra = self.all_extra[0] if self.all_extra else None
self.git_commit = None
for extra in self.all_extra:
if extra and re.match('^git-[0-9a-f]{16}$', extra):
self.git_commit = extra[4:]
break
else:
raise ValueError("'%s' isn't a properly formatted tor version" % version_str)
def __str__(self):
"""
Provides the string used to construct the version.
"""
return self.version_str
def _compare(self, other, method):
"""
Compares version ordering according to the spec.
"""
if not isinstance(other, Version):
return False
for attr in ('major', 'minor', 'micro', 'patch'):
my_version = getattr(self, attr)
other_version = getattr(other, attr)
if my_version is None:
my_version = 0
if other_version is None:
other_version = 0
if my_version != other_version:
return method(my_version, other_version)
# According to the version spec...
#
# If we *do* encounter two versions that differ only by status tag, we
# compare them lexically as ASCII byte strings.
my_status = self.status if self.status else ''
other_status = other.status if other.status else ''
return method(my_status, other_status)
def __hash__(self):
return stem.util._hash_attr(self, 'major', 'minor', 'micro', 'patch', 'status', cache = True)
def __eq__(self, other):
return self._compare(other, lambda s, o: s == o)
def __ne__(self, other):
return not self == other
def __gt__(self, other):
"""
Checks if this version meets the requirements for a given feature. We can
be compared to either a :class:`~stem.version.Version` or
:class:`~stem.version._VersionRequirements`.
"""
if isinstance(other, _VersionRequirements):
for rule in other.rules:
if rule(self):
return True
return False
return self._compare(other, lambda s, o: s > o)
def __ge__(self, other):
if isinstance(other, _VersionRequirements):
for rule in other.rules:
if rule(self):
return True
return False
return self._compare(other, lambda s, o: s >= o)
class _VersionRequirements(object):
"""
Series of version constraints that can be compared to. For instance, this
allows for comparisons like 'if I'm greater than version X in the 0.2.2
series, or greater than version Y in the 0.2.3 series'.
This is a logical 'or' of the series of rules.
"""
def __init__(self):
self.rules = []
def greater_than(self, version, inclusive = True):
"""
Adds a constraint that we're greater than the given version.
:param stem.version.Version version: version we're checking against
:param bool inclusive: if comparison is inclusive or not
"""
if inclusive:
self.rules.append(lambda v: version <= v)
else:
self.rules.append(lambda v: version < v)
def less_than(self, version, inclusive = True):
"""
Adds a constraint that we're less than the given version.
:param stem.version.Version version: version we're checking against
:param bool inclusive: if comparison is inclusive or not
"""
if inclusive:
self.rules.append(lambda v: version >= v)
else:
self.rules.append(lambda v: version > v)
def in_range(self, from_version, to_version, from_inclusive = True, to_inclusive = False):
"""
Adds constraint that we're within the range from one version to another.
:param stem.version.Version from_version: beginning of the comparison range
:param stem.version.Version to_version: end of the comparison range
:param bool from_inclusive: if comparison is inclusive with the starting version
:param bool to_inclusive: if comparison is inclusive with the ending version
"""
def new_rule(v):
if from_inclusive and to_inclusive:
return from_version <= v <= to_version
elif from_inclusive:
return from_version <= v < to_version
else:
return from_version < v < to_version
self.rules.append(new_rule)
safecookie_req = _VersionRequirements()
safecookie_req.in_range(Version('0.2.2.36'), Version('0.2.3.0'))
safecookie_req.greater_than(Version('0.2.3.13'))
Requirement = stem.util.enum.Enum(
('AUTH_SAFECOOKIE', safecookie_req),
('DESCRIPTOR_COMPRESSION', Version('0.3.1.1-alpha')),
('DORMANT_MODE', Version('0.4.0.1-alpha')),
('DROPGUARDS', Version('0.2.5.1-alpha')),
('EVENT_AUTHDIR_NEWDESCS', Version('0.1.1.10-alpha')),
('EVENT_BUILDTIMEOUT_SET', Version('0.2.2.7-alpha')),
('EVENT_CIRC_MINOR', Version('0.2.3.11-alpha')),
('EVENT_CLIENTS_SEEN', Version('0.2.1.10-alpha')),
('EVENT_CONF_CHANGED', Version('0.2.3.3-alpha')),
('EVENT_DESCCHANGED', Version('0.1.2.2-alpha')),
('EVENT_GUARD', Version('0.1.2.5-alpha')),
('EVENT_HS_DESC_CONTENT', Version('0.2.7.1-alpha')),
('EVENT_NS', Version('0.1.2.3-alpha')),
('EVENT_NETWORK_LIVENESS', Version('0.2.7.2-alpha')),
('EVENT_NEWCONSENSUS', Version('0.2.1.13-alpha')),
('EVENT_SIGNAL', Version('0.2.3.1-alpha')),
('EVENT_STATUS', Version('0.1.2.3-alpha')),
('EVENT_STREAM_BW', Version('0.1.2.8-beta')),
('EVENT_TRANSPORT_LAUNCHED', Version('0.2.5.0-alpha')),
('EVENT_CONN_BW', Version('0.2.5.2-alpha')),
('EVENT_CIRC_BW', Version('0.2.5.2-alpha')),
('EVENT_CELL_STATS', Version('0.2.5.2-alpha')),
('EVENT_TB_EMPTY', Version('0.2.5.2-alpha')),
('EVENT_HS_DESC', Version('0.2.5.2-alpha')),
('EXTENDCIRCUIT_PATH_OPTIONAL', Version('0.2.2.9')),
('FEATURE_EXTENDED_EVENTS', Version('0.2.2.1-alpha')),
('FEATURE_VERBOSE_NAMES', Version('0.2.2.1-alpha')),
('GETINFO_CONFIG_TEXT', Version('0.2.2.7-alpha')),
('GETINFO_GEOIP_AVAILABLE', Version('0.3.2.1-alpha')),
('GETINFO_MICRODESCRIPTORS', Version('0.3.5.1-alpha')),
('GETINFO_UPTIME', Version('0.3.5.1-alpha')),
('HIDDEN_SERVICE_V3', Version('0.3.3.1-alpha')),
('HSFETCH', Version('0.2.7.1-alpha')),
('HSFETCH_V3', Version('0.4.1.1-alpha')),
('HSPOST', Version('0.2.7.1-alpha')),
('ADD_ONION', Version('0.2.7.1-alpha')),
('ADD_ONION_BASIC_AUTH', Version('0.2.9.1-alpha')),
('ADD_ONION_NON_ANONYMOUS', Version('0.2.9.3-alpha')),
('ADD_ONION_MAX_STREAMS', Version('0.2.7.2-alpha')),
('LOADCONF', Version('0.2.1.1')),
('MICRODESCRIPTOR_IS_DEFAULT', Version('0.2.3.3')),
('SAVECONF_FORCE', Version('0.3.1.1-alpha')),
('TAKEOWNERSHIP', Version('0.2.2.28-beta')),
('TORRC_CONTROL_SOCKET', Version('0.2.0.30')),
('TORRC_PORT_FORWARDING', Version('0.2.3.1-alpha')),
('TORRC_DISABLE_DEBUGGER_ATTACHMENT', Version('0.2.3.9')),
('TORRC_VIA_STDIN', Version('0.2.6.3-alpha')),
)
stem-1.8.0/stem/client/ 0000775 0001750 0001750 00000000000 13602232262 015436 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/client/datatype.py 0000664 0001750 0001750 00000060016 13564354230 017635 0 ustar atagar atagar 0000000 0000000 # Copyright 2018-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Support for `Tor's ORPort protocol
`_.
**This module only consists of low level components, and is not intended for
users.** See our :class:`~stem.client.Relay` the API you probably want.
.. versionadded:: 1.7.0
::
split - splits bytes into substrings
LinkProtocol - ORPort protocol version.
Field - Packable and unpackable datatype.
|- LinkSpecifier - Communication method relays in a circuit.
| |- LinkByIPv4 - TLS connection to an IPv4 address.
| |- LinkByIPv6 - TLS connection to an IPv6 address.
| |- LinkByFingerprint - SHA1 identity fingerprint.
| +- LinkByEd25519 - Ed25519 identity fingerprint.
|
|- Size - Field of a static size.
|- Address - Relay address.
|- Certificate - Relay certificate.
|
|- pack - encodes content
|- unpack - decodes content
+- pop - decodes content with remainder
KDF - KDF-TOR derivatived attributes
+- from_value - parses key material
.. data:: AddrType (enum)
Form an address takes.
===================== ===========
AddressType Description
===================== ===========
**HOSTNAME** relay hostname
**IPv4** IPv4 address
**IPv6** IPv6 address
**ERROR_TRANSIENT** temporarily error retrieving address
**ERROR_PERMANENT** permanent error retrieving address
**UNKNOWN** unrecognized address type
===================== ===========
.. data:: RelayCommand (enum)
Command concerning streams and circuits we've established with a relay.
Commands have two characteristics...
* **forward/backward**: **forward** commands are issued from the orgin,
whereas **backward** come from the relay
* **stream/circuit**: **steam** commands concern an individual steam, whereas
**circuit** concern the entire circuit we've established with a relay
===================== ===========
RelayCommand Description
===================== ===========
**BEGIN** begin a stream (**forward**, **stream**)
**DATA** transmit data (**forward/backward**, **stream**)
**END** end a stream (**forward/backward**, **stream**)
**CONNECTED** BEGIN reply (**backward**, **stream**)
**SENDME** ready to accept more cells (**forward/backward**, **stream/circuit**)
**EXTEND** extend the circuit through another relay (**forward**, **circuit**)
**EXTENDED** EXTEND reply (**backward**, **circuit**)
**TRUNCATE** remove last circuit hop (**forward**, **circuit**)
**TRUNCATED** TRUNCATE reply (**backward**, **circuit**)
**DROP** ignorable no-op (**forward/backward**, **circuit**)
**RESOLVE** request DNS resolution (**forward**, **stream**)
**RESOLVED** RESOLVE reply (**backward**, **stream**)
**BEGIN_DIR** request descriptor (**forward**, **steam**)
**EXTEND2** ntor EXTEND request (**forward**, **circuit**)
**EXTENDED2** EXTEND2 reply (**backward**, **circuit**)
**UNKNOWN** unrecognized command
===================== ===========
.. data:: CertType (enum)
Certificate purpose. For more information see...
* `tor-spec.txt `_ section 4.2
* `cert-spec.txt `_ section A.1
* `rend-spec-v3.txt `_ appendix E
.. versionchanged:: 1.8.0
Added the ED25519_SIGNING, LINK_CERT, ED25519_AUTHENTICATE,
ED25519_IDENTITY, HS_V3_DESC_SIGNING, HS_V3_INTRO_AUTH, NTOR_ONION_KEY,
and HS_V3_NTOR_ENC certificate types.
========================= ===========
CertType Description
========================= ===========
**LINK** link key certificate certified by RSA1024 identity
**IDENTITY** RSA1024 Identity certificate
**AUTHENTICATE** RSA1024 AUTHENTICATE cell link certificate
**ED25519_SIGNING** Ed25519 signing key, signed with identity key
**LINK_CERT** TLS link certificate, signed with ed25519 signing key
**ED25519_AUTHENTICATE** Ed25519 AUTHENTICATE cell key, signed with ed25519 signing key
**ED25519_IDENTITY** Ed25519 identity, signed with RSA identity
**HS_V3_DESC_SIGNING** hidden service v3 short-term descriptor signing key
**HS_V3_INTRO_AUTH** hidden service v3 introduction point authentication key
**NTOR_ONION_KEY** ntor onion key cross-certifying ed25519 identity key
**HS_V3_NTOR_ENC** hidden service v3 ntor-extra encryption key
**UNKNOWN** unrecognized certificate type
========================= ===========
.. data:: CloseReason (enum)
Reason a relay is closed.
===================== ===========
CloseReason Description
===================== ===========
**NONE** no reason given
**PROTOCOL** tor protocol violation
**INTERNAL** internal error
**REQUESTED** client sent a TRUNCATE command
**HIBERNATING** relay suspended, trying to save bandwidth
**RESOURCELIMIT** out of memory, sockets, or circuit IDs
**CONNECTFAILED** unable to reach relay
**OR_IDENTITY** connected, but its OR identity was not as expected
**OR_CONN_CLOSED** connection that was carrying this circuit died
**FINISHED** circuit has expired for being dirty or old
**TIMEOUT** circuit construction took too long
**DESTROYED** circuit was destroyed without a client TRUNCATE
**NOSUCHSERVICE** request was for an unknown hidden service
**UNKNOWN** unrecognized reason
===================== ===========
"""
import binascii
import collections
import hashlib
import struct
import stem.client.cell
import stem.prereq
import stem.util
import stem.util.connection
import stem.util.enum
ZERO = b'\x00'
HASH_LEN = 20
KEY_LEN = 16
class _IntegerEnum(stem.util.enum.Enum):
"""
Integer backed enumeration. Enumerations of this type always have an implicit
**UNKNOWN** value for integer values that lack a mapping.
"""
def __init__(self, *args):
self._enum_to_int = {}
self._int_to_enum = {}
parent_args = []
for entry in args:
if len(entry) == 2:
enum, int_val = entry
str_val = enum
elif len(entry) == 3:
enum, str_val, int_val = entry
else:
raise ValueError('IntegerEnums can only be constructed with two or three value tuples: %s' % repr(entry))
self._enum_to_int[str_val] = int_val
self._int_to_enum[int_val] = str_val
parent_args.append((enum, str_val))
parent_args.append(('UNKNOWN', 'UNKNOWN'))
super(_IntegerEnum, self).__init__(*parent_args)
def get(self, val):
"""
Provides the (enum, int_value) tuple for a given value.
"""
if stem.util._is_int(val):
return self._int_to_enum.get(val, self.UNKNOWN), val
elif val in self:
return val, self._enum_to_int.get(val, val)
else:
raise ValueError("Invalid enumeration '%s', options are %s" % (val, ', '.join(self)))
AddrType = _IntegerEnum(
('HOSTNAME', 0),
('IPv4', 4),
('IPv6', 6),
('ERROR_TRANSIENT', 16),
('ERROR_PERMANENT', 17),
)
RelayCommand = _IntegerEnum(
('BEGIN', 'RELAY_BEGIN', 1),
('DATA', 'RELAY_DATA', 2),
('END', 'RELAY_END', 3),
('CONNECTED', 'RELAY_CONNECTED', 4),
('SENDME', 'RELAY_SENDME', 5),
('EXTEND', 'RELAY_EXTEND', 6),
('EXTENDED', 'RELAY_EXTENDED', 7),
('TRUNCATE', 'RELAY_TRUNCATE', 8),
('TRUNCATED', 'RELAY_TRUNCATED', 9),
('DROP', 'RELAY_DROP', 10),
('RESOLVE', 'RELAY_RESOLVE', 11),
('RESOLVED', 'RELAY_RESOLVED', 12),
('BEGIN_DIR', 'RELAY_BEGIN_DIR', 13),
('EXTEND2', 'RELAY_EXTEND2', 14),
('EXTENDED2', 'RELAY_EXTENDED2', 15),
)
CertType = _IntegerEnum(
('LINK', 1), # (tor-spec.txt section 4.2)
('IDENTITY', 2), # (tor-spec.txt section 4.2)
('AUTHENTICATE', 3), # (tor-spec.txt section 4.2)
('ED25519_SIGNING', 4), # (prop220 section 4.2)
('LINK_CERT', 5), # (prop220 section 4.2)
('ED25519_AUTHENTICATE', 6), # (prop220 section 4.2)
('ED25519_IDENTITY', 7), # (prop220 section 4.2)
('HS_V3_DESC_SIGNING', 8), # (rend-spec-v3.txt, "DESC_OUTER" description)
('HS_V3_INTRO_AUTH', 9), # (rend-spec-v3.txt, "auth-key" description)
('NTOR_ONION_KEY', 10), # (dir-spec.txt, "ntor-onion-key-crosscert" description)
('HS_V3_NTOR_ENC', 11), # (rend-spec-v3.txt, "enc-key-cert" description)
)
CloseReason = _IntegerEnum(
('NONE', 0),
('PROTOCOL', 1),
('INTERNAL', 2),
('REQUESTED', 3),
('HIBERNATING', 4),
('RESOURCELIMIT', 5),
('CONNECTFAILED', 6),
('OR_IDENTITY', 7),
('OR_CONN_CLOSED', 8),
('FINISHED', 9),
('TIMEOUT', 10),
('DESTROYED', 11),
('NOSUCHSERVICE', 12),
)
def split(content, size):
"""
Simple split of bytes into two substrings.
:param bytes content: string to split
:param int size: index to split the string on
:returns: two value tuple with the split bytes
"""
return content[:size], content[size:]
class LinkProtocol(int):
"""
Constants that vary by our link protocol version.
:var int version: link protocol version
:var stem.client.datatype.Size circ_id_size: circuit identifier field size
:var int fixed_cell_length: size of cells with a fixed length
:var int first_circ_id: When creating circuits we pick an unused identifier
from a range that's determined by our link protocol.
"""
def __new__(cls, version):
if isinstance(version, LinkProtocol):
return version # already a LinkProtocol
protocol = int.__new__(cls, version)
protocol.version = version
protocol.circ_id_size = Size.LONG if version > 3 else Size.SHORT
protocol.first_circ_id = 0x80000000 if version > 3 else 0x01
cell_header_size = protocol.circ_id_size.size + 1 # circuit id (2 or 4 bytes) + command (1 byte)
protocol.fixed_cell_length = cell_header_size + stem.client.cell.FIXED_PAYLOAD_LEN
return protocol
def __hash__(self):
# All LinkProtocol attributes can be derived from our version, so that's
# all we need in our hash. Offsetting by our type so we don't hash conflict
# with ints.
return self.version * hash(str(type(self)))
def __eq__(self, other):
if isinstance(other, int):
return self.version == other
elif isinstance(other, LinkProtocol):
return hash(self) == hash(other)
else:
return False
def __ne__(self, other):
return not self == other
def __int__(self):
return self.version
class Field(object):
"""
Packable and unpackable datatype.
"""
def pack(self):
"""
Encodes field into bytes.
:returns: **bytes** that can be communicated over Tor's ORPort
:raises: **ValueError** if incorrect type or size
"""
raise NotImplementedError('Not yet available')
@classmethod
def unpack(cls, packed):
"""
Decodes bytes into a field of this type.
:param bytes packed: content to decode
:returns: instance of this class
:raises: **ValueError** if packed data is malformed
"""
unpacked, remainder = cls.pop(packed)
if remainder:
raise ValueError('%s is the wrong size for a %s field' % (repr(packed), cls.__name__))
return unpacked
@staticmethod
def pop(packed):
"""
Decodes bytes as this field type, providing it and the remainder.
:param bytes packed: content to decode
:returns: tuple of the form (unpacked, remainder)
:raises: **ValueError** if packed data is malformed
"""
raise NotImplementedError('Not yet available')
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Field) else False
def __ne__(self, other):
return not self == other
class Size(Field):
"""
Unsigned `struct.pack format
` for
network-order fields.
==================== ===========
Pack Description
==================== ===========
CHAR Unsigned char (1 byte)
SHORT Unsigned short (2 bytes)
LONG Unsigned long (4 bytes)
LONG_LONG Unsigned long long (8 bytes)
==================== ===========
"""
def __init__(self, name, size, pack_format):
self.name = name
self.size = size
self.format = pack_format
@staticmethod
def pop(packed):
raise NotImplementedError("Use our constant's unpack() and pop() instead")
def pack(self, content):
# TODO: Python 2.6's struct module behaves a little differently in a couple
# respsects...
#
# * Invalid types raise a TypeError rather than a struct.error.
#
# * Negative values are happily packed despite being unsigned fields with
# a message printed to stdout (!) that says...
#
# stem/client/datatype.py:362: DeprecationWarning: struct integer overflow masking is deprecated
# packed = struct.pack(self.format, content)
# stem/client/datatype.py:362: DeprecationWarning: 'B' format requires 0 <= number <= 255
# packed = struct.pack(self.format, content)
#
# Rather than adjust this method to account for these differences doing
# duplicate upfront checks just for python 2.6. When we drop 2.6 support
# this can obviously be dropped.
if stem.prereq._is_python_26():
if not stem.util._is_int(content):
raise ValueError('Size.pack encodes an integer, but was a %s' % type(content).__name__)
elif content < 0:
raise ValueError('Packed values must be positive (attempted to pack %i as a %s)' % (content, self.name))
# TODO: When we drop python 2.x support this can be simplified via
# integer's to_bytes() method. For example...
#
# struct.pack('>Q', my_number)
#
# ... is the same as...
#
# my_number.to_bytes(8, 'big')
try:
packed = struct.pack(self.format, content)
except struct.error:
if not stem.util._is_int(content):
raise ValueError('Size.pack encodes an integer, but was a %s' % type(content).__name__)
elif content < 0:
raise ValueError('Packed values must be positive (attempted to pack %i as a %s)' % (content, self.name))
else:
raise # some other struct exception
if self.size != len(packed):
raise ValueError('%s is the wrong size for a %s field' % (repr(packed), self.name))
return packed
def unpack(self, packed):
if self.size != len(packed):
raise ValueError('%s is the wrong size for a %s field' % (repr(packed), self.name))
return struct.unpack(self.format, packed)[0]
def pop(self, packed):
to_unpack, remainder = split(packed, self.size)
return self.unpack(to_unpack), remainder
def __hash__(self):
return stem.util._hash_attr(self, 'name', 'size', 'format', cache = True)
class Address(Field):
"""
Relay address.
:var stem.client.AddrType type: address type
:var int type_int: integer value of the address type
:var unicode value: address value
:var bytes value_bin: encoded address value
"""
def __init__(self, value, addr_type = None):
if addr_type is None:
if stem.util.connection.is_valid_ipv4_address(value):
addr_type = AddrType.IPv4
elif stem.util.connection.is_valid_ipv6_address(value):
addr_type = AddrType.IPv6
else:
raise ValueError("'%s' isn't an IPv4 or IPv6 address" % value)
self.type, self.type_int = AddrType.get(addr_type)
if self.type == AddrType.IPv4:
if stem.util.connection.is_valid_ipv4_address(value):
self.value = value
self.value_bin = b''.join([Size.CHAR.pack(int(v)) for v in value.split('.')])
else:
if len(value) != 4:
raise ValueError('Packed IPv4 addresses should be four bytes, but was: %s' % repr(value))
self.value = _unpack_ipv4_address(value)
self.value_bin = value
elif self.type == AddrType.IPv6:
if stem.util.connection.is_valid_ipv6_address(value):
self.value = stem.util.connection.expand_ipv6_address(value).lower()
self.value_bin = b''.join([Size.SHORT.pack(int(v, 16)) for v in self.value.split(':')])
else:
if len(value) != 16:
raise ValueError('Packed IPv6 addresses should be sixteen bytes, but was: %s' % repr(value))
self.value = _unpack_ipv6_address(value)
self.value_bin = value
else:
# The spec doesn't really tell us what form to expect errors to be. For
# now just leaving the value unset so we can fill it in later when we
# know what would be most useful.
self.value = None
self.value_bin = value
def pack(self):
cell = bytearray()
cell += Size.CHAR.pack(self.type_int)
cell += Size.CHAR.pack(len(self.value_bin))
cell += self.value_bin
return bytes(cell)
@staticmethod
def pop(content):
addr_type, content = Size.CHAR.pop(content)
addr_length, content = Size.CHAR.pop(content)
if len(content) < addr_length:
raise ValueError('Address specified a payload of %i bytes, but only had %i' % (addr_length, len(content)))
addr_value, content = split(content, addr_length)
return Address(addr_value, addr_type), content
def __hash__(self):
return stem.util._hash_attr(self, 'type_int', 'value_bin', cache = True)
class Certificate(Field):
"""
Relay certificate as defined in tor-spec section 4.2.
:var stem.client.CertType type: certificate type
:var int type_int: integer value of the certificate type
:var bytes value: certificate value
"""
def __init__(self, cert_type, value):
self.type, self.type_int = CertType.get(cert_type)
self.value = value
def pack(self):
cell = bytearray()
cell += Size.CHAR.pack(self.type_int)
cell += Size.SHORT.pack(len(self.value))
cell += self.value
return bytes(cell)
@staticmethod
def pop(content):
cert_type, content = Size.CHAR.pop(content)
cert_size, content = Size.SHORT.pop(content)
if cert_size > len(content):
raise ValueError('CERTS cell should have a certificate with %i bytes, but only had %i remaining' % (cert_size, len(content)))
cert_bytes, content = split(content, cert_size)
return Certificate(cert_type, cert_bytes), content
def __hash__(self):
return stem.util._hash_attr(self, 'type_int', 'value')
class LinkSpecifier(Field):
"""
Method of communicating with a circuit's relay. Recognized link specification
types are an instantiation of a subclass. For more information see the
`EXTEND cell specification
`_.
.. versionadded:: 1.8.0
:var int type: numeric identifier of our type
:var bytes value: encoded link specification destination
"""
def __init__(self, link_type, value):
self.type = link_type
self.value = value
@staticmethod
def pop(packed):
# LSTYPE (Link specifier type) [1 byte]
# LSLEN (Link specifier length) [1 byte]
# LSPEC (Link specifier) [LSLEN bytes]
link_type, packed = Size.CHAR.pop(packed)
value_size, packed = Size.CHAR.pop(packed)
if value_size > len(packed):
raise ValueError('Link specifier should have %i bytes, but only had %i remaining' % (value_size, len(packed)))
value, packed = split(packed, value_size)
if link_type == 0:
return LinkByIPv4.unpack(value), packed
elif link_type == 1:
return LinkByIPv6.unpack(value), packed
elif link_type == 2:
return LinkByFingerprint(value), packed
elif link_type == 3:
return LinkByEd25519(value), packed
else:
return LinkSpecifier(link_type, value), packed # unrecognized type
def pack(self):
cell = bytearray()
cell += Size.CHAR.pack(self.type)
cell += Size.CHAR.pack(len(self.value))
cell += self.value
return bytes(cell)
class LinkByIPv4(LinkSpecifier):
"""
TLS connection to an IPv4 address.
.. versionadded:: 1.8.0
:var str address: relay IPv4 address
:var int port: relay ORPort
"""
def __init__(self, address, port):
super(LinkByIPv4, self).__init__(0, _pack_ipv4_address(address) + Size.SHORT.pack(port))
self.address = address
self.port = port
@staticmethod
def unpack(value):
if len(value) != 6:
raise ValueError('IPv4 link specifiers should be six bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value)))
addr, port = split(value, 4)
return LinkByIPv4(_unpack_ipv4_address(addr), Size.SHORT.unpack(port))
class LinkByIPv6(LinkSpecifier):
"""
TLS connection to an IPv6 address.
.. versionadded:: 1.8.0
:var str address: relay IPv6 address
:var int port: relay ORPort
"""
def __init__(self, address, port):
super(LinkByIPv6, self).__init__(1, _pack_ipv6_address(address) + Size.SHORT.pack(port))
self.address = address
self.port = port
@staticmethod
def unpack(value):
if len(value) != 18:
raise ValueError('IPv6 link specifiers should be eighteen bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value)))
addr, port = split(value, 16)
return LinkByIPv6(_unpack_ipv6_address(addr), Size.SHORT.unpack(port))
class LinkByFingerprint(LinkSpecifier):
"""
Connection to a SHA1 identity fingerprint.
.. versionadded:: 1.8.0
:var str fingerprint: relay sha1 fingerprint
"""
def __init__(self, value):
super(LinkByFingerprint, self).__init__(2, value)
if len(value) != 20:
raise ValueError('Fingerprint link specifiers should be twenty bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value)))
self.fingerprint = stem.util.str_tools._to_unicode(value)
class LinkByEd25519(LinkSpecifier):
"""
Connection to a Ed25519 identity fingerprint.
.. versionadded:: 1.8.0
:var str fingerprint: relay ed25519 fingerprint
"""
def __init__(self, value):
super(LinkByEd25519, self).__init__(3, value)
if len(value) != 32:
raise ValueError('Fingerprint link specifiers should be thirty two bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value)))
self.fingerprint = stem.util.str_tools._to_unicode(value)
class KDF(collections.namedtuple('KDF', ['key_hash', 'forward_digest', 'backward_digest', 'forward_key', 'backward_key'])):
"""
Computed KDF-TOR derived values for TAP, CREATE_FAST handshakes, and hidden
service protocols as defined tor-spec section 5.2.1.
:var bytes key_hash: hash that proves knowledge of our shared key
:var bytes forward_digest: forward digest hash seed
:var bytes backward_digest: backward digest hash seed
:var bytes forward_key: forward encryption key
:var bytes backward_key: backward encryption key
"""
@staticmethod
def from_value(key_material):
# Derived key material, as per...
#
# K = H(K0 | [00]) | H(K0 | [01]) | H(K0 | [02]) | ...
derived_key = b''
counter = 0
while len(derived_key) < KEY_LEN * 2 + HASH_LEN * 3:
derived_key += hashlib.sha1(key_material + Size.CHAR.pack(counter)).digest()
counter += 1
key_hash, derived_key = split(derived_key, HASH_LEN)
forward_digest, derived_key = split(derived_key, HASH_LEN)
backward_digest, derived_key = split(derived_key, HASH_LEN)
forward_key, derived_key = split(derived_key, KEY_LEN)
backward_key, derived_key = split(derived_key, KEY_LEN)
return KDF(key_hash, forward_digest, backward_digest, forward_key, backward_key)
def _pack_ipv4_address(address):
return b''.join([Size.CHAR.pack(int(v)) for v in address.split('.')])
def _unpack_ipv4_address(value):
return '.'.join([str(Size.CHAR.unpack(value[i:i + 1])) for i in range(4)])
def _pack_ipv6_address(address):
return b''.join([Size.SHORT.pack(int(v, 16)) for v in address.split(':')])
def _unpack_ipv6_address(value):
return ':'.join(['%04x' % Size.SHORT.unpack(value[i * 2:(i + 1) * 2]) for i in range(8)])
setattr(Size, 'CHAR', Size('CHAR', 1, '!B'))
setattr(Size, 'SHORT', Size('SHORT', 2, '!H'))
setattr(Size, 'LONG', Size('LONG', 4, '!L'))
setattr(Size, 'LONG_LONG', Size('LONG_LONG', 8, '!Q'))
stem-1.8.0/stem/client/__init__.py 0000664 0001750 0001750 00000032222 13501272761 017556 0 ustar atagar atagar 0000000 0000000 # Copyright 2018-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Interaction with a Tor relay's ORPort. :class:`~stem.client.Relay` is
a wrapper for :class:`~stem.socket.RelaySocket`, much the same way as
:class:`~stem.control.Controller` provides higher level functions for
:class:`~stem.socket.ControlSocket`.
.. versionadded:: 1.7.0
::
Relay - Connection with a tor relay's ORPort.
| +- connect - Establishes a connection with a relay.
|
|- is_alive - reports if our connection is open or closed
|- connection_time - time when we last connected or disconnected
|- close - shuts down our connection
|
+- create_circuit - establishes a new circuit
Circuit - Circuit we've established through a relay.
|- send - sends a message through this circuit
+- close - closes this circuit
"""
import hashlib
import threading
import stem
import stem.client.cell
import stem.socket
import stem.util.connection
from stem.client.cell import (
CELL_TYPE_SIZE,
FIXED_PAYLOAD_LEN,
Cell,
)
from stem.client.datatype import (
ZERO,
Address,
KDF,
LinkProtocol,
RelayCommand,
split,
)
__all__ = [
'cell',
'datatype',
]
DEFAULT_LINK_PROTOCOLS = (3, 4, 5)
class Relay(object):
"""
Connection with a Tor relay's ORPort.
:var int link_protocol: link protocol version we established
"""
def __init__(self, orport, link_protocol):
# TODO: Python 3.x adds a getbuffer() method which
# lets us get the size...
#
# https://stackoverflow.com/questions/26827055/python-how-to-get-iobytes-allocated-memory-length
#
# When we drop python 2.x support we should replace
# self._orport_buffer with an io.BytesIO.
self.link_protocol = LinkProtocol(link_protocol)
self._orport = orport
self._orport_buffer = b'' # unread bytes
self._orport_lock = threading.RLock()
self._circuits = {}
@staticmethod
def connect(address, port, link_protocols = DEFAULT_LINK_PROTOCOLS):
"""
Establishes a connection with the given ORPort.
:param str address: ip address of the relay
:param int port: ORPort of the relay
:param tuple link_protocols: acceptable link protocol versions
:raises:
* **ValueError** if address or port are invalid
* :class:`stem.SocketError` if we're unable to establish a connection
"""
relay_addr = Address(address)
if not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port" % port)
elif not link_protocols:
raise ValueError("Connection can't be established without a link protocol.")
try:
conn = stem.socket.RelaySocket(address, port)
except stem.SocketError as exc:
if 'Connection refused' in str(exc):
raise stem.SocketError("Failed to connect to %s:%i. Maybe it isn't an ORPort?" % (address, port))
# If not an ORPort (for instance, mistakenly connecting to a ControlPort
# instead) we'll likely fail during SSL negotiation. This can result
# in a variety of responses so normalizing what we can...
#
# Debian 9.5: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:661)
# Ubuntu 16.04: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:590)
# Ubuntu 12.04: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
if 'unknown protocol' in str(exc) or 'wrong version number' in str(exc):
raise stem.SocketError("Failed to SSL authenticate to %s:%i. Maybe it isn't an ORPort?" % (address, port))
raise
# To negotiate our link protocol the first VERSIONS cell is expected to use
# a circuit ID field size from protocol version 1-3 for backward
# compatibility...
#
# The first VERSIONS cell, and any cells sent before the
# first VERSIONS cell, always have CIRCID_LEN == 2 for backward
# compatibility.
conn.send(stem.client.cell.VersionsCell(link_protocols).pack(2))
response = conn.recv()
# Link negotiation ends right away if we lack a common protocol
# version. (#25139)
if not response:
conn.close()
raise stem.SocketError('Unable to establish a common link protocol with %s:%i' % (address, port))
versions_reply = stem.client.cell.Cell.pop(response, 2)[0]
common_protocols = set(link_protocols).intersection(versions_reply.versions)
if not common_protocols:
conn.close()
raise stem.SocketError('Unable to find a common link protocol. We support %s but %s:%i supports %s.' % (', '.join(link_protocols), address, port, ', '.join(versions_reply.versions)))
# Establishing connections requires sending a NETINFO, but including our
# address is optional. We can revisit including it when we have a usecase
# where it would help.
link_protocol = max(common_protocols)
conn.send(stem.client.cell.NetinfoCell(relay_addr, []).pack(link_protocol))
return Relay(conn, link_protocol)
def _recv(self, raw = False):
"""
Reads the next cell from our ORPort. If none is present this blocks
until one is available.
:param bool raw: provides bytes rather than parsing as a cell if **True**
:returns: next :class:`~stem.client.cell.Cell`
"""
with self._orport_lock:
# cells begin with [circ_id][cell_type][...]
circ_id_size = self.link_protocol.circ_id_size.size
while len(self._orport_buffer) < (circ_id_size + CELL_TYPE_SIZE.size):
self._orport_buffer += self._orport.recv() # read until we know the cell type
cell_type = Cell.by_value(CELL_TYPE_SIZE.pop(self._orport_buffer[circ_id_size:])[0])
if cell_type.IS_FIXED_SIZE:
cell_size = circ_id_size + CELL_TYPE_SIZE.size + FIXED_PAYLOAD_LEN
else:
# variable length, our next field is the payload size
while len(self._orport_buffer) < (circ_id_size + CELL_TYPE_SIZE.size + FIXED_PAYLOAD_LEN.size):
self._orport_buffer += self._orport.recv() # read until we know the cell size
payload_len = FIXED_PAYLOAD_LEN.pop(self._orport_buffer[circ_id_size + CELL_TYPE_SIZE.size:])[0]
cell_size = circ_id_size + CELL_TYPE_SIZE.size + FIXED_PAYLOAD_LEN.size + payload_len
while len(self._orport_buffer) < cell_size:
self._orport_buffer += self._orport.recv() # read until we have the full cell
if raw:
content, self._orport_buffer = split(self._orport_buffer, cell_size)
return content
else:
cell, self._orport_buffer = Cell.pop(self._orport_buffer, self.link_protocol)
return cell
def _msg(self, cell):
"""
Sends a cell on the ORPort and provides the response we receive in reply.
Unfortunately unlike control sockets, ORPorts don't have generalized rules
for predictable message IO. With control sockets...
* Each message we send receives a single reply.
* We may also receive asynchronous events marked with a 650 status.
ORPorts by contrast receive variable length cells with differing rules on
their arrival. As such making a best effort attempt at a send-and-receive
method in which we do the following...
* Discard any existing unread data from the socket.
* Send our request.
* Await up to a second for a reply.
It's quite possible this is a stupid approach. If so, patches welcome.
:param stem.client.cell.Cell cell: cell to be sent
:returns: **generator** with the cells received in reply
"""
self._orport.recv(timeout = 0) # discard unread data
self._orport.send(cell.pack(self.link_protocol))
response = self._orport.recv(timeout = 1)
for received_cell in stem.client.cell.Cell.pop(response, self.link_protocol):
yield received_cell
def is_alive(self):
"""
Checks if our socket is currently connected. This is a pass-through for our
socket's :func:`~stem.socket.BaseSocket.is_alive` method.
:returns: **bool** that's **True** if our socket is connected and **False** otherwise
"""
return self._orport.is_alive()
def connection_time(self):
"""
Provides the unix timestamp for when our socket was either connected or
disconnected. That is to say, the time we connected if we're currently
connected and the time we disconnected if we're not connected.
:returns: **float** for when we last connected or disconnected, zero if
we've never connected
"""
return self._orport.connection_time()
def close(self):
"""
Closes our socket connection. This is a pass-through for our socket's
:func:`~stem.socket.BaseSocket.close` method.
"""
with self._orport_lock:
return self._orport.close()
def create_circuit(self):
"""
Establishes a new circuit.
"""
with self._orport_lock:
circ_id = max(self._circuits) + 1 if self._circuits else self.link_protocol.first_circ_id
create_fast_cell = stem.client.cell.CreateFastCell(circ_id)
created_fast_cell = None
for cell in self._msg(create_fast_cell):
if isinstance(cell, stem.client.cell.CreatedFastCell):
created_fast_cell = cell
break
if not created_fast_cell:
raise ValueError('We should get a CREATED_FAST response from a CREATE_FAST request')
kdf = KDF.from_value(create_fast_cell.key_material + created_fast_cell.key_material)
if created_fast_cell.derivative_key != kdf.key_hash:
raise ValueError('Remote failed to prove that it knows our shared key')
circ = Circuit(self, circ_id, kdf)
self._circuits[circ.id] = circ
return circ
def __iter__(self):
with self._orport_lock:
for circ in self._circuits.values():
yield circ
def __enter__(self):
return self
def __exit__(self, exit_type, value, traceback):
self.close()
class Circuit(object):
"""
Circuit through which requests can be made of a `Tor relay's ORPort
`_.
:var stem.client.Relay relay: relay through which this circuit has been established
:var int id: circuit id
:var hashlib.sha1 forward_digest: digest for forward integrity check
:var hashlib.sha1 backward_digest: digest for backward integrity check
:var bytes forward_key: forward encryption key
:var bytes backward_key: backward encryption key
"""
def __init__(self, relay, circ_id, kdf):
if not stem.prereq.is_crypto_available():
raise ImportError('Circuit construction requires the cryptography module')
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
ctr = modes.CTR(ZERO * (algorithms.AES.block_size // 8))
self.relay = relay
self.id = circ_id
self.forward_digest = hashlib.sha1(kdf.forward_digest)
self.backward_digest = hashlib.sha1(kdf.backward_digest)
self.forward_key = Cipher(algorithms.AES(kdf.forward_key), ctr, default_backend()).encryptor()
self.backward_key = Cipher(algorithms.AES(kdf.backward_key), ctr, default_backend()).decryptor()
def directory(self, request, stream_id = 0):
"""
Request descriptors from the relay.
:param str request: directory request to make
:param int stream_id: specific stream this concerns
:returns: **str** with the requested descriptor data
"""
with self.relay._orport_lock:
self._send(RelayCommand.BEGIN_DIR, stream_id = stream_id)
self._send(RelayCommand.DATA, request, stream_id = stream_id)
response = []
while True:
# Decrypt relay cells received in response. Our digest/key only
# updates when handled successfully.
encrypted_cell = self.relay._recv(raw = True)
decrypted_cell, backward_key, backward_digest = stem.client.cell.RelayCell.decrypt(self.relay.link_protocol, encrypted_cell, self.backward_key, self.backward_digest)
if self.id != decrypted_cell.circ_id:
raise stem.ProtocolError('Response should be for circuit id %i, not %i' % (self.id, decrypted_cell.circ_id))
self.backward_digest = backward_digest
self.backward_key = backward_key
if decrypted_cell.command == RelayCommand.END:
return b''.join([cell.data for cell in response])
else:
response.append(decrypted_cell)
def _send(self, command, data = '', stream_id = 0):
"""
Sends a message over the circuit.
:param stem.client.datatype.RelayCommand command: command to be issued
:param bytes data: message payload
:param int stream_id: specific stream this concerns
"""
with self.relay._orport_lock:
# Encrypt and send the cell. Our digest/key only updates if the cell is
# successfully sent.
cell = stem.client.cell.RelayCell(self.id, command, data, stream_id = stream_id)
payload, forward_key, forward_digest = cell.encrypt(self.relay.link_protocol, self.forward_key, self.forward_digest)
self.relay._orport.send(payload)
self.forward_digest = forward_digest
self.forward_key = forward_key
def close(self):
with self.relay._orport_lock:
self.relay._orport.send(stem.client.cell.DestroyCell(self.id).pack(self.relay.link_protocol))
del self.relay._circuits[self.id]
def __enter__(self):
return self
def __exit__(self, exit_type, value, traceback):
self.close()
stem-1.8.0/stem/client/cell.py 0000664 0001750 0001750 00000065275 13501272761 016754 0 ustar atagar atagar 0000000 0000000 # Copyright 2018-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Messages communicated over a Tor relay's ORPort.
.. versionadded:: 1.7.0
**Module Overview:**
::
Cell - Base class for ORPort messages.
|- CircuitCell - Circuit management.
| |- CreateCell - Create a circuit. (section 5.1)
| |- CreatedCell - Acknowledge create. (section 5.1)
| |- RelayCell - End-to-end data. (section 6.1)
| |- DestroyCell - Stop using a circuit. (section 5.4)
| |- CreateFastCell - Create a circuit, no PK. (section 5.1)
| |- CreatedFastCell - Circuit created, no PK. (section 5.1)
| |- RelayEarlyCell - End-to-end data; limited. (section 5.6)
| |- Create2Cell - Extended CREATE cell. (section 5.1)
| +- Created2Cell - Extended CREATED cell. (section 5.1)
|
|- PaddingCell - Padding negotiation. (section 7.2)
|- VersionsCell - Negotiate proto version. (section 4)
|- NetinfoCell - Time and address info. (section 4.5)
|- PaddingNegotiateCell - Padding negotiation. (section 7.2)
|- VPaddingCell - Variable-length padding. (section 7.2)
|- CertsCell - Relay certificates. (section 4.2)
|- AuthChallengeCell - Challenge value. (section 4.3)
|- AuthenticateCell - Client authentication. (section 4.5)
|- AuthorizeCell - Client authorization. (not yet used)
|
|- pack - encodes cell into bytes
|- unpack - decodes series of cells
+- pop - decodes cell with remainder
"""
import copy
import datetime
import inspect
import os
import sys
import stem.util
from stem import UNDEFINED
from stem.client.datatype import HASH_LEN, ZERO, LinkProtocol, Address, Certificate, CloseReason, RelayCommand, Size, split
from stem.util import datetime_to_unix, str_tools
FIXED_PAYLOAD_LEN = 509 # PAYLOAD_LEN, per tor-spec section 0.2
AUTH_CHALLENGE_SIZE = 32
CELL_TYPE_SIZE = Size.CHAR
PAYLOAD_LEN_SIZE = Size.SHORT
RELAY_DIGEST_SIZE = Size.LONG
STREAM_ID_REQUIRED = (
RelayCommand.BEGIN,
RelayCommand.DATA,
RelayCommand.END,
RelayCommand.CONNECTED,
RelayCommand.RESOLVE,
RelayCommand.RESOLVED,
RelayCommand.BEGIN_DIR,
)
STREAM_ID_DISALLOWED = (
RelayCommand.EXTEND,
RelayCommand.EXTENDED,
RelayCommand.TRUNCATE,
RelayCommand.TRUNCATED,
RelayCommand.DROP,
RelayCommand.EXTEND2,
RelayCommand.EXTENDED2,
)
class Cell(object):
"""
Metadata for ORPort cells.
Unused padding are **not** used in equality checks or hashing. If two cells
differ only in their *unused* attribute they are functionally equal.
The following cell types explicitly don't have *unused* content:
* PaddingCell (we consider all content part of payload)
* VersionsCell (all content is unpacked and treated as a version specification)
* VPaddingCell (we consider all content part of payload)
:var bytes unused: unused filler that padded the cell to the expected size
"""
NAME = 'UNKNOWN'
VALUE = -1
IS_FIXED_SIZE = False
def __init__(self, unused = b''):
super(Cell, self).__init__()
self.unused = unused
@staticmethod
def by_name(name):
"""
Provides cell attributes by its name.
:param str name: cell command to fetch
:raises: **ValueError** if cell type is invalid
"""
for _, cls in inspect.getmembers(sys.modules[__name__]):
if name == getattr(cls, 'NAME', UNDEFINED):
return cls
raise ValueError("'%s' isn't a valid cell type" % name)
@staticmethod
def by_value(value):
"""
Provides cell attributes by its value.
:param int value: cell value to fetch
:raises: **ValueError** if cell type is invalid
"""
for _, cls in inspect.getmembers(sys.modules[__name__]):
if value == getattr(cls, 'VALUE', UNDEFINED):
return cls
raise ValueError("'%s' isn't a valid cell value" % value)
def pack(self, link_protocol):
raise NotImplementedError('Packing not yet implemented for %s cells' % type(self).NAME)
@staticmethod
def unpack(content, link_protocol):
"""
Unpacks all cells from a response.
:param bytes content: payload to decode
:param int link_protocol: link protocol version
:returns: :class:`~stem.client.cell.Cell` generator
:raises:
* ValueError if content is malformed
* NotImplementedError if unable to unpack any of the cell types
"""
while content:
cell, content = Cell.pop(content, link_protocol)
yield cell
@staticmethod
def pop(content, link_protocol):
"""
Unpacks the first cell.
:param bytes content: payload to decode
:param int link_protocol: link protocol version
:returns: (:class:`~stem.client.cell.Cell`, remainder) tuple
:raises:
* ValueError if content is malformed
* NotImplementedError if unable to unpack this cell type
"""
link_protocol = LinkProtocol(link_protocol)
circ_id, content = link_protocol.circ_id_size.pop(content)
command, content = CELL_TYPE_SIZE.pop(content)
cls = Cell.by_value(command)
if cls.IS_FIXED_SIZE:
payload_len = FIXED_PAYLOAD_LEN
else:
payload_len, content = PAYLOAD_LEN_SIZE.pop(content)
if len(content) < payload_len:
raise ValueError('%s cell should have a payload of %i bytes, but only had %i' % (cls.NAME, payload_len, len(content)))
payload, content = split(content, payload_len)
return cls._unpack(payload, circ_id, link_protocol), content
@classmethod
def _pack(cls, link_protocol, payload, unused = b'', circ_id = None):
"""
Provides bytes that can be used on the wire for these cell attributes.
Format of a properly packed cell depends on if it's fixed or variable
sized...
::
Fixed: [ CircuitID ][ Command ][ Payload ][ Padding ]
Variable: [ CircuitID ][ Command ][ Size ][ Payload ]
:param str name: cell command
:param int link_protocol: link protocol version
:param bytes payload: cell payload
:param int circ_id: circuit id, if a CircuitCell
:returns: **bytes** with the encoded payload
:raises: **ValueError** if cell type invalid or payload makes cell too large
"""
if issubclass(cls, CircuitCell):
if circ_id is None:
raise ValueError('%s cells require a circuit identifier' % cls.NAME)
elif circ_id < 1:
raise ValueError('Circuit identifiers must a positive integer, not %s' % circ_id)
else:
if circ_id is not None:
raise ValueError('%s cells should not specify a circuit identifier' % cls.NAME)
circ_id = 0 # cell doesn't concern a circuit, default field to zero
link_protocol = LinkProtocol(link_protocol)
cell = bytearray()
cell += link_protocol.circ_id_size.pack(circ_id)
cell += Size.CHAR.pack(cls.VALUE)
cell += b'' if cls.IS_FIXED_SIZE else Size.SHORT.pack(len(payload) + len(unused))
cell += payload
# include the unused portion (typically from unpacking)
cell += unused
# pad fixed sized cells to the required length
if cls.IS_FIXED_SIZE:
if len(cell) > link_protocol.fixed_cell_length:
raise ValueError('Cell of type %s is too large (%i bytes), must not be more than %i. Check payload size (was %i bytes)' % (cls.NAME, len(cell), link_protocol.fixed_cell_length, len(payload)))
cell += ZERO * (link_protocol.fixed_cell_length - len(cell))
return bytes(cell)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
"""
Subclass implementation for unpacking cell content.
:param bytes content: payload to decode
:param stem.client.datatype.LinkProtocol link_protocol: link protocol version
:param int circ_id: circuit id cell is for
:returns: instance of this cell type
:raises: **ValueError** if content is malformed
"""
raise NotImplementedError('Unpacking not yet implemented for %s cells' % cls.NAME)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Cell) else False
def __ne__(self, other):
return not self == other
class CircuitCell(Cell):
"""
Cell concerning circuits.
:var int circ_id: circuit id
"""
def __init__(self, circ_id, unused = b''):
super(CircuitCell, self).__init__(unused)
self.circ_id = circ_id
class PaddingCell(Cell):
"""
Randomized content to either keep activity going on a circuit.
:var bytes payload: randomized payload
"""
NAME = 'PADDING'
VALUE = 0
IS_FIXED_SIZE = True
def __init__(self, payload = None):
if not payload:
payload = os.urandom(FIXED_PAYLOAD_LEN)
elif len(payload) != FIXED_PAYLOAD_LEN:
raise ValueError('Padding payload should be %i bytes, but was %i' % (FIXED_PAYLOAD_LEN, len(payload)))
super(PaddingCell, self).__init__()
self.payload = payload
def pack(self, link_protocol):
return PaddingCell._pack(link_protocol, self.payload)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
return PaddingCell(content)
def __hash__(self):
return stem.util._hash_attr(self, 'payload', cache = True)
class CreateCell(CircuitCell):
NAME = 'CREATE'
VALUE = 1
IS_FIXED_SIZE = True
def __init__(self):
super(CreateCell, self).__init__() # TODO: implement
class CreatedCell(CircuitCell):
NAME = 'CREATED'
VALUE = 2
IS_FIXED_SIZE = True
def __init__(self):
super(CreatedCell, self).__init__() # TODO: implement
class RelayCell(CircuitCell):
"""
Command concerning a relay circuit.
Our 'recognized' attribute provides a cheap (but incomplete) check for if our
cell payload is encrypted. If non-zero our payload *IS* encrypted, but if
zero we're *PROBABLY* fully decrypted. This uncertainty is because encrypted
cells have a small chance of coincidently producing zero for this value as
well.
:var stem.client.RelayCommand command: command to be issued
:var int command_int: integer value of our command
:var bytes data: payload of the cell
:var int recognized: non-zero if payload is encrypted
:var int digest: running digest held with the relay
:var int stream_id: specific stream this concerns
"""
NAME = 'RELAY'
VALUE = 3
IS_FIXED_SIZE = True
def __init__(self, circ_id, command, data, digest = 0, stream_id = 0, recognized = 0, unused = b''):
if 'hash' in str(type(digest)).lower():
# Unfortunately hashlib generates from a dynamic private class so
# isinstance() isn't such a great option. With python2/python3 the
# name is 'hashlib.HASH' whereas PyPy calls it just 'HASH' or 'Hash'.
digest_packed = digest.digest()[:RELAY_DIGEST_SIZE.size]
digest = RELAY_DIGEST_SIZE.unpack(digest_packed)
elif stem.util._is_str(digest):
digest_packed = digest[:RELAY_DIGEST_SIZE.size]
digest = RELAY_DIGEST_SIZE.unpack(digest_packed)
elif stem.util._is_int(digest):
pass
else:
raise ValueError('RELAY cell digest must be a hash, string, or int but was a %s' % type(digest).__name__)
super(RelayCell, self).__init__(circ_id, unused)
self.command, self.command_int = RelayCommand.get(command)
self.recognized = recognized
self.stream_id = stream_id
self.digest = digest
self.data = str_tools._to_bytes(data)
if digest == 0:
if not stream_id and self.command in STREAM_ID_REQUIRED:
raise ValueError('%s relay cells require a stream id' % self.command)
elif stream_id and self.command in STREAM_ID_DISALLOWED:
raise ValueError('%s relay cells concern the circuit itself and cannot have a stream id' % self.command)
def pack(self, link_protocol):
payload = bytearray()
payload += Size.CHAR.pack(self.command_int)
payload += Size.SHORT.pack(self.recognized)
payload += Size.SHORT.pack(self.stream_id)
payload += Size.LONG.pack(self.digest)
payload += Size.SHORT.pack(len(self.data))
payload += self.data
return RelayCell._pack(link_protocol, bytes(payload), self.unused, self.circ_id)
@staticmethod
def decrypt(link_protocol, content, key, digest):
"""
Decrypts content as a relay cell addressed to us. This provides back a
tuple of the form...
::
(cell (RelayCell), new_key (CipherContext), new_digest (HASH))
:param int link_protocol: link protocol version
:param bytes content: cell content to be decrypted
:param cryptography.hazmat.primitives.ciphers.CipherContext key:
key established with the relay we received this cell from
:param hashlib.HASH digest: running digest held with the relay
:returns: **tuple** with our decrypted cell and updated key/digest
:raises: :class:`stem.ProtocolError` if content doesn't belong to a relay
cell
"""
new_key = copy.copy(key)
new_digest = digest.copy()
if len(content) != link_protocol.fixed_cell_length:
raise stem.ProtocolError('RELAY cells should be %i bytes, but received %i' % (link_protocol.fixed_cell_length, len(content)))
circ_id, content = link_protocol.circ_id_size.pop(content)
command, encrypted_payload = Size.CHAR.pop(content)
if command != RelayCell.VALUE:
raise stem.ProtocolError('Cannot decrypt as a RELAY cell. This had command %i instead.' % command)
payload = new_key.update(encrypted_payload)
cell = RelayCell._unpack(payload, circ_id, link_protocol)
# TODO: Implement our decryption digest. It is used to support relaying
# within multi-hop circuits. On first glance this should go something
# like...
#
# # Our updated digest is calculated based on this cell with a blanked
# # digest field.
#
# digest_cell = RelayCell(self.circ_id, self.command, self.data, 0, self.stream_id, self.recognized, self.unused)
# new_digest.update(digest_cell.pack(link_protocol))
#
# is_encrypted == cell.recognized != 0 or self.digest == new_digest
#
# ... or something like that. Until we attempt to support relaying this is
# both moot and difficult to exercise in order to ensure we get it right.
return cell, new_key, new_digest
def encrypt(self, link_protocol, key, digest):
"""
Encrypts our cell content to be sent with the given key. This provides back
a tuple of the form...
::
(payload (bytes), new_key (CipherContext), new_digest (HASH))
:param int link_protocol: link protocol version
:param cryptography.hazmat.primitives.ciphers.CipherContext key:
key established with the relay we're sending this cell to
:param hashlib.HASH digest: running digest held with the relay
:returns: **tuple** with our encrypted payload and updated key/digest
"""
new_key = copy.copy(key)
new_digest = digest.copy()
# Digests are computed from our payload, not including our header's circuit
# id (2 or 4 bytes) and command (1 byte).
header_size = link_protocol.circ_id_size.size + 1
payload_without_digest = self.pack(link_protocol)[header_size:]
new_digest.update(payload_without_digest)
# Pack a copy of ourselves with our newly calculated digest, and encrypt
# the payload. Header remains plaintext.
cell = RelayCell(self.circ_id, self.command, self.data, new_digest, self.stream_id, self.recognized, self.unused)
header, payload = split(cell.pack(link_protocol), header_size)
return header + new_key.update(payload), new_key, new_digest
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
command, content = Size.CHAR.pop(content)
recognized, content = Size.SHORT.pop(content) # 'recognized' field
stream_id, content = Size.SHORT.pop(content)
digest, content = Size.LONG.pop(content)
data_len, content = Size.SHORT.pop(content)
data, unused = split(content, data_len)
if len(data) != data_len:
raise ValueError('%s cell said it had %i bytes of data, but only had %i' % (cls.NAME, data_len, len(data)))
return RelayCell(circ_id, command, data, digest, stream_id, recognized, unused)
def __hash__(self):
return stem.util._hash_attr(self, 'command_int', 'stream_id', 'digest', 'data', cache = True)
class DestroyCell(CircuitCell):
"""
Closes the given circuit.
:var stem.client.CloseReason reason: reason the circuit is being closed
:var int reason_int: integer value of our closure reason
"""
NAME = 'DESTROY'
VALUE = 4
IS_FIXED_SIZE = True
def __init__(self, circ_id, reason = CloseReason.NONE, unused = b''):
super(DestroyCell, self).__init__(circ_id, unused)
self.reason, self.reason_int = CloseReason.get(reason)
def pack(self, link_protocol):
return DestroyCell._pack(link_protocol, Size.CHAR.pack(self.reason_int), self.unused, self.circ_id)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
reason, unused = Size.CHAR.pop(content)
return DestroyCell(circ_id, reason, unused)
def __hash__(self):
return stem.util._hash_attr(self, 'circ_id', 'reason_int', cache = True)
class CreateFastCell(CircuitCell):
"""
Create a circuit with our first hop. This is lighter weight than further hops
because we've already established the relay's identity and secret key.
:var bytes key_material: randomized key material
"""
NAME = 'CREATE_FAST'
VALUE = 5
IS_FIXED_SIZE = True
def __init__(self, circ_id, key_material = None, unused = b''):
if not key_material:
key_material = os.urandom(HASH_LEN)
elif len(key_material) != HASH_LEN:
raise ValueError('Key material should be %i bytes, but was %i' % (HASH_LEN, len(key_material)))
super(CreateFastCell, self).__init__(circ_id, unused)
self.key_material = key_material
def pack(self, link_protocol):
return CreateFastCell._pack(link_protocol, self.key_material, self.unused, self.circ_id)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
key_material, unused = split(content, HASH_LEN)
if len(key_material) != HASH_LEN:
raise ValueError('Key material should be %i bytes, but was %i' % (HASH_LEN, len(key_material)))
return CreateFastCell(circ_id, key_material, unused)
def __hash__(self):
return stem.util._hash_attr(self, 'circ_id', 'key_material', cache = True)
class CreatedFastCell(CircuitCell):
"""
CREATE_FAST reply.
:var bytes key_material: randomized key material
:var bytes derivative_key: hash proving the relay knows our shared key
"""
NAME = 'CREATED_FAST'
VALUE = 6
IS_FIXED_SIZE = True
def __init__(self, circ_id, derivative_key, key_material = None, unused = b''):
if not key_material:
key_material = os.urandom(HASH_LEN)
elif len(key_material) != HASH_LEN:
raise ValueError('Key material should be %i bytes, but was %i' % (HASH_LEN, len(key_material)))
if len(derivative_key) != HASH_LEN:
raise ValueError('Derivatived key should be %i bytes, but was %i' % (HASH_LEN, len(derivative_key)))
super(CreatedFastCell, self).__init__(circ_id, unused)
self.key_material = key_material
self.derivative_key = derivative_key
def pack(self, link_protocol):
return CreatedFastCell._pack(link_protocol, self.key_material + self.derivative_key, self.unused, self.circ_id)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
if len(content) < HASH_LEN * 2:
raise ValueError('Key material and derivatived key should be %i bytes, but was %i' % (HASH_LEN * 2, len(content)))
key_material, content = split(content, HASH_LEN)
derivative_key, content = split(content, HASH_LEN)
return CreatedFastCell(circ_id, derivative_key, key_material, content)
def __hash__(self):
return stem.util._hash_attr(self, 'circ_id', 'derivative_key', 'key_material', cache = True)
class VersionsCell(Cell):
"""
Link version negotiation cell.
:var list versions: link versions
"""
NAME = 'VERSIONS'
VALUE = 7
IS_FIXED_SIZE = False
def __init__(self, versions):
super(VersionsCell, self).__init__()
self.versions = versions
def pack(self, link_protocol):
payload = b''.join([Size.SHORT.pack(v) for v in self.versions])
return VersionsCell._pack(link_protocol, payload)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
link_protocols = []
while content:
version, content = Size.SHORT.pop(content)
link_protocols.append(version)
return VersionsCell(link_protocols)
def __hash__(self):
return stem.util._hash_attr(self, 'versions', cache = True)
class NetinfoCell(Cell):
"""
Information relays exchange about each other.
:var datetime timestamp: current time
:var stem.client.datatype.Address receiver_address: receiver's OR address
:var list sender_addresses: sender's OR addresses
"""
NAME = 'NETINFO'
VALUE = 8
IS_FIXED_SIZE = True
def __init__(self, receiver_address, sender_addresses, timestamp = None, unused = b''):
super(NetinfoCell, self).__init__(unused)
self.timestamp = timestamp if timestamp else datetime.datetime.now()
self.receiver_address = receiver_address
self.sender_addresses = sender_addresses
def pack(self, link_protocol):
payload = bytearray()
payload += Size.LONG.pack(int(datetime_to_unix(self.timestamp)))
payload += self.receiver_address.pack()
payload += Size.CHAR.pack(len(self.sender_addresses))
for addr in self.sender_addresses:
payload += addr.pack()
return NetinfoCell._pack(link_protocol, bytes(payload), self.unused)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
timestamp, content = Size.LONG.pop(content)
receiver_address, content = Address.pop(content)
sender_addresses = []
sender_addr_count, content = Size.CHAR.pop(content)
for i in range(sender_addr_count):
addr, content = Address.pop(content)
sender_addresses.append(addr)
return NetinfoCell(receiver_address, sender_addresses, datetime.datetime.utcfromtimestamp(timestamp), unused = content)
def __hash__(self):
return stem.util._hash_attr(self, 'timestamp', 'receiver_address', 'sender_addresses', cache = True)
class RelayEarlyCell(CircuitCell):
NAME = 'RELAY_EARLY'
VALUE = 9
IS_FIXED_SIZE = True
def __init__(self):
super(RelayEarlyCell, self).__init__() # TODO: implement
class Create2Cell(CircuitCell):
NAME = 'CREATE2'
VALUE = 10
IS_FIXED_SIZE = True
def __init__(self):
super(Create2Cell, self).__init__() # TODO: implement
class Created2Cell(Cell):
NAME = 'CREATED2'
VALUE = 11
IS_FIXED_SIZE = True
def __init__(self):
super(Created2Cell, self).__init__() # TODO: implement
class PaddingNegotiateCell(Cell):
NAME = 'PADDING_NEGOTIATE'
VALUE = 12
IS_FIXED_SIZE = True
def __init__(self):
super(PaddingNegotiateCell, self).__init__() # TODO: implement
class VPaddingCell(Cell):
"""
Variable length randomized content to either keep activity going on a circuit.
:var bytes payload: randomized payload
"""
NAME = 'VPADDING'
VALUE = 128
IS_FIXED_SIZE = False
def __init__(self, size = None, payload = None):
if size is None and payload is None:
raise ValueError('VPaddingCell constructor must specify payload or size')
elif size is not None and size < 0:
raise ValueError('VPaddingCell size (%s) cannot be negative' % size)
elif size is not None and payload is not None and size != len(payload):
raise ValueError('VPaddingCell constructor specified both a size of %i bytes and payload of %i bytes' % (size, len(payload)))
super(VPaddingCell, self).__init__()
self.payload = payload if payload is not None else os.urandom(size)
def pack(self, link_protocol):
return VPaddingCell._pack(link_protocol, self.payload)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
return VPaddingCell(payload = content)
def __hash__(self):
return stem.util._hash_attr(self, 'payload', cache = True)
class CertsCell(Cell):
"""
Certificate held by the relay we're communicating with.
:var list certificates: :class:`~stem.client.Certificate` of the relay
"""
NAME = 'CERTS'
VALUE = 129
IS_FIXED_SIZE = False
def __init__(self, certs, unused = b''):
super(CertsCell, self).__init__(unused)
self.certificates = certs
def pack(self, link_protocol):
return CertsCell._pack(link_protocol, Size.CHAR.pack(len(self.certificates)) + b''.join([cert.pack() for cert in self.certificates]), self.unused)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
cert_count, content = Size.CHAR.pop(content)
certs = []
for i in range(cert_count):
if not content:
raise ValueError('CERTS cell indicates it should have %i certificates, but only contained %i' % (cert_count, len(certs)))
cert, content = Certificate.pop(content)
certs.append(cert)
return CertsCell(certs, unused = content)
def __hash__(self):
return stem.util._hash_attr(self, 'certificates', cache = True)
class AuthChallengeCell(Cell):
"""
First step of the authentication handshake.
:var bytes challenge: random bytes for us to sign to authenticate
:var list methods: authentication methods supported by the relay we're
communicating with
"""
NAME = 'AUTH_CHALLENGE'
VALUE = 130
IS_FIXED_SIZE = False
def __init__(self, methods, challenge = None, unused = b''):
if not challenge:
challenge = os.urandom(AUTH_CHALLENGE_SIZE)
elif len(challenge) != AUTH_CHALLENGE_SIZE:
raise ValueError('AUTH_CHALLENGE must be %i bytes, but was %i' % (AUTH_CHALLENGE_SIZE, len(challenge)))
super(AuthChallengeCell, self).__init__(unused)
self.challenge = challenge
self.methods = methods
def pack(self, link_protocol):
payload = bytearray()
payload += self.challenge
payload += Size.SHORT.pack(len(self.methods))
for method in self.methods:
payload += Size.SHORT.pack(method)
return AuthChallengeCell._pack(link_protocol, bytes(payload), self.unused)
@classmethod
def _unpack(cls, content, circ_id, link_protocol):
min_size = AUTH_CHALLENGE_SIZE + Size.SHORT.size
if len(content) < min_size:
raise ValueError('AUTH_CHALLENGE payload should be at least %i bytes, but was %i' % (min_size, len(content)))
challenge, content = split(content, AUTH_CHALLENGE_SIZE)
method_count, content = Size.SHORT.pop(content)
if len(content) < method_count * Size.SHORT.size:
raise ValueError('AUTH_CHALLENGE should have %i methods, but only had %i bytes for it' % (method_count, len(content)))
methods = []
for i in range(method_count):
method, content = Size.SHORT.pop(content)
methods.append(method)
return AuthChallengeCell(methods, challenge, unused = content)
def __hash__(self):
return stem.util._hash_attr(self, 'challenge', 'methods', cache = True)
class AuthenticateCell(Cell):
NAME = 'AUTHENTICATE'
VALUE = 131
IS_FIXED_SIZE = False
def __init__(self):
super(AuthenticateCell, self).__init__() # TODO: implement
class AuthorizeCell(Cell):
NAME = 'AUTHORIZE'
VALUE = 132
IS_FIXED_SIZE = False
def __init__(self):
super(AuthorizeCell, self).__init__() # TODO: implement
stem-1.8.0/stem/interpreter/ 0000775 0001750 0001750 00000000000 13602232262 016523 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/interpreter/help.py 0000664 0001750 0001750 00000007303 13501272761 020036 0 ustar atagar atagar 0000000 0000000 # Copyright 2014-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Provides our /help responses.
"""
import stem.prereq
from stem.interpreter import (
STANDARD_OUTPUT,
BOLD_OUTPUT,
ERROR_OUTPUT,
msg,
uses_settings,
)
from stem.util.term import format
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
def response(controller, arg):
"""
Provides our /help response.
:param stem.control.Controller controller: tor control connection
:param str arg: controller or interpreter command to provide help output for
:returns: **str** with our help response
"""
# Normalizing inputs first so we can better cache responses.
return _response(controller, _normalize(arg))
def _normalize(arg):
arg = arg.upper()
# If there's multiple arguments then just take the first. This is
# particularly likely if they're trying to query a full command (for
# instance "/help GETINFO version")
arg = arg.split(' ')[0]
# strip slash if someone enters an interpreter command (ex. "/help /help")
if arg.startswith('/'):
arg = arg[1:]
return arg
@lru_cache()
@uses_settings
def _response(controller, arg, config):
if not arg:
return _general_help()
usage_info = config.get('help.usage', {})
if arg not in usage_info:
return format("No help information available for '%s'..." % arg, *ERROR_OUTPUT)
output = format(usage_info[arg] + '\n', *BOLD_OUTPUT)
description = config.get('help.description.%s' % arg.lower(), '')
for line in description.splitlines():
output += format(' ' + line, *STANDARD_OUTPUT) + '\n'
output += '\n'
if arg == 'GETINFO':
results = controller.get_info('info/names', None)
if results:
for line in results.splitlines():
if ' -- ' in line:
opt, summary = line.split(' -- ', 1)
output += format('%-33s' % opt, *BOLD_OUTPUT)
output += format(' - %s' % summary, *STANDARD_OUTPUT) + '\n'
elif arg == 'GETCONF':
results = controller.get_info('config/names', None)
if results:
options = [opt.split(' ', 1)[0] for opt in results.splitlines()]
for i in range(0, len(options), 2):
line = ''
for entry in options[i:i + 2]:
line += '%-42s' % entry
output += format(line.rstrip(), *STANDARD_OUTPUT) + '\n'
elif arg == 'SIGNAL':
signal_options = config.get('help.signal.options', {})
for signal, summary in signal_options.items():
output += format('%-15s' % signal, *BOLD_OUTPUT)
output += format(' - %s' % summary, *STANDARD_OUTPUT) + '\n'
elif arg == 'SETEVENTS':
results = controller.get_info('events/names', None)
if results:
entries = results.split()
# displays four columns of 20 characters
for i in range(0, len(entries), 4):
line = ''
for entry in entries[i:i + 4]:
line += '%-20s' % entry
output += format(line.rstrip(), *STANDARD_OUTPUT) + '\n'
elif arg == 'USEFEATURE':
results = controller.get_info('features/names', None)
if results:
output += format(results, *STANDARD_OUTPUT) + '\n'
elif arg in ('LOADCONF', 'POSTDESCRIPTOR'):
# gives a warning that this option isn't yet implemented
output += format(msg('msg.multiline_unimplemented_notice'), *ERROR_OUTPUT) + '\n'
return output.rstrip()
def _general_help():
lines = []
for line in msg('help.general').splitlines():
div = line.find(' - ')
if div != -1:
cmd, description = line[:div], line[div:]
lines.append(format(cmd, *BOLD_OUTPUT) + format(description, *STANDARD_OUTPUT))
else:
lines.append(format(line, *BOLD_OUTPUT))
return '\n'.join(lines)
stem-1.8.0/stem/interpreter/arguments.py 0000664 0001750 0001750 00000005365 13501272761 021121 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Commandline argument parsing for our interpreter prompt.
"""
import collections
import getopt
import os
import stem.interpreter
import stem.util.connection
DEFAULT_ARGS = {
'control_address': '127.0.0.1',
'control_port': 'default',
'user_provided_port': False,
'control_socket': '/var/run/tor/control',
'user_provided_socket': False,
'tor_path': 'tor',
'run_cmd': None,
'run_path': None,
'disable_color': False,
'print_help': False,
}
OPT = 'i:s:h'
OPT_EXPANDED = ['interface=', 'socket=', 'tor=', 'run=', 'no-color', 'help']
def parse(argv):
"""
Parses our arguments, providing a named tuple with their values.
:param list argv: input arguments to be parsed
:returns: a **named tuple** with our parsed arguments
:raises: **ValueError** if we got an invalid argument
"""
args = dict(DEFAULT_ARGS)
try:
recognized_args, unrecognized_args = getopt.getopt(argv, OPT, OPT_EXPANDED)
if unrecognized_args:
error_msg = "aren't recognized arguments" if len(unrecognized_args) > 1 else "isn't a recognized argument"
raise getopt.GetoptError("'%s' %s" % ("', '".join(unrecognized_args), error_msg))
except Exception as exc:
raise ValueError('%s (for usage provide --help)' % exc)
for opt, arg in recognized_args:
if opt in ('-i', '--interface'):
if ':' in arg:
address, port = arg.rsplit(':', 1)
else:
address, port = None, arg
if address is not None:
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError("'%s' isn't a valid IPv4 address" % address)
args['control_address'] = address
if not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port number" % port)
args['control_port'] = int(port)
args['user_provided_port'] = True
elif opt in ('-s', '--socket'):
args['control_socket'] = arg
args['user_provided_socket'] = True
elif opt in ('--tor'):
args['tor_path'] = arg
elif opt in ('--run'):
if os.path.exists(arg):
args['run_path'] = arg
else:
args['run_cmd'] = arg
elif opt == '--no-color':
args['disable_color'] = True
elif opt in ('-h', '--help'):
args['print_help'] = True
# translates our args dict into a named tuple
Args = collections.namedtuple('Args', args.keys())
return Args(**args)
def get_help():
"""
Provides our --help usage information.
:returns: **str** with our usage information
"""
return stem.interpreter.msg(
'msg.help',
address = DEFAULT_ARGS['control_address'],
port = DEFAULT_ARGS['control_port'],
socket = DEFAULT_ARGS['control_socket'],
)
stem-1.8.0/stem/interpreter/commands.py 0000664 0001750 0001750 00000027545 13501272761 020721 0 ustar atagar atagar 0000000 0000000 # Copyright 2014-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Handles making requests and formatting the responses.
"""
import code
import contextlib
import socket
import sys
import stem
import stem.control
import stem.descriptor.remote
import stem.interpreter.help
import stem.util.connection
import stem.util.str_tools
import stem.util.tor_tools
from stem.interpreter import STANDARD_OUTPUT, BOLD_OUTPUT, ERROR_OUTPUT, uses_settings, msg
from stem.util.term import format
try:
from cStringIO import StringIO
except ImportError:
from io import StringIO
MAX_EVENTS = 100
def _get_fingerprint(arg, controller):
"""
Resolves user input into a relay fingerprint. This accepts...
* Fingerprints
* Nicknames
* IPv4 addresses, either with or without an ORPort
* Empty input, which is resolved to ourselves if we're a relay
:param str arg: input to be resolved to a relay fingerprint
:param stem.control.Controller controller: tor control connection
:returns: **str** for the relay fingerprint
:raises: **ValueError** if we're unable to resolve the input to a relay
"""
if not arg:
try:
return controller.get_info('fingerprint')
except:
raise ValueError("We aren't a relay, no information to provide")
elif stem.util.tor_tools.is_valid_fingerprint(arg):
return arg
elif stem.util.tor_tools.is_valid_nickname(arg):
try:
return controller.get_network_status(arg).fingerprint
except:
raise ValueError("Unable to find a relay with the nickname of '%s'" % arg)
elif ':' in arg or stem.util.connection.is_valid_ipv4_address(arg):
if ':' in arg:
address, port = arg.rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError("'%s' isn't a valid IPv4 address" % address)
elif port and not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port" % port)
port = int(port)
else:
address, port = arg, None
matches = {}
for desc in controller.get_network_statuses():
if desc.address == address:
if not port or desc.or_port == port:
matches[desc.or_port] = desc.fingerprint
if len(matches) == 0:
raise ValueError('No relays found at %s' % arg)
elif len(matches) == 1:
return list(matches.values())[0]
else:
response = "There's multiple relays at %s, include a port to specify which.\n\n" % arg
for i, or_port in enumerate(matches):
response += ' %i. %s:%s, fingerprint: %s\n' % (i + 1, address, or_port, matches[or_port])
raise ValueError(response)
else:
raise ValueError("'%s' isn't a fingerprint, nickname, or IP address" % arg)
@contextlib.contextmanager
def redirect(stdout, stderr):
original = sys.stdout, sys.stderr
sys.stdout, sys.stderr = stdout, stderr
try:
yield
finally:
sys.stdout, sys.stderr = original
class ControlInterpreter(code.InteractiveConsole):
"""
Handles issuing requests and providing nicely formed responses, with support
for special irc style subcommands.
"""
def __init__(self, controller):
self._received_events = []
code.InteractiveConsole.__init__(self, {
'stem': stem,
'stem.control': stem.control,
'controller': controller,
'events': self.get_events,
})
self._controller = controller
self._run_python_commands = True
# Indicates if we're processing a multiline command, such as conditional
# block or loop.
self.is_multiline_context = False
# Intercept events our controller hears about at a pretty low level since
# the user will likely be requesting them by direct 'SETEVENTS' calls.
handle_event_real = self._controller._handle_event
def handle_event_wrapper(event_message):
handle_event_real(event_message)
self._received_events.insert(0, event_message)
if len(self._received_events) > MAX_EVENTS:
self._received_events.pop()
self._controller._handle_event = handle_event_wrapper
def get_events(self, *event_types):
events = list(self._received_events)
event_types = list(map(str.upper, event_types)) # make filtering case insensitive
if event_types:
events = [e for e in events if e.type in event_types]
return events
def do_help(self, arg):
"""
Performs the '/help' operation, giving usage information for the given
argument or a general summary if there wasn't one.
"""
return stem.interpreter.help.response(self._controller, arg)
def do_events(self, arg):
"""
Performs the '/events' operation, dumping the events that we've received
belonging to the given types. If no types are specified then this provides
all buffered events.
If the user runs '/events clear' then this clears the list of events we've
received.
"""
event_types = arg.upper().split()
if 'CLEAR' in event_types:
del self._received_events[:]
return format('cleared event backlog', *STANDARD_OUTPUT)
return '\n'.join([format(str(e), *STANDARD_OUTPUT) for e in self.get_events(*event_types)])
def do_info(self, arg):
"""
Performs the '/info' operation, looking up a relay by fingerprint, IP
address, or nickname and printing its descriptor and consensus entries in a
pretty fashion.
"""
try:
fingerprint = _get_fingerprint(arg, self._controller)
except ValueError as exc:
return format(str(exc), *ERROR_OUTPUT)
ns_desc = self._controller.get_network_status(fingerprint, None)
server_desc = self._controller.get_server_descriptor(fingerprint, None)
extrainfo_desc = None
micro_desc = self._controller.get_microdescriptor(fingerprint, None)
# We'll mostly rely on the router status entry. Either the server
# descriptor or microdescriptor will be missing, so we'll treat them as
# being optional.
if not ns_desc:
return format('Unable to find consensus information for %s' % fingerprint, *ERROR_OUTPUT)
# More likely than not we'll have the microdescriptor but not server and
# extrainfo descriptors. If so then fetching them.
downloader = stem.descriptor.remote.DescriptorDownloader(timeout = 5)
server_desc_query = downloader.get_server_descriptors(fingerprint)
extrainfo_desc_query = downloader.get_extrainfo_descriptors(fingerprint)
for desc in server_desc_query:
server_desc = desc
for desc in extrainfo_desc_query:
extrainfo_desc = desc
address_extrainfo = []
try:
address_extrainfo.append(socket.gethostbyaddr(ns_desc.address)[0])
except:
pass
try:
address_extrainfo.append(self._controller.get_info('ip-to-country/%s' % ns_desc.address))
except:
pass
address_extrainfo_label = ' (%s)' % ', '.join(address_extrainfo) if address_extrainfo else ''
if server_desc:
exit_policy_label = str(server_desc.exit_policy)
elif micro_desc:
exit_policy_label = str(micro_desc.exit_policy)
else:
exit_policy_label = 'Unknown'
lines = [
'%s (%s)' % (ns_desc.nickname, fingerprint),
format('address: ', *BOLD_OUTPUT) + '%s:%s%s' % (ns_desc.address, ns_desc.or_port, address_extrainfo_label),
]
if server_desc:
lines.append(format('tor version: ', *BOLD_OUTPUT) + str(server_desc.tor_version))
lines.append(format('flags: ', *BOLD_OUTPUT) + ', '.join(ns_desc.flags))
lines.append(format('exit policy: ', *BOLD_OUTPUT) + exit_policy_label)
if server_desc and server_desc.contact:
contact = stem.util.str_tools._to_unicode(server_desc.contact)
# clears up some highly common obscuring
for alias in (' at ', ' AT '):
contact = contact.replace(alias, '@')
for alias in (' dot ', ' DOT '):
contact = contact.replace(alias, '.')
lines.append(format('contact: ', *BOLD_OUTPUT) + contact)
descriptor_section = [
('Server Descriptor:', server_desc),
('Extrainfo Descriptor:', extrainfo_desc),
('Microdescriptor:', micro_desc),
('Router Status Entry:', ns_desc),
]
div = format('-' * 80, *STANDARD_OUTPUT)
for label, desc in descriptor_section:
if desc:
lines += ['', div, format(label, *BOLD_OUTPUT), div, '']
lines += [format(l, *STANDARD_OUTPUT) for l in str(desc).splitlines()]
return '\n'.join(lines)
def do_python(self, arg):
"""
Performs the '/python' operation, toggling if we accept python commands or
not.
"""
if not arg:
status = 'enabled' if self._run_python_commands else 'disabled'
return format('Python support is currently %s.' % status, *STANDARD_OUTPUT)
elif arg.lower() == 'enable':
self._run_python_commands = True
elif arg.lower() == 'disable':
self._run_python_commands = False
else:
return format("'%s' is not recognized. Please run either '/python enable' or '/python disable'." % arg, *ERROR_OUTPUT)
if self._run_python_commands:
response = "Python support enabled, we'll now run non-interpreter commands as python."
else:
response = "Python support disabled, we'll now pass along all commands to tor."
return format(response, *STANDARD_OUTPUT)
@uses_settings
def run_command(self, command, config, print_response = False):
"""
Runs the given command. Requests starting with a '/' are special commands
to the interpreter, and anything else is sent to the control port.
:param stem.control.Controller controller: tor control connection
:param str command: command to be processed
:param bool print_response: prints the response to stdout if true
:returns: **list** out output lines, each line being a list of
(msg, format) tuples
:raises: **stem.SocketClosed** if the control connection has been severed
"""
# Commands fall into three categories:
#
# * Interpreter commands. These start with a '/'.
#
# * Controller commands stem knows how to handle. We use our Controller's
# methods for these to take advantage of caching and present nicer
# output.
#
# * Other tor commands. We pass these directly on to the control port.
cmd, arg = command.strip(), ''
if ' ' in cmd:
cmd, arg = cmd.split(' ', 1)
output = ''
if cmd.startswith('/'):
cmd = cmd.lower()
if cmd == '/quit':
raise stem.SocketClosed()
elif cmd == '/events':
output = self.do_events(arg)
elif cmd == '/info':
output = self.do_info(arg)
elif cmd == '/python':
output = self.do_python(arg)
elif cmd == '/help':
output = self.do_help(arg)
else:
output = format("'%s' isn't a recognized command" % command, *ERROR_OUTPUT)
else:
cmd = cmd.upper() # makes commands uppercase to match the spec
if cmd.replace('+', '') in ('LOADCONF', 'POSTDESCRIPTOR'):
# provides a notice that multi-line controller input isn't yet implemented
output = format(msg('msg.multiline_unimplemented_notice'), *ERROR_OUTPUT)
elif cmd == 'QUIT':
self._controller.msg(command)
raise stem.SocketClosed()
else:
is_tor_command = cmd in config.get('help.usage', {}) and cmd.lower() != 'events'
if self._run_python_commands and not is_tor_command:
console_output = StringIO()
with redirect(console_output, console_output):
self.is_multiline_context = code.InteractiveConsole.push(self, command)
output = console_output.getvalue().strip()
else:
try:
output = format(self._controller.msg(command).raw_content().strip(), *STANDARD_OUTPUT)
except stem.ControllerError as exc:
if isinstance(exc, stem.SocketClosed):
raise
else:
output = format(str(exc), *ERROR_OUTPUT)
if output:
output += '\n' # give ourselves an extra line before the next prompt
if print_response:
print(output)
return output
stem-1.8.0/stem/interpreter/__init__.py 0000664 0001750 0001750 00000013671 13501272761 020652 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Interactive interpreter for interacting with Tor directly. This adds usability
features such as tab completion, history, and IRC-style functions (like /help).
"""
import os
import sys
import stem
import stem.connection
import stem.prereq
import stem.process
import stem.util.conf
import stem.util.system
import stem.util.term
from stem.util.term import Attr, Color, format
__all__ = [
'arguments',
'autocomplete',
'commands',
'help',
]
PROMPT = format('>>> ', Color.GREEN, Attr.BOLD, Attr.READLINE_ESCAPE)
STANDARD_OUTPUT = (Color.BLUE, Attr.LINES)
BOLD_OUTPUT = (Color.BLUE, Attr.BOLD, Attr.LINES)
HEADER_OUTPUT = (Color.GREEN, Attr.LINES)
HEADER_BOLD_OUTPUT = (Color.GREEN, Attr.BOLD, Attr.LINES)
ERROR_OUTPUT = (Attr.BOLD, Color.RED, Attr.LINES)
settings_path = os.path.join(os.path.dirname(__file__), 'settings.cfg')
uses_settings = stem.util.conf.uses_settings('stem_interpreter', settings_path)
@uses_settings
def msg(message, config, **attr):
return config.get(message).format(**attr)
def main():
import readline
import stem.interpreter.arguments
import stem.interpreter.autocomplete
import stem.interpreter.commands
try:
args = stem.interpreter.arguments.parse(sys.argv[1:])
except ValueError as exc:
print(exc)
sys.exit(1)
if args.print_help:
print(stem.interpreter.arguments.get_help())
sys.exit()
if args.disable_color or not sys.stdout.isatty():
global PROMPT
stem.util.term.DISABLE_COLOR_SUPPORT = True
PROMPT = '>>> '
# If the user isn't connecting to something in particular then offer to start
# tor if it isn't running.
if not (args.user_provided_port or args.user_provided_socket):
is_tor_running = stem.util.system.is_running('tor') or stem.util.system.is_running('tor.real')
if not is_tor_running:
if args.tor_path == 'tor' and not stem.util.system.is_available('tor'):
print(format(msg('msg.tor_unavailable'), *ERROR_OUTPUT))
sys.exit(1)
else:
if not args.run_cmd and not args.run_path:
print(format(msg('msg.starting_tor'), *HEADER_OUTPUT))
control_port = '9051' if args.control_port == 'default' else str(args.control_port)
try:
stem.process.launch_tor_with_config(
config = {
'SocksPort': '0',
'ControlPort': control_port,
'CookieAuthentication': '1',
'ExitPolicy': 'reject *:*',
},
tor_cmd = args.tor_path,
completion_percent = 5,
take_ownership = True,
)
except OSError as exc:
print(format(msg('msg.unable_to_start_tor', error = exc), *ERROR_OUTPUT))
sys.exit(1)
control_port = (args.control_address, args.control_port)
control_socket = args.control_socket
# If the user explicitely specified an endpoint then just try to connect to
# that.
if args.user_provided_socket and not args.user_provided_port:
control_port = None
elif args.user_provided_port and not args.user_provided_socket:
control_socket = None
controller = stem.connection.connect(
control_port = control_port,
control_socket = control_socket,
password_prompt = True,
)
if controller is None:
sys.exit(1)
with controller:
interpreter = stem.interpreter.commands.ControlInterpreter(controller)
showed_close_confirmation = False
if args.run_cmd:
if args.run_cmd.upper().startswith('SETEVENTS '):
# TODO: we can use a lambda here when dropping python 2.x support, but
# until then print's status as a keyword prevents it from being used in
# lambdas
def handle_event(event_message):
print(format(str(event_message), *STANDARD_OUTPUT))
controller._handle_event = handle_event
if sys.stdout.isatty():
events = args.run_cmd.upper().split(' ', 1)[1]
print(format('Listening to %s events. Press any key to quit.\n' % events, *HEADER_BOLD_OUTPUT))
controller.msg(args.run_cmd)
try:
raw_input()
except (KeyboardInterrupt, stem.SocketClosed):
pass
else:
interpreter.run_command(args.run_cmd, print_response = True)
elif args.run_path:
try:
for line in open(args.run_path).readlines():
interpreter.run_command(line.strip(), print_response = True)
except IOError as exc:
print(format(msg('msg.unable_to_read_file', path = args.run_path, error = exc), *ERROR_OUTPUT))
sys.exit(1)
else:
autocompleter = stem.interpreter.autocomplete.Autocompleter(controller)
readline.parse_and_bind('tab: complete')
readline.set_completer(autocompleter.complete)
readline.set_completer_delims('\n')
for line in msg('msg.startup_banner').splitlines():
line_format = HEADER_BOLD_OUTPUT if line.startswith(' ') else HEADER_OUTPUT
print(format(line, *line_format))
print('')
while True:
try:
prompt = '... ' if interpreter.is_multiline_context else PROMPT
user_input = input(prompt) if stem.prereq.is_python_3() else raw_input(prompt)
interpreter.run_command(user_input, print_response = True)
except stem.SocketClosed:
if showed_close_confirmation:
print(format('Unable to run tor commands. The control connection has been closed.', *ERROR_OUTPUT))
else:
prompt = format("Tor's control port has closed. Do you want to continue this interpreter? (y/n) ", *HEADER_BOLD_OUTPUT)
user_input = input(prompt) if stem.prereq.is_python_3() else raw_input(prompt)
print('') # blank line
if user_input.lower() in ('y', 'yes'):
showed_close_confirmation = True
else:
break
except (KeyboardInterrupt, EOFError, stem.SocketClosed):
print('') # move cursor to the following line
break
stem-1.8.0/stem/interpreter/settings.cfg 0000664 0001750 0001750 00000030141 13501272761 021051 0 ustar atagar atagar 0000000 0000000 ################################################################################
#
# Configuration data used by Stem's interpreter prompt.
#
################################################################################
##################
# GENERAL MESSAGES #
##################
msg.multiline_unimplemented_notice Multi-line control options like this are not yet implemented.
msg.help
|Interactive interpreter for Tor. This provides you with direct access
|to Tor's control interface via either python or direct requests.
|
| -i, --interface [ADDRESS:]PORT change control interface from {address}:{port}
| -s, --socket SOCKET_PATH attach using unix domain socket if present,
| SOCKET_PATH defaults to: {socket}
| --tor PATH tor binary if tor isn't already running
| --run executes the given command or file of commands
| --no-color disables colorized output
| -h, --help presents this help
|
msg.startup_banner
|Welcome to Stem's interpreter prompt. This provides you with direct access to
|Tor's control interface.
|
|This acts like a standard python interpreter with a Tor connection available
|via your 'controller' variable...
|
| >>> controller.get_info('version')
| '0.2.5.1-alpha-dev (git-245ecfff36c0cecc)'
|
|You can also issue requests directly to Tor...
|
| >>> GETINFO version
| 250-version=0.2.5.1-alpha-dev (git-245ecfff36c0cecc)
| 250 OK
|
|For more information run '/help'.
|
msg.tor_unavailable Tor isn't running and the command currently isn't in your PATH.
msg.unable_to_start_tor Unable to start tor: {error}
msg.unable_to_read_file Unable to read {path}: {error}
msg.starting_tor
|Tor isn't running. Starting a temporary Tor instance for our interpreter to
|interact with. This will have a minimal non-relaying configuration, and be
|shut down when you're done.
|
|--------------------------------------------------------------------------------
|
#################
# OUTPUT OF /HELP #
#################
# Response for the '/help' command without any arguments.
help.general
|Interpreter commands include:
| /help - provides information for interpreter and tor commands
| /events - prints events that we've received
| /info - general information for a relay
| /python - enable or disable support for running python commands
| /quit - shuts down the interpreter
|
|Tor commands include:
| GETINFO - queries information from tor
| GETCONF, SETCONF, RESETCONF - show or edit a configuration option
| SIGNAL - issues control signal to the process (for resetting, stopping, etc)
| SETEVENTS - configures the events tor will notify us of
|
| USEFEATURE - enables custom behavior for the controller
| SAVECONF - writes tor's current configuration to our torrc
| LOADCONF - loads the given input like it was part of our torrc
| MAPADDRESS - replaces requests for one address with another
| POSTDESCRIPTOR - adds a relay descriptor to our cache
| EXTENDCIRCUIT - create or extend a tor circuit
| SETCIRCUITPURPOSE - configures the purpose associated with a circuit
| CLOSECIRCUIT - closes the given circuit
| ATTACHSTREAM - associates an application's stream with a tor circuit
| REDIRECTSTREAM - sets a stream's destination
| CLOSESTREAM - closes the given stream
| ADD_ONION - create a new hidden service
| DEL_ONION - delete a hidden service that was created with ADD_ONION
| HSFETCH - retrieve a hidden service descriptor, providing it in a HS_DESC_CONTENT event
| HSPOST - uploads a hidden service descriptor
| RESOLVE - issues an asynchronous dns or rdns request over tor
| TAKEOWNERSHIP - instructs tor to quit when this control connection is closed
| PROTOCOLINFO - queries version and controller authentication information
| QUIT - disconnect the control connection
|
|For more information use '/help [OPTION]'.
# Usage of tor and interpreter commands.
help.usage HELP => /help [OPTION]
help.usage EVENTS => /events [types]
help.usage INFO => /info [relay fingerprint, nickname, or IP address]
help.usage PYTHON => /python [enable,disable]
help.usage QUIT => /quit
help.usage GETINFO => GETINFO OPTION
help.usage GETCONF => GETCONF OPTION
help.usage SETCONF => SETCONF PARAM[=VALUE]
help.usage RESETCONF => RESETCONF PARAM[=VALUE]
help.usage SIGNAL => SIGNAL SIG
help.usage SETEVENTS => SETEVENTS [EXTENDED] [EVENTS]
help.usage USEFEATURE => USEFEATURE OPTION
help.usage SAVECONF => SAVECONF
help.usage LOADCONF => LOADCONF...
help.usage MAPADDRESS => MAPADDRESS SOURCE_ADDR=DESTINATION_ADDR
help.usage POSTDESCRIPTOR => POSTDESCRIPTOR [purpose=general/controller/bridge] [cache=yes/no]...
help.usage EXTENDCIRCUIT => EXTENDCIRCUIT CircuitID [PATH] [purpose=general/controller]
help.usage SETCIRCUITPURPOSE => SETCIRCUITPURPOSE CircuitID purpose=general/controller
help.usage CLOSECIRCUIT => CLOSECIRCUIT CircuitID [IfUnused]
help.usage ATTACHSTREAM => ATTACHSTREAM StreamID CircuitID [HOP=HopNum]
help.usage REDIRECTSTREAM => REDIRECTSTREAM StreamID Address [Port]
help.usage CLOSESTREAM => CLOSESTREAM StreamID Reason [Flag]
help.usage ADD_ONION => KeyType:KeyBlob [Flags=Flag] (Port=Port [,Target])...
help.usage DEL_ONION => ServiceID
help.usage HSFETCH => HSFETCH (HSAddress/v2-DescId) [SERVER=Server]...
help.usage HSPOST => [SERVER=Server] DESCRIPTOR
help.usage RESOLVE => RESOLVE [mode=reverse] address
help.usage TAKEOWNERSHIP => TAKEOWNERSHIP
help.usage PROTOCOLINFO => PROTOCOLINFO [ProtocolVersion]
# Longer description of what tor and interpreter commands do.
help.description.help
|Provides usage information for the given interpreter, tor command, or tor
|configuration option.
|
|Example:
| /help info # provides a description of the '/info' option
| /help GETINFO # usage information for tor's GETINFO controller option
help.description.events
|Provides events that we've received belonging to the given event types. If
|no types are specified then this provides all the messages that we've
|received.
|
|You can also run '/events clear' to clear the backlog of events we've
|received.
help.description.info
|Provides information for a relay that's currently in the consensus. If no
|relay is specified then this provides information on ourselves.
help.description.python
|Enables or disables support for running python commands. This determines how
|we treat commands this interpreter doesn't recognize...
|
|* If enabled then unrecognized commands are executed as python.
|* If disabled then unrecognized commands are passed along to tor.
help.description.quit
|Terminates the interpreter.
help.description.getinfo
|Queries the tor process for information. Options are...
|
help.description.getconf
|Provides the current value for a given configuration value. Options include...
|
help.description.setconf
|Sets the given configuration parameters. Values can be quoted or non-quoted
|strings, and reverts the option to 0 or NULL if not provided.
|
|Examples:
| * Sets a contact address and resets our family to NULL
| SETCONF MyFamily ContactInfo=foo@bar.com
|
| * Sets an exit policy that only includes port 80/443
| SETCONF ExitPolicy=\"accept *:80, accept *:443, reject *:*\"\
help.description.resetconf
|Reverts the given configuration options to their default values. If a value
|is provided then this behaves in the same way as SETCONF.
|
|Examples:
| * Returns both of our accounting parameters to their defaults
| RESETCONF AccountingMax AccountingStart
|
| * Uses the default exit policy and sets our nickname to be 'Goomba'
| RESETCONF ExitPolicy Nickname=Goomba
help.description.signal
|Issues a signal that tells the tor process to reload its torrc, dump its
|stats, halt, etc.
help.description.setevents
|Sets the events that we will receive. This turns off any events that aren't
|listed so sending 'SETEVENTS' without any values will turn off all event reporting.
|
|For Tor versions between 0.1.1.9 and 0.2.2.1 adding 'EXTENDED' causes some
|events to give us additional information. After version 0.2.2.1 this is
|always on.
|
|Events include...
|
help.description.usefeature
|Customizes the behavior of the control port. Options include...
|
help.description.saveconf
|Writes Tor's current configuration to its torrc.
help.description.loadconf
|Reads the given text like it belonged to our torrc.
|
|Example:
| +LOADCONF
| # sets our exit policy to just accept ports 80 and 443
| ExitPolicy accept *:80
| ExitPolicy accept *:443
| ExitPolicy reject *:*
| .
help.description.mapaddress
|Replaces future requests for one address with another.
|
|Example:
| MAPADDRESS 0.0.0.0=torproject.org 1.2.3.4=tor.freehaven.net
help.description.postdescriptor
|Simulates getting a new relay descriptor.
help.description.extendcircuit
|Extends the given circuit or create a new one if the CircuitID is zero. The
|PATH is a comma separated list of fingerprints. If it isn't set then this
|uses Tor's normal path selection.
help.description.setcircuitpurpose
|Sets the purpose attribute for a circuit.
help.description.closecircuit
|Closes the given circuit. If "IfUnused" is included then this only closes
|the circuit if it isn't currently being used.
help.description.attachstream
|Attaches a stream with the given built circuit (tor picks one on its own if
|CircuitID is zero). If HopNum is given then this hop is used to exit the
|circuit, otherwise the last relay is used.
help.description.redirectstream
|Sets the destination for a given stream. This can only be done after a
|stream is created but before it's attached to a circuit.
help.description.closestream
|Closes the given stream, the reason being an integer matching a reason as
|per section 6.3 of the tor-spec.
help.description.add_onion
|Creates a new hidden service. Unlike 'SETCONF HiddenServiceDir...' this
|doesn't persist the service to disk.
help.description.del_onion
|Delete a hidden service that was created with ADD_ONION.
help.description.hsfetch
|Retrieves the descriptor for a hidden service. This is an asynchronous
|request, with the descriptor provided by a HS_DESC_CONTENT event.
help.description.hspost
|Uploads a descriptor to a hidden service directory.
help.description.resolve
|Performs IPv4 DNS resolution over tor, doing a reverse lookup instead if
|"mode=reverse" is included. This request is processed in the background and
|results in a ADDRMAP event with the response.
help.description.takeownership
|Instructs Tor to gracefully shut down when this control connection is closed.
help.description.protocolinfo
|Provides bootstrapping information that a controller might need when first
|starting, like Tor's version and controller authentication. This can be done
|before authenticating to the control port.
help.signal.options RELOAD / HUP => reload our torrc
help.signal.options SHUTDOWN / INT => gracefully shut down, waiting 30 seconds if we're a relay
help.signal.options DUMP / USR1 => logs information about open connections and circuits
help.signal.options DEBUG / USR2 => makes us log at the DEBUG runlevel
help.signal.options HALT / TERM => immediately shut down
help.signal.options CLEARDNSCACHE => clears any cached DNS results
help.signal.options NEWNYM => clears the DNS cache and uses new circuits for future connections
################
# TAB COMPLETION #
################
# Commands we'll autocomplete when the user hits tab. This is just the start of
# our autocompletion list - more are determined dynamically by checking what
# tor supports.
autocomplete /help
autocomplete /events
autocomplete /info
autocomplete /quit
autocomplete SAVECONF
autocomplete MAPADDRESS
autocomplete EXTENDCIRCUIT
autocomplete SETCIRCUITPURPOSE
autocomplete SETROUTERPURPOSE
autocomplete ATTACHSTREAM
#autocomplete +POSTDESCRIPTOR # TODO: needs multi-line support
autocomplete REDIRECTSTREAM
autocomplete CLOSESTREAM
autocomplete CLOSECIRCUIT
autocomplete QUIT
autocomplete RESOLVE
autocomplete PROTOCOLINFO
#autocomplete +LOADCONF # TODO: needs multi-line support
autocomplete TAKEOWNERSHIP
autocomplete AUTHCHALLENGE
autocomplete DROPGUARDS
autocomplete ADD_ONION NEW:BEST
autocomplete ADD_ONION NEW:RSA1024
autocomplete ADD_ONION NEW:ED25519-V3
autocomplete ADD_ONION RSA1024:
autocomplete ADD_ONION ED25519-V3:
autocomplete DEL_ONION
autocomplete HSFETCH
autocomplete HSPOST
stem-1.8.0/stem/interpreter/autocomplete.py 0000664 0001750 0001750 00000005743 13501272761 021615 0 ustar atagar atagar 0000000 0000000 # Copyright 2014-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Tab completion for our interpreter prompt.
"""
import stem.prereq
from stem.interpreter import uses_settings
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
@uses_settings
def _get_commands(controller, config):
"""
Provides commands recognized by tor.
"""
commands = config.get('autocomplete', [])
if controller is None:
return commands
# GETINFO commands. Lines are of the form '[option] -- [description]'. This
# strips '*' from options that accept values.
results = controller.get_info('info/names', None)
if results:
for line in results.splitlines():
option = line.split(' ', 1)[0].rstrip('*')
commands.append('GETINFO %s' % option)
else:
commands.append('GETINFO ')
# GETCONF, SETCONF, and RESETCONF commands. Lines are of the form
# '[option] [type]'.
results = controller.get_info('config/names', None)
if results:
for line in results.splitlines():
option = line.split(' ', 1)[0]
commands.append('GETCONF %s' % option)
commands.append('SETCONF %s' % option)
commands.append('RESETCONF %s' % option)
else:
commands += ['GETCONF ', 'SETCONF ', 'RESETCONF ']
# SETEVENT, USEFEATURE, and SIGNAL commands. For each of these the GETINFO
# results are simply a space separated lists of the values they can have.
options = (
('SETEVENTS ', 'events/names'),
('USEFEATURE ', 'features/names'),
('SIGNAL ', 'signal/names'),
)
for prefix, getinfo_cmd in options:
results = controller.get_info(getinfo_cmd, None)
if results:
commands += [prefix + value for value in results.split()]
else:
commands.append(prefix)
# Adds /help commands.
usage_info = config.get('help.usage', {})
for cmd in usage_info.keys():
commands.append('/help ' + cmd)
return commands
class Autocompleter(object):
def __init__(self, controller):
self._commands = _get_commands(controller)
@lru_cache()
def matches(self, text):
"""
Provides autocompletion matches for the given text.
:param str text: text to check for autocompletion matches with
:returns: **list** with possible matches
"""
lowercase_text = text.lower()
return [cmd for cmd in self._commands if cmd.lower().startswith(lowercase_text)]
def complete(self, text, state):
"""
Provides case insensetive autocompletion options, acting as a functor for
the readlines set_completer function.
:param str text: text to check for autocompletion matches with
:param int state: index of result to be provided, readline fetches matches
until this function provides None
:returns: **str** with the autocompletion match, **None** if eithe none
exists or state is higher than our number of matches
"""
try:
return self.matches(text)[state]
except IndexError:
return None
stem-1.8.0/stem/cached_fallbacks.cfg 0000664 0001750 0001750 00000150027 13526063314 020064 0 ustar atagar atagar 0000000 0000000 tor_commit 1dd95278970f9f32d83a31fe73e0258a30523539
stem_commit ec67e06398d6bbbcefdc14b56d2e91bd49f47539
header.timestamp 20190625114911
header.source whitelist
header.version 2.0.0
header.timestamp0 20190625114911
header.timestamp1 20190628085927
header.type fallback
001524DD403D729F08F7E5D77813EF12756CFA8D.address 185.13.39.197
001524DD403D729F08F7E5D77813EF12756CFA8D.or_port 443
001524DD403D729F08F7E5D77813EF12756CFA8D.dir_port 80
001524DD403D729F08F7E5D77813EF12756CFA8D.nickname Neldoreth
001524DD403D729F08F7E5D77813EF12756CFA8D.has_extrainfo false
025B66CEBC070FCB0519D206CF0CF4965C20C96E.address 185.100.85.61
025B66CEBC070FCB0519D206CF0CF4965C20C96E.or_port 443
025B66CEBC070FCB0519D206CF0CF4965C20C96E.dir_port 80
025B66CEBC070FCB0519D206CF0CF4965C20C96E.nickname nibbana
025B66CEBC070FCB0519D206CF0CF4965C20C96E.has_extrainfo false
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.address 185.225.17.3
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.or_port 443
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.dir_port 80
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.nickname Nebuchadnezzar
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.has_extrainfo false
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.orport6_address 2a0a:c800:1:5::3
0338F9F55111FE8E3570E7DE117EF3AF999CC1D7.orport6_port 443
0B85617241252517E8ECF2CFC7F4C1A32DCD153F.address 163.172.149.155
0B85617241252517E8ECF2CFC7F4C1A32DCD153F.or_port 443
0B85617241252517E8ECF2CFC7F4C1A32DCD153F.dir_port 80
0B85617241252517E8ECF2CFC7F4C1A32DCD153F.nickname niij02
0B85617241252517E8ECF2CFC7F4C1A32DCD153F.has_extrainfo false
0C039F35C2E40DCB71CD8A07E97C7FD7787D42D6.address 5.200.21.144
0C039F35C2E40DCB71CD8A07E97C7FD7787D42D6.or_port 443
0C039F35C2E40DCB71CD8A07E97C7FD7787D42D6.dir_port 80
0C039F35C2E40DCB71CD8A07E97C7FD7787D42D6.nickname libel
0C039F35C2E40DCB71CD8A07E97C7FD7787D42D6.has_extrainfo false
113143469021882C3A4B82F084F8125B08EE471E.address 37.252.185.182
113143469021882C3A4B82F084F8125B08EE471E.or_port 8080
113143469021882C3A4B82F084F8125B08EE471E.dir_port 9030
113143469021882C3A4B82F084F8125B08EE471E.nickname parasol
113143469021882C3A4B82F084F8125B08EE471E.has_extrainfo false
113143469021882C3A4B82F084F8125B08EE471E.orport6_address 2a00:63c1:a:182::2
113143469021882C3A4B82F084F8125B08EE471E.orport6_port 8080
11DF0017A43AF1F08825CD5D973297F81AB00FF3.address 37.120.174.249
11DF0017A43AF1F08825CD5D973297F81AB00FF3.or_port 443
11DF0017A43AF1F08825CD5D973297F81AB00FF3.dir_port 80
11DF0017A43AF1F08825CD5D973297F81AB00FF3.nickname gGDHjdcC6zAlM8k08lX
11DF0017A43AF1F08825CD5D973297F81AB00FF3.has_extrainfo false
11DF0017A43AF1F08825CD5D973297F81AB00FF3.orport6_address 2a03:4000:6:724c:df98:15f9:b34d:443
11DF0017A43AF1F08825CD5D973297F81AB00FF3.orport6_port 443
1211AC1BBB8A1AF7CBA86BCE8689AA3146B86423.address 95.85.8.226
1211AC1BBB8A1AF7CBA86BCE8689AA3146B86423.or_port 443
1211AC1BBB8A1AF7CBA86BCE8689AA3146B86423.dir_port 80
1211AC1BBB8A1AF7CBA86BCE8689AA3146B86423.nickname ccrelaycc
1211AC1BBB8A1AF7CBA86BCE8689AA3146B86423.has_extrainfo false
12AD30E5D25AA67F519780E2111E611A455FDC89.address 193.11.114.43
12AD30E5D25AA67F519780E2111E611A455FDC89.or_port 9001
12AD30E5D25AA67F519780E2111E611A455FDC89.dir_port 9030
12AD30E5D25AA67F519780E2111E611A455FDC89.nickname mdfnet1
12AD30E5D25AA67F519780E2111E611A455FDC89.has_extrainfo false
12AD30E5D25AA67F519780E2111E611A455FDC89.orport6_address 2001:6b0:30:1000::99
12AD30E5D25AA67F519780E2111E611A455FDC89.orport6_port 9050
12FD624EE73CEF37137C90D38B2406A66F68FAA2.address 37.157.195.87
12FD624EE73CEF37137C90D38B2406A66F68FAA2.or_port 443
12FD624EE73CEF37137C90D38B2406A66F68FAA2.dir_port 8030
12FD624EE73CEF37137C90D38B2406A66F68FAA2.nickname thanatosCZ
12FD624EE73CEF37137C90D38B2406A66F68FAA2.has_extrainfo false
183005F78229D94EE51CE7795A42280070A48D0D.address 217.182.51.248
183005F78229D94EE51CE7795A42280070A48D0D.or_port 443
183005F78229D94EE51CE7795A42280070A48D0D.dir_port 80
183005F78229D94EE51CE7795A42280070A48D0D.nickname Cosworth02
183005F78229D94EE51CE7795A42280070A48D0D.has_extrainfo false
185663B7C12777F052B2C2D23D7A239D8DA88A0F.address 171.25.193.25
185663B7C12777F052B2C2D23D7A239D8DA88A0F.or_port 443
185663B7C12777F052B2C2D23D7A239D8DA88A0F.dir_port 80
185663B7C12777F052B2C2D23D7A239D8DA88A0F.nickname DFRI5
185663B7C12777F052B2C2D23D7A239D8DA88A0F.has_extrainfo false
185663B7C12777F052B2C2D23D7A239D8DA88A0F.orport6_address 2001:67c:289c::25
185663B7C12777F052B2C2D23D7A239D8DA88A0F.orport6_port 443
1938EBACBB1A7BFA888D9623C90061130E63BB3F.address 149.56.141.138
1938EBACBB1A7BFA888D9623C90061130E63BB3F.or_port 9001
1938EBACBB1A7BFA888D9623C90061130E63BB3F.dir_port 9030
1938EBACBB1A7BFA888D9623C90061130E63BB3F.nickname Aerodynamik04
1938EBACBB1A7BFA888D9623C90061130E63BB3F.has_extrainfo false
1AE039EE0B11DB79E4B4B29CBA9F752864A0259E.address 81.7.14.253
1AE039EE0B11DB79E4B4B29CBA9F752864A0259E.or_port 443
1AE039EE0B11DB79E4B4B29CBA9F752864A0259E.dir_port 9001
1AE039EE0B11DB79E4B4B29CBA9F752864A0259E.nickname Ichotolot60
1AE039EE0B11DB79E4B4B29CBA9F752864A0259E.has_extrainfo true
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.address 50.7.74.171
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.or_port 9001
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.dir_port 9030
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.nickname theia1
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.has_extrainfo false
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.orport6_address 2001:49f0:d002:2::51
1CD17CB202063C51C7DAD3BACEF87ECE81C2350F.orport6_port 443
1F6ABD086F40B890A33C93CC4606EE68B31C9556.address 199.184.246.250
1F6ABD086F40B890A33C93CC4606EE68B31C9556.or_port 443
1F6ABD086F40B890A33C93CC4606EE68B31C9556.dir_port 80
1F6ABD086F40B890A33C93CC4606EE68B31C9556.nickname dao
1F6ABD086F40B890A33C93CC4606EE68B31C9556.has_extrainfo false
1F6ABD086F40B890A33C93CC4606EE68B31C9556.orport6_address 2620:124:1009:1::171
1F6ABD086F40B890A33C93CC4606EE68B31C9556.orport6_port 443
20462CBA5DA4C2D963567D17D0B7249718114A68.address 212.47.229.2
20462CBA5DA4C2D963567D17D0B7249718114A68.or_port 9001
20462CBA5DA4C2D963567D17D0B7249718114A68.dir_port 9030
20462CBA5DA4C2D963567D17D0B7249718114A68.nickname scaletor
20462CBA5DA4C2D963567D17D0B7249718114A68.has_extrainfo false
20462CBA5DA4C2D963567D17D0B7249718114A68.orport6_address 2001:bc8:4400:2100::f03
20462CBA5DA4C2D963567D17D0B7249718114A68.orport6_port 9001
204DFD2A2C6A0DC1FA0EACB495218E0B661704FD.address 77.247.181.164
204DFD2A2C6A0DC1FA0EACB495218E0B661704FD.or_port 443
204DFD2A2C6A0DC1FA0EACB495218E0B661704FD.dir_port 80
204DFD2A2C6A0DC1FA0EACB495218E0B661704FD.nickname HaveHeart
204DFD2A2C6A0DC1FA0EACB495218E0B661704FD.has_extrainfo false
230A8B2A8BA861210D9B4BA97745AEC217A94207.address 163.172.176.167
230A8B2A8BA861210D9B4BA97745AEC217A94207.or_port 443
230A8B2A8BA861210D9B4BA97745AEC217A94207.dir_port 80
230A8B2A8BA861210D9B4BA97745AEC217A94207.nickname niij01
230A8B2A8BA861210D9B4BA97745AEC217A94207.has_extrainfo false
2F0F32AB1E5B943CA7D062C03F18960C86E70D94.address 97.74.237.196
2F0F32AB1E5B943CA7D062C03F18960C86E70D94.or_port 9001
2F0F32AB1E5B943CA7D062C03F18960C86E70D94.dir_port 9030
2F0F32AB1E5B943CA7D062C03F18960C86E70D94.nickname Minotaur
2F0F32AB1E5B943CA7D062C03F18960C86E70D94.has_extrainfo false
322C6E3A973BC10FC36DE3037AD27BC89F14723B.address 212.83.154.33
322C6E3A973BC10FC36DE3037AD27BC89F14723B.or_port 8443
322C6E3A973BC10FC36DE3037AD27BC89F14723B.dir_port 8080
322C6E3A973BC10FC36DE3037AD27BC89F14723B.nickname bauruine204
322C6E3A973BC10FC36DE3037AD27BC89F14723B.has_extrainfo false
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.address 109.105.109.162
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.or_port 60784
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.dir_port 52860
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.nickname ndnr1
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.has_extrainfo false
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.orport6_address 2001:948:7:2::163
32EE911D968BE3E016ECA572BB1ED0A9EE43FC2F.orport6_port 5001
330CD3DB6AD266DC70CDB512B036957D03D9BC59.address 185.100.84.212
330CD3DB6AD266DC70CDB512B036957D03D9BC59.or_port 443
330CD3DB6AD266DC70CDB512B036957D03D9BC59.dir_port 80
330CD3DB6AD266DC70CDB512B036957D03D9BC59.nickname TeamTardis
330CD3DB6AD266DC70CDB512B036957D03D9BC59.has_extrainfo false
330CD3DB6AD266DC70CDB512B036957D03D9BC59.orport6_address 2a06:1700:0:7::1
330CD3DB6AD266DC70CDB512B036957D03D9BC59.orport6_port 443
361D33C96D0F161275EE67E2C91EE10B276E778B.address 37.157.255.35
361D33C96D0F161275EE67E2C91EE10B276E778B.or_port 9090
361D33C96D0F161275EE67E2C91EE10B276E778B.dir_port 9030
361D33C96D0F161275EE67E2C91EE10B276E778B.nickname cxx4freedom
361D33C96D0F161275EE67E2C91EE10B276E778B.has_extrainfo false
375DCBB2DBD94E5263BC0C015F0C9E756669617E.address 64.79.152.132
375DCBB2DBD94E5263BC0C015F0C9E756669617E.or_port 443
375DCBB2DBD94E5263BC0C015F0C9E756669617E.dir_port 80
375DCBB2DBD94E5263BC0C015F0C9E756669617E.nickname ebola
375DCBB2DBD94E5263BC0C015F0C9E756669617E.has_extrainfo false
39F91959416763AFD34DBEEC05474411B964B2DC.address 213.183.60.21
39F91959416763AFD34DBEEC05474411B964B2DC.or_port 443
39F91959416763AFD34DBEEC05474411B964B2DC.dir_port 9030
39F91959416763AFD34DBEEC05474411B964B2DC.nickname angeltest11
39F91959416763AFD34DBEEC05474411B964B2DC.has_extrainfo false
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.address 50.7.74.174
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.or_port 9001
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.dir_port 9030
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.nickname theia7
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.has_extrainfo false
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.orport6_address 2001:49f0:d002:2::57
3AFDAAD91A15B4C6A7686A53AA8627CA871FF491.orport6_port 443
3CA0D15567024D2E0B557DC0CF3E962B37999A79.address 199.249.230.83
3CA0D15567024D2E0B557DC0CF3E962B37999A79.or_port 443
3CA0D15567024D2E0B557DC0CF3E962B37999A79.dir_port 80
3CA0D15567024D2E0B557DC0CF3E962B37999A79.nickname QuintexAirVPN30
3CA0D15567024D2E0B557DC0CF3E962B37999A79.has_extrainfo false
3CA0D15567024D2E0B557DC0CF3E962B37999A79.orport6_address 2620:7:6001::ffff:c759:e653
3CA0D15567024D2E0B557DC0CF3E962B37999A79.orport6_port 80
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.address 51.38.65.160
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.or_port 9001
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.dir_port 9030
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.nickname rofltor10
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.has_extrainfo false
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.orport6_address 2001:41d0:801:2000::f6e
3CB4193EF4E239FCEDC4DC43468E0B0D6B67ACC3.orport6_port 9001
3E53D3979DB07EFD736661C934A1DED14127B684.address 217.79.179.177
3E53D3979DB07EFD736661C934A1DED14127B684.or_port 9001
3E53D3979DB07EFD736661C934A1DED14127B684.dir_port 9030
3E53D3979DB07EFD736661C934A1DED14127B684.nickname Unnamed
3E53D3979DB07EFD736661C934A1DED14127B684.has_extrainfo false
3E53D3979DB07EFD736661C934A1DED14127B684.orport6_address 2001:4ba0:fff9:131:6c4f::90d3
3E53D3979DB07EFD736661C934A1DED14127B684.orport6_port 9001
3F092986E9B87D3FDA09B71FA3A602378285C77A.address 66.111.2.16
3F092986E9B87D3FDA09B71FA3A602378285C77A.or_port 9001
3F092986E9B87D3FDA09B71FA3A602378285C77A.dir_port 9030
3F092986E9B87D3FDA09B71FA3A602378285C77A.nickname NYCBUG1
3F092986E9B87D3FDA09B71FA3A602378285C77A.has_extrainfo false
3F092986E9B87D3FDA09B71FA3A602378285C77A.orport6_address 2610:1c0:0:5::16
3F092986E9B87D3FDA09B71FA3A602378285C77A.orport6_port 9001
4061C553CA88021B8302F0814365070AAE617270.address 185.100.85.101
4061C553CA88021B8302F0814365070AAE617270.or_port 9001
4061C553CA88021B8302F0814365070AAE617270.dir_port 9030
4061C553CA88021B8302F0814365070AAE617270.nickname TorExitRomania
4061C553CA88021B8302F0814365070AAE617270.has_extrainfo false
4623A9EC53BFD83155929E56D6F7B55B5E718C24.address 163.172.157.213
4623A9EC53BFD83155929E56D6F7B55B5E718C24.or_port 443
4623A9EC53BFD83155929E56D6F7B55B5E718C24.dir_port 8080
4623A9EC53BFD83155929E56D6F7B55B5E718C24.nickname Cotopaxi
4623A9EC53BFD83155929E56D6F7B55B5E718C24.has_extrainfo false
465D17C6FC297E3857B5C6F152006A1E212944EA.address 195.123.245.141
465D17C6FC297E3857B5C6F152006A1E212944EA.or_port 443
465D17C6FC297E3857B5C6F152006A1E212944EA.dir_port 9030
465D17C6FC297E3857B5C6F152006A1E212944EA.nickname angeltest14
465D17C6FC297E3857B5C6F152006A1E212944EA.has_extrainfo false
46791D156C9B6C255C2665D4D8393EC7DBAA7798.address 31.31.78.49
46791D156C9B6C255C2665D4D8393EC7DBAA7798.or_port 443
46791D156C9B6C255C2665D4D8393EC7DBAA7798.dir_port 80
46791D156C9B6C255C2665D4D8393EC7DBAA7798.nickname KrigHaBandolo
46791D156C9B6C255C2665D4D8393EC7DBAA7798.has_extrainfo false
484A10BA2B8D48A5F0216674C8DD50EF27BC32F3.address 193.70.43.76
484A10BA2B8D48A5F0216674C8DD50EF27BC32F3.or_port 9001
484A10BA2B8D48A5F0216674C8DD50EF27BC32F3.dir_port 9030
484A10BA2B8D48A5F0216674C8DD50EF27BC32F3.nickname Aerodynamik03
484A10BA2B8D48A5F0216674C8DD50EF27BC32F3.has_extrainfo false
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.address 37.187.102.186
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.or_port 9001
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.dir_port 9030
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.nickname txtfileTorNode65536
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.has_extrainfo false
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.orport6_address 2001:41d0:a:26ba::1
489D94333DF66D57FFE34D9D59CC2D97E2CB0053.orport6_port 9001
4EB55679FA91363B97372554F8DC7C63F4E5B101.address 81.7.13.84
4EB55679FA91363B97372554F8DC7C63F4E5B101.or_port 443
4EB55679FA91363B97372554F8DC7C63F4E5B101.dir_port 80
4EB55679FA91363B97372554F8DC7C63F4E5B101.nickname torpidsDEisppro
4EB55679FA91363B97372554F8DC7C63F4E5B101.has_extrainfo false
4EB55679FA91363B97372554F8DC7C63F4E5B101.orport6_address 2a02:180:1:1::5b8f:538c
4EB55679FA91363B97372554F8DC7C63F4E5B101.orport6_port 443
4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2.address 108.53.208.157
4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2.or_port 443
4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2.dir_port 80
4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2.nickname Binnacle
4F0DB7E687FC7C0AE55C8F243DA8B0EB27FBF1F2.has_extrainfo true
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.address 5.9.158.75
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.or_port 9001
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.dir_port 9030
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.nickname zwiebeltoralf2
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.has_extrainfo true
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.orport6_address 2a01:4f8:190:514a::2
509EAB4C5D10C9A9A24B4EA0CE402C047A2D64E6.orport6_port 9001
51E1CF613FD6F9F11FE24743C91D6F9981807D82.address 81.7.16.182
51E1CF613FD6F9F11FE24743C91D6F9981807D82.or_port 443
51E1CF613FD6F9F11FE24743C91D6F9981807D82.dir_port 80
51E1CF613FD6F9F11FE24743C91D6F9981807D82.nickname torpidsDEisppro3
51E1CF613FD6F9F11FE24743C91D6F9981807D82.has_extrainfo false
51E1CF613FD6F9F11FE24743C91D6F9981807D82.orport6_address 2a02:180:1:1::517:10b6
51E1CF613FD6F9F11FE24743C91D6F9981807D82.orport6_port 993
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.address 192.160.102.166
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.or_port 9001
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.dir_port 80
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.nickname chaucer
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.has_extrainfo false
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.orport6_address 2620:132:300c:c01d::6
547DA56F6B88B6C596B3E3086803CDA4F0EF8F21.orport6_port 9002
557ACEC850F54EEE65839F83CACE2B0825BE811E.address 192.160.102.170
557ACEC850F54EEE65839F83CACE2B0825BE811E.or_port 9001
557ACEC850F54EEE65839F83CACE2B0825BE811E.dir_port 80
557ACEC850F54EEE65839F83CACE2B0825BE811E.nickname ogopogo
557ACEC850F54EEE65839F83CACE2B0825BE811E.has_extrainfo false
557ACEC850F54EEE65839F83CACE2B0825BE811E.orport6_address 2620:132:300c:c01d::a
557ACEC850F54EEE65839F83CACE2B0825BE811E.orport6_port 9002
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.address 50.7.74.170
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.or_port 443
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.dir_port 80
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.nickname theia8
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.has_extrainfo false
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.orport6_address 2001:49f0:d002:2::58
5BF17163CBE73D8CD9FDBE030C944EA05707DA93.orport6_port 443
5E56738E7F97AA81DEEF59AF28494293DFBFCCDF.address 172.98.193.43
5E56738E7F97AA81DEEF59AF28494293DFBFCCDF.or_port 443
5E56738E7F97AA81DEEF59AF28494293DFBFCCDF.dir_port 80
5E56738E7F97AA81DEEF59AF28494293DFBFCCDF.nickname Backplane
5E56738E7F97AA81DEEF59AF28494293DFBFCCDF.has_extrainfo false
616081EC829593AF4232550DE6FFAA1D75B37A90.address 95.128.43.164
616081EC829593AF4232550DE6FFAA1D75B37A90.or_port 443
616081EC829593AF4232550DE6FFAA1D75B37A90.dir_port 80
616081EC829593AF4232550DE6FFAA1D75B37A90.nickname AquaRayTerminus
616081EC829593AF4232550DE6FFAA1D75B37A90.has_extrainfo false
616081EC829593AF4232550DE6FFAA1D75B37A90.orport6_address 2a02:ec0:209:10::4
616081EC829593AF4232550DE6FFAA1D75B37A90.orport6_port 443
68F175CCABE727AA2D2309BCD8789499CEE36ED7.address 163.172.139.104
68F175CCABE727AA2D2309BCD8789499CEE36ED7.or_port 443
68F175CCABE727AA2D2309BCD8789499CEE36ED7.dir_port 8080
68F175CCABE727AA2D2309BCD8789499CEE36ED7.nickname Pichincha
68F175CCABE727AA2D2309BCD8789499CEE36ED7.has_extrainfo false
6A7551EEE18F78A9813096E82BF84F740D32B911.address 94.130.186.5
6A7551EEE18F78A9813096E82BF84F740D32B911.or_port 443
6A7551EEE18F78A9813096E82BF84F740D32B911.dir_port 80
6A7551EEE18F78A9813096E82BF84F740D32B911.nickname TorMachine
6A7551EEE18F78A9813096E82BF84F740D32B911.has_extrainfo false
6A7551EEE18F78A9813096E82BF84F740D32B911.orport6_address 2a01:4f8:1c0c:45f7::1
6A7551EEE18F78A9813096E82BF84F740D32B911.orport6_port 443
6EF897645B79B6CB35E853B32506375014DE3621.address 80.127.137.19
6EF897645B79B6CB35E853B32506375014DE3621.or_port 443
6EF897645B79B6CB35E853B32506375014DE3621.dir_port 80
6EF897645B79B6CB35E853B32506375014DE3621.nickname d6relay
6EF897645B79B6CB35E853B32506375014DE3621.has_extrainfo false
6EF897645B79B6CB35E853B32506375014DE3621.orport6_address 2001:981:47c1:1::6
6EF897645B79B6CB35E853B32506375014DE3621.orport6_port 443
7088D485934E8A403B81531F8C90BDC75FA43C98.address 37.139.8.104
7088D485934E8A403B81531F8C90BDC75FA43C98.or_port 9001
7088D485934E8A403B81531F8C90BDC75FA43C98.dir_port 9030
7088D485934E8A403B81531F8C90BDC75FA43C98.nickname Basil
7088D485934E8A403B81531F8C90BDC75FA43C98.has_extrainfo false
7088D485934E8A403B81531F8C90BDC75FA43C98.orport6_address 2a03:b0c0:0:1010::24c:1001
7088D485934E8A403B81531F8C90BDC75FA43C98.orport6_port 9001
70C55A114C0EF3DC5784A4FAEE64388434A3398F.address 188.138.88.42
70C55A114C0EF3DC5784A4FAEE64388434A3398F.or_port 443
70C55A114C0EF3DC5784A4FAEE64388434A3398F.dir_port 80
70C55A114C0EF3DC5784A4FAEE64388434A3398F.nickname torpidsFRplusserver
70C55A114C0EF3DC5784A4FAEE64388434A3398F.has_extrainfo false
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.address 85.235.250.88
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.or_port 443
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.dir_port 80
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.nickname TykRelay01
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.has_extrainfo false
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.orport6_address 2a01:3a0:1:1900:85:235:250:88
72B2B12A3F60408BDBC98C6DF53988D3A0B3F0EE.orport6_port 443
742C45F2D9004AADE0077E528A4418A6A81BC2BA.address 178.17.170.23
742C45F2D9004AADE0077E528A4418A6A81BC2BA.or_port 9001
742C45F2D9004AADE0077E528A4418A6A81BC2BA.dir_port 9030
742C45F2D9004AADE0077E528A4418A6A81BC2BA.nickname TorExitMoldova2
742C45F2D9004AADE0077E528A4418A6A81BC2BA.has_extrainfo false
742C45F2D9004AADE0077E528A4418A6A81BC2BA.orport6_address 2a00:1dc0:caff:7d::8254
742C45F2D9004AADE0077E528A4418A6A81BC2BA.orport6_port 9001
745369332749021C6FAF100D327BC3BF1DF4707B.address 50.7.74.173
745369332749021C6FAF100D327BC3BF1DF4707B.or_port 9001
745369332749021C6FAF100D327BC3BF1DF4707B.dir_port 9030
745369332749021C6FAF100D327BC3BF1DF4707B.nickname theia5
745369332749021C6FAF100D327BC3BF1DF4707B.has_extrainfo false
745369332749021C6FAF100D327BC3BF1DF4707B.orport6_address 2001:49f0:d002:2::55
745369332749021C6FAF100D327BC3BF1DF4707B.orport6_port 443
77131D7E2EC1CA9B8D737502256DA9103599CE51.address 77.247.181.166
77131D7E2EC1CA9B8D737502256DA9103599CE51.or_port 443
77131D7E2EC1CA9B8D737502256DA9103599CE51.dir_port 80
77131D7E2EC1CA9B8D737502256DA9103599CE51.nickname CriticalMass
77131D7E2EC1CA9B8D737502256DA9103599CE51.has_extrainfo false
775B0FAFDE71AADC23FFC8782B7BEB1D5A92733E.address 5.196.23.64
775B0FAFDE71AADC23FFC8782B7BEB1D5A92733E.or_port 9001
775B0FAFDE71AADC23FFC8782B7BEB1D5A92733E.dir_port 9030
775B0FAFDE71AADC23FFC8782B7BEB1D5A92733E.nickname Aerodynamik01
775B0FAFDE71AADC23FFC8782B7BEB1D5A92733E.has_extrainfo false
79509683AB4C8DDAF90A120C69A4179C6CD5A387.address 185.244.193.141
79509683AB4C8DDAF90A120C69A4179C6CD5A387.or_port 9001
79509683AB4C8DDAF90A120C69A4179C6CD5A387.dir_port 9030
79509683AB4C8DDAF90A120C69A4179C6CD5A387.nickname DerDickeReloaded
79509683AB4C8DDAF90A120C69A4179C6CD5A387.has_extrainfo false
79509683AB4C8DDAF90A120C69A4179C6CD5A387.orport6_address 2a03:4000:27:192:24:12:1984:4
79509683AB4C8DDAF90A120C69A4179C6CD5A387.orport6_port 9001
7BB70F8585DFC27E75D692970C0EEB0F22983A63.address 51.254.136.195
7BB70F8585DFC27E75D692970C0EEB0F22983A63.or_port 443
7BB70F8585DFC27E75D692970C0EEB0F22983A63.dir_port 80
7BB70F8585DFC27E75D692970C0EEB0F22983A63.nickname torproxy02
7BB70F8585DFC27E75D692970C0EEB0F22983A63.has_extrainfo false
7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55.address 77.247.181.162
7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55.or_port 443
7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55.dir_port 80
7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55.nickname sofia
7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55.has_extrainfo false
7E281CD2C315C4F7A84BC7C8721C3BC974DDBFA3.address 185.220.101.48
7E281CD2C315C4F7A84BC7C8721C3BC974DDBFA3.or_port 20048
7E281CD2C315C4F7A84BC7C8721C3BC974DDBFA3.dir_port 10048
7E281CD2C315C4F7A84BC7C8721C3BC974DDBFA3.nickname niftyporcupine
7E281CD2C315C4F7A84BC7C8721C3BC974DDBFA3.has_extrainfo false
80AAF8D5956A43C197104CEF2550CD42D165C6FB.address 193.11.114.45
80AAF8D5956A43C197104CEF2550CD42D165C6FB.or_port 9002
80AAF8D5956A43C197104CEF2550CD42D165C6FB.dir_port 9031
80AAF8D5956A43C197104CEF2550CD42D165C6FB.nickname mdfnet2
80AAF8D5956A43C197104CEF2550CD42D165C6FB.has_extrainfo false
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.address 51.254.96.208
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.or_port 9001
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.dir_port 9030
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.nickname rofltor01
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.has_extrainfo false
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.orport6_address 2001:41d0:401:3100::30dc
8101421BEFCCF4C271D5483C5AABCAAD245BBB9D.orport6_port 9001
81B75D534F91BFB7C57AB67DA10BCEF622582AE8.address 192.42.116.16
81B75D534F91BFB7C57AB67DA10BCEF622582AE8.or_port 443
81B75D534F91BFB7C57AB67DA10BCEF622582AE8.dir_port 80
81B75D534F91BFB7C57AB67DA10BCEF622582AE8.nickname hviv104
81B75D534F91BFB7C57AB67DA10BCEF622582AE8.has_extrainfo false
823AA81E277F366505545522CEDC2F529CE4DC3F.address 192.160.102.164
823AA81E277F366505545522CEDC2F529CE4DC3F.or_port 9001
823AA81E277F366505545522CEDC2F529CE4DC3F.dir_port 80
823AA81E277F366505545522CEDC2F529CE4DC3F.nickname snowfall
823AA81E277F366505545522CEDC2F529CE4DC3F.has_extrainfo false
823AA81E277F366505545522CEDC2F529CE4DC3F.orport6_address 2620:132:300c:c01d::4
823AA81E277F366505545522CEDC2F529CE4DC3F.orport6_port 9002
844AE9CAD04325E955E2BE1521563B79FE7094B7.address 192.87.28.82
844AE9CAD04325E955E2BE1521563B79FE7094B7.or_port 9001
844AE9CAD04325E955E2BE1521563B79FE7094B7.dir_port 9030
844AE9CAD04325E955E2BE1521563B79FE7094B7.nickname Smeerboel
844AE9CAD04325E955E2BE1521563B79FE7094B7.has_extrainfo false
844AE9CAD04325E955E2BE1521563B79FE7094B7.orport6_address 2001:678:230:3028:192:87:28:82
844AE9CAD04325E955E2BE1521563B79FE7094B7.orport6_port 9001
8456DFA94161CDD99E480C2A2992C366C6564410.address 62.210.254.132
8456DFA94161CDD99E480C2A2992C366C6564410.or_port 443
8456DFA94161CDD99E480C2A2992C366C6564410.dir_port 80
8456DFA94161CDD99E480C2A2992C366C6564410.nickname turingmachine
8456DFA94161CDD99E480C2A2992C366C6564410.has_extrainfo false
855BC2DABE24C861CD887DB9B2E950424B49FC34.address 85.230.178.139
855BC2DABE24C861CD887DB9B2E950424B49FC34.or_port 443
855BC2DABE24C861CD887DB9B2E950424B49FC34.dir_port 9030
855BC2DABE24C861CD887DB9B2E950424B49FC34.nickname Logforme
855BC2DABE24C861CD887DB9B2E950424B49FC34.has_extrainfo false
85A885433E50B1874F11CEC9BE98451E24660976.address 178.254.7.88
85A885433E50B1874F11CEC9BE98451E24660976.or_port 8443
85A885433E50B1874F11CEC9BE98451E24660976.dir_port 8080
85A885433E50B1874F11CEC9BE98451E24660976.nickname wr3ck3d0ni0n01
85A885433E50B1874F11CEC9BE98451E24660976.has_extrainfo false
86C281AD135058238D7A337D546C902BE8505DDE.address 185.96.88.29
86C281AD135058238D7A337D546C902BE8505DDE.or_port 443
86C281AD135058238D7A337D546C902BE8505DDE.dir_port 80
86C281AD135058238D7A337D546C902BE8505DDE.nickname TykRelay05
86C281AD135058238D7A337D546C902BE8505DDE.has_extrainfo false
86C281AD135058238D7A337D546C902BE8505DDE.orport6_address 2a00:4020::185:96:88:29
86C281AD135058238D7A337D546C902BE8505DDE.orport6_port 443
8C00FA7369A7A308F6A137600F0FA07990D9D451.address 163.172.194.53
8C00FA7369A7A308F6A137600F0FA07990D9D451.or_port 9001
8C00FA7369A7A308F6A137600F0FA07990D9D451.dir_port 9030
8C00FA7369A7A308F6A137600F0FA07990D9D451.nickname GrmmlLitavis
8C00FA7369A7A308F6A137600F0FA07990D9D451.has_extrainfo false
8C00FA7369A7A308F6A137600F0FA07990D9D451.orport6_address 2001:bc8:225f:142:6c69:7461:7669:73
8C00FA7369A7A308F6A137600F0FA07990D9D451.orport6_port 9001
8D79F73DCD91FC4F5017422FAC70074D6DB8DD81.address 5.189.169.190
8D79F73DCD91FC4F5017422FAC70074D6DB8DD81.or_port 8080
8D79F73DCD91FC4F5017422FAC70074D6DB8DD81.dir_port 8030
8D79F73DCD91FC4F5017422FAC70074D6DB8DD81.nickname thanatosDE
8D79F73DCD91FC4F5017422FAC70074D6DB8DD81.has_extrainfo false
8FA37B93397015B2BC5A525C908485260BE9F422.address 81.7.11.96
8FA37B93397015B2BC5A525C908485260BE9F422.or_port 9001
8FA37B93397015B2BC5A525C908485260BE9F422.dir_port 9030
8FA37B93397015B2BC5A525C908485260BE9F422.nickname Doedel22
8FA37B93397015B2BC5A525C908485260BE9F422.has_extrainfo false
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.address 54.37.139.118
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.or_port 9001
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.dir_port 9030
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.nickname rofltor09
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.has_extrainfo false
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.orport6_address 2001:41d0:601:1100::1b8
90A5D1355C4B5840E950EB61E673863A6AE3ACA1.orport6_port 9001
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.address 37.187.20.59
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.or_port 443
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.dir_port 80
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.nickname torpidsFRovh
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.has_extrainfo false
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.orport6_address 2001:41d0:a:143b::1
91D23D8A539B83D2FB56AA67ECD4D75CC093AC55.orport6_port 993
91E4015E1F82DAF0121D62267E54A1F661AB6DC7.address 173.255.245.116
91E4015E1F82DAF0121D62267E54A1F661AB6DC7.or_port 9001
91E4015E1F82DAF0121D62267E54A1F661AB6DC7.dir_port 9030
91E4015E1F82DAF0121D62267E54A1F661AB6DC7.nickname IWorshipHisShadow
91E4015E1F82DAF0121D62267E54A1F661AB6DC7.has_extrainfo false
924B24AFA7F075D059E8EEB284CC400B33D3D036.address 96.253.78.108
924B24AFA7F075D059E8EEB284CC400B33D3D036.or_port 443
924B24AFA7F075D059E8EEB284CC400B33D3D036.dir_port 80
924B24AFA7F075D059E8EEB284CC400B33D3D036.nickname NSDFreedom
924B24AFA7F075D059E8EEB284CC400B33D3D036.has_extrainfo false
9288B75B5FF8861EFF32A6BE8825CC38A4F9F8C2.address 92.38.163.21
9288B75B5FF8861EFF32A6BE8825CC38A4F9F8C2.or_port 443
9288B75B5FF8861EFF32A6BE8825CC38A4F9F8C2.dir_port 9030
9288B75B5FF8861EFF32A6BE8825CC38A4F9F8C2.nickname angeltest9
9288B75B5FF8861EFF32A6BE8825CC38A4F9F8C2.has_extrainfo false
935F589545B8A271A722E330445BB99F67DBB058.address 163.172.53.84
935F589545B8A271A722E330445BB99F67DBB058.or_port 443
935F589545B8A271A722E330445BB99F67DBB058.dir_port 80
935F589545B8A271A722E330445BB99F67DBB058.nickname Multivac0
935F589545B8A271A722E330445BB99F67DBB058.has_extrainfo false
935F589545B8A271A722E330445BB99F67DBB058.orport6_address 2001:bc8:24f8::
935F589545B8A271A722E330445BB99F67DBB058.orport6_port 443
94C4B7B8C50C86A92B6A20107539EE2678CF9A28.address 204.8.156.142
94C4B7B8C50C86A92B6A20107539EE2678CF9A28.or_port 443
94C4B7B8C50C86A92B6A20107539EE2678CF9A28.dir_port 80
94C4B7B8C50C86A92B6A20107539EE2678CF9A28.nickname BostonUCompSci
94C4B7B8C50C86A92B6A20107539EE2678CF9A28.has_extrainfo false
9772EFB535397C942C3AB8804FB35CFFAD012438.address 37.153.1.10
9772EFB535397C942C3AB8804FB35CFFAD012438.or_port 9001
9772EFB535397C942C3AB8804FB35CFFAD012438.dir_port 9030
9772EFB535397C942C3AB8804FB35CFFAD012438.nickname smallsweatnode
9772EFB535397C942C3AB8804FB35CFFAD012438.has_extrainfo false
99E246DB480B313A3012BC3363093CC26CD209C7.address 173.212.254.192
99E246DB480B313A3012BC3363093CC26CD209C7.or_port 31337
99E246DB480B313A3012BC3363093CC26CD209C7.dir_port 31336
99E246DB480B313A3012BC3363093CC26CD209C7.nickname ViDiSrv
99E246DB480B313A3012BC3363093CC26CD209C7.has_extrainfo false
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.address 185.100.86.128
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.or_port 9001
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.dir_port 9030
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.nickname TorExitFinland
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.has_extrainfo false
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.orport6_address 2a06:1700:1::11
9B31F1F1C1554F9FFB3455911F82E818EF7C7883.orport6_port 9001
9B816A5B3EB20B8E4E9B9D1FBA299BD3F40F0320.address 185.220.101.49
9B816A5B3EB20B8E4E9B9D1FBA299BD3F40F0320.or_port 20049
9B816A5B3EB20B8E4E9B9D1FBA299BD3F40F0320.dir_port 10049
9B816A5B3EB20B8E4E9B9D1FBA299BD3F40F0320.nickname niftypygmyjerboa
9B816A5B3EB20B8E4E9B9D1FBA299BD3F40F0320.has_extrainfo false
9C900A7F6F5DD034CFFD192DAEC9CCAA813DB022.address 86.105.212.130
9C900A7F6F5DD034CFFD192DAEC9CCAA813DB022.or_port 443
9C900A7F6F5DD034CFFD192DAEC9CCAA813DB022.dir_port 9030
9C900A7F6F5DD034CFFD192DAEC9CCAA813DB022.nickname firstor2
9C900A7F6F5DD034CFFD192DAEC9CCAA813DB022.has_extrainfo false
9EAD5B2D3DBD96DBC80DCE423B0C345E920A758D.address 31.185.104.19
9EAD5B2D3DBD96DBC80DCE423B0C345E920A758D.or_port 443
9EAD5B2D3DBD96DBC80DCE423B0C345E920A758D.dir_port 80
9EAD5B2D3DBD96DBC80DCE423B0C345E920A758D.nickname Digitalcourage3ip1
9EAD5B2D3DBD96DBC80DCE423B0C345E920A758D.has_extrainfo false
9F7D6E6420183C2B76D3CE99624EBC98A21A967E.address 46.28.110.244
9F7D6E6420183C2B76D3CE99624EBC98A21A967E.or_port 443
9F7D6E6420183C2B76D3CE99624EBC98A21A967E.dir_port 80
9F7D6E6420183C2B76D3CE99624EBC98A21A967E.nickname Nivrim
9F7D6E6420183C2B76D3CE99624EBC98A21A967E.has_extrainfo false
A0F06C2FADF88D3A39AA3072B406F09D7095AC9E.address 46.165.230.5
A0F06C2FADF88D3A39AA3072B406F09D7095AC9E.or_port 443
A0F06C2FADF88D3A39AA3072B406F09D7095AC9E.dir_port 80
A0F06C2FADF88D3A39AA3072B406F09D7095AC9E.nickname Dhalgren
A0F06C2FADF88D3A39AA3072B406F09D7095AC9E.has_extrainfo true
A2E6BB5C391CD46B38C55B4329C35304540771F1.address 81.7.3.67
A2E6BB5C391CD46B38C55B4329C35304540771F1.or_port 443
A2E6BB5C391CD46B38C55B4329C35304540771F1.dir_port 993
A2E6BB5C391CD46B38C55B4329C35304540771F1.nickname BeastieJoy62
A2E6BB5C391CD46B38C55B4329C35304540771F1.has_extrainfo true
A53C46F5B157DD83366D45A8E99A244934A14C46.address 128.31.0.13
A53C46F5B157DD83366D45A8E99A244934A14C46.or_port 443
A53C46F5B157DD83366D45A8E99A244934A14C46.dir_port 80
A53C46F5B157DD83366D45A8E99A244934A14C46.nickname csailmitexit
A53C46F5B157DD83366D45A8E99A244934A14C46.has_extrainfo false
A86EC24F5B8B964F67AC7C27CE92842025983274.address 185.246.152.22
A86EC24F5B8B964F67AC7C27CE92842025983274.or_port 443
A86EC24F5B8B964F67AC7C27CE92842025983274.dir_port 9030
A86EC24F5B8B964F67AC7C27CE92842025983274.nickname angeltest19
A86EC24F5B8B964F67AC7C27CE92842025983274.has_extrainfo false
A9406A006D6E7B5DA30F2C6D4E42A338B5E340B2.address 163.172.149.122
A9406A006D6E7B5DA30F2C6D4E42A338B5E340B2.or_port 443
A9406A006D6E7B5DA30F2C6D4E42A338B5E340B2.dir_port 80
A9406A006D6E7B5DA30F2C6D4E42A338B5E340B2.nickname niij03
A9406A006D6E7B5DA30F2C6D4E42A338B5E340B2.has_extrainfo false
AC2BEDD0BAC72838EA7E6F113F856C4E8018ACDB.address 176.10.107.180
AC2BEDD0BAC72838EA7E6F113F856C4E8018ACDB.or_port 9001
AC2BEDD0BAC72838EA7E6F113F856C4E8018ACDB.dir_port 9030
AC2BEDD0BAC72838EA7E6F113F856C4E8018ACDB.nickname schokomilch
AC2BEDD0BAC72838EA7E6F113F856C4E8018ACDB.has_extrainfo false
ACDD9E85A05B127BA010466C13C8C47212E8A38F.address 185.129.62.62
ACDD9E85A05B127BA010466C13C8C47212E8A38F.or_port 9001
ACDD9E85A05B127BA010466C13C8C47212E8A38F.dir_port 9030
ACDD9E85A05B127BA010466C13C8C47212E8A38F.nickname kramse
ACDD9E85A05B127BA010466C13C8C47212E8A38F.has_extrainfo false
ACDD9E85A05B127BA010466C13C8C47212E8A38F.orport6_address 2a06:d380:0:3700::62
ACDD9E85A05B127BA010466C13C8C47212E8A38F.orport6_port 9001
ADB2C26629643DBB9F8FE0096E7D16F9414B4F8D.address 31.185.104.20
ADB2C26629643DBB9F8FE0096E7D16F9414B4F8D.or_port 443
ADB2C26629643DBB9F8FE0096E7D16F9414B4F8D.dir_port 80
ADB2C26629643DBB9F8FE0096E7D16F9414B4F8D.nickname Digitalcourage3ip2
ADB2C26629643DBB9F8FE0096E7D16F9414B4F8D.has_extrainfo false
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.address 45.79.108.130
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.or_port 9001
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.dir_port 9030
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.nickname linss
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.has_extrainfo false
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.orport6_address 2600:3c01:e000:131::8000:0
AEDAC7081AE14B8D241ECF0FF17A2858AB4383D0.orport6_port 9001
B0553175AADB0501E5A61FC61CEA3970BE130FF2.address 5.9.147.226
B0553175AADB0501E5A61FC61CEA3970BE130FF2.or_port 9001
B0553175AADB0501E5A61FC61CEA3970BE130FF2.dir_port 9030
B0553175AADB0501E5A61FC61CEA3970BE130FF2.nickname zwiubel
B0553175AADB0501E5A61FC61CEA3970BE130FF2.has_extrainfo false
B0553175AADB0501E5A61FC61CEA3970BE130FF2.orport6_address 2a01:4f8:190:30e1::2
B0553175AADB0501E5A61FC61CEA3970BE130FF2.orport6_port 9001
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.address 178.17.174.14
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.or_port 9001
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.dir_port 9030
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.nickname TorExitMoldova
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.has_extrainfo false
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.orport6_address 2a00:1dc0:caff:8b::5b9a
B06F093A3D4DFAD3E923F4F28A74901BD4F74EB1.orport6_port 9001
B143D439B72D239A419F8DCE07B8A8EB1B486FA7.address 212.129.62.232
B143D439B72D239A419F8DCE07B8A8EB1B486FA7.or_port 443
B143D439B72D239A419F8DCE07B8A8EB1B486FA7.dir_port 80
B143D439B72D239A419F8DCE07B8A8EB1B486FA7.nickname wardsback
B143D439B72D239A419F8DCE07B8A8EB1B486FA7.has_extrainfo false
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.address 199.249.230.64
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.or_port 443
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.dir_port 80
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.nickname Quintex41
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.has_extrainfo false
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.orport6_address 2620:7:6001::ffff:c759:e640
B2197C23A4FF5D1C49EE45BA7688BA8BCCD89A0B.orport6_port 80
B291D30517D23299AD7CEE3E60DFE60D0E3A4664.address 136.243.214.137
B291D30517D23299AD7CEE3E60DFE60D0E3A4664.or_port 443
B291D30517D23299AD7CEE3E60DFE60D0E3A4664.dir_port 80
B291D30517D23299AD7CEE3E60DFE60D0E3A4664.nickname TorKIT
B291D30517D23299AD7CEE3E60DFE60D0E3A4664.has_extrainfo false
B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20.address 212.47.233.86
B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20.or_port 9001
B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20.dir_port 9030
B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20.nickname netimanmu
B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20.has_extrainfo false
B5212DB685A2A0FCFBAE425738E478D12361710D.address 93.115.97.242
B5212DB685A2A0FCFBAE425738E478D12361710D.or_port 9001
B5212DB685A2A0FCFBAE425738E478D12361710D.dir_port 9030
B5212DB685A2A0FCFBAE425738E478D12361710D.nickname firstor
B5212DB685A2A0FCFBAE425738E478D12361710D.has_extrainfo false
B57A87009FA838471FB2227DDE68165AB2A2FCC4.address 51.38.134.104
B57A87009FA838471FB2227DDE68165AB2A2FCC4.or_port 443
B57A87009FA838471FB2227DDE68165AB2A2FCC4.dir_port 9030
B57A87009FA838471FB2227DDE68165AB2A2FCC4.nickname angeltest5
B57A87009FA838471FB2227DDE68165AB2A2FCC4.has_extrainfo false
B83DC1558F0D34353BB992EF93AFEAFDB226A73E.address 193.11.114.46
B83DC1558F0D34353BB992EF93AFEAFDB226A73E.or_port 9003
B83DC1558F0D34353BB992EF93AFEAFDB226A73E.dir_port 9032
B83DC1558F0D34353BB992EF93AFEAFDB226A73E.nickname mdfnet3
B83DC1558F0D34353BB992EF93AFEAFDB226A73E.has_extrainfo false
B84F248233FEA90CAD439F292556A3139F6E1B82.address 85.248.227.164
B84F248233FEA90CAD439F292556A3139F6E1B82.or_port 9002
B84F248233FEA90CAD439F292556A3139F6E1B82.dir_port 444
B84F248233FEA90CAD439F292556A3139F6E1B82.nickname tollana
B84F248233FEA90CAD439F292556A3139F6E1B82.has_extrainfo false
B84F248233FEA90CAD439F292556A3139F6E1B82.orport6_address 2a00:1298:8011:212::164
B84F248233FEA90CAD439F292556A3139F6E1B82.orport6_port 9004
B86137AE9681701901C6720E55C16805B46BD8E3.address 81.7.11.186
B86137AE9681701901C6720E55C16805B46BD8E3.or_port 443
B86137AE9681701901C6720E55C16805B46BD8E3.dir_port 1080
B86137AE9681701901C6720E55C16805B46BD8E3.nickname BeastieJoy60
B86137AE9681701901C6720E55C16805B46BD8E3.has_extrainfo true
BB60F5BA113A0B8B44B7B37DE3567FE561E92F78.address 51.15.179.153
BB60F5BA113A0B8B44B7B37DE3567FE561E92F78.or_port 995
BB60F5BA113A0B8B44B7B37DE3567FE561E92F78.dir_port 110
BB60F5BA113A0B8B44B7B37DE3567FE561E92F78.nickname Casper04
BB60F5BA113A0B8B44B7B37DE3567FE561E92F78.has_extrainfo false
BCEDF6C193AA687AE471B8A22EBF6BC57C2D285E.address 198.96.155.3
BCEDF6C193AA687AE471B8A22EBF6BC57C2D285E.or_port 5001
BCEDF6C193AA687AE471B8A22EBF6BC57C2D285E.dir_port 8080
BCEDF6C193AA687AE471B8A22EBF6BC57C2D285E.nickname gurgle
BCEDF6C193AA687AE471B8A22EBF6BC57C2D285E.has_extrainfo false
BCEF908195805E03E92CCFE669C48738E556B9C5.address 128.199.55.207
BCEF908195805E03E92CCFE669C48738E556B9C5.or_port 9001
BCEF908195805E03E92CCFE669C48738E556B9C5.dir_port 9030
BCEF908195805E03E92CCFE669C48738E556B9C5.nickname EldritchReaper
BCEF908195805E03E92CCFE669C48738E556B9C5.has_extrainfo false
BCEF908195805E03E92CCFE669C48738E556B9C5.orport6_address 2a03:b0c0:2:d0::158:3001
BCEF908195805E03E92CCFE669C48738E556B9C5.orport6_port 9001
BD552C165E2ED2887D3F1CCE9CFF155DDA2D86E6.address 213.141.138.174
BD552C165E2ED2887D3F1CCE9CFF155DDA2D86E6.or_port 9001
BD552C165E2ED2887D3F1CCE9CFF155DDA2D86E6.dir_port 9030
BD552C165E2ED2887D3F1CCE9CFF155DDA2D86E6.nickname Schakalium
BD552C165E2ED2887D3F1CCE9CFF155DDA2D86E6.has_extrainfo false
BF0FB582E37F738CD33C3651125F2772705BB8E8.address 148.251.190.229
BF0FB582E37F738CD33C3651125F2772705BB8E8.or_port 9010
BF0FB582E37F738CD33C3651125F2772705BB8E8.dir_port 9030
BF0FB582E37F738CD33C3651125F2772705BB8E8.nickname quadhead
BF0FB582E37F738CD33C3651125F2772705BB8E8.has_extrainfo false
BF0FB582E37F738CD33C3651125F2772705BB8E8.orport6_address 2a01:4f8:211:c68::2
BF0FB582E37F738CD33C3651125F2772705BB8E8.orport6_port 9010
BF735F669481EE1CCC348F0731551C933D1E2278.address 212.47.233.250
BF735F669481EE1CCC348F0731551C933D1E2278.or_port 9001
BF735F669481EE1CCC348F0731551C933D1E2278.dir_port 9030
BF735F669481EE1CCC348F0731551C933D1E2278.nickname FreewaySca
BF735F669481EE1CCC348F0731551C933D1E2278.has_extrainfo false
BF735F669481EE1CCC348F0731551C933D1E2278.orport6_address 2001:bc8:4400:2b00::1c:629
BF735F669481EE1CCC348F0731551C933D1E2278.orport6_port 9001
C0192FF43E777250084175F4E59AC1BA2290CE38.address 192.160.102.169
C0192FF43E777250084175F4E59AC1BA2290CE38.or_port 9001
C0192FF43E777250084175F4E59AC1BA2290CE38.dir_port 80
C0192FF43E777250084175F4E59AC1BA2290CE38.nickname manipogo
C0192FF43E777250084175F4E59AC1BA2290CE38.has_extrainfo false
C0192FF43E777250084175F4E59AC1BA2290CE38.orport6_address 2620:132:300c:c01d::9
C0192FF43E777250084175F4E59AC1BA2290CE38.orport6_port 9002
C0C4F339046EB824999F711D178472FDF53BE7F5.address 132.248.241.5
C0C4F339046EB824999F711D178472FDF53BE7F5.or_port 9101
C0C4F339046EB824999F711D178472FDF53BE7F5.dir_port 9130
C0C4F339046EB824999F711D178472FDF53BE7F5.nickname toritounam2
C0C4F339046EB824999F711D178472FDF53BE7F5.has_extrainfo false
C2AAB088555850FC434E68943F551072042B85F1.address 31.185.104.21
C2AAB088555850FC434E68943F551072042B85F1.or_port 443
C2AAB088555850FC434E68943F551072042B85F1.dir_port 80
C2AAB088555850FC434E68943F551072042B85F1.nickname Digitalcourage3ip3
C2AAB088555850FC434E68943F551072042B85F1.has_extrainfo false
C36A434DB54C66E1A97A5653858CE36024352C4D.address 50.7.74.170
C36A434DB54C66E1A97A5653858CE36024352C4D.or_port 9001
C36A434DB54C66E1A97A5653858CE36024352C4D.dir_port 9030
C36A434DB54C66E1A97A5653858CE36024352C4D.nickname theia9
C36A434DB54C66E1A97A5653858CE36024352C4D.has_extrainfo false
C36A434DB54C66E1A97A5653858CE36024352C4D.orport6_address 2001:49f0:d002:2::59
C36A434DB54C66E1A97A5653858CE36024352C4D.orport6_port 443
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.address 85.248.227.163
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.or_port 9001
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.dir_port 443
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.nickname ori
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.has_extrainfo false
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.orport6_address 2a00:1298:8011:212::163
C793AB88565DDD3C9E4C6F15CCB9D8C7EF964CE9.orport6_port 9003
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.address 192.160.102.165
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.or_port 9001
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.dir_port 80
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.nickname cowcat
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.has_extrainfo false
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.orport6_address 2620:132:300c:c01d::5
C90CA3B7FE01A146B8268D56977DC4A2C024B9EA.orport6_port 9002
CBD0D1BD110EC52963082D839AC6A89D0AE243E7.address 176.31.103.150
CBD0D1BD110EC52963082D839AC6A89D0AE243E7.or_port 9001
CBD0D1BD110EC52963082D839AC6A89D0AE243E7.dir_port 9030
CBD0D1BD110EC52963082D839AC6A89D0AE243E7.nickname UV74S7mjxRcYVrGsAMw
CBD0D1BD110EC52963082D839AC6A89D0AE243E7.has_extrainfo false
D15AFF44BE641368B958A32FB6B071AC2136B8B1.address 51.254.147.57
D15AFF44BE641368B958A32FB6B071AC2136B8B1.or_port 443
D15AFF44BE641368B958A32FB6B071AC2136B8B1.dir_port 80
D15AFF44BE641368B958A32FB6B071AC2136B8B1.nickname Cosworth01
D15AFF44BE641368B958A32FB6B071AC2136B8B1.has_extrainfo false
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.address 50.7.74.172
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.or_port 443
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.dir_port 80
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.nickname theia2
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.has_extrainfo false
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.orport6_address 2001:49f0:d002:2::52
D1AFBF3117B308B6D1A7AA762B1315FD86A6B8AF.orport6_port 443
D379A1CB8285748FFF64AE94296CA89878F25B22.address 62.141.38.69
D379A1CB8285748FFF64AE94296CA89878F25B22.or_port 443
D379A1CB8285748FFF64AE94296CA89878F25B22.dir_port 9030
D379A1CB8285748FFF64AE94296CA89878F25B22.nickname angeltest3
D379A1CB8285748FFF64AE94296CA89878F25B22.has_extrainfo false
D379A1CB8285748FFF64AE94296CA89878F25B22.orport6_address 2001:4ba0:cafe:ac5::1
D379A1CB8285748FFF64AE94296CA89878F25B22.orport6_port 443
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.address 5.45.111.149
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.or_port 443
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.dir_port 80
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.nickname gGDHjdcC6zAlM8k08lY
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.has_extrainfo false
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.orport6_address 2a03:4000:6:2388:df98:15f9:b34d:443
D405FCCF06ADEDF898DF2F29C9348DCB623031BA.orport6_port 443
D50101A2ABD09DC245F7E96C0818D003CDD62351.address 50.7.74.174
D50101A2ABD09DC245F7E96C0818D003CDD62351.or_port 443
D50101A2ABD09DC245F7E96C0818D003CDD62351.dir_port 80
D50101A2ABD09DC245F7E96C0818D003CDD62351.nickname theia6
D50101A2ABD09DC245F7E96C0818D003CDD62351.has_extrainfo false
D50101A2ABD09DC245F7E96C0818D003CDD62351.orport6_address 2001:49f0:d002:2::56
D50101A2ABD09DC245F7E96C0818D003CDD62351.orport6_port 443
D5039E1EBFD96D9A3F9846BF99EC9F75EDDE902A.address 37.187.115.157
D5039E1EBFD96D9A3F9846BF99EC9F75EDDE902A.or_port 9001
D5039E1EBFD96D9A3F9846BF99EC9F75EDDE902A.dir_port 9030
D5039E1EBFD96D9A3F9846BF99EC9F75EDDE902A.nickname Janky328891
D5039E1EBFD96D9A3F9846BF99EC9F75EDDE902A.has_extrainfo false
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.address 85.10.201.47
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.or_port 9001
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.dir_port 9030
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.nickname sif
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.has_extrainfo false
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.orport6_address 2a01:4f8:a0:43eb::beef
D8B7A3A6542AA54D0946B9DC0257C53B6C376679.orport6_port 9001
DAA39FC00B196B353C2A271459C305C429AF09E4.address 193.35.52.53
DAA39FC00B196B353C2A271459C305C429AF09E4.or_port 9001
DAA39FC00B196B353C2A271459C305C429AF09E4.dir_port 9030
DAA39FC00B196B353C2A271459C305C429AF09E4.nickname Arne
DAA39FC00B196B353C2A271459C305C429AF09E4.has_extrainfo false
DB2682153AC0CCAECD2BD1E9EBE99C6815807A1E.address 54.36.237.163
DB2682153AC0CCAECD2BD1E9EBE99C6815807A1E.or_port 443
DB2682153AC0CCAECD2BD1E9EBE99C6815807A1E.dir_port 80
DB2682153AC0CCAECD2BD1E9EBE99C6815807A1E.nickname GermanCraft2
DB2682153AC0CCAECD2BD1E9EBE99C6815807A1E.has_extrainfo false
DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686.address 176.158.236.102
DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686.or_port 9001
DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686.dir_port 9030
DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686.nickname Underworld
DC163DDEF4B6F0C6BC226F9F6656A5A30C5C5686.has_extrainfo false
DD823AFB415380A802DCAEB9461AE637604107FB.address 178.33.183.251
DD823AFB415380A802DCAEB9461AE637604107FB.or_port 443
DD823AFB415380A802DCAEB9461AE637604107FB.dir_port 80
DD823AFB415380A802DCAEB9461AE637604107FB.nickname grenouille
DD823AFB415380A802DCAEB9461AE637604107FB.has_extrainfo false
DD823AFB415380A802DCAEB9461AE637604107FB.orport6_address 2001:41d0:2:a683::251
DD823AFB415380A802DCAEB9461AE637604107FB.orport6_port 443
DD8BD7307017407FCC36F8D04A688F74A0774C02.address 171.25.193.20
DD8BD7307017407FCC36F8D04A688F74A0774C02.or_port 443
DD8BD7307017407FCC36F8D04A688F74A0774C02.dir_port 80
DD8BD7307017407FCC36F8D04A688F74A0774C02.nickname DFRI0
DD8BD7307017407FCC36F8D04A688F74A0774C02.has_extrainfo false
DD8BD7307017407FCC36F8D04A688F74A0774C02.orport6_address 2001:67c:289c::20
DD8BD7307017407FCC36F8D04A688F74A0774C02.orport6_port 443
DED6892FF89DBD737BA689698A171B2392EB3E82.address 92.222.38.67
DED6892FF89DBD737BA689698A171B2392EB3E82.or_port 443
DED6892FF89DBD737BA689698A171B2392EB3E82.dir_port 80
DED6892FF89DBD737BA689698A171B2392EB3E82.nickname ThorExit
DED6892FF89DBD737BA689698A171B2392EB3E82.has_extrainfo false
DED6892FF89DBD737BA689698A171B2392EB3E82.orport6_address 2001:41d0:52:100::112a
DED6892FF89DBD737BA689698A171B2392EB3E82.orport6_port 443
E41B16F7DDF52EBB1DB4268AB2FE340B37AD8904.address 166.70.207.2
E41B16F7DDF52EBB1DB4268AB2FE340B37AD8904.or_port 9101
E41B16F7DDF52EBB1DB4268AB2FE340B37AD8904.dir_port 9130
E41B16F7DDF52EBB1DB4268AB2FE340B37AD8904.nickname xmission1
E41B16F7DDF52EBB1DB4268AB2FE340B37AD8904.has_extrainfo false
E51620B90DCB310138ED89EDEDD0A5C361AAE24E.address 185.100.86.182
E51620B90DCB310138ED89EDEDD0A5C361AAE24E.or_port 8080
E51620B90DCB310138ED89EDEDD0A5C361AAE24E.dir_port 9030
E51620B90DCB310138ED89EDEDD0A5C361AAE24E.nickname NormalCitizen
E51620B90DCB310138ED89EDEDD0A5C361AAE24E.has_extrainfo false
E81EF60A73B3809F8964F73766B01BAA0A171E20.address 212.47.244.38
E81EF60A73B3809F8964F73766B01BAA0A171E20.or_port 443
E81EF60A73B3809F8964F73766B01BAA0A171E20.dir_port 8080
E81EF60A73B3809F8964F73766B01BAA0A171E20.nickname Chimborazo
E81EF60A73B3809F8964F73766B01BAA0A171E20.has_extrainfo false
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.address 185.4.132.148
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.or_port 443
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.dir_port 80
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.nickname libreonion1
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.has_extrainfo false
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.orport6_address 2a02:c500:2:f0::5492
E8D114B3C78D8E6E7FEB1004650DD632C2143C9E.orport6_port 443
EBE718E1A49EE229071702964F8DB1F318075FF8.address 131.188.40.188
EBE718E1A49EE229071702964F8DB1F318075FF8.or_port 80
EBE718E1A49EE229071702964F8DB1F318075FF8.dir_port 1443
EBE718E1A49EE229071702964F8DB1F318075FF8.nickname fluxe4
EBE718E1A49EE229071702964F8DB1F318075FF8.has_extrainfo true
EBE718E1A49EE229071702964F8DB1F318075FF8.orport6_address 2001:638:a000:4140::ffff:188
EBE718E1A49EE229071702964F8DB1F318075FF8.orport6_port 80
ED2338CAC2711B3E331392E1ED2831219B794024.address 192.87.28.28
ED2338CAC2711B3E331392E1ED2831219B794024.or_port 9001
ED2338CAC2711B3E331392E1ED2831219B794024.dir_port 9030
ED2338CAC2711B3E331392E1ED2831219B794024.nickname SEC6xFreeBSD64
ED2338CAC2711B3E331392E1ED2831219B794024.has_extrainfo false
ED2338CAC2711B3E331392E1ED2831219B794024.orport6_address 2001:678:230:3028:192:87:28:28
ED2338CAC2711B3E331392E1ED2831219B794024.orport6_port 9001
EE4AF632058F0734C1426B1AD689F47445CA2056.address 37.252.187.111
EE4AF632058F0734C1426B1AD689F47445CA2056.or_port 443
EE4AF632058F0734C1426B1AD689F47445CA2056.dir_port 9030
EE4AF632058F0734C1426B1AD689F47445CA2056.nickname angeltest7
EE4AF632058F0734C1426B1AD689F47445CA2056.has_extrainfo false
EE4AF632058F0734C1426B1AD689F47445CA2056.orport6_address 2a00:63c1:c:111::2
EE4AF632058F0734C1426B1AD689F47445CA2056.orport6_port 443
EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F.address 217.182.75.181
EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F.or_port 9001
EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F.dir_port 9030
EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F.nickname Aerodynamik02
EFEACD781604EB80FBC025EDEDEA2D523AEAAA2F.has_extrainfo false
F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC.address 193.70.112.165
F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC.or_port 443
F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC.dir_port 80
F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC.nickname ParkBenchInd001
F10BDE279AE71515DDCCCC61DC19AC8765F8A3CC.has_extrainfo false
F4263275CF54A6836EE7BD527B1328836A6F06E1.address 37.187.102.108
F4263275CF54A6836EE7BD527B1328836A6F06E1.or_port 443
F4263275CF54A6836EE7BD527B1328836A6F06E1.dir_port 80
F4263275CF54A6836EE7BD527B1328836A6F06E1.nickname EvilMoe
F4263275CF54A6836EE7BD527B1328836A6F06E1.has_extrainfo false
F4263275CF54A6836EE7BD527B1328836A6F06E1.orport6_address 2001:41d0:a:266c::1
F4263275CF54A6836EE7BD527B1328836A6F06E1.orport6_port 443
F4C0EDAA0BF0F7EC138746F8FEF1CE26C7860265.address 5.199.142.236
F4C0EDAA0BF0F7EC138746F8FEF1CE26C7860265.or_port 9001
F4C0EDAA0BF0F7EC138746F8FEF1CE26C7860265.dir_port 9030
F4C0EDAA0BF0F7EC138746F8FEF1CE26C7860265.nickname tornodenumber9004
F4C0EDAA0BF0F7EC138746F8FEF1CE26C7860265.has_extrainfo false
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.address 192.160.102.168
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.or_port 9001
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.dir_port 80
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.nickname prawksi
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.has_extrainfo false
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.orport6_address 2620:132:300c:c01d::8
F6A358DD367B3282D6EF5824C9D45E1A19C7E815.orport6_port 9002
F8D27B163B9247B232A2EEE68DD8B698695C28DE.address 78.47.18.110
F8D27B163B9247B232A2EEE68DD8B698695C28DE.or_port 80
F8D27B163B9247B232A2EEE68DD8B698695C28DE.dir_port 443
F8D27B163B9247B232A2EEE68DD8B698695C28DE.nickname fluxe3
F8D27B163B9247B232A2EEE68DD8B698695C28DE.has_extrainfo true
F8D27B163B9247B232A2EEE68DD8B698695C28DE.orport6_address 2a01:4f8:120:4023::110
F8D27B163B9247B232A2EEE68DD8B698695C28DE.orport6_port 80
F93D8F37E35C390BCAD9F9069E13085B745EC216.address 185.96.180.29
F93D8F37E35C390BCAD9F9069E13085B745EC216.or_port 443
F93D8F37E35C390BCAD9F9069E13085B745EC216.dir_port 80
F93D8F37E35C390BCAD9F9069E13085B745EC216.nickname TykRelay06
F93D8F37E35C390BCAD9F9069E13085B745EC216.has_extrainfo false
F93D8F37E35C390BCAD9F9069E13085B745EC216.orport6_address 2a00:4820::185:96:180:29
F93D8F37E35C390BCAD9F9069E13085B745EC216.orport6_port 443
FE296180018833AF03A8EACD5894A614623D3F76.address 149.56.45.200
FE296180018833AF03A8EACD5894A614623D3F76.or_port 9001
FE296180018833AF03A8EACD5894A614623D3F76.dir_port 9030
FE296180018833AF03A8EACD5894A614623D3F76.nickname PyotrTorpotkinOne
FE296180018833AF03A8EACD5894A614623D3F76.has_extrainfo false
FE296180018833AF03A8EACD5894A614623D3F76.orport6_address 2607:5300:201:3000::17d3
FE296180018833AF03A8EACD5894A614623D3F76.orport6_port 9002
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.address 193.11.164.243
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.or_port 9001
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.dir_port 9030
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.nickname Lule
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.has_extrainfo false
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.orport6_address 2001:6b0:7:125::243
FFA72BD683BC2FCF988356E6BEC1E490F313FB07.orport6_port 9001
stem-1.8.0/stem/connection.py 0000664 0001750 0001750 00000135747 13501272761 016720 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Functions for connecting and authenticating to the tor process.
The :func:`~stem.connection.connect` function give an easy, one line
method for getting an authenticated control connection. This is handy for CLI
applications and the python interactive interpreter, but does several things
that makes it undesirable for applications (uses stdin/stdout, suppresses
exceptions, etc).
::
import sys
from stem.connection import connect
if __name__ == '__main__':
controller = connect()
if not controller:
sys.exit(1) # unable to get a connection
print 'Tor is running version %s' % controller.get_version()
controller.close()
::
% python example.py
Tor is running version 0.2.4.10-alpha-dev (git-8be6058d8f31e578)
... or if Tor isn't running...
::
% python example.py
[Errno 111] Connection refused
The :func:`~stem.connection.authenticate` function, however, gives easy but
fine-grained control over the authentication process. For instance...
::
import sys
import getpass
import stem.connection
import stem.socket
try:
control_socket = stem.socket.ControlPort(port = 9051)
except stem.SocketError as exc:
print 'Unable to connect to port 9051 (%s)' % exc
sys.exit(1)
try:
stem.connection.authenticate(control_socket)
except stem.connection.IncorrectSocketType:
print 'Please check in your torrc that 9051 is the ControlPort.'
print 'Maybe you configured it to be the ORPort or SocksPort instead?'
sys.exit(1)
except stem.connection.MissingPassword:
controller_password = getpass.getpass('Controller password: ')
try:
stem.connection.authenticate_password(control_socket, controller_password)
except stem.connection.PasswordAuthFailed:
print 'Unable to authenticate, password is incorrect'
sys.exit(1)
except stem.connection.AuthenticationFailure as exc:
print 'Unable to authenticate: %s' % exc
sys.exit(1)
**Module Overview:**
::
connect - Simple method for getting authenticated control connection
authenticate - Main method for authenticating to a control socket
authenticate_none - Authenticates to an open control socket
authenticate_password - Authenticates to a socket supporting password auth
authenticate_cookie - Authenticates to a socket supporting cookie auth
authenticate_safecookie - Authenticates to a socket supporting safecookie auth
get_protocolinfo - Issues a PROTOCOLINFO query
AuthenticationFailure - Base exception raised for authentication failures
|- UnrecognizedAuthMethods - Authentication methods are unsupported
|- IncorrectSocketType - Socket does not speak the tor control protocol
|
|- OpenAuthFailed - Failure when authenticating by an open socket
| +- OpenAuthRejected - Tor rejected this method of authentication
|
|- PasswordAuthFailed - Failure when authenticating by a password
| |- PasswordAuthRejected - Tor rejected this method of authentication
| |- IncorrectPassword - Password was rejected
| +- MissingPassword - Socket supports password auth but wasn't attempted
|
|- CookieAuthFailed - Failure when authenticating by a cookie
| |- CookieAuthRejected - Tor rejected this method of authentication
| |- IncorrectCookieValue - Authentication cookie was rejected
| |- IncorrectCookieSize - Size of the cookie file is incorrect
| |- UnreadableCookieFile - Unable to read the contents of the auth cookie
| +- AuthChallengeFailed - Failure completing the authchallenge request
| |- AuthChallengeUnsupported - Tor doesn't recognize the AUTHCHALLENGE command
| |- AuthSecurityFailure - Server provided the wrong nonce credentials
| |- InvalidClientNonce - The client nonce is invalid
| +- UnrecognizedAuthChallengeMethod - AUTHCHALLENGE does not support the given methods.
|
+- MissingAuthInfo - Unexpected PROTOCOLINFO response, missing auth info
|- NoAuthMethods - Missing any methods for authenticating
+- NoAuthCookie - Supports cookie auth but doesn't have its path
.. data:: AuthMethod (enum)
Enumeration of PROTOCOLINFO responses for supported authentication methods.
============== ===========
AuthMethod Description
============== ===========
**NONE** No authentication required.
**PASSWORD** Password required, see tor's HashedControlPassword option.
**COOKIE** Contents of the cookie file required, see tor's CookieAuthentication option.
**SAFECOOKIE** Need to reply to a hmac challenge using the contents of the cookie file.
**UNKNOWN** Tor provided one or more authentication methods that we don't recognize, probably something new.
============== ===========
"""
import binascii
import getpass
import hashlib
import hmac
import os
import stem.control
import stem.response
import stem.socket
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
import stem.util.system
import stem.version
from stem.util import log
AuthMethod = stem.util.enum.Enum('NONE', 'PASSWORD', 'COOKIE', 'SAFECOOKIE', 'UNKNOWN')
CLIENT_HASH_CONSTANT = b'Tor safe cookie authentication controller-to-server hash'
SERVER_HASH_CONSTANT = b'Tor safe cookie authentication server-to-controller hash'
CRYPTOVARIABLE_EQUALITY_COMPARISON_NONCE = os.urandom(32)
MISSING_PASSWORD_BUG_MSG = """
BUG: You provided a password but despite this stem reported that it was
missing. This shouldn't happen - please let us know about it!
http://bugs.torproject.org
"""
UNRECOGNIZED_AUTH_TYPE_MSG = """
Tor is using a type of authentication we do not recognize...
{auth_methods}
Please check that stem is up to date and if there is an existing issue on
'http://bugs.torproject.org'. If there isn't one then let us know!
"""
UNREADABLE_COOKIE_FILE_MSG = """
We were unable to read tor's authentication cookie...
Path: {path}
Issue: {issue}
"""
WRONG_PORT_TYPE_MSG = """
Please check in your torrc that {port} is the ControlPort. Maybe you
configured it to be the ORPort or SocksPort instead?
"""
WRONG_SOCKET_TYPE_MSG = """
Unable to connect to tor. Are you sure the interface you specified belongs to
tor?
"""
CONNECT_MESSAGES = {
'general_auth_failure': 'Unable to authenticate: {error}',
'incorrect_password': 'Incorrect password',
'no_control_port': "Unable to connect to tor. Maybe it's running without a ControlPort?",
'password_prompt': 'Tor controller password:',
'needs_password': 'Tor requires a password to authenticate',
'socket_doesnt_exist': "The socket file you specified ({path}) doesn't exist",
'tor_isnt_running': "Unable to connect to tor. Are you sure it's running?",
'unable_to_use_port': 'Unable to connect to {address}:{port}: {error}',
'unable_to_use_socket': "Unable to connect to '{path}': {error}",
'missing_password_bug': MISSING_PASSWORD_BUG_MSG.strip(),
'uncrcognized_auth_type': UNRECOGNIZED_AUTH_TYPE_MSG.strip(),
'unreadable_cookie_file': UNREADABLE_COOKIE_FILE_MSG.strip(),
'wrong_port_type': WRONG_PORT_TYPE_MSG.strip(),
'wrong_socket_type': WRONG_SOCKET_TYPE_MSG.strip(),
}
COMMON_TOR_COMMANDS = (
'tor',
'tor.real', # TBB command ran
'/usr/local/bin/tor', # FreeBSD expands the whole path, this is the default location
)
def connect(control_port = ('127.0.0.1', 'default'), control_socket = '/var/run/tor/control', password = None, password_prompt = False, chroot_path = None, controller = stem.control.Controller):
"""
Convenience function for quickly getting a control connection. This is very
handy for debugging or CLI setup, handling setup and prompting for a password
if necessary (and none is provided). If any issues arise this prints a
description of the problem and returns **None**.
If both a **control_port** and **control_socket** are provided then the
**control_socket** is tried first, and this provides a generic error message
if they're both unavailable.
In much the same vein as git porcelain commands, users should not rely on
details of how this works. Messages and details of this function's behavior
could change in the future.
If the **port** is **'default'** then this checks on both 9051 (default for
relays) and 9151 (default for the Tor Browser). This default may change in
the future.
.. versionadded:: 1.2.0
.. versionchanged:: 1.5.0
Use both port 9051 and 9151 by default.
:param tuple contol_port: address and port tuple, for instance **('127.0.0.1', 9051)**
:param str path: path where the control socket is located
:param str password: passphrase to authenticate to the socket
:param bool password_prompt: prompt for the controller password if it wasn't
supplied
:param str chroot_path: path prefix if in a chroot environment
:param Class controller: :class:`~stem.control.BaseController` subclass to be
returned, this provides a :class:`~stem.socket.ControlSocket` if **None**
:returns: authenticated control connection, the type based on the controller argument
:raises: **ValueError** if given an invalid control_port, or both
**control_port** and **control_socket** are **None**
"""
if control_port is None and control_socket is None:
raise ValueError('Neither a control port nor control socket were provided. Nothing to connect to.')
elif control_port:
if len(control_port) != 2:
raise ValueError('The control_port argument for connect() should be an (address, port) tuple.')
elif not stem.util.connection.is_valid_ipv4_address(control_port[0]):
raise ValueError("'%s' isn't a vaid IPv4 address" % control_port[0])
elif control_port[1] != 'default' and not stem.util.connection.is_valid_port(control_port[1]):
raise ValueError("'%s' isn't a valid port" % control_port[1])
control_connection, error_msg = None, ''
if control_socket:
if os.path.exists(control_socket):
try:
control_connection = stem.socket.ControlSocketFile(control_socket)
except stem.SocketError as exc:
error_msg = CONNECT_MESSAGES['unable_to_use_socket'].format(path = control_socket, error = exc)
else:
error_msg = CONNECT_MESSAGES['socket_doesnt_exist'].format(path = control_socket)
if control_port and not control_connection:
address, port = control_port
try:
if port == 'default':
control_connection = _connection_for_default_port(address)
else:
control_connection = stem.socket.ControlPort(address, int(port))
except stem.SocketError as exc:
error_msg = CONNECT_MESSAGES['unable_to_use_port'].format(address = address, port = port, error = exc)
# If unable to connect to either a control socket or port then finally fail
# out. If we only attempted to connect to one of them then provide the error
# output from that. Otherwise we provide a more generic error message.
if not control_connection:
if control_socket and control_port:
is_tor_running = stem.util.system.is_running(COMMON_TOR_COMMANDS)
error_msg = CONNECT_MESSAGES['no_control_port'] if is_tor_running else CONNECT_MESSAGES['tor_isnt_running']
print(error_msg)
return None
return _connect_auth(control_connection, password, password_prompt, chroot_path, controller)
def connect_port(address = '127.0.0.1', port = 9051, password = None, chroot_path = None, controller = stem.control.Controller):
"""
Convenience function for quickly getting a control connection. This is very
handy for debugging or CLI setup, handling setup and prompting for a password
if necessary (and none is provided). If any issues arise this prints a
description of the problem and returns **None**.
.. deprecated:: 1.2.0
Use :func:`~stem.connection.connect` instead.
:param str address: ip address of the controller
:param int port: port number of the controller
:param str password: passphrase to authenticate to the socket
:param str chroot_path: path prefix if in a chroot environment
:param Class controller: :class:`~stem.control.BaseController` subclass to be
returned, this provides a :class:`~stem.socket.ControlSocket` if **None**
:returns: authenticated control connection, the type based on the controller argument
"""
try:
control_port = stem.socket.ControlPort(address, port)
except stem.SocketError as exc:
print(exc)
return None
return _connect_auth(control_port, password, True, chroot_path, controller)
def connect_socket_file(path = '/var/run/tor/control', password = None, chroot_path = None, controller = stem.control.Controller):
"""
Convenience function for quickly getting a control connection. For more
information see the :func:`~stem.connection.connect_port` function.
In much the same vein as git porcelain commands, users should not rely on
details of how this works. Messages or details of this function's behavior
might change in the future.
.. deprecated:: 1.2.0
Use :func:`~stem.connection.connect` instead.
:param str path: path where the control socket is located
:param str password: passphrase to authenticate to the socket
:param str chroot_path: path prefix if in a chroot environment
:param Class controller: :class:`~stem.control.BaseController` subclass to be
returned, this provides a :class:`~stem.socket.ControlSocket` if **None**
:returns: authenticated control connection, the type based on the controller argument
"""
try:
control_socket = stem.socket.ControlSocketFile(path)
except stem.SocketError as exc:
print(exc)
return None
return _connect_auth(control_socket, password, True, chroot_path, controller)
def _connect_auth(control_socket, password, password_prompt, chroot_path, controller):
"""
Helper for the connect_* functions that authenticates the socket and
constructs the controller.
:param stem.socket.ControlSocket control_socket: socket being authenticated to
:param str password: passphrase to authenticate to the socket
:param bool password_prompt: prompt for the controller password if it wasn't
supplied
:param str chroot_path: path prefix if in a chroot environment
:param Class controller: :class:`~stem.control.BaseController` subclass to be
returned, this provides a :class:`~stem.socket.ControlSocket` if **None**
:returns: authenticated control connection, the type based on the controller argument
"""
try:
authenticate(control_socket, password, chroot_path)
if controller is None:
return control_socket
else:
return controller(control_socket, is_authenticated = True)
except IncorrectSocketType:
if isinstance(control_socket, stem.socket.ControlPort):
print(CONNECT_MESSAGES['wrong_port_type'].format(port = control_socket.port))
else:
print(CONNECT_MESSAGES['wrong_socket_type'])
control_socket.close()
return None
except UnrecognizedAuthMethods as exc:
print(CONNECT_MESSAGES['uncrcognized_auth_type'].format(auth_methods = ', '.join(exc.unknown_auth_methods)))
control_socket.close()
return None
except IncorrectPassword:
print(CONNECT_MESSAGES['incorrect_password'])
control_socket.close()
return None
except MissingPassword:
if password is not None:
control_socket.close()
raise ValueError(CONNECT_MESSAGES['missing_password_bug'])
if password_prompt:
try:
password = getpass.getpass(CONNECT_MESSAGES['password_prompt'] + ' ')
except KeyboardInterrupt:
control_socket.close()
return None
return _connect_auth(control_socket, password, password_prompt, chroot_path, controller)
else:
print(CONNECT_MESSAGES['needs_password'])
control_socket.close()
return None
except UnreadableCookieFile as exc:
print(CONNECT_MESSAGES['unreadable_cookie_file'].format(path = exc.cookie_path, issue = str(exc)))
control_socket.close()
return None
except AuthenticationFailure as exc:
print(CONNECT_MESSAGES['general_auth_failure'].format(error = exc))
control_socket.close()
return None
def authenticate(controller, password = None, chroot_path = None, protocolinfo_response = None):
"""
Authenticates to a control socket using the information provided by a
PROTOCOLINFO response. In practice this will often be all we need to
authenticate, raising an exception if all attempts to authenticate fail.
All exceptions are subclasses of AuthenticationFailure so, in practice,
callers should catch the types of authentication failure that they care
about, then have a :class:`~stem.connection.AuthenticationFailure` catch-all
at the end.
This can authenticate to either a :class:`~stem.control.BaseController` or
:class:`~stem.socket.ControlSocket`.
:param controller: tor controller or socket to be authenticated
:param str password: passphrase to present to the socket if it uses password
authentication (skips password auth if **None**)
:param str chroot_path: path prefix if in a chroot environment
:param stem.response.protocolinfo.ProtocolInfoResponse protocolinfo_response:
tor protocolinfo response, this is retrieved on our own if **None**
:raises: If all attempts to authenticate fails then this will raise a
:class:`~stem.connection.AuthenticationFailure` subclass. Since this may
try multiple authentication methods it may encounter multiple exceptions.
If so then the exception this raises is prioritized as follows...
* :class:`stem.connection.IncorrectSocketType`
The controller does not speak the tor control protocol. Most often this
happened because the user confused the SocksPort or ORPort with the
ControlPort.
* :class:`stem.connection.UnrecognizedAuthMethods`
All of the authentication methods tor will accept are new and
unrecognized. Please upgrade stem and, if that doesn't work, file a
ticket on 'trac.torproject.org' and I'd be happy to add support.
* :class:`stem.connection.MissingPassword`
We were unable to authenticate but didn't attempt password authentication
because none was provided. You should prompt the user for a password and
try again via 'authenticate_password'.
* :class:`stem.connection.IncorrectPassword`
We were provided with a password but it was incorrect.
* :class:`stem.connection.IncorrectCookieSize`
Tor allows for authentication by reading it a cookie file, but that file
is the wrong size to be an authentication cookie.
* :class:`stem.connection.UnreadableCookieFile`
Tor allows for authentication by reading it a cookie file, but we can't
read that file (probably due to permissions).
* **\\***:class:`stem.connection.IncorrectCookieValue`
Tor allows for authentication by reading it a cookie file, but rejected
the contents of that file.
* **\\***:class:`stem.connection.AuthChallengeUnsupported`
Tor doesn't recognize the AUTHCHALLENGE command. This is probably a Tor
version prior to SAFECOOKIE being implement, but this exception shouldn't
arise because we won't attempt SAFECOOKIE auth unless Tor claims to
support it.
* **\\***:class:`stem.connection.UnrecognizedAuthChallengeMethod`
Tor couldn't recognize the AUTHCHALLENGE method Stem sent to it. This
shouldn't happen at all.
* **\\***:class:`stem.connection.InvalidClientNonce`
Tor says that the client nonce provided by Stem during the AUTHCHALLENGE
process is invalid.
* **\\***:class:`stem.connection.AuthSecurityFailure`
Nonce value provided by the server was invalid.
* **\\***:class:`stem.connection.OpenAuthRejected`
Tor says that it allows for authentication without any credentials, but
then rejected our authentication attempt.
* **\\***:class:`stem.connection.MissingAuthInfo`
Tor provided us with a PROTOCOLINFO reply that is technically valid, but
missing the information we need to authenticate.
* **\\***:class:`stem.connection.AuthenticationFailure`
There are numerous other ways that authentication could have failed
including socket failures, malformed controller responses, etc. These
mostly constitute transient failures or bugs.
**\\*** In practice it is highly unusual for this to occur, being more of a
theoretical possibility rather than something you should expect. It's fine
to treat these as errors. If you have a use case where this commonly
happens, please file a ticket on 'trac.torproject.org'.
In the future new :class:`~stem.connection.AuthenticationFailure`
subclasses may be added to allow for better error handling.
"""
if not protocolinfo_response:
try:
protocolinfo_response = get_protocolinfo(controller)
except stem.ProtocolError:
raise IncorrectSocketType('unable to use the control socket')
except stem.SocketError as exc:
raise AuthenticationFailure('socket connection failed (%s)' % exc)
auth_methods = list(protocolinfo_response.auth_methods)
auth_exceptions = []
if len(auth_methods) == 0:
raise NoAuthMethods('our PROTOCOLINFO response did not have any methods for authenticating')
# remove authentication methods that are either unknown or for which we don't
# have an input
if AuthMethod.UNKNOWN in auth_methods:
auth_methods.remove(AuthMethod.UNKNOWN)
unknown_methods = protocolinfo_response.unknown_auth_methods
plural_label = 's' if len(unknown_methods) > 1 else ''
methods_label = ', '.join(unknown_methods)
# we... er, can't do anything with only unrecognized auth types
if not auth_methods:
exc_msg = 'unrecognized authentication method%s (%s)' % (plural_label, methods_label)
auth_exceptions.append(UnrecognizedAuthMethods(exc_msg, unknown_methods))
else:
log.debug('Authenticating to a socket with unrecognized auth method%s, ignoring them: %s' % (plural_label, methods_label))
if protocolinfo_response.cookie_path is None:
for cookie_auth_method in (AuthMethod.COOKIE, AuthMethod.SAFECOOKIE):
if cookie_auth_method in auth_methods:
auth_methods.remove(cookie_auth_method)
exc_msg = 'our PROTOCOLINFO response did not have the location of our authentication cookie'
auth_exceptions.append(NoAuthCookie(exc_msg, cookie_auth_method == AuthMethod.SAFECOOKIE))
if AuthMethod.PASSWORD in auth_methods and password is None:
auth_methods.remove(AuthMethod.PASSWORD)
auth_exceptions.append(MissingPassword('no passphrase provided'))
# iterating over AuthMethods so we can try them in this order
for auth_type in (AuthMethod.NONE, AuthMethod.PASSWORD, AuthMethod.SAFECOOKIE, AuthMethod.COOKIE):
if auth_type not in auth_methods:
continue
try:
if auth_type == AuthMethod.NONE:
authenticate_none(controller, False)
elif auth_type == AuthMethod.PASSWORD:
authenticate_password(controller, password, False)
elif auth_type in (AuthMethod.COOKIE, AuthMethod.SAFECOOKIE):
cookie_path = protocolinfo_response.cookie_path
if chroot_path:
cookie_path = os.path.join(chroot_path, cookie_path.lstrip(os.path.sep))
if auth_type == AuthMethod.SAFECOOKIE:
authenticate_safecookie(controller, cookie_path, False)
else:
authenticate_cookie(controller, cookie_path, False)
if isinstance(controller, stem.control.BaseController):
controller._post_authentication()
return # success!
except OpenAuthRejected as exc:
auth_exceptions.append(exc)
except IncorrectPassword as exc:
auth_exceptions.append(exc)
except PasswordAuthRejected as exc:
# Since the PROTOCOLINFO says password auth is available we can assume
# that if PasswordAuthRejected is raised it's being raised in error.
log.debug('The authenticate_password method raised a PasswordAuthRejected when password auth should be available. Stem may need to be corrected to recognize this response: %s' % exc)
auth_exceptions.append(IncorrectPassword(str(exc)))
except AuthSecurityFailure as exc:
log.info('Tor failed to provide the nonce expected for safecookie authentication. (%s)' % exc)
auth_exceptions.append(exc)
except (InvalidClientNonce, UnrecognizedAuthChallengeMethod, AuthChallengeFailed) as exc:
auth_exceptions.append(exc)
except (IncorrectCookieSize, UnreadableCookieFile, IncorrectCookieValue) as exc:
auth_exceptions.append(exc)
except CookieAuthRejected as exc:
auth_func = 'authenticate_safecookie' if exc.is_safecookie else 'authenticate_cookie'
log.debug('The %s method raised a CookieAuthRejected when cookie auth should be available. Stem may need to be corrected to recognize this response: %s' % (auth_func, exc))
auth_exceptions.append(IncorrectCookieValue(str(exc), exc.cookie_path, exc.is_safecookie))
except stem.ControllerError as exc:
auth_exceptions.append(AuthenticationFailure(str(exc)))
# All authentication attempts failed. Raise the exception that takes priority
# according to our pydocs.
for exc_type in AUTHENTICATE_EXCEPTIONS:
for auth_exc in auth_exceptions:
if isinstance(auth_exc, exc_type):
raise auth_exc
# We really, really shouldn't get here. It means that auth_exceptions is
# either empty or contains something that isn't an AuthenticationFailure.
raise AssertionError('BUG: Authentication failed without providing a recognized exception: %s' % str(auth_exceptions))
def authenticate_none(controller, suppress_ctl_errors = True):
"""
Authenticates to an open control socket. All control connections need to
authenticate before they can be used, even if tor hasn't been configured to
use any authentication.
If authentication fails tor will disconnect and we'll make a best effort
attempt to re-establish the connection. This may not succeed, so check
:func:`~stem.socket.ControlSocket.is_alive` before using the socket further.
This can authenticate to either a :class:`~stem.control.BaseController` or
:class:`~stem.socket.ControlSocket`.
For general usage use the :func:`~stem.connection.authenticate` function
instead.
:param controller: tor controller or socket to be authenticated
:param bool suppress_ctl_errors: reports raised
:class:`~stem.ControllerError` as authentication rejection if
**True**, otherwise they're re-raised
:raises: :class:`stem.connection.OpenAuthRejected` if the empty authentication credentials aren't accepted
"""
try:
auth_response = _msg(controller, 'AUTHENTICATE')
# if we got anything but an OK response then error
if str(auth_response) != 'OK':
try:
controller.connect()
except:
pass
raise OpenAuthRejected(str(auth_response), auth_response)
except stem.ControllerError as exc:
try:
controller.connect()
except:
pass
if not suppress_ctl_errors:
raise
else:
raise OpenAuthRejected('Socket failed (%s)' % exc)
def authenticate_password(controller, password, suppress_ctl_errors = True):
"""
Authenticates to a control socket that uses a password (via the
HashedControlPassword torrc option). Quotes in the password are escaped.
If authentication fails tor will disconnect and we'll make a best effort
attempt to re-establish the connection. This may not succeed, so check
:func:`~stem.socket.ControlSocket.is_alive` before using the socket further.
If you use this function directly, rather than
:func:`~stem.connection.authenticate`, we may mistakenly raise a
PasswordAuthRejected rather than IncorrectPassword. This is because we rely
on tor's error messaging which is liable to change in future versions
(:trac:`4817`).
This can authenticate to either a :class:`~stem.control.BaseController` or
:class:`~stem.socket.ControlSocket`.
For general usage use the :func:`~stem.connection.authenticate` function
instead.
:param controller: tor controller or socket to be authenticated
:param str password: passphrase to present to the socket
:param bool suppress_ctl_errors: reports raised
:class:`~stem.ControllerError` as authentication rejection if
**True**, otherwise they're re-raised
:raises:
* :class:`stem.connection.PasswordAuthRejected` if the socket doesn't
accept password authentication
* :class:`stem.connection.IncorrectPassword` if the authentication
credentials aren't accepted
"""
# Escapes quotes. Tor can include those in the password hash, in which case
# it expects escaped quotes from the controller. For more information see...
# https://trac.torproject.org/projects/tor/ticket/4600
password = password.replace('"', '\\"')
try:
auth_response = _msg(controller, 'AUTHENTICATE "%s"' % password)
# if we got anything but an OK response then error
if str(auth_response) != 'OK':
try:
controller.connect()
except:
pass
# all we have to go on is the error message from tor...
# Password did not match HashedControlPassword value value from configuration...
# Password did not match HashedControlPassword *or*...
if 'Password did not match HashedControlPassword' in str(auth_response):
raise IncorrectPassword(str(auth_response), auth_response)
else:
raise PasswordAuthRejected(str(auth_response), auth_response)
except stem.ControllerError as exc:
try:
controller.connect()
except:
pass
if not suppress_ctl_errors:
raise
else:
raise PasswordAuthRejected('Socket failed (%s)' % exc)
def authenticate_cookie(controller, cookie_path, suppress_ctl_errors = True):
"""
Authenticates to a control socket that uses the contents of an authentication
cookie (generated via the CookieAuthentication torrc option). This does basic
validation that this is a cookie before presenting the contents to the
socket.
The :class:`~stem.connection.IncorrectCookieSize` and
:class:`~stem.connection.UnreadableCookieFile` exceptions take precedence
over the other types.
If authentication fails tor will disconnect and we'll make a best effort
attempt to re-establish the connection. This may not succeed, so check
:func:`~stem.socket.ControlSocket.is_alive` before using the socket further.
If you use this function directly, rather than
:func:`~stem.connection.authenticate`, we may mistakenly raise a
:class:`~stem.connection.CookieAuthRejected` rather than
:class:`~stem.connection.IncorrectCookieValue`. This is because we rely on
tor's error messaging which is liable to change in future versions
(:trac:`4817`).
This can authenticate to either a :class:`~stem.control.BaseController` or
:class:`~stem.socket.ControlSocket`.
For general usage use the :func:`~stem.connection.authenticate` function
instead.
:param controller: tor controller or socket to be authenticated
:param str cookie_path: path of the authentication cookie to send to tor
:param bool suppress_ctl_errors: reports raised
:class:`~stem.ControllerError` as authentication rejection if
**True**, otherwise they're re-raised
:raises:
* :class:`stem.connection.IncorrectCookieSize` if the cookie file's size
is wrong
* :class:`stem.connection.UnreadableCookieFile` if the cookie file doesn't
exist or we're unable to read it
* :class:`stem.connection.CookieAuthRejected` if cookie authentication is
attempted but the socket doesn't accept it
* :class:`stem.connection.IncorrectCookieValue` if the cookie file's value
is rejected
"""
cookie_data = _read_cookie(cookie_path, False)
try:
# binascii.b2a_hex() takes a byte string and returns one too. With python 3
# this is a problem because string formatting for byte strings includes the
# b'' wrapper...
#
# >>> "AUTHENTICATE %s" % b'content'
# "AUTHENTICATE b'content'"
#
# This seems dumb but oh well. Converting the result to unicode so it won't
# misbehave.
auth_token_hex = binascii.b2a_hex(stem.util.str_tools._to_bytes(cookie_data))
msg = 'AUTHENTICATE %s' % stem.util.str_tools._to_unicode(auth_token_hex)
auth_response = _msg(controller, msg)
# if we got anything but an OK response then error
if str(auth_response) != 'OK':
try:
controller.connect()
except:
pass
# all we have to go on is the error message from tor...
# ... Authentication cookie did not match expected value.
# ... *or* authentication cookie.
if '*or* authentication cookie.' in str(auth_response) or \
'Authentication cookie did not match expected value.' in str(auth_response):
raise IncorrectCookieValue(str(auth_response), cookie_path, False, auth_response)
else:
raise CookieAuthRejected(str(auth_response), cookie_path, False, auth_response)
except stem.ControllerError as exc:
try:
controller.connect()
except:
pass
if not suppress_ctl_errors:
raise
else:
raise CookieAuthRejected('Socket failed (%s)' % exc, cookie_path, False)
def authenticate_safecookie(controller, cookie_path, suppress_ctl_errors = True):
"""
Authenticates to a control socket using the safe cookie method, which is
enabled by setting the CookieAuthentication torrc option on Tor client's which
support it.
Authentication with this is a two-step process...
1. send a nonce to the server and receives a challenge from the server for
the cookie's contents
2. generate a hash digest using the challenge received in the first step, and
use it to authenticate the controller
The :class:`~stem.connection.IncorrectCookieSize` and
:class:`~stem.connection.UnreadableCookieFile` exceptions take precedence
over the other exception types.
The :class:`~stem.connection.AuthChallengeUnsupported`,
:class:`~stem.connection.UnrecognizedAuthChallengeMethod`,
:class:`~stem.connection.InvalidClientNonce` and
:class:`~stem.connection.CookieAuthRejected` exceptions are next in the order
of precedence. Depending on the reason, one of these is raised if the first
(AUTHCHALLENGE) step fails.
In the second (AUTHENTICATE) step,
:class:`~stem.connection.IncorrectCookieValue` or
:class:`~stem.connection.CookieAuthRejected` maybe raised.
If authentication fails tor will disconnect and we'll make a best effort
attempt to re-establish the connection. This may not succeed, so check
:func:`~stem.socket.ControlSocket.is_alive` before using the socket further.
For general usage use the :func:`~stem.connection.authenticate` function
instead.
:param controller: tor controller or socket to be authenticated
:param str cookie_path: path of the authentication cookie to send to tor
:param bool suppress_ctl_errors: reports raised
:class:`~stem.ControllerError` as authentication rejection if
**True**, otherwise they're re-raised
:raises:
* :class:`stem.connection.IncorrectCookieSize` if the cookie file's size
is wrong
* :class:`stem.connection.UnreadableCookieFile` if the cookie file doesn't
exist or we're unable to read it
* :class:`stem.connection.CookieAuthRejected` if cookie authentication is
attempted but the socket doesn't accept it
* :class:`stem.connection.IncorrectCookieValue` if the cookie file's value
is rejected
* :class:`stem.connection.UnrecognizedAuthChallengeMethod` if the Tor
client fails to recognize the AuthChallenge method
* :class:`stem.connection.AuthChallengeUnsupported` if AUTHCHALLENGE is
unimplemented, or if unable to parse AUTHCHALLENGE response
* :class:`stem.connection.AuthSecurityFailure` if AUTHCHALLENGE's response
looks like a security attack
* :class:`stem.connection.InvalidClientNonce` if stem's AUTHCHALLENGE
client nonce is rejected for being invalid
"""
cookie_data = _read_cookie(cookie_path, True)
client_nonce = os.urandom(32)
try:
client_nonce_hex = stem.util.str_tools._to_unicode(binascii.b2a_hex(client_nonce))
authchallenge_response = _msg(controller, 'AUTHCHALLENGE SAFECOOKIE %s' % client_nonce_hex)
if not authchallenge_response.is_ok():
try:
controller.connect()
except:
pass
authchallenge_response_str = str(authchallenge_response)
if 'Authentication required.' in authchallenge_response_str:
raise AuthChallengeUnsupported("SAFECOOKIE authentication isn't supported", cookie_path)
elif 'AUTHCHALLENGE only supports' in authchallenge_response_str:
raise UnrecognizedAuthChallengeMethod(authchallenge_response_str, cookie_path)
elif 'Invalid base16 client nonce' in authchallenge_response_str:
raise InvalidClientNonce(authchallenge_response_str, cookie_path)
elif 'Cookie authentication is disabled' in authchallenge_response_str:
raise CookieAuthRejected(authchallenge_response_str, cookie_path, True)
else:
raise AuthChallengeFailed(authchallenge_response, cookie_path)
except stem.ControllerError as exc:
try:
controller.connect()
except:
pass
if not suppress_ctl_errors:
raise
else:
raise AuthChallengeFailed('Socket failed (%s)' % exc, cookie_path, True)
try:
stem.response.convert('AUTHCHALLENGE', authchallenge_response)
except stem.ProtocolError as exc:
if not suppress_ctl_errors:
raise
else:
raise AuthChallengeFailed('Unable to parse AUTHCHALLENGE response: %s' % exc, cookie_path)
expected_server_hash = _hmac_sha256(
SERVER_HASH_CONSTANT,
cookie_data + client_nonce + authchallenge_response.server_nonce)
authchallenge_hmac = _hmac_sha256(CRYPTOVARIABLE_EQUALITY_COMPARISON_NONCE, authchallenge_response.server_hash)
expected_hmac = _hmac_sha256(CRYPTOVARIABLE_EQUALITY_COMPARISON_NONCE, expected_server_hash)
if authchallenge_hmac != expected_hmac:
raise AuthSecurityFailure('Tor provided the wrong server nonce', cookie_path)
try:
client_hash = _hmac_sha256(
CLIENT_HASH_CONSTANT,
cookie_data + client_nonce + authchallenge_response.server_nonce)
auth_response = _msg(controller, 'AUTHENTICATE %s' % stem.util.str_tools._to_unicode(binascii.b2a_hex(client_hash)))
except stem.ControllerError as exc:
try:
controller.connect()
except:
pass
if not suppress_ctl_errors:
raise
else:
raise CookieAuthRejected('Socket failed (%s)' % exc, cookie_path, True, auth_response)
# if we got anything but an OK response then err
if not auth_response.is_ok():
try:
controller.connect()
except:
pass
# all we have to go on is the error message from tor...
# ... Safe cookie response did not match expected value
# ... *or* authentication cookie.
if '*or* authentication cookie.' in str(auth_response) or \
'Safe cookie response did not match expected value' in str(auth_response):
raise IncorrectCookieValue(str(auth_response), cookie_path, True, auth_response)
else:
raise CookieAuthRejected(str(auth_response), cookie_path, True, auth_response)
def get_protocolinfo(controller):
"""
Issues a PROTOCOLINFO query to a control socket, getting information about
the tor process running on it. If the socket is already closed then it is
first reconnected.
This can authenticate to either a :class:`~stem.control.BaseController` or
:class:`~stem.socket.ControlSocket`.
:param controller: tor controller or socket to be queried
:returns: :class:`~stem.response.protocolinfo.ProtocolInfoResponse` provided by tor
:raises:
* :class:`stem.ProtocolError` if the PROTOCOLINFO response is
malformed
* :class:`stem.SocketError` if problems arise in establishing or
using the socket
"""
try:
protocolinfo_response = _msg(controller, 'PROTOCOLINFO 1')
except:
protocolinfo_response = None
# Tor hangs up on sockets after receiving a PROTOCOLINFO query if it isn't
# next followed by authentication. Transparently reconnect if that happens.
if not protocolinfo_response or str(protocolinfo_response) == 'Authentication required.':
controller.connect()
try:
protocolinfo_response = _msg(controller, 'PROTOCOLINFO 1')
except stem.SocketClosed as exc:
raise stem.SocketError(exc)
stem.response.convert('PROTOCOLINFO', protocolinfo_response)
return protocolinfo_response
def _msg(controller, message):
"""
Sends and receives a message with either a
:class:`~stem.socket.ControlSocket` or :class:`~stem.control.BaseController`.
"""
if isinstance(controller, stem.socket.ControlSocket):
controller.send(message)
return controller.recv()
else:
return controller.msg(message)
def _connection_for_default_port(address):
"""
Attempts to provide a controller connection for either port 9051 (default for
relays) or 9151 (default for Tor Browser). If both fail then this raises the
exception for port 9051.
:param str address: address to connect to
:returns: :class:`~stem.socket.ControlPort` for the controller conneciton
:raises: :class:`stem.SocketError` if we're unable to establish a connection
"""
try:
return stem.socket.ControlPort(address, 9051)
except stem.SocketError as exc:
try:
return stem.socket.ControlPort(address, 9151)
except stem.SocketError:
raise exc
def _read_cookie(cookie_path, is_safecookie):
"""
Provides the contents of a given cookie file.
:param str cookie_path: absolute path of the cookie file
:param bool is_safecookie: **True** if this was for SAFECOOKIE
authentication, **False** if for COOKIE
:raises:
* :class:`stem.connection.UnreadableCookieFile` if the cookie file is
unreadable
* :class:`stem.connection.IncorrectCookieSize` if the cookie size is
incorrect (not 32 bytes)
"""
if not os.path.exists(cookie_path):
exc_msg = "Authentication failed: '%s' doesn't exist" % cookie_path
raise UnreadableCookieFile(exc_msg, cookie_path, is_safecookie)
# Abort if the file isn't 32 bytes long. This is to avoid exposing arbitrary
# file content to the port.
#
# Without this a malicious socket could, for instance, claim that
# '~/.bash_history' or '~/.ssh/id_rsa' was its authentication cookie to trick
# us into reading it for them with our current permissions.
#
# https://trac.torproject.org/projects/tor/ticket/4303
auth_cookie_size = os.path.getsize(cookie_path)
if auth_cookie_size != 32:
exc_msg = "Authentication failed: authentication cookie '%s' is the wrong size (%i bytes instead of 32)" % (cookie_path, auth_cookie_size)
raise IncorrectCookieSize(exc_msg, cookie_path, is_safecookie)
try:
with open(cookie_path, 'rb', 0) as f:
return f.read()
except IOError as exc:
exc_msg = "Authentication failed: unable to read '%s' (%s)" % (cookie_path, exc)
raise UnreadableCookieFile(exc_msg, cookie_path, is_safecookie)
def _hmac_sha256(key, msg):
"""
Generates a sha256 digest using the given key and message.
:param str key: starting key for the hash
:param str msg: message to be hashed
:returns: sha256 digest of msg as bytes, hashed using the given key
"""
return hmac.new(key, msg, hashlib.sha256).digest()
class AuthenticationFailure(Exception):
"""
Base error for authentication failures.
:var stem.socket.ControlMessage auth_response: AUTHENTICATE response from the
control socket, **None** if one wasn't received
"""
def __init__(self, message, auth_response = None):
super(AuthenticationFailure, self).__init__(message)
self.auth_response = auth_response
class UnrecognizedAuthMethods(AuthenticationFailure):
"""
All methods for authenticating aren't recognized.
:var list unknown_auth_methods: authentication methods that weren't recognized
"""
def __init__(self, message, unknown_auth_methods):
super(UnrecognizedAuthMethods, self).__init__(message)
self.unknown_auth_methods = unknown_auth_methods
class IncorrectSocketType(AuthenticationFailure):
'Socket does not speak the control protocol.'
class OpenAuthFailed(AuthenticationFailure):
'Failure to authenticate to an open socket.'
class OpenAuthRejected(OpenAuthFailed):
'Attempt to connect to an open control socket was rejected.'
class PasswordAuthFailed(AuthenticationFailure):
'Failure to authenticate with a password.'
class PasswordAuthRejected(PasswordAuthFailed):
'Socket does not support password authentication.'
class IncorrectPassword(PasswordAuthFailed):
'Authentication password incorrect.'
class MissingPassword(PasswordAuthFailed):
"Password authentication is supported but we weren't provided with one."
class CookieAuthFailed(AuthenticationFailure):
"""
Failure to authenticate with an authentication cookie.
:param str cookie_path: location of the authentication cookie we attempted
:param bool is_safecookie: **True** if this was for SAFECOOKIE
authentication, **False** if for COOKIE
:param stem.response.ControlMessage auth_response: reply to our
authentication attempt
"""
def __init__(self, message, cookie_path, is_safecookie, auth_response = None):
super(CookieAuthFailed, self).__init__(message, auth_response)
self.is_safecookie = is_safecookie
self.cookie_path = cookie_path
class CookieAuthRejected(CookieAuthFailed):
'Socket does not support password authentication.'
class IncorrectCookieValue(CookieAuthFailed):
'Authentication cookie value was rejected.'
class IncorrectCookieSize(CookieAuthFailed):
'Aborted because the cookie file is the wrong size.'
class UnreadableCookieFile(CookieAuthFailed):
'Error arose in reading the authentication cookie.'
class AuthChallengeFailed(CookieAuthFailed):
"""
AUTHCHALLENGE command has failed.
"""
def __init__(self, message, cookie_path):
super(AuthChallengeFailed, self).__init__(message, cookie_path, True)
class AuthChallengeUnsupported(AuthChallengeFailed):
"""
AUTHCHALLENGE isn't implemented.
"""
class UnrecognizedAuthChallengeMethod(AuthChallengeFailed):
"""
Tor couldn't recognize our AUTHCHALLENGE method.
:var str authchallenge_method: AUTHCHALLENGE method that Tor couldn't recognize
"""
def __init__(self, message, cookie_path, authchallenge_method):
super(UnrecognizedAuthChallengeMethod, self).__init__(message, cookie_path)
self.authchallenge_method = authchallenge_method
class AuthSecurityFailure(AuthChallengeFailed):
'AUTHCHALLENGE response is invalid.'
class InvalidClientNonce(AuthChallengeFailed):
'AUTHCHALLENGE request contains an invalid client nonce.'
class MissingAuthInfo(AuthenticationFailure):
"""
The PROTOCOLINFO response didn't have enough information to authenticate.
These are valid control responses but really shouldn't happen in practice.
"""
class NoAuthMethods(MissingAuthInfo):
"PROTOCOLINFO response didn't have any methods for authenticating."
class NoAuthCookie(MissingAuthInfo):
"""
PROTOCOLINFO response supports cookie auth but doesn't have its path.
:param bool is_safecookie: **True** if this was for SAFECOOKIE
authentication, **False** if for COOKIE
"""
def __init__(self, message, is_safecookie):
super(NoAuthCookie, self).__init__(message)
self.is_safecookie = is_safecookie
# authentication exceptions ordered as per the authenticate function's pydocs
AUTHENTICATE_EXCEPTIONS = (
IncorrectSocketType,
UnrecognizedAuthMethods,
MissingPassword,
IncorrectPassword,
IncorrectCookieSize,
UnreadableCookieFile,
IncorrectCookieValue,
AuthChallengeUnsupported,
UnrecognizedAuthChallengeMethod,
InvalidClientNonce,
AuthSecurityFailure,
OpenAuthRejected,
MissingAuthInfo,
AuthenticationFailure
)
stem-1.8.0/stem/cached_manual.sqlite 0000664 0001750 0001750 00000756000 13601502033 020152 0 ustar atagar atagar 0000000 0000000 SQLite format 3 @ ÷ -ñ¸
6
Ì Â>™ÿj‘å Ìf ‚
tabletorrctorrc
CREATE TABLE torrc(key TEXT PRIMARY KEY, name TEXT, category TEXT, usage TEXT, summary TEXT, description TEXT, position INTEGER))
= indexsqlite_autoindex_torrc_1torrc RtablefilesfilesCREATE TABLE files(name TEXT PRIMARY KEY, description TEXT))= indexsqlite_autoindex_files_1files XtablesignalssignalsCREATE TABLE signals(name TEXT PRIMARY KEY, description TEXT)-A indexsqlite_autoindex_signals_1signalsd##tablecommandlinecommandlineCREATE TABLE commandline(name TEXT PRIMARY KEY, description TEXT)5I# indexsqlite_autoindex_commandline_1commandline UtablemetadatametadataCREATE TABLE metadata(name TEXT, synopsis TEXT, description TEXT, man_commit TEXT, stem_commit TEXT)<UtableschemaschemaCREATE TABLE schema(version INTEGER)
ü ü
’ ’ ˆ"]7Ž)]]tor - The second-generation onion routertor [OPTION value]...Tor is a connection-oriented anonym ì ûöñì
ÿ 0¹ÿž‰aJîp¢¾9Ññ+â =--hash-password PASSWORD!-h, --help
--version6q--service install [--options command-line options]5--list-torrc-options5--keygen [--newpass];--passphrase-fd FILEDES)--quiet|--hush
C--service remove|start|stop +--verify-config %--nt-service
7--allow-missing-torrc 7--defaults-torrc FILE1--list-fingerprint ?--list-deprecated-options A--key-expiration [purpose]9--ignore-missing-torrc(U--dump-config short|full|non-builtin -f FILE) --list-modules
{ ^õ7Q Ë { NSIGXFSZIf this signal exists on your platform, Tor catches and ignores it.QSIGTERMTor will catch this, clean up and sync to disk if necessary, and exit.1[SIGPIPETor catches this signal and ignores it.cƒ?SIGINTTor clients behave as with SIGTERM; but Tor servers will do a controlled slow shutdown, closing listeners and waiting 30 seconds before exiting. (The delay can be configured with the ShutdownWaitLength config option.)V#SIGUSR1Log statistics about current connections, past connections, and throughput.d?SIGCHLDTor receives this signal when one of its helper processes has exited, so it can clean up.gESIGUSR2Switch all logs to loglevel debug. You can go back to the old loglevels by sending a SIGHUP. ‚7SIGHUPThe signal instructs Tor to reload its configuration (including closing and reopening logs), and kill and restart its helper processes if applicable.
£ ÞöÇ»¯Òê£ SIGXFSZ SIGTERM SIGPIPE
SIGINT SIGUSR1 SIGCHLD SIGUSR2 SIGHUP É ûöñìçâÝØÓÎÉ . + ( %
Ù Ù "IDataDirectory/stats/conn-stats ú Öú Õ8 Ñ ô|Xçé?ÍÑ Ú+TRUNCATELOGFILEO |'QHIDDENSERVICEENABLEINTRODOSDEFENSE “;OUTBOUNDBINDADDRESSEXIT9X ˜ ä!HTTPSPROXY.é ë ; CCOOKIEAUTHFILEGROUPREADABLE :3CIRCUITBUILDTIMEOUTU Â+YTESTINGCLIENTMAXINTERVALWITHOUTREQUEST/ Ÿ-REPHISTTRACKTIME à V-EXCLUDEEXITNODES^ izing communication service. Users choose a source-routed path through a set of nodes, and negotiate a "virtual circuit" through the network. Each node in a virtual circuit knows its predecessor and successor nodes, but no other nodes. Traffic flowing down the circuit is unwrapped by a symmetric key at each node, which reveals the downstream node.
Basically, Tor provides a distributed network of servers or relays ("onion routers"). Users bounce their TCP streams, including web traffic, ftp, ssh, etc., around the network, so that recipients, observers, and even the relays themselves have difficulty tracking the source of the stream.
Note
By default, tor acts as a client only. To help the network by providing bandwidth as a relay, change the ORPort configuration option as mentioned below. Please also consult the documentation on the Tor Project's website.616c0f823c7a65c04de7e03a2c0da1543e2be9e6fde3201470ed1b74916c893ceb8ecd6a065651bf
b nŠ6 b Q9‚{--ignore-missing-torrcSpecify that Tor should treat a missing torrc file as though it were empty. Ordinarily, Tor does this for missing default torrc files, but not for those specified on the command line.‚QU„_--dump-config short|full|non-builtinWrite a complete list of Tor's configured options to standard output. When the short flag is selected, only write the options that are different from their default values. When non-builtin is selected, write options that are not zero or the empty string. When full is selected, write every option.aƒ9-f FILESpecify a new configuration file to contain further Tor configuration options, or pass - to make Tor read its configuration from standard input. (Default: @CONFDIR@/torrc, or $HOME/.torrc if that file is not found))‚--list-modulesList whether each optional module has been compiled into Tor. (Any module not listed is not optional in this version of Tor.)
B "9 B t7ƒC--defaults-torrc FILESpecify a file in which to find default values for Tor options. The contents of this file are overridden by those in the regular configuration file, and by those on the command line. (Default: @CONFDIR@/torrc-defaults.)R1--list-fingerprintGenerate your keys and output your nickname and fingerprint.?w--list-deprecated-optionsList all valid options that are scheduled to become obsolete in a future version. (This is a warning, not a promise.)ƒ[A‡--key-expiration [purpose]The purpose specifies which type of key certificate to determine the expiration of. The only currently recognised purpose is "sign". Running tor --key-expiration sign will attempt to find your signing key certificate and will output, both in the logs as well as to stdout, the signing key certificate's expiration time in ISO-8601 format. For example, the output sent to stdout will be of the form: "signing-cert-expiry: 2017-07-25 08:30:15 UTC"
´ s3𘠴 ƒa
)‡+--quiet|--hushOverride the default console logging behavior. By default, Tor starts out logging messages at level "notice" and higher to the console. It stops doing so after it parses its configuration, if the configuration tells it to log anywhere else. These options override the default console logging behavior. Use the --hush option if you want Tor to log only warnings and errors to the console, or use the --quiet option if you want Tor not to log to the console at all.V C}--service remove|start|stopRemove, start, or stop a configured Tor Windows service.A +k--verify-configVerify whether the configuration file is valid.>
%k--nt-serviceUsed internally to implement a Windows service.
7o--allow-missing-torrcAllow the configuration file specified by -f to be missing, if the defaults-torrc file (see below) is accessible.
J ÊK7 J 3!Y-h, --helpDisplay a short help message and exit.5 ‚]--versionDisplay Tor version and exit. The output is a single line of the format "Tor version [version number]." (The version number format is as specified in version-spec.txt.)aq‚c--service install [--options command-line options]Install an instance of Tor as a Windows service, with the provided command-line options. Current instructions can be found at https://www.torproject.org/docs/faq#NTService.5;--list-torrc-optionsList all valid options.ˆt5‘E--keygen [--newpass]Running tor --keygen creates a new ed25519 master identity key for a relay, or only a fresh temp ‚3;„=--passphrase-fd FILEDESFile descriptor to read the passphrase from. Note that unlike with the tor-gencert program, the entire file contents are read and used as the passphrase, including any trailing newlines. If the file descriptor is not specified, the passphrase is read from the terminal by default. orary signing key and certificate, if you already have a master key. Optionally, you can encrypt the master identity key with a passphrase. When Tor asks you for a passphrase and you don't want to encrypt the master key, just don't enter any passphrase when asked. Use the --newpass option with --keygen only when you need to add, change, or remove a passphrase on an existing ed25519 master identity key. You will be prompted for the old passphase (if any), and the new passphrase (if any). Note When generating a master key, you may want to use --DataDirectory to control where the keys and certificates will be stored, and --SigningKeyLifetime to control their lifetimes. See the server options section to learn more about the behavior of these options. You must have write access to the specified DataDirectory. To use the generated files, you must copy them to the DataDirectory/keys directory of your Tor daemon, and make sure that they are owned by the user actually running the Tor daemon on your system.
° ° N=s--hash-password PASSWORDGenerate a hashed password for control port access.
[ 6€ðA [ $S‚CacheDirectory/unverified-consensusContains a network consensus document that has been downloaded, but which we didn't have the right certificates to check yet.=+c@CONFDIR@/torrcDefault location of the configuration file.,M‚ DataDirectory/hashed-fingerprintOnly used by bridges. Contains the hashed fingerprint of the bridge's identity key. (That is, the hash of the hash of the identity key.)
M_DataDirectory/stats/dirreq-statsOnly used by directory caches and authorities. This file is used to collect directory request statistics.31‚GDataDirectory/lockThis file is used to prevent two Tor instances from using the same data directory. If access to this file is locked, data directory is already in use by Tor.Gg‚9CacheDirectory/unverified-microdesc-consensusContains a microdescriptor-flavored network consensus document that has been downloaded, but which we didn't have the right certificates to check yet.
F g¹F ‚p }„uCacheDirectory/cached-extrainfo and cached-extrainfo.newSimilar to cached-descriptors, but holds optionally-downloaded "extra-info" documents. Relays use these documents to send inessential information about statistics, bandwidth history, and network health to the authorities. They aren't fetched by default. See the DownloadExtraInfo option for more information.+C‚%CacheDirectory/cached-certsContains downloaded directory key certificates that are used to verify authenticity of documents generated by the Tor directory authorities.OoKeyDirectory/ed25519_signing_certThe certificate which authenticates "ed25519_signing_secret_key" as having been signed by the Ed25519 master key.
j Á# Ø j l
M DataDirectory/stats/buffer-statsOnly used by servers. This file is used to collect buffer usage history.‚H „ CacheDirectory/cached-microdescs and cached-microdescs.newThese files hold downloaded microdescriptors. Lines beginning with @-signs are annotations that contain more information about a given router. The .new file is an append-only journal; when it gets too large, all entries are merged into a new cached-microdescs file. G‚DataDirectory/v3-status-votesOnly for v3 authoritative directory servers. This file contains status votes from all the authoritative directory servers.‚<
O„;DataDirectory/key-pinning-journalUsed by authorities. A line-based file that records mappings between RSA1024 and Ed25519 identity keys. Authorities enforce these mappings, so that once a relay has picked an Ed25519 key, stealing or factoring the RSA1024 key will no longer let an attacker impersonate the relay.
$ ö" · $ KgKeyDirectory/legacy_certificateAs authority_certificate; used only when V3AuthUseLegacyKey is set. See documentation for V3AuthUseLegacyKey.i?%DataDirectory/fingerprintOnly used by servers. Contains the fingerprint of the server's identity key.QQ‚cKeyDirectory/authority_signing_keyOnly directory authorities use this file. A v3 directory authority's signing key that is used to sign votes and consensuses. Corresponds to the authority_certificate cert.„I‡WDataDirectory/approved-routersOnly used by authoritative directory servers. This file lists the status of routers by their identity fingerprint. Each line lists a status and a fingerprint separated by whitespace. See your fingerprint file in the DataDirectory for an example line. If the status is !reject, then the descriptors from the given identity (fingerprint) are rejected by this server. If it is !invalid, then the descriptors are accepted but marked in the directory as not valid, that is, not recommended.
) xìLÿS ) ‚'S„
KeyDirectory/authority_identity_keyA v3 directory authority's master identity key, used to authenticate its signing key. Tor doesn't use this while it's running. The tor-gencert program uses this. If you're running an authority, you should keep this key offline, and not put it in this file.)A‚#KeyDirectory/secret_id_keyA relay's RSA1024 permanent identity key, including private and public components. Used to sign router descriptors, and to sign other keys.K=m@LOCALSTATEDIR@/lib/tor/The tor process stores keys and other data here. I‚DataDirectory/stats/conn-statsOnly used by servers. This file is used to collect approximate connection history (number of active connections over time). I[DataDirectory/unparseable-descOnion server descriptors that Tor was unable to parse are dumped to this file. Only used for debugging.QKHiddenServiceDirectory/client_keysContains authorization data for a hidden service that is only accessible by authorized clients.
à u2§ à aQƒKeyDirectory/authority_certificateOnly directory authorities use this file. A v3 directory authority's certificate which authenticates the authority's current vote- and consensus-signing key using its master identity key.IYDataDirectory/stats/exit-statsOnly used by servers. This file is used to collect outgoing connection statistics by Tor exit routers.‚@
„KeyDirectory/secret_onion_key_ntor and secret_onion_key_ntor.oldA relay's Curve25519 short-term onion key. Used to handle modern ("ntor") circuit extension requests. The .old file holds the previously generated key, which the relay uses to handle any requests that were made by clients that didn't have the new one.KWDataDirectory/stats/entry-statsOnly used by servers. This file is used to collect incoming connection statistics by Tor entry nodes.
@fZ ìì ª¯'2Ïߘ @šn‰¸ w fqº ; %ODataDirectory/control_auth_cookie.9DataDirectory/sr-state,(UDataDirectory/networkstatus-bridges`*ACacheDirectory/cached-descriptors and cached-descriptors.new) =@LOCALSTATEDIR@/lib/tor/g FCacheDirectory/cached-consensus and/or cached-microdesc-consensus$%$HOME/.torrc "IDataDirectory/router-stability ?DataDirectory/fingerprintg$MDataDirectory/stats/bridge-stats%"IDataDirectory/approved-routers$MDataDirectory/stats/buffer-stats
?CacheDirectory/cached-microdescs and cached-microdescs.new
3DataDirectory/state&%ODataDirectory/key-pinning-journal
<}CacheDirectory/cached-extrainfo and cached-extrainfo.new CCacheDirectory/cached-certs“ ?CacheDirectory/diff-cache('SCacheDirectory/unverified-consensus+@CONFDIR@/torrc$MDataDirectory/hashed-fingerprint CDataDirectory/bw_accounting+1DataDirectory/lock0g CacheDirectory/unverified-microdesc-consensus
t Û·”tqO( ˜M Ù èÕ³ ¼ tpš* #KKeyDirectory/legacy_signing_key/#KHiddenServiceDirectory/hostname-+[KeyDirectory/ed25519_signing_secret_key'-_KeyDirectory/ed25519_master_id_public_key#6qHiddenServiceDirectory/onion_service_non_anonymous"&QHiddenServiceDirectory/private_key!%ODataDirectory/stats/hidserv-stats :yKeyDirectory/secret_onion_key and secret_onion_key.old -_KeyDirectory/ed25519_master_id_secret_key &QKeyDirectory/authority_certificateE
KeyDirectory/secret_onion_key_ntor and secret_onion_key_ntor.old AKeyDirectory/secret_id_key#KKeyDirectory/legacy_certificate%OKeyDirectory/ed25519_signing_cert&QKeyDirectory/authority_signing_key'SKeyDirectory/authority_identity_key&QHiddenServiceDirectory/client_keys!GDataDirectory/v3-status-votes "IDataDirectory/unparseable-desc"IDataDirectory/stats/exit-stats#KDataDirectory/stats/entry-stats$MDataDirectory/stats/dirreq-stats
] · ¬ ] M %$HOME/.torrcFallback location for torrc, if @CONFDIR@/torrc is not found.P I‚iDataDirectory/router-stabilityOnly used by authoritative directory servers. Tracks measurements for router mean-time-between-failures so that authorities have a fair idea of how to set their Stable flags.‚5 y„KeyDirectory/secret_onion_key and secret_onion_key.oldA relay's RSA1024 short-term onion key. Used to decrypt old-style ("TAP") circuit extension requests. The .old file holds the previously generated key, which the relay uses to handle any requests that were made by clients that didn't have the new one.‚F _„?KeyDirectory/ed25519_master_id_secret_keyThe private part of a relay's Ed25519 permanent identity key. This key is used to sign the medium-term ed25519 signing key. This file can be kept offline or encrypted. If so, Tor will not be able to generate new signing keys automatically; you'll need to use tor --keygen to do so.
¤ ¶#¸, ¤ %MODataDirectory/stats/bridge-statsOnly used by servers. This file is used to collect incoming connection statistics by Tor bridges. $CacheDirectory/cached-consensus and/or cached-microdesc-consensusThe most recent consensus network status document we've downloaded.i#_KeyDirectory/ed25519_master_id_public_keyThe public part of a relay's Ed25519 permanent identity key."qAHiddenServiceDirectory/onion_service_non_anonymousThis file is present if a hidden service key was created in HiddenServiceNonAnonymousMode.V!QoHiddenServiceDirectory/private_keyContains the private key for this hidden service.o Oƒ!DataDirectory/stats/hidserv-statsOnly used by servers. This file is used to collect approximate counts of what fraction of the traffic is hidden service rendezvous traffic, and approximately how many hidden services the relay has seen.
€ ¨µ € ‚2(?„7CacheDirectory/diff-cacheDirectory cache only. Holds older consensuses and diffs from oldest to the most recent consensus of each type compressed in various ways. Each file contains a set of key-value arguments describing its contents, followed by a single NUL byte, followed by the main file contents.p'[ƒKeyDirectory/ed25519_signing_secret_keyThe private and public components of a relay's medium-term Ed25519 signing key. This key is authenticated by the Ed25519 master key, which in turn authenticates other keys (and router descriptors).‚U&3… DataDirectory/stateContains a set of persistent key-value mappings. These include: o the current entry guards and their status. o the current bandwidth accounting values. o when the file was last written o what version of Tor generated the state file o a short history of bandwidth usage, as produced in the server descriptors.
œ M• œ v+Cƒ;DataDirectory/bw_accountingThis file is obsolete and the data is now stored in the state file instead. Used to track bandwidth accounting values (when the current period starts and ends; how much has been read and written so far this period).5*U‚'DataDirectory/networkstatus-bridges`Only used by authoritative bridge directories. Contains information about bridges that have self-reported themselves to the bridge authority.ƒ0)…kCacheDirectory/cached-descriptors and cached-descriptors.newThese files contain the downloaded router statuses. Some routers may appear more than once; if so, the most recently published descriptor is used. Lines beginning with @-signs are annotations that contain more information about a given router. The .new file is an append-only journal; when it gets too large, all entries are merged into a new cached-descriptors file.
Y j‚ Y ‚&.O„DataDirectory/control_auth_cookieThis file can be used only when cookie authentication is enabled. Used for cookie authentication with the controller. Location can be overridden by the CookieAuthFile configuration option. Regenerated on startup. See control-spec.txt in torspec for details.ƒe-K‡HiddenServiceDirectory/hostnameThe .onion domain name for this hidden service. If the hidden service is restricted to authorized clients only, this file also contains authorization data for all clients. Note The clients will ignore any extra subdomains prepended to a hidden service hostname. Supposing you have "xyz.onion" as your hostname, you can ask your clients to connect to "www.xyz.onion" or "irc.xyz.onion" for virtual-hosting purposes.,9DataDirectory/sr-stateAuthority only. This file is used to record information about the current status of the shared-random-value voting state.
m m /KgKeyDirectory/legacy_signing_keyAs authority_signing_key: used only when V3AuthUseLegacyKey is set. See documentation for V3AuthUseLegacyKey.
Y ÿY ƒ# c…1 ACCELNAMEAccelNameGeneralNAMEOpenSSL engine name for crypto accelerationWhen using OpenSSL hardware crypto acceleration attempt to load the dynamic engine of this name. This must be used for any dynamic hardware engine. Names can be verified with the openssl engine command. Can not be changed while tor is running.
If the engine name is prefixed with a "!", then Tor will exit if the engine cannot be loaded.~ MƒACCELDIRAccelDirGeneralDIRCrypto acceleration library pathSpecify this option if using dynamic hardware acceleration and the engine implementation library resides somewhere other than the OpenSSL default. Can not be changed while tor is running.
ƒz ==mm…?ALTERNATEBRIDGEAUTHORITYAlternateBridgeAuthorityGeneral[nickname] [flags] ipv4address:port fingerprintAlternative directory authorities (bridges only)These options behave as DirAuthority, but they replace fewer of the default directory authorities. Using AlternateDirAuthority replaces the default Tor directory authorities, but leaves the default bridge authorities in place. Similarly, AlternateBridgeAuthority replaces the default bridge authority, but leaves the directory authorities alone.
ó ó ‚ 11W‚wANDROIDIDENTITYTAGAndroidIdentityTagGeneraltagTag when logging to android subsystemWhen logging to Android's logging subsystem, adds a tag to the log identity such that log entries are marked with "Tor-tag". Can not be changed while tor is running. (Default: none)ƒu 77kq…?ALTERNATEDIRAUTHORITYAlternateDirAuthorityGeneral[nickname] [flags] ipv4address:port fingerprintAlternative directory authorities (consensus only)These options behave as DirAuthority, but they replace fewer of the default directory authorities. Using AlternateDirAuthority replaces the default Tor directory authorities, but leaves the default bridge authorities in place. Similarly, AlternateBridgeAuthority replaces the default bridge authority, but leaves the directory authorities alone.
J ÛÒ J Š}
''G“BANDWIDTHRATEBandwidthRateGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsAverage bandwidth usage limitA token bucket limits the average incoming bandwidth usage on this node to the specified number of bytes per second, and the average outgoing bandwidth usage to that same value. If you want to run a relay in the public network, this needs to be at the ve %‚
))G‚
BANDWIDTHBURSTBandwidthBurstGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsMaximum bandwidth usage limitLimit the maximum token bucket size (also known as the burst) to the given number of bytes in each direction. (Default: 1 GByte)‚" ++mƒ
AVOIDDISKWRITESAvoidDiskWritesGeneral0|1Toggles if tor avoids frequently writing to diskIf non-zero, try to write to disk less frequently than we would otherwise. This is useful when running on flash memory or other media that support only a limited number of writes. (Default: 0) ry least 75 KBytes for a relay (that is, 600 kbits) or 50 KBytes for a bridge (400 kbits) -- but of course, more is better; we recommend at least 250 KBytes (2 mbits) if possible. (Default: 1 GByte)
Note that this option, and other bandwidth-limiting options, apply to TCP data only: They do not count TCP headers or DNS traffic.
Tor uses powers of two, not powers of ten, so 1 GByte is 1024*1024*1024 bytes as opposed to 1 billion bytes.
With this option, and in other options that take arguments in bytes, KBytes, and so on, other formats are also supported. Notably, "KBytes" can also be written as "kilobytes" or "kb"; "MBytes" can be written as "megabytes" or "MB"; "kbits" can be written as "kilobits"; and so forth. Case doesn't matter. Tor also accepts "byte" and "bit" in the singular. The prefixes "tera" and "T" are also recognized. If no units are given, we default to bytes. To avoid confusion, we recommend writing "bytes" or "bits" explicitly, since it's easy to forget that "B" means bytes, not bits.
] 0] ƒP
CC i…3CACHEDIRECTORYGROUPREADABLECacheDirectoryGroupReadableGeneral0|1|autoGroup read permissions for the cache directoryIf this option is set to 0, don't allow the filesystem group to read the CacheDirectory. If the option is set to 1, make the CacheDirectory readable by the default GID. If the option is "auto", then we use the setting for DataDirectoryGroupReadable when the CacheDirectory is the same as the DataDirectory, and 0 otherwise. (Default: auto) M ))W}CACHEDIRECTORYCacheDirectoryGeneralDIRDirectory where information is cachedStore cached directory data in DIR. Can not be changed while tor is running. (Default: uses the value of DataDirectory.)
Y Y …$
;;ˆICIRCUITPRIORITYHALFLIFECircuitPriorityHalflifeGeneralNUMOverwrite method for prioritizing traffic among relayed connectionsIf this value is set, we override the default algorithm for choosing which circuit's cell to deliver or relay next. It is delivered first to the circuit that has the lowest weighted cell count, where cells are weighted exponentially according to this value (in seconds). If the value is -1, it is taken from the consensus if possible else it will fallback to the default value of 30. Minimum: 1, Maximum: 2147483647. This can be defined as a float value. This is an advanced option; you generally shouldn't have to mess with it. (Default: -1)
ü ü † 77[a‰wCLIENTTRANSPORTPLUGINClientTransportPluginGeneraltransport exec path-to-binary [options]Proxy when establishing bridge connectionsIn its first form, when set along with a corresponding Bridge line, the Tor client forwards its traffic to a SOCKS-speaking proxy on "IP:PORT". (IPv4 addresses should written as-is; IPv6 addresses should be wrapped in square brackets.) It's the duty of that proxy to properly forward the traffic to the bridge.
In its second form, when set along with a corresponding Bridge line, the Tor client launches the pluggable transport proxy executable in path-to-binary using options as its command-line options, and forwards its traffic to it. It's the duty of that proxy to properly forward the traffic to the bridge. (Default: none)
‹ ˆ? 11YOCONSTRAINEDSOCKETSConstrainedSocketsGeneral0|1Shrinks sockets to ConstrainedSockSizeIf set, To *†r
sŒ?CONNLIMITConnLimitGeneralNUMMinimum number of file descriptors for Tor to startThe minimum number of file descriptors that must be available to the Tor process before it will start. Tor will ask the OS for as many file descriptors as the OS will allow (you can find this by "ulimit -H -n"). If this number is less than ConnLimit, then Tor will refuse to start.
Tor relays need thousands of sockets, to connect to every other relay. If you are running a private bridge, you can reduce the number of sockets that Tor uses. For example, to limit Tor to 500 sockets, run "ulimit -n 500" in a shell. Then start tor in the same shell, with ConnLimit 500. You may also need to set DisableOOSCheck 0.
Unless you have severely limited sockets, you probably don't need to adjust ConnLimit itself. It has no effect on Windows, since that platform lacks getrlimit(). (Default: 1000) r will tell the kernel to attempt to shrink the buffers for all sockets to the size specified in ConstrainedSockSize. This is useful for virtual servers and other environments where system level TCP buffers may be limited. If you're on a virtual server, and you encounter the "Error creating network socket: No buffer space available" message, you are likely experiencing this problem.
The preferred solution is to have the admin increase the buffer pool for the host itself via /proc/sys/net/ipv4/tcp_mem or equivalent facility; this configuration option is a second-resort.
The DirPort option should also not be used if TCP buffers are scarce. The cached directory requests consume additional sockets which exacerbates the problem.
You should not enable this feature unless you encounter the "no buffer space available" issue. Reducing the TCP buffers affects window size for the TCP stream and will reduce throughput in proportion to round trip time on long paths. (Default: 0)
‘ ²Ë ‘ ‚7 EEmƒCONTROLPORTFILEGROUPREADABLEControlPortFileGroupReadableGeneral0|1Group read permissions for the control port fileIf this option is set to 0, don't allow the filesystem group to read the control port file. If the option is set to 1, make the control port file readable by the default GID. (Default: 0)‰\
##W‘3CONTROLPORTControlPortGeneral[address:]port|unix:path|auto [flags]Port providing access to tor controllers (nyx, vidalia, etc)If set, Tor will accept connections on this port and allow those connections to control ,‚K 33)yƒ-CONSTRAINEDSOCKSIZEConstrainedSockSizeGeneralN bytes|KBytesLimit for the received and transmit buffers of socketsWhen ConstrainedSockets is enabled the receive and transmit buffers for all sockets will be set to this limit. Must be a value between 2048 and 262144, in 1024 byte increments. Default of 8192 is recommended. the Tor process using the Tor Control Protocol (described in control-spec.txt in torspec). Note: unless you also specify one or more of HashedControlPassword or CookieAuthentication, setting this option will cause Tor to allow any process on the local host to control it. (Setting both authentication methods means either method is sufficient to authenticate to Tor.) This option is required for many Tor controllers; most use the value of 9051. If a unix domain socket is used, you may quote the path using standard C escape sequences. You can specify this directive multiple times, to bind to multiple address/port pairs. Set it to "auto" to have Tor pick a port for you. (Default: 0)
Recognized flags are:
GroupWritable
Unix domain sockets only: makes the socket get created as group-writable.
WorldWritable
Unix domain sockets only: makes the socket get created as world-writable.
RelaxDirModeCheck
Unix domain sockets only: Do not insist that the directory that holds the socket be read-restricted.
“ ×è “ ‚R CCgƒCCONTROLSOCKETSGROUPWRITABLEControlSocketsGroupWritableGeneral0|1Group read permissions for the control socketIf this option is set to 0, don't allow the filesystem group to read and write unix sockets (e.g. ControlSocket). If the option is set to 1, make the control socket readable and writable by the default GID. (Default: 0)l ''Q‚CCONTROLSOCKETControlSocketGeneralPathSocket providing controller accessLike ControlPort, but listens on a Unix domain socket, rather than a TCP socket. 0 disables ControlSocket. (Unix and Unix-like systems only.) (Default: 0)‚& 99y‚kCONTROLPORTWRITETOFILEControlPortWriteToFileGeneralPathPath for a file tor writes containing its control portIf set, Tor writes the address and port of any control port it opens to this address. Usable by controllers to learn the actual control port when ControlPort is set to "auto".
— i— O ))WCOOKIEAUTHFILECookieAuthFileGeneralPathLocation of the authentication cookieIf set, this option overrides the default location and file name for Tor's cookie file. (See CookieAuthentication above.)ƒ 55i„aCOOKIEAUTHENTICATIONCookieAuthenticationGeneral0|1If set, authenticates controllers via a cookieIf this option is set to 1, allow connections on the control port when the connecting process knows the contents of a file named "control_auth_cookie", which Tor will create in its data directory. This authentication method should only be used on systems with good filesystem security. (Default: 0)
_ ‚K 77gƒMCOUNTPRIVATEBANDWIDTHCountPrivateBandwidthGeneral0|1Applies rate limiting to private IP addressesIf this option is set, then Tor's rate-limiting applies not only to remote connections, but also to connections to private addresses like 127.0.0.1 or 10.0.0.1. This is mostly useful for debugging rate-limiting. (Default: 0)ƒ CCu„MCOOKIEAUTHFILEGROUPREADABLECookieAuthFileGroupReadableGeneral0|1Group read permissions for the authentication cookieIf this option is set to 0, don't allow the filesystem group to read the cookie file. If the option is set to 1, make the cookie file readable by the default GID. [Making the file readable by other groups is not yet implemented; let us know if you need this for some reason.] (Default: 0)
ž Éž ‚( AAg‚sDATADIRECTORYGROUPREADABLEDataDirectoryGroupReadableGeneral0|1Group read permissions for the data directoryIf this option is set to 0, don't allow the filesystem group to read the DataDirectory. If the option is set to 1, make the DataDirectory readable by the default GID. (Default: 0)‚4 ''uƒ1DATADIRECTORYDataDirectoryGeneralDIRLocation for storing runtime data (state, keys, etc)Store working data in DIR. Can not be changed while tor is running. (Default: ~/.tor if your home directory is not /; otherwise, @LOCALSTATEDIR@/lib/tor. On Windows, the default is your ApplicationData folder.) e directory server is chosen randomly with probability proportional to that weight (default 1.0). If a flag "v3ident=fp" is given, the dirserver is a v3 directory authority whose v3 long-term signing key has the fingerprint fp. Lastly, if an "ipv6=[ipv6address]:orport" flag is present, then the directory authority is listening for IPv6 connections on the indicated IPv6 address and OR Port.
Tor will contact the authority at ipv4address to download directory documents. Clients always use the ORPort. Relays usually use the DirPort, but will use the ORPort in some circumstances. If an IPv6 ORPort is supplied, clients will also download directory documents at the IPv6 ORPort, if they are configured to use IPv6.
If no DirAuthority line is given, Tor will use the default directory authorities. NOTE: this option is intended for setting up a private Tor network with its own directory authorities. If you use it, you will be distinguishable from other users, because you won't believe the same authorities they do.
ê ê Ž %%qOš+DIRAUTHORITYDirAuthorityGeneral[nickname] [flags] ipv4address:dirport fingerprintAlternative directory authoritiesUse a nonstandard authoritative directory server at the provided address and port, with the specified key fingerprint. This option can be repeated many times, for multiple authoritative directory servers. Flags are separated by spaces, and determine what kind of an authority this directory is. By default, an authority is not authoritative for any directory style or version unless an appropriate flag is given.
Tor will use this authority as a bridge authoritative directory if the "bridge" flag is set. If a flag "orport=orport" is given, Tor will use the given port when opening encrypted tunnels to the dirserver. If a flag "weight=num" is given, then th 1
, g , „8 ))w‡3DISABLEALLSWAPDisableAllSwapGeneral0|1Locks all allocated memory so they can't be paged outIf set to 1, Tor will attempt to lock all current and future memory pages, so that memory cannot be paged out. Windows, OS X and Solaris are currently not supported. We believe that this feature works on modern Gnu/Linux distributions, and that it should work on *BSD systems (untested). This option requires that you start your Tor as root, and you should use the User option to properly reduce Tor's privileges. Can not be changed while tor is running. (Default: 0) ƒ ==[„cDIRAUTHORITYFALLBACKRATEDirAuthorityFallbackRateGeneralNUMRate at which to use fallback directoryWhen configured to use both directory authorities and fallback directories, the directory authorities also work as fallbacks. They are chosen with their regular weights, multiplied by this number, which should be 1.0 or less. The default is less than 1, to reduce load on authorities. (Default: 0.1) n retrieve about the processIf set to 1, Tor will attempt to prevent basic debugging attachment attempts by other processes. This may also keep Tor from generating core files if it crashes. It has no impact for users who wish to attach if they have CAP_SYS_PTRACE or if they are root. We believe that this feature works on modern Gnu/Linux distributions, and that it may also work on *BSD systems (untested). Some modern Gnu/Linux systems such as Ubuntu have the kernel.yama.ptrace_scope sysctl and by default enable it as an attempt to limit the PTRACE scope for all user processes by default. This feature will attempt to limit the PTRACE scope for Tor specifically - it will not attempt to alter the system wide ptrace scope as it may not even exist. If you wish to attach to Tor with a debugger such as gdb or strace you will want to set this to 0 for the duration of your debugging. Normal users should leave it on. Disabling this option while Tor is running is prohibited. (Default: 1)
™ ’™ ƒv ))[†KDISABLENETWORKDisableNetworkGeneral0|1Don't accept non-controller connectionsWhen this option is set, we don't listen for or accept any connections other than controller connections, and we close (and don't reattempt) any outbound connections. Controllers sometimes use this option to avoid using the network until Tor is fully configured. Tor will make still certain network-related calls (like DNS lookups) as a part of its configuration process, even if DisableNetwork is set. (Default: 0) ˆG
??DISABLEDEBUGGERATTACHMENTDisableDebuggerAttachmentGeneral0|1Limit information applications ca 4
% Sd % ‚<" ;;oƒ EXTORPORTCOOKIEAUTHFILEExtORPortCookieAuthFileGeneralPathLocation of the ExtORPort's authentication cookieIf set, this option overrides the default location and file name for the Extended ORPort's cookie file -- the cookie file is needed for pluggable transports to communicate through the Extended ORPort.!l! 3]‚)EXTORPORTExtORPortGeneral[address:]port|autoEndpoint for extended ORPort connectionsOpen this port to listen for Extended ORPort connections from your pluggable transports.
(Default: DataDirectory/extended_orport_auth_cookie) ƒ* // q…EXTENDBYED25519IDExtendByEd25519IDGeneral0|1|autoInclude Ed25519 identifier when extending circuitsIf this option is set to 1, we always try to include a relay's Ed25519 ID when telling the proceeding relay in a circuit to extend to it. If this option is set to 0, we never include Ed25519 IDs when extending circuits. If the option is set to "default", we obey a parameter in the consensus document. (Default: auto)
‰ /Á ‰ ‚5%
//ƒFETCHDIRINFOEARLYFetchDirInfoEarlyGeneral0|1Keeps consensus information up to date, even if unnecessaryIf set to 1, Tor will always fetch directory information like other directory caches, even if you don't meet the normal criteria for fetching early. Normal users should leave it off. (Default: 0)$‡^$
##?{ŒYFALLBACKDIRFallbackDirGeneralipv4address:dirport orport=orport id=fingerprint [weight=num] [i 8ƒN#
UU
„oEXTORPORTCOOKIEAUTHFILEGROUPREADABLEExtORPortCookieAuthFileGroupReadableGeneral0|1Group read permissions for the ExtORPort's authentication cookieIf this option is set to 0, don't allow the filesystem group to read the Extended OR Port cookie file. If the option is set to 1, make the cookie file readable by the default GID. [Making the file readable by other groups is not yet implemented; let us know if you need this for some reason.] (Default: 0)" pv6=[ipv6address]:orport]Fallback when unable to retrieve descriptor informationWhen tor is unable to connect to any directory cache for directory info (usually because it doesn't know about any yet) it tries a hard-coded directory. Relays try one directory authority at a time. Clients try multiple directory authorities and FallbackDirs, to avoid hangs on startup if a hard-coded directory is down. Clients wait for a few seconds between each attempt, and retry FallbackDirs more often than directory authorities, to reduce the load on the directory authorities.
FallbackDirs should be stable relays with stable IP addresses, ports, and identity keys. They must have a DirPort.
By default, the directory authorities are also FallbackDirs. Specifying a FallbackDir replaces Tor's default hard-coded FallbackDirs (if any). (See the DirAuthority entry for an explanation of each flag.)#
E ¨E ‚`'
;;ƒ;FETCHHIDSERVDESCRIPTORSFetchHidServDescriptorsGeneral0|1Toggles if hidden service descriptors are fetched automatically or notIf set to 0, Tor will never fetch any hidden service descriptors from the rendezvous directories. This option is only useful if you're using a Tor controller that handles hidden service fetches for you. (Default: 1)&‚U& 99{ƒIFETCHDIRINFOEXTRAEARLYFetchDirInfoExtraEarlyGeneral0|1Updates consensus information when it's first availableIf set to 1, Tor will fetch directory information before other directory caches. It will attempt to download directory information closer to the start of the consensus period. Normal users should leave it off. (Default: 0)%
s ( _ ôæÓ¿ª€cI2 òØ» ~§wYE2 ÿßèŽzgUJ. _ ö å Ò ² ž s )BRIDGEPASSWORD ý AAUTHDIRHASIPV6CONNECTIVITY)CELLSTATISTICS Ñ CCACHEDIRECTORYGROUPREADABLE
)CACHEDIRECTORY #BRIDGERELAY ° ABRIDGERECORDUSAGEBYCOUNTRY Í1BRIDGEDISTRIBUTION ±9BRIDGEAUTHORITATIVEDIR ë
BRIDGES'BANDWIDTHRATE)BANDWIDTHBURST+AVOIDDISKWRITES5AUTOMAPHOSTSSUFFIXES ‹7AUTOMAPHOSTSONRESOLVE Š9AUTHORITATIVEDIRECTORY æ AAUTHDIRTESTED25519LINKKEYS ü ;AUTHDIRSHAREDRANDOMNESS û-AUTHDIRREJECTCCS õ'AUTHDIRREJECT ò)AUTHDIRPINKEYS ú =AUTHDIRMAXSERVERSPERADDR ÷3AUTHDIRLISTBADEXITS ö/AUTHDIRINVALIDCCS ô)AUTHDIRINVALID ñ ;AUTHDIRGUARDBWGUARANTEE ù5AUTHDIRFASTGUARANTEE ø/AUTHDIRBADEXITCCS ó)AUTHDIRBADEXIT ð+ASSUMEREACHABLE ¯1ANDROIDIDENTITYTAG7ALTERNATEDIRAUTHORITY =ALTERNATEBRIDGEAUTHORITY ;ALLOWNONRFC953HOSTNAMES … ADDRESS ®+ACCOUNTINGSTART Å)ACCOUNTINGRULE Ä'ACCOUNTINGMAX Ã
ACCELNAME ACCELDIR
u íÑ´›FÍw`Q4õÛȵ˜‚t_H0 î Ó Á ¡ ˆ u UŠt Ö » ’ )COOKIEAUTHFILE5COOKIEAUTHENTICATION CCONTROLSOCKETSGROUPWRITABLE'CONTROLSOCKET9CONTROLPORTWRITETOFILE ECONTROLPORTFILEGROUPREADABLE#CONTROLPORT#CONTACTINFO ²3CONSTRAINEDSOCKSIZE1CONSTRAINEDSOCKETS+CONSENSUSPARAMS î
CONNLIMIT
/CONNECTIONPADDINGY ;CONNDIRECTIONSTATISTICS Ö'CLIENTUSEIPV6 ¡'CLIENTUSEIPV4 7CLIENTTRANSPORTPLUGIN "GCLIENTREJECTINTERNALADDRESSES Ž9CLIENTPREFERIPV6ORPORT £ ;CLIENTPREFERIPV6DIRPORT ¢!CLIENTONLYX1CLIENTONIONAUTHDIRj%MCLIENTDNSREJECTINTERNALADDRESSES /aCLIENTBOOTSTRAPCONSENSUSMAXINPROGRESSTRIES ©9uCLIENTBOOTSTRAPCONSENSUSFALLBACKDOWNLOADINITIALDELAY §>CLIENTBOOTSTRAPCONSENSUSAUTHORITYONLYDOWNLOADINITIALDELAY ¨:wCLIENTBOOTSTRAPCONSENSUSAUTHORITYDOWNLOADINITIALDELAY ¦5CLIENTAUTOIPV6ORPORT ¤5CIRCUITSTREAMTIMEOUTW =CIRCUITSAVAILABLETIMEOUTV;CIRCUITPRIORITYHALFLIFE )CIRCUITPADDING[
E ¤6E n* ''u‚%HARDWAREACCELHardwareAccelGeneral0|1Toggles if tor attempts to use hardware accelerationIf non-zero, try to use built-in (static) crypto hardware acceleration when available. Can not be changed while tor is running. (Default: 0))ˆM)
;;% FETCHUSELESSDESCRIPTORSFetchUselessDescriptorsGeneral0|1Toggles if relay descriptors are fetc =‚Y( 99}ƒOFETCHSERVERDESCRIPTORSFetchServerDescriptorsGeneral0|1Toggles if the consensus is fetched automatically or notIf set to 0, Tor will never fetch any network status summaries or server descriptors from the directory servers. This option is only useful if you're using a Tor controller that handles directory fetches for you. (Default: 1)' hed when they aren't strictly necessaryIf set to 1, Tor will fetch every consensus flavor, and all server descriptors and authority certificates referenced by those consensuses, except for extra info descriptors. When this option is 1, Tor will also keep fetching descriptors, even when idle. If set to 0, Tor will avoid fetching useless descriptors: flavors that it is not using to build circuits, and authority certificates it does not trust. When Tor hasn't built any application circuits, it will go idle, and stop fetching descriptors. This option is useful if you're using a tor client with an external parser that uses a full consensus. This option fetches all documents except extrainfo descriptors, DirCache fetches and serves all documents except extrainfo descriptors, DownloadExtraInfo* fetches extrainfo documents, and serves them if DirCache is on, and UseMicrodescriptors changes the flavour of consensues and descriptors that is fetched and used for building circuits. (Default: 0)(
. \. ‚+, #MƒGHTTPPROXYHTTPProxyGeneralhost[:port]HTTP proxy for connecting to torTor will make all its directory requests through this host:port (or host:80 if port is not specified), rather than connecting directly to any directory servers. (DEPRECATED: As of 0.3.1.0-alpha you should use HTTPSProxy.)+ƒ!+
77+„CHASHEDCONTROLPASSWORDHashedControlPasswordGeneralhashed_passwordHash of the password for authenticating to the control portAllow connections on the control port if they present the password whose one-way hash is hashed_password. You can compute the hash of a password by running "tor --hash-password password". You can provide several acceptable passwords by using more than one HashedControlPassword line.*
¸ K ¸ ƒ. !!#K…HTTPSPROXYHTTPSProxyGeneralhost[:port]SSL proxy for connecting to torTor will make all its OR (SSL) connections through this host:port (or host:443 if port is not specified), via HTTP CONNECT rather than connecting directly to servers. You may want to set FascistFirewall to restrict the set of ports you might try to connect to, if your HTTPS proxy only allows connecting to certain ports.-ƒ2- 99/]…HTTPPROXYAUTHENTICATORHTTPProxyAuthenticatorGeneralusername:passwordAuthentication credentials for HTTPProxyIf defined, Tor will use this username:password for Basic HTTP proxy authentication, as in RFC 2617. This is currently the only form of HTTP proxy authentication that Tor supports; feel free to submit a patch if you want it to support others. (DEPRECATED: As of 0.3.1.0-alpha you should use HTTPSProxyAuthenticator.),
ž ž o0 ++[‚9KEEPALIVEPERIODKeepalivePeriodGeneralNUMRate at which to send keepalive packetsTo keep firewalls from expiring connections, send a padding keepalive cell every NUM seconds on open connections that are in use. (Default: 5 minutes)/‚m/ ;;/_ƒuHTTPSPROXYAUTHENTICATORHTTPSProxyAuthenticatorGeneralusername:passwordAuthentication credentials for HTTPSProxyIf defined, Tor will use this username:password for Basic HTTPS proxy authentication, as in RFC 2617. This is currently the only form of HTTPS proxy authentication that Tor supports; feel free to submit a patch if you want it to support others..
ð ‰a2
Y‘WLOGLogGeneral[domain,...]minSeverity[-maxSeverity] ... stderr|stdout|syslogRunlevels and location for tor loggingAs above, but select messages by range of log severity and by a set of "logging domains". Each logging dom B„
1 55 o†CKEEPBINDCAPABILITIESKeepBindCapabilitiesGeneral0|1|autoRetain permission for binding to low valued portsOn Linux, when we are started as root and we switch our identity using the User option, the KeepBindCapabilities option tells us whether to try to retain our ability to bind to low ports. If this value is 1, we try to keep the capability; if it is 0 we do not; and if it is auto, we keep the capability only if we are configured to listen on a low port. Can not be changed while tor is running. (Default: auto.)0 ain corresponds to an area of functionality inside Tor. You can specify any number of severity ranges for a single log statement, each of them prefixed by a comma-separated list of logging domains. You can prefix a domain with ~ to indicate negation, and use * to indicate "all domains". If you specify a severity range without a list of domains, it matches all domains.
This is an advanced feature which is most useful for debugging one or two of Tor's subsystems at a time.
The currently recognized domains are: general, crypto, net, config, fs, protocol, mm, http, app, control, circ, rend, bug, dir, dirserv, or, edge, acct, hist, handshake, heartbeat, channel, sched, guard, consdiff, dos, process, pt, btrack, and mesg. Domain names are case-insensitive.
For example, "Log [handshake]debug [~net,~mm]info notice stdout" sends to stdout: all handshake messages of any severity, all info-and-higher messages from domains other than networking and memory management, and all messages of severity notice or higher.1
× × × ƒ}4 11e†?LOGTIMEGRANULARITYLogTimeGranularityGeneralNUMlimits granularity of log message timestampsSet the resolution of timestamps in Tor's logs to NUM milliseconds. NUM must be positive and either a divisor or a multiple of 1 second. Note that this option only controls the granularity written by Tor to a file or console log. Tor does not (for example) "batch up" log messages to affect times logged by a controller, times attached to syslog messages, or the mtime fields on log files. (Default: 1 second)3‚&3 //[ƒ LOGMESSAGEDOMAINSLogMessageDomainsGeneral0|1Includes a domain when logging messagesIf 1, Tor includes message domains with each log message. Every log message currently has at least one domain; most currently have exactly one. This doesn't affect controller log messages. (Default: 0)2
ö ö „5 99… MAXADVERTISEDBANDWIDTHMaxAdvertisedBandwidthGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsLimit for the bandwidth we advertise as being available for relayingIf set, we will not advertise more than this amount of bandwidth for our BandwidthRate. Server operators who want to reduce the number of clients who ask to build circuits through them (since this is proportional to advertised bandwidth rate) can thus reduce the CPU demands on their server without impacting network performance.4
´ û ´ ‚D7 ]„NOEXECNoExecGeneral0|1Prevents any launch of other executablesIf this option is set to 1, then Tor will never launch another executable, regardless of the settings of ClientTransportPlugin or ServerTransportPlugin. Once this option has been set to 1, it cannot be set back to 0 without restarting Tor. (Default: 0)6„6 CCSw…SMAXUNPARSEABLEDESCSIZETOLOGMaxUnparseableDescSizeToLogGeneralN bytes|KBytes|MBytes|GBytes|TBytesSize of the dedicated log for unparseable descriptorsUnparseable descriptors (e.g. for votes, consensuses, routers) are logged in separate files by hash, up to the specified size in total. Note that only files logged during the lifetime of this Tor process count toward the total; this is intended to be used to debug problems without opening live servers to resource exhaustion attacks. (Default: 10 MBytes)5
À À „=8 33Y‡IOUTBOUNDBINDADDRESSOutboundBindAddressGeneralIPSets the IP used for connecting to torMake all outbound connections originate from the IP address specified. This is only useful when you have multiple network interfaces, and you want all of Tor's outgoing connections to use a single one. This option may be used twice, once with an IPv4 address and once with an IPv6 address. IPv6 addresses should be wrapped in square brackets. This setting will be ignored for connections to the loopback addresses (127.0.0.0/8 and ::1), and is not used for DNS requests as well.7
ƒu9
;;…OUTBOUNDBINDADDRESSEXITOutboundBindAddressExitGeneralIPMake outbound exit connections originate from this addressMake all outbound exit connections originate from the IP address specified. This option overrides OutboundBindAddress for the same IP version. This option may be used twice, once with an IPv4 address and once with an IPv6 address. IPv6 addresses should be wrapped in square brackets. This setting will be ignored for connections to the loopback addresses (127.0.0.0/8 and ::1).8
® ò ® ‚A;
))i‚aPERCONNBWBURSTPerConnBWBurstGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsMaximum relayed bandwidth limit per connectionIf this option is set manually, or via the "perconnbwburst" consensus field, Tor will use it for separate rate limiting for each connection from a non-relay. (Default: 0):„ :
77 †+OUTBOUNDBINDADDRESSOROutboundBindAddressORGeneralIPMake outbound non-exit connections originate from this addressMake all outbound non-exit (relay and other) connections originate from the IP address specified. This option overrides OutboundBindAddress for the same IP version. This option may be used twice, once with an IPv4 address and once with an IPv6 address. IPv6 addresses should be wrapped in square brackets. This setting will be ignored for connections to the loopback addresses (127.0.0.0/8 and ::1).9
ë ¿ú ë ‚ > --k‚_PROTOCOLWARNINGSProtocolWarningsGeneral0|1Toggles if protocol errors give warnings or notIf 1, Tor will log with severity 'warn' various cases of other parties not following the Tor specification. Otherwise, they are logged with severity 'info'. (Default: 0)=B= ucPIDFILEPidFileGeneralFILEPath for a file tor writes containing its process idOn startup, write our PID to FILE. On clean shutdown, remove FILE. Can not be changed while tor is running.<‚><
''i‚_PERCONNBWRATEPerConnBWRateGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsAverage relayed bandwidth limit per connectionIf this option is set manually, or via the "perconnbwrate" consensus field, Tor will use it for separate rate limiting for each connection from a non-relay. (Default: 0);
C C ƒ:?
33a„GRELAYBANDWIDTHBURSTRelayBandwidthBurstGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsMaximum bandwidth usage limit for relayingIf not 0, limit the maximum token bucket size (also known as the burst) for _relayed traffic_ to the given number of bytes in each direction. They do not include directory fetches by the relay (from authority or other relays), because that is considered "client" activity. (Default: 0)>
c ~ c ‚A ##[ƒRUNASDAEMONRunAsDaemonGeneral0|1Toggles if tor runs as a daemon processIf 1, Tor forks and daemonizes to the background. This option has no effect on Windows; instead you should use the --service command-line option. Can not be changed while tor is running. (Default: 0)@„@
11a‡URELAYBANDWIDTHRATERelayBandwidthRateGeneralN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsAverage bandwidth usage limit for relayingIf not 0, a separate token bucket limits the average incoming bandwidth usage for _relayed traffic_ on this node to the specified number of bytes per second, and the average outgoing bandwidth usage to that same value. Relayed traffic currently is calculated to include answers to directory requests, but that may change in future versions. They do not include directory fetches by the relay (from authority or other relays), because that is considered "client" activity. (Default: 0)?
…`B ## wŠSAFELOGGINGSafeLoggingGeneral0|1|relayToggles if logs are scrubbed of sensitive informationTor can scrub potentially sensitive strings from log messages (e.g. addresses) by replacing them with the string [scrubbed]. This way logs can still be useful, but they don't leave behind personally identifying information about what sites a user might have visited.
If this option is set to 0, Tor will not perform any scrubbing, if it is set to 1, all potentially sensitive strings are replaced. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not. Note: Tor may not heed this option when logging at log levels below Notice. (Default: 1)A
8 8 ‡EC EŽSANDBOXSandboxGeneral0|1Run within a syscall sandboxIf set to 1, Tor will run securely through the use of a syscall sandbox. Otherwise the sandbox will be disabled. The option is currently an experimental feature. It only works on Linux-based operating systems, and only when Tor has been built with the libseccomp library. This option can not be changed while tor is running.
When the Sandbox is 1, the following options can not be changed when tor is running: Address, ConnLimit, CookieAuthFile, DirPortFrontPage, ExtORPortCookieAuthFile, Logs, ServerDNSResolvConfFile, ClientOnionAuthDir (and any files in it won't reload on HUP signal).
Launching new Onion Services through the control port is not supported with current syscall sandboxing implementation.
Tor must remain in client or server mode (some changes to ClientOnly and ORPort are not allowed). Currently, if Sandbox is 1, ControlPort command "GETINFO address" will not work.
(Default: 0)B stly effects relays, and most operators should leave it set to its default value. (Default: KIST,KISTLite,Vanilla)
The possible scheduler types are:
KIST: Kernel-Informed Socket Transport. Tor will use TCP information from the kernel to make informed decisions regarding how much data to send and when to send it. KIST also handles traffic in batches (see KISTSchedRunInterval) in order to improve traffic prioritization decisions. As implemented, KIST will only work on Linux kernel version 2.6.39 or higher.
KISTLite: Same as KIST but without kernel support. Tor will use all the same mechanics as with KIST, including the batching, but its decisions regarding how much data to send will not be as good. KISTLite will work on all kernels and operating systems, and the majority of the benefits of KIST are still realized with KISTLite.
Vanilla: The scheduler that Tor used before KIST was implemented. It sends as much data as possible, as soon as possible. Vanilla will work on all kernels and operating systems.C
Ä C Ä ‚|E 55 O„AKISTSCHEDRUNINTERVALKISTSchedRunIntervalGeneralNUM msecScheduling interval if using KISTIf KIST or KISTLite is used in the Schedulers option, this controls at which interval the scheduler tick is. If the value is 0 msec, the value is taken from the consensus if possible else it will fallback to the default 10 msec. Maximum possible value is 100 msec. (Default: 0 msec)D‹2D !!7s•SCHEDULERSSchedulersGeneralKIST|KISTLite|VanillaScheduling algorithm by which to send outbound dataSpecify the scheduler type that tor should use. The scheduler is responsible for moving data around within a Tor process. This is an ordered list by priority which means that the first value will be tried first and if unavailable, the second one is tried and so on. It is possible to change these values at runtime. This option mo N
4 ˜ 4 ‚aH 997[ƒ]SERVERTRANSPORTOPTIONSServerTransportOptionsGeneraltransport k=v k=v ...Additional arguments for bridge's proxyWhen this option is set, Tor will pass the k=v parameters to any pluggable transport proxy that tries to launch transport.
(Example: ServerTransportOptions obfs45 shared-secret=bridgepasswd cache=/var/lib/tor/cache) (Default: none)G‚zG ??/kƒ{SERVERTRANSPORTLISTENADDRServerTransportListenAddrGeneraltransport IP:PORTEndpoint for bridge's pluggable transport proxyWhen this option is set, Tor will suggest IP:PORT as the listening address of any pluggable transport proxy that tries to launch transport. (IPv4 addresses should written as-is; IPv6 addresses should be wrapped in square brackets.) (Default: none)FhF 77g‚KISTSOCKBUFSIZEFACTORKISTSockBufSizeFactorGeneralNUMMultiplier for per-socket limit if using KISTIf KIST is used in Schedulers, this is a multiplier of the per-socket limit calculation of the KIST algorithm. (Default: 1.0)E
È ¼ô2 È hL33 a
SOCKS5PROXYUSERNAMESocks5ProxyUsernameGeneralusernameUsername for connecting to the Socks5ProxyK?K ###GmSOCKS5PROXYSocks5ProxyGeneralhost[:port]SOCKS 5 for connecting to torTor will make all OR connections through the SOCKS 5 proxy at host:port (or host:1080 if port is not specified).JEJ ###SmSOCKS4PROXYSocks4ProxyGeneralhost[:port]SOCKS 4 proxy for connecting to torTor will make all OR connections through the SOCKS 4 proxy at host:port (or host:1080 if port is not specified).I‚AI 77[[‚}SERVERTRANSPORTPLUGINServerTransportPluginGeneraltransport exec path-to-binary [options]Proxy when servicing bridge connectionsThe Tor relay launches the pluggable transport proxy in path-to-binary using options as its command-line options, and expects to receive proxied client traffic from it. (Default: none)H
îá ^O ++}uTRUNCATELOGFILETruncateLogFileGeneral0|1Overwrites log file rather than appending when restartedIf 1, Tor will overwrite logs at startup and in response to a HUP signal, instead of appending to them. (Default: 0)N‚
N //o‚SSYSLOGIDENTITYTAGSyslogIdentityTagGeneraltagTag logs appended to the syslog as being from torWhen logging to syslog, adds a tag to the syslog identity such that log entries are marked with "Tor-tag". Can not be changed while tor is running. (Default: none)M‚M 33 a‚YSOCKS5PROXYPASSWORDSocks5ProxyPasswordGeneralpasswordPassword for connecting to the Socks5ProxyIf defined, authenticate to the SOCKS 5 server using username and password in accordance to RFC 1929. Both username and password must be between 1 and 255 characters.L
\ ·y Ê \ ˆIS S/BRIDGEBridgeClient[transport] IP:ORPort [fingerprint]Available bridgesWhen set along with UseB T,R McUSERUserGeneralUsernameUID for the process when startedOn startup, setuid to this user and setgid to their primary group. Can not be changed while tor is running.Q‚;Q 99ƒUSEDEFAULTFALLBACKDIRSUseDefaultFallbackDirsGeneral0|1Use hard-coded fallback directory authorities when neededUse Tor's default hard-coded FallbackDirs (if any). (When a FallbackDir line is present, it replaces the hard-coded FallbackDirs, regardless of the value of UseDefaultFallbackDirs.) (Default: 1)P‚FP 99eƒAUNIXSOCKSGROUPWRITABLEUnixSocksGroupWritableGeneral0|1Group write permissions for the socks socketIf this option is set to 0, don't allow the filesystem group to read and write unix sockets (e.g. SocksPort unix:). If the option is set to 1, make the Unix socket readable and writable by the default GID. (Default: 0)O ridges, instructs Tor to use the relay at "IP:ORPort" as a "bridge" relaying into the Tor network. If "fingerprint" is provided (using the same format as for DirAuthority), we will verify that the relay running at that location has the right fingerprint. We also use fingerprint to look up the bridge descriptor at the bridge authority, if it's provided and if UpdateBridgesFromAuthority is set too.
If "transport" is provided, it must match a ClientTransportPlugin line. We then use that pluggable transport's proxy to transfer data to the bridge, rather than connecting to the bridge directly. Some transports use a transport-specific method to work out the remote address to connect to. These transports typically ignore the "IP:ORPort" specified in the bridge line.
Tor passes any "key=val" settings to the pluggable transport proxy as per-connection arguments when connecting to the bridge. Consult the documentation of the pluggable transport for details of what arguments it supports.R
µ Gµ ƒU 33U„qCIRCUITBUILDTIMEOUTCircuitBuildTimeoutClientNUMInitial timeout for circuit creationTry for at most NUM seconds when building circuits. If the circuit isn't open in that time, give up on it. If LearnCircuitBuildTimeout is 1, this value serves as the initial value to use before a timeout is learned. If LearnCircuitBuildTimeout is 0, this value is the only value used. (Default: 60 seconds)T6T ==iLEARNCIRCUITBUILDTIMEOUTLearnCircuitBuildTimeoutClient0|1Toggles adaptive timeouts for circuit creationIf 0, CircuitBuildTimeout adaptive learning is disabled. (Default: 1)S
~ " ` Æ´•wfI;, ó௚oU:ô˨‰cG `- Š ñ Ö Ç ² Œ ~ =DOSCONNECTIONDEFENSETYPE à 'QDOSREFUSESINGLEHOPCLIENTRENDEZVOUS +ENTRYSTATISTICS Ô!ENTRYNODESb9ENFORCEDISTINCTSUBNETSq/DOWNLOADEXTRAINFO $KDOSCONNECTIONMAXCONCURRENTCOUNT 5DOSCONNECTIONENABLED 9DOSCIRCUITCREATIONRATE%MDOSCIRCUITCREATIONMINCONNECTIONS ?DOSCIRCUITCREATIONENABLED"GDOSCIRCUITCREATIONDEFENSETYPE(SDOSCIRCUITCREATIONDEFENSETIMEPERIOD ;DOSCIRCUITCREATIONBURST(SDORMANTTIMEOUTDISABLEDBYIDLESTREAMS «7DORMANTONFIRSTSTARTUP ¬5DORMANTCLIENTTIMEOUT ª =DORMANTCANCELEDBYSTARTUP DNSPORT Œ+DISABLEOOSCHECK Û)DISABLENETWORK ?DISABLEDEBUGGERATTACHMENT )DISABLEALLSWAP -DIRREQSTATISTICS Ó-DIRPORTFRONTPAGE á DIRPORT â DIRPOLICY ã
DIRCACHE ä =DIRAUTHORITYFALLBACKRATE %DIRAUTHORITY =DIRALLOWPRIVATEADDRESSES ï ADATADIRECTORYGROUPREADABLE'DATADIRECTORY7COUNTPRIVATEBANDWIDTH
5 • 5 ‚]W 55cƒ{CIRCUITSTREAMTIMEOUTCircuitStreamTimeoutClientNUMTimeout for shifting streams among circuitsIf non-zero, this option overrides our internal timeout schedule for how many seconds until we detach a stream from a circuit and try a new circuit. If your network is particularly slow, you might want to set this to a number like 60. (Default: 0)V„hV ==_ˆCIRCUITSAVAILABLETIMEOUTCircuitsAvailableTimeoutClientNUMTime to keep circuits open and unused forTor will attempt to keep at least one open, unused circuit available for this amount of time. This option governs how long idle circuits are kept open, as well as the amount of time Tor will keep a circuit open to each of the recently used ports. This way when the Tor client is entirely idle, it can expire all of its circuits, and then expire its TLS connections. Note that the actual timeout value is uniformly randomized from the specified value to twice that amount. (Default: 30 minutes; Max: 24 hours)U
ï ï „X
!!†eCLIENTONLYClientOnlyClient0|1Ensures that we aren't used as a relay or directory mirrorIf set to 1, Tor will not run as a relay or serve directory requests, even if the ORPort, ExtORPort, or DirPort options are set. (This config option is mostly unnecessary: we added it back when we were considering having Tor clients auto-promote themselves to being relays if they were stable and fast enough. The current behavior is simply that Tor is a client unless ORPort, ExtORPort, or DirPort are configured.) (Default: 0)W
¬ ƒZ
== „ REDUCEDCONNECTIONPADDINGReducedConnectionPaddingClient0|1Reduce padding and increase circuit cycling for low bandidth connectionsIf set to 1, Tor will not not hold OR connections open for very long, and will send less padding on these connections. Only clients may set this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. (Default: 0)Y„QY // k‡]CONNECTIONPADDINGConnectionPaddingClient0|1|autoPad traffic to help prevent correlation attacksThis option governs Tor's use of padding to defend against some forms of traffic analysis. If it is set to auto, Tor will send padding only if both the client and the relay support it. If it is set to 0, Tor will not send any padding cells. If it is set to 1, Tor will still send padding for client connections regardless of relay support. Only clients may set this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. (Default: auto)X
Ü & Ü ‚G\ 77[ƒSREDUCEDCIRCUITPADDINGReducedCircuitPaddingClient0|1Only use lightweight padding algorithmsIf set to 1, Tor will only use circuit padding algorithms that have low overhead. Only clients may set this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. (Default: 0)[ƒW[ )){…oCIRCUITPADDINGCircuitPaddingClient0|1Pad circuit traffic to help prevent correlation attacksIf set to 0, Tor will not pad client circuits with additional cover traffic. Only clients may set this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. If set to 1, padding will be negotiated as per the consensus and relay support (unlike ConnectionPadding, CircuitPadding cannot be force-enabled). (Default: 1)Z ISO3166 codes, and must be wrapped in braces; fingerprints may be preceded by a dollar sign. (Example: ExcludeNodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8)
By default, this option is treated as a preference that Tor is allowed to override in order to keep working. For example, if you try to connect to a hidden service, but you have excluded all of the hidden service's introduction points, Tor will connect to one of them anyway. If you do not want this behavior, set the StrictNodes option (documented below).
Note also that if you are a relay, this (and the other node selection options below) only affects your own circuits that Tor builds for you. Clients can still build circuits through you to any node. Controllers can tell Tor to build circuits through any node.
Country codes are case-insensitive. The code "{??}" refers to nodes whose country can't be identified. No country code, including {??}, works if no GeoIPFile can be loaded. See also the GeoIPExcludeUnknown option below.\
„ ^ --'e†MEXCLUDEEXITNODESExcludeExitNodesClientnode,node,...Relays or locales never to be used for exitsA list of identity fingerprints, country codes, and address patterns of nodes to never use when picking an exit node---that is, a node that delivers traffic for you outside the Tor network. Note that any node listed in ExcludeNodes is automatically considered to be part of this list too. See the ExcludeNodes option for more information on how to specify nodes. See also the caveats on the "ExitNodes" option below.]‰h] %%'i’EXCLUDENODESExcludeNodesClientnode,node,...Relays or locales never to be used in circuitsA list of identity fingerprints, country codes, and address patterns of nodes to avoid when building a circuit. Country codes are 2-letter [
õp ˆ%a ##'Q-MIDDLENODESMiddleNodesClientnode,node,...Preferred middle hops for circuitsA list of identity _ˆz` 'McEXITNODESExitNodesClientnode,node,...Preferred final hop for circuitsA list of identity fingerprints, country codes, ^„_ 33 s†;GEOIPEXCLUDEUNKNOWNGeoIPExcludeUnknownClient0|1|autoDon't use relays with an unknown locale in circuitsIf this option is set to auto, then whenever any country code is set in ExcludeNodes or ExcludeExitNodes, all nodes with unknown country ({??} and possibly {A1}) are treated as excluded as well. If this option is set to 1, then all unknown countries are treated as excluded in ExcludeNodes and ExcludeExitNodes. This option has no effect when a GeoIP file isn't configured or can't be found. (Default: auto)^ and address patterns of nodes to use as exit node---that is, a node that delivers traffic for you outside the Tor network. See the ExcludeNodes option for more information on how to specify nodes.
Note that if you list too few nodes here, or if you exclude too many exit nodes with ExcludeExitNodes, you can degrade functionality. For example, if none of the exits you list allows traffic on port 80 or 443, you won't be able to browse the web.
Note also that not every circuit is used to deliver traffic outside of the Tor network. It is normal to see non-exit circuits (such as those used to connect to hidden services, those that do directory fetches, those used for relay reachability self-tests, and so on) that end at a non-exit node. To keep a node from being used entirely, see ExcludeNodes and StrictNodes.
The ExcludeNodes option overrides this option: any node listed in both ExitNodes and ExcludeNodes is treated as excluded.
The .exit address notation, if enabled via MapAddress, overrides this option._ fingerprints and country codes of nodes to use for "middle" hops in your normal circuits. Normal circuits include all circuits except for direct connections to directory servers. Middle hops are all hops other than exit and entry.
This is an **experimental** feature that is meant to be used by researchers
and developers to test new features in the Tor network safely. Using it
without care will strongly influence your anonymity. This feature might get
removed in the future.
The HSLayer2Node and HSLayer3Node options override this option for onion
service circuits, if they are set. The vanguards addon will read this
option, and if set, it will set HSLayer2Nodes and HSLayer3Nodes to nodes
from this set.
The ExcludeNodes option overrides this option: any node listed in both
MiddleNodes and ExcludeNodes is treated as excluded. See
the **ExcludeNodes** option for more information on how to specify nodes.`
™ ™ „db !!'Oˆ1ENTRYNODESEntryNodesClientnode,node,...Preferred first hops for circuitsA list of identity fingerprints and country codes of nodes to use for the first hop in your normal circuits. Normal circuits include all circuits except for direct connections to directory servers. The Bridge option overrides this option; if you have configured bridges and UseBridges is 1, the Bridges are used as your entry nodes.
The ExcludeNodes option overrides this option: any node listed in both EntryNodes and ExcludeNodes is treated as excluded. See the ExcludeNodes option for more information on how to specify nodes.a
Í Í †0c ##c‹ESTRICTNODESStrictNodesClient0|1Never uses notes outside of Entry/ExitNodesIf StrictNodes is set to 1, Tor will treat solely the ExcludeNodes option as a requirement to follow for all the circuits you generate, even if doing so will break functionality for you (StrictNodes does not apply to ExcludeExitNodes, ExitNodes, MiddleNodes, or MapAddress). If StrictNodes is set to 0, Tor will still try to avoid nodes in the ExcludeNodes list, but it will err on the side of avoiding unexpected errors. Specifically, StrictNodes 0 tells Tor that it is okay to use an excluded node when it is necessary to perform relay reachability self-tests, connect to a hidden service, provide a hidden service to a client, fulfill a .exit request, upload directory information, or download directory information. (Default: 0)b
, ,, }e ''G‚oFIREWALLPORTSFirewallPortsClientPORTSPorts used by FascistFirewallA list of ports that your firewall allows you to connect to. Only used when FascistFirewall is set. This option is deprecated; use ReachableAddresses instead. (Default: 80, 443)dƒQd ++k…oFASCISTFIREWALLFascistFirewallClient0|1Only make outbound connections on FirewallPortsIf 1, Tor will only create outgoing connections to ORs running on ports that your firewall allows (defaults to 80 and 443; see FirewallPorts). This will allow you to run Tor as a client behind a firewall with restrictive policies, but will not allow you to run as a server behind such a firewall. If you prefer more fine-grained control, use ReachableAddresses instead.c
¯ ¯ „Nf 113Y‡OREACHABLEADDRESSESReachableAddressesClientIP[/MASK][:PORT]...Rules for bypassing the local firewallA comma-separated list of IP addresses and ports that your firewall allows you to connect to. The format is as for the addresses in ExitPolicy, except that "accept" is understood unless "reject" is explicitly provided. For example, 'ReachableAddresses 99.0.0.0/8, reject 18.0.0.0/8:80, accept *:80' means that your firewall allows connections to everything inside net 99, rejects port 80 connections to net 18, and accepts connections to port 80 otherwise. (Default: 'accept *:*'.)e
ƒmg
773…WREACHABLEDIRADDRESSESReachableDirAddressesClientIP[/MASK][:PORT]...Rules for bypassing the local firewall (directory fetches)Like ReachableAddresses, a list of addresses and ports. Tor will obey these restrictions when fetching directory information, using standard HTTP GET requests. If not set explicitly then the value of ReachableAddresses is used. If HTTPProxy is set then these connections will go through that proxy. (DEPRECATED: This option has had no effect for some time.)f
…xh 553{‰yREACHABLEORADDRESSESReachableORAddressesClientIP[/MASK][:PORT]...Rules for bypassing the local firewall (OR connections)Like ReachableAddresses, a list of addresses and ports. Tor will obey these restrictions when connecting to Onion Routers, using TLS/SSL. If not set explicitly then the value of ReachableAddresses is used. If HTTPSProxy is set then these connections will go through that proxy.
The separation between ReachableORAddresses and ReachableDirAddresses is only interesting when you are connecting through proxies (see HTTPProxy and HTTPSProxy). Most proxies limit TLS connections (which Tor uses to connect to Onion Routers) to port 443, and some limit HTTP GET requests (which Tor uses for fetching directory information) to port 80.g
Y Y …$i
##]ˆ=HIDSERVAUTHHidServAuthClientonion-address auth-cookie [service-name]Authentication credentials for connecting to a hidden serviceClient authorization for a v2 hidden service. Valid onion addresses contain 16 characters in a-z2-7 plus ".onion", and valid auth cookies contain 22 characters in A-Za-z0-9+/. The service name is only used for internal purposes, e.g., for Tor controllers. This option may be used multiple times for different hidden services. If a hidden service uses authorization and this option is not set, the hidden service is not accessible. Hidden services can be configured to require authorization using the HiddenServiceAuthorizeClient option.h
‡ ‡ „vj 11qˆ%CLIENTONIONAUTHDIRClientOnionAuthDirClientpathPath containing hidden service authorization filesPath to the directory containing v3 hidden service authorization files. Each file is for a single onion address, and the files MUST have the suffix ".auth_private" (i.e. "bob_onion.auth_private"). The content format MUST be:
:descriptor:x25519:
The MUST NOT have the ".onion" suffix. The is the base32 representation of the raw key bytes only (32 bytes for x25519). See Appendix G in the rend-spec-v3.txt file of torspec for more information.i
Å Ç 6m --s-NEWCIRCUITPERIODNewCircuitPeriodClientNUMPeriod for considering the creation of new circuitsEvery NUM seconds consider whether to build a new circuit. (Default: 30 seconds)l‘ol !!1S¢9MAPADDRESSMapAddressClientaddress newaddressAlias mappings for address requestsWhen a request for address arrives to Tor, it will transform to newaddress before processing it. For example, if you always want connections to www.example.com i„8k ))Y‡OLONGLIVEDPORTSLongLivedPortsClientPORTSPorts requiring highly reliable relaysA list of ports for services that tend to have long-running connections (e.g. chat and interactive shells). Circuits for streams that use these ports will contain only high-uptime nodes, to reduce the chance that a node will go down before the stream is finished. Note that the list is also honored for circuits (both client and service side) involving hidden services whose virtual port is in this list. (Default: 21, 22, 706, 1863, 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300)j j to exit via torserver (where torserver is the fingerprint of the server), use "MapAddress www.example.com www.example.com.torserver.exit". If the value is prefixed with a "*.", matches an entire domain. For example, if you always want connections to example.com and any if its subdomains to exit via torserver (where torserver is the fingerprint of the server), use "MapAddress *.example.com *.example.com.torserver.exit". (Note the leading "*." in each part of the directive.) You can also redirect all subdomains of a domain to a single address. For example, "MapAddress *.example.com www.example.com". If the specified exit is not available, or the exit can not connect to the site, Tor will fail any connections to the mapped address.+
NOTES:
1. When evaluating MapAddress expressions Tor stops when it hits the most recently added expression that matches the requested address. So if you have the following in your torrc, www.torproject.org will map to 198.51.100.1:
MapAddress www.torproject.org 192.0 .2.1
MapAddress www.torproject.org 198.51.100.1
2. Tor evaluates the MapAddress configuration until it finds no matches. So if you have the following in your torrc, www.torproject.org will map to 203.0.113.1:
MapAddress 198.51.100.1 203.0.113.1
MapAddress www.torproject.org 198.51.100.1
3. The following MapAddress expression is invalid (and will be ignored) because you cannot map from a specific address to a wildcard address:
MapAddress www.torproject.org *.torproject.org.torserver.exit
4. Using a wildcard to match only part of a string (as in *ample.com) is also invalid.
5. Tor maps hostnames and IP addresses separately. If you MapAddress a DNS name, but use an IP address to connect, then Tor will ignore the DNS name mapping.
6. MapAddress does not apply to redirects in the application protocol. For example, HTTP redirects and alt-svc headers will ignore mappings for the original address. You can use a wildcard mapping to handle redirects within the same site.k
› ä › ‚Fo ==yƒ'MAXCLIENTCIRCUITSPENDINGMaxClientCircuitsPendingClientNUMNumber of circuits that can be in construction at onceDo not allow more than NUM circuits to be pending at a time for handling client streams. A circuit is pending if we have begun constructing it, but it has not yet been completely constructed. (Default: 32)n„n 33_†{MAXCIRCUITDIRTINESSMaxCircuitDirtinessClientNUMDuration for reusing constructed circuitsFeel free to reuse a circuit that was first used at most NUM seconds ago, but never attach a new stream to a circuit that is too old. For hidden services, this applies to the last time a circuit was used, not the first. Circuits with streams constructed with SOCKS authentication via SocksPorts that have KeepAliveIsolateSOCKSAuth also remain alive for MaxCircuitDirtiness seconds after carrying the last such stream. (Default: 10 minutes)m
h ž h ‚3q
99
‚sENFORCEDISTINCTSUBNETSEnforceDistinctSubnetsClient0|1Prevent use of multiple relays from the same subnet on a circuitIf 1, Tor will not put two servers whose IP addresses are "too close" on the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1)p„_p !!'Yˆ NODEFAMILYNodeFamilyClientnode,node,...Define relays as belonging to a familyThe Tor servers, defined by their identity fingerprints, constitute a "family" of similar or co-administered servers, so never use any two of them in the same circuit. Defining a NodeFamily is only needed when a server doesn't list the family itself (with MyFamily). This option can be used multiple times; each instance defines a separate family. In addition to nodes, you can also list IP address and ranges and country codes in {curly braces}. See the ExcludeNodes option for more information on how to specify nodes.o nng applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. If a unix domain socket is used, you may quote the path using standard C escape sequences. (Default: 9050)
NOTE: Although this option allows you to specify an IP address other than localhost, you should do so only with extreme caution. The SOCKS protocol is unencrypted and (as we use it) unauthenticated, so exposing it in this way could leak your information to anybody watching your network, and allow anybody to use your computer as an open proxy.
If multiple entries of this option are present in your configuration file, Tor will perform stream isolation between listeners by default. The isolation flags arguments give Tor rules for which streams received on this SocksPort are allowed to share circuits with one another. Recognized isolation flags are:
IsolateClientAddr
Don't s ohare circuits with streams from a different client address. (On by default and strongly recommended when supported; you can disable it with NoIsolateClientAddr. Unsupported and force-disabled when using Unix domain sockets.)
IsolateSOCKSAuth
Don't share circuits with streams for which different SOCKS authentication was provided. (For HTTPTunnelPort connections, this option looks at the Proxy-Authorization and X-Tor-Stream-Isolation headers. On by default; you can disable it with NoIsolateSOCKSAuth.)
IsolateClientProtocol
Don't share circuits with streams using a different protocol. (SOCKS 4, SOCKS 5, TransPort connections, NATDPort connections, and DNSPort requests are all considered to be different protocols.)
IsolateDestPort
Don't share circuits with streams targeting a different destination port.
IsolateDestAddr
Don't share circuits with streams targeting a different destination address.
KeepAliveIsolateSOCKSAuth
If IsolateSOCKSAuth is enabled, keep alive circuits while they ha pve at least one stream with SOCKS authentication active. After such a circuit is idle for more than MaxCircuitDirtiness seconds, it can be closed.
SessionGroup=INT
If no other isolation rules would prevent it, allow streams on this port to share circuits with streams from every other port with the same session group. (By default, streams received on different SocksPorts, TransPorts, etc are always isolated from one another. This option overrides that behavior.)
Other recognized flags for a SocksPort are:
NoIPv4Traffic
Tell exits to not connect to IPv4 addresses in response to SOCKS requests on this connection.
IPv6Traffic
Tell exits to allow IPv6 addresses in response to SOCKS requests on this connection, so long as SOCKS5 is in use. (SOCKS4 can't handle IPv6.)
PreferIPv6
Tells exits that, if a host has both an IPv4 and an IPv6 address, we would prefer to connect to it via IPv6. (IPv4 is the default.)
NoDNSRequest
Do not ask exits to resolve DNS addresses in SOCKS5 requests. Tor qwill connect to IPv4 addresses, IPv6 addresses (if IPv6Traffic is set) and .onion addresses.
NoOnionTraffic
Do not connect to .onion addresses in SOCKS5 requests.
OnionTrafficOnly
Tell the tor client to only connect to .onion addresses in response to SOCKS5 requests on this connection. This is equivalent to NoDNSRequest, NoIPv4Traffic, NoIPv6Traffic. The corresponding NoOnionTrafficOnly flag is not supported.
CacheIPv4DNS
Tells the client to remember IPv4 DNS answers we receive from exit nodes via this connection.
CacheIPv6DNS
Tells the client to remember IPv6 DNS answers we receive from exit nodes via this connection.
GroupWritable
Unix domain sockets only: makes the socket get created as group-writable.
WorldWritable
Unix domain sockets only: makes the socket get created as world-writable.
CacheDNS
Tells the client to remember all DNS answers we receive from exit nodes via this connection.
UseIPv4Cache
Tells the client to use any cached IPv4 DNS answers we have wh ren making requests via this connection. (NOTE: This option, or UseIPv6Cache or UseDNSCache, can harm your anonymity, and probably won't help performance as much as you might expect. Use with care!)
UseIPv6Cache
Tells the client to use any cached IPv6 DNS answers we have when making requests via this connection.
UseDNSCache
Tells the client to use any cached DNS answers we have when making requests via this connection.
PreferIPv6Automap
When serving a hostname lookup request on this port that should get automapped (according to AutomapHostsOnResolve), if we could return either an IPv4 or an IPv6 answer, prefer an IPv6 answer. (On by default.)
PreferSOCKSNoAuth
Ordinarily, when an application offers both "username/password authentication" and "no authentication" to Tor via SOCKS5, Tor selects username/password authentication so that IsolateSOCKSAuth can work. This can confuse some applications, if they offer a username/password combination then get confused when asked for one. You can di ssable this behavior, so that Tor will select "No authentication" when IsolateSOCKSAuth is disabled, or when this option is set.
ExtendedErrors
Return extended error code in the SOCKS reply. So far, the possible errors are:
X'F0' Onion Service Descriptor Can Not be Found
The requested onion service descriptor can't be found on the
hashring and thus not reachable by the client. (v3 only)
X'F1' Onion Service Descriptor Is Invalid
The requested onion service descriptor can't be parsed or
signature validation failed. (v3 only)
X'F2' Onion Service Introduction Failed
Client failed to introduce to the service meaning the descriptor
was found but the service is not connected anymore to the
introduction point. The service has likely changed its descriptor
or is not running. (v3 only)
X'F3' Onion Service Rendezvous Failed
Client failed to rendezvous with the service which means that the
clien t is unable to finalize the connection. (v3 only)
X'F4' Onion Service Missing Client Authorization
Client was able to download the requested onion service descriptor
but is unable to decrypt its content because it is missing client
authorization information. (v3 only)
X'F5' Onion Service Wrong Client Authorization
Client was able to download the requested onion service descriptor
but is unable to decrypt its content using the client
authorization information it has. This means the client access
were revoked. (v3 only)
X'F6' Onion Service Invalid Address
The given .onion address is invalid. In one of these cases this
error is returned: address checksum doesn't match, ed25519 public
key is invalid or the encoding is invalid. (v3 only)
Flags are processed left to right. If flags conflict, the last flag on the line is used, and all earlier flags are ignored. No error is issued for conflicting flags.q
Ý Dä Ý ‚t
%%‚CSOCKSTIMEOUTSocksTimeoutClientNUMTime until idle or unestablished socks connections are closedLet a socks connection wait NUM seconds handshaking, and NUM seconds unattached waiting for an appropriate circuit, before we fail it. (Default: 2 minutes)s‚]s ##/M„SOCKSPOLICYSocksPolicyClientpolicy,policy,...Access policy for the pocks portSet an entrance policy for this server, to limit who can connect to the SocksPort and DNSPort ports. The policies have the same form as exit policies below, except that port specifiers are ignored. Any address not matched by some entry in the policy is accepted.r¹r {SðGSOCKSPORTSocksPortClient[address:]port|unix:path|auto [flags] [isolation flags]Port for using tor as a Socks proxyOpen this port to listen for connections from SOCKS-speaki m
n n …u
??/‡{TOKENBUCKETREFILLINTERVALTokenBucketRefillIntervalClientNUM [msec|second]Frequency at which exhausted connections are checked for new trafficSet the refill delay interval of Tor's token bucket to NUM milliseconds. NUM must be between 1 and 1000, inclusive. When Tor is out of bandwidth, on a connection or globally, it will wait up to this long before it tries to use that connection again. Note that bandwidth limits are still expressed in bytes per second: this option only affects the frequency with which Tor checks to see whether previously exhausted connections may read again. Can not be changed while tor is running. (Default: 100 msec)t
µ µ †Hv
))-‹TRACKHOSTEXITSTrackHostExitsClienthost,.domain,...Maintains use of the same exit whenever connecting to this destinationFor each value in the comma separated list, Tor will track recent connections to hosts that match this value and attempt to reuse the same exit node for each. If the value is prepended with a '.', it is treated as matching an entire domain. If one of the values is just a '.', it means match everything. This option is useful if you frequently connect to sites that will expire all your authentication cookies (i.e. log you out) if your IP address changes. Note that this option does have the disadvantage of making it more clear that a given history is associated with a single user. However, most people who would wish to observe this will observe it through cookies or other protocol-specific means anyhow.u
¥ î“ ¥ ky !!I‚YUSEBRIDGESUseBridgesClient0|1Make use of configured bridgesWhen set, Tor will fetch descriptors for each bridge listed in the "Bridge" config lines, and use these relays as both entry guards and directory guards. (Default: 0)x‚Xx AA}ƒ?UPDATEBRIDGESFROMAUTHORITYUpdateBridgesFromAuthorityClient0|1Toggles fetching bridge descriptors from the authoritiesWhen set (along with UseBridges), Tor will try to fetch bridge descriptors from the configured bridge authorities when feasible. It will fall back to a direct request if the authority responds with a 404. (Default: 0)w‚w 55i‚YTRACKHOSTEXITSEXPIRETrackHostExitsExpireClientNUMTime until use of an exit for tracking expiresSince exit servers go up and down, it is desirable to expire the association between host and exit server after NUM seconds. The default is 1800 seconds (30 minutes).v
5 ‚{ // {‚]GUARDFRACTIONFILEGuardfractionFileClientFILENAMEFile containing information with duration of our guardsV3 authoritative directories only. Configures the location of the guardfraction file which contains information about how long relays have been guards. (Default: unset)zƒHz ))I†USEENTRYGUARDSUseEntryGuardsClient0|1Use guard relays for first hopIf this option is set to 1, we pick a few long-term entry servers, and try to stick with them. This is desirable because constantly changing servers increases the odds that an adversary who owns some servers will observe a fraction of your paths. Entry Guards can not be used by Directory Authorities or Single Onion Services. In these cases, this option is ignored. (Default: 1)y
- ¢- ‚r} ))c„=NUMENTRYGUARDSNumEntryGuardsClientNUMPool size of guard relays we'll select fromIf UseEntryGuards is set to 1, we will try to pick a total of NUM routers as long-term entries for our circuits. If NUM is 0, we try to learn the number from the guard-n-primary-guards-to-use consensus parameter, and default to 1 if the consensus parameter isn't set. (Default: 0)|‚[| -- qƒoUSEGUARDFRACTIONUseGuardFractionClient0|1|autoTake guardfraction into account for path selectionThis option specifies whether clients should use the guardfraction information found in the consensus during path selection. If it's set to auto, clients will do what the UseGuardFraction consensus parameter tells them to do. (Default: auto){
» = » ‚ 11k„?NUMDIRECTORYGUARDSNumDirectoryGuardsClientNUMPool size of directory guards we'll select fromIf UseEntryGuards is set to 1, we try to make sure we have at least NUM routers to use as directory guards. If this option is set to 0, use the value from the guard-n-primary-dir-guards-to-use consensus parameter, and default to 3 if the consensus parameter isn't set. (Default: 0)~ƒ@~
-- …)NUMPRIMARYGUARDSNumPrimaryGuardsClientNUMPool size of strongly preferred guard relays we'll select fromIf UseEntryGuards is set to 1, we will try to pick NUM routers for our primary guard list, which is the set of routers we strongly prefer when connecting to the Tor network. If NUM is 0, we try to learn the number from the guard-n-primary-guards consensus parameter, and default to 3 if the consensus parameter isn't set. (Default: 0)}
f ëf ƒ {„USAFESOCKSSafeSocksClient0|1Toggles rejecting unsafe variants of the socks protocolWhen this option is enabled, Tor will reject application connections that use unsafe variants of the socks protocol -- ones that only provide an IP address, meaning the application is doing a DNS resolve first. Specifically, these are socks4 and socks5 when not doing remote DNS. (Default: 0) €‚ ''3O‚sGUARDLIFETIMEGuardLifetimeClientN days|weeks|monthsMinimum time to keep entry guardsIf UseEntryGuards is set, minimum time to keep a guard on our guard list before picking a new one. If less than one day, we use defaults from the consensus directory. (Default: 0)
" ¾ Ü Î ¾" í$íßÚq]GåÉ®’€hYH2
óÞº˜‚_3 9 + !EXITPOLICY ´
EXITNODES`%EXCLUDENODES]1EXITPORTSTATISTICS Õ ;EXITPOLICYREJECTPRIVATE µ$KEXITPOLICYREJECTLOCALINTERFACES ¶/FETCHDIRINFOEARLY%+FASCISTFIREWALLd#FALLBACKDIR$3EXTRAINFOSTATISTICS Ø(UEXTORPORTCOOKIEAUTHFILEGROUPREADABLE#;EXTORPORTCOOKIEAUTHFILE"
EXTORPORT!/EXTENDBYED25519ID CEXTENDALLOWPRIVATEADDRESSES Ù EXITRELAY ³+YHIDDENSERVICEENABLEINTRODOSBURSTPERSEC"GHIDDENSERVICEDIRGROUPREADABLE-HIDDENSERVICEDIR!EHIDDENSERVICEAUTHORIZECLIENT #IHIDDENSERVICEALLOWUNKNOWNPORTS
+HEARTBEATPERIOD Á7HASHEDCONTROLPASSWORD+'HARDWAREACCEL*'GUARDLIFETIME €/GUARDFRACTIONFILE{#GEOIPV6FILE Ð GEOIPFILE Ï3GEOIPEXCLUDEUNKNOWN_'FIREWALLPORTSe;FETCHUSELESSDESCRIPTORS)9FETCHSERVERDESCRIPTORS(;FETCHHIDSERVDESCRIPTORS'9FETCHDIRINFOEXTRAEARLY&
W NÆW ‡{ 991}uVIRTUALADDRNETWORKIPV6VirtualAddrNetworkIPv6Client[IPv6Address]/bitsIPv6 address range to use ~99-}
VIRTUALADDRNETWORKIPV4VirtualAddrNetworkIPv4ClientIPv4Address/bitsIPv4 address range to use when needing a virtual address ‚ƒ.
#…TESTSOCKSTestSocksClient0|1Provide notices for if socks connections are of the safe or unsafe variantsWhen this option is enabled, Tor will make a notice-level log entry for each connection to the Socks port indicating whether the request used a safe socks protocol or an unsafe one (see above entry on SafeSocks). This helps to determine whether an application using Tor is possibly leaking DNS requests. (Default: 0) when needing a virtual addressWhen Tor needs to assign a virtual (unused) address because of a MAPADDRESS command from the controller or the AutomapHostsOnResolve feature, Tor picks an unassigned address from this range. (Defaults: 127.192.0.0/10 and [FE80::]/10 respectively.)
When providing proxy server service to a network of computers using a tool like dns-proxy-tor, change the IPv4 network to "10.192.0.0/10" or "172.16.0.0/12" and change the IPv6 network to "[FC00::]/7". The default VirtualAddrNetwork address ranges on a properly configured machine will route to the loopback or link-local interface. The maximum number of bits for the network prefix is set to 104 for IPv6 and 16 for IPv4. However, a wider network - smaller prefix length
o is preferable since it reduces the chances for an attacker to guess the used IP. For local use, no change to the default VirtualAddrNetwork setting is needed. ƒ
› … ))Woˆ
HTTPTUNNELPORTHTTPTunnelPortClient[address:]port|auto [isolation flags]Port on which to allow 'HTTP CONNECT' connectionsOpen this port to listen for proxy connections using the "HTTP CONNECT" protocol instead of SOCKS. Set this to 0 if you don't want to allow "HTTP CONNECT" connections. Set the port to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. If multiple entries of this option are present in your configuration file, Tor will perform stream isolation between listeners by default. See SOCKSPort for an explanation of isolation flags. (Default: 0) …‚a
;;ƒUALLOWNONRFC953HOSTNAMESAllowNonRFC953HostnamesClient0|1Toggles blocking invalid characters in hostname resolutionWhen this option is disabled, Tor blocks hostnames containing illegal characters (like @ and :) rather than sending them to an exit node to be resolved. This helps trap accidental attempts to resolve URLs and so on. (Default: 0) „
E ´ E ˆ( ))G7 TRANSPROXYTYPETransProxyTypeClientdefault|TPROXY|ipfw|pf-divertProxy type to be usedTransProxy †H Ws‹'TRANSPORTTransPortClient[address:]port|auto [isolation flags]Port for transparent proxying if the OS supports itOpen this port to listen for transparent proxy connections. Set this to 0 if you don't want to allow transparent proxy connections. Set the port to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. If multiple entries of this option are present in your configuration file, Tor will perform stream isolation between listeners by default. See SOCKSPort for an explanation of isolation flags.
TransPort requires OS support for transparent proxies, such as BSDs' pf or Linux's IPTables. If you're planning to use Tor as a transparent proxy for a network, you'll want to examine and change VirtualAddrNetwork from the default setting. (Default: 0) † Type may only be enabled when there is transparent proxy listener enabled.
Set this to "TPROXY" if you wish to be able to use the TPROXY Linux module to transparently proxy connections that are configured using the TransPort option. Detailed information on how to configure the TPROXY feature can be found in the Linux kernel source tree in the file Documentation/networking/tproxy.txt.
Set this option to "ipfw" to use the FreeBSD ipfw interface.
On *BSD operating systems when using pf, set this to "pf-divert" to take advantage of divert-to rules, which do not modify the packets like rdr-to rules do. Detailed information on how to configure pf to use divert-to rules can be found in the pf.conf(5) manual page. On OpenBSD, divert-to is available to use on versions greater than or equal to OpenBSD 4.4.
Set this to "default", or leave it unconfigured, to use regular IPTables on Linux, or to use pf rdr-to rules on *BSD systems.
(Default: "default") ‡
> > …> W_‰+NATDPORTNATDPortClient[address:]port|auto [isolation flags]Port for forwarding ipfw NATD connectionsOpen this port to listen for connections from old versions of ipfw (as included in old versions of FreeBSD, etc) using the NATD protocol. Use 0 if you don't want to allow NATD connections. Set the port to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. If multiple entries of this option are present in your configuration file, Tor will perform stream isolation between listeners by default. See SocksPort for an explanation of isolation flags.
This option is only for people who cannot use TransPort. (Default: 0) ˆ
% ‚
55/u‚+AUTOMAPHOSTSSUFFIXESAutomapHostsSuffixesClientSUFFIX,SUFFIX,...Address suffixes recognized by AutomapHostsOnResolveA comma-separated list of suffixes to use with AutomapHostsOnResolve. The "." suffix is equivalent to "all addresses." (Default: .exit,.onion). ŠƒW
77 …?AUTOMAPHOSTSONRESOLVEAutomapHostsOnResolveClient0|1Map addresses ending with special suffixes to virtual addressesWhen this option is enabled, and we get a request to resolve an address that ends with one of the suffixes in AutomapHostsSuffixes, we map an unused virtual address to that address, and return the new virtual address. This is handy for making ".onion" addresses work with applications that resolve an address and then connect to it. (Default: 0) ‰
P ÷ P ƒ#
MM„9CLIENTDNSREJECTINTERNALADDRESSESClientDNSRejectInternalAddressesClient0|1Disregards anonymous DNS responses for internal addressesIf true, Tor does not believe any anonymously retrieved DNS answer that tells it that an address resolves to an internal address (like 127.0.0.1 or 192.168.0.1). This option prevents certain browser-based attacks; it is not allowed to be set on the default network. (Default: 1) Œ„ W}† DNSPORTDNSPortClient[address:]port|auto [isolation flags]Port from which DNS responses are fetched instead of torIf non-zero, open this port to listen for UDP DNS requests, and resolve them anonymously. This port only handles A, AAAA, and PTR requests---it doesn't handle arbitrary DNS request types. Set the port to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. See SocksPort for an explanation of isolation flags. (Default: 0) ‹
¢ . ¢ ƒ //q„MDOWNLOADEXTRAINFODownloadExtraInfoClient0|1Toggles fetching of extra information about relaysIf true, Tor downloads and caches "extra-info" documents. These documents contain information about servers other than the information in their regular server descriptors. Tor does not use this information for anything itself; to save bandwidth, leave this option turned off. (Default: 0) ŽƒN GGe…5CLIENTREJECTINTERNALADDRESSESClientRejectInternalAddressesClient0|1Disables use of Tor for internal connectionsIf true, Tor does not try to fulfill requests to connect to an internal address (like 127.0.0.1 or 192.168.0.1) unless an exit node is specifically requested (for example, via a .exit hostname, or a controller request). If true, multicast DNS hostnames for machines on the local network (of the form *.local) are also rejected. (Default: 1)
¾ ±¾ o 55'S‚REJECTPLAINTEXTPORTSRejectPlaintextPortsClientport,port,...Prevents connections on risky portsLike WarnPlaintextPorts, but instead of warning about risky port uses, Tor will instead refuse to make the connection. (Default: None) ‚K 11'YƒSWARNPLAINTEXTPORTSWarnPlaintextPortsClientport,port,...Toggles warnings for using risky portsTells Tor to issue a warnings whenever the user tries to make an anonymous connection to one of these ports. This option is designed to alert users to services that risk sending passwords in the clear. (Default: 23,109,110,143)
ˆ àZ ˆ ‘B '''s¡;HSLAYER3NODESHSLayer3NodesClientnode,node,...permissible relays for the third hop of HS circuitsA list of identity fingerprints, nicknames, country codes, and address patterns of nodes that are Šv '''u !HSLAYER2NODESHSLayer2NodesClientnode,node,...permissible relays for the second hop of HS circuitsA list of identity f ˆ„
)) †[OPTIMISTICDATAOptimisticDataClient0|1|autoUse exits without confirmation that prior connections succeededWhen this option is set, and Tor is using an exit node that supports the feature, it will try optimistically to send data to the exit node without waiting for the exit node to report whether the connection succeeded. This can save a round-trip time for protocols like HTTP where the client talks first. If OptimisticData is set to auto, Tor will look at the UseOptimisticData parameter in the networkstatus. (Default: auto) ‘ ‰ingerprints, nicknames, country codes, and address patterns of nodes that are allowed to be used as the second hop in all client or service-side Onion Service circuits. This option mitigates attacks where the adversary runs middle nodes and induces your client or service to create many circuits, in order to discover your primary guard node. (Default: Any node in the network may be used in the second hop.)
(Example: HSLayer2Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8)
When this is set, the resulting hidden service paths will look like:
C - G - L2 - M - Rend
C - G - L2 - M - HSDir
C - G - L2 - M - Intro
S - G - L2 - M - Rend
S - G - L2 - M - HSDir
S - G - L2 - M - Intro
where C is this client, S is the service, G is the Guard node, L2 is a node from this option, and M is a random middle node. Rend, HSDir, and Intro point selection is not affected by this option.
This option may be combined with HSLayer3Nodes to create paths of the form:
C - G - L2 - L3 - Rend
C - G - L2 - L3 - M - HSDir
C - G - L2 - L3 - M - Intro
S - G - L2 - L3 - M - Rend
S - G - L2 - L3 - HSDir
S - G - L2 - L3 - Intro
ExcludeNodes have higher priority than HSLayer2Nodes, which means that nodes specified in ExcludeNodes will not be picked.
When either this option or HSLayer3Nodes are set, the /16 subnet and node family restrictions are removed for hidden service circuits. Additionally, we allow the guard node to be present as the Rend, HSDir, and IP node, and as the hop before it. This is done to prevent the adversary from inferring information about our guard, layer2, and layer3 node choices at later points in the path.
This option is meant to be managed by a Tor controller such as https://github.com/mikeperry-tor/vanguards that selects and updates this set of nodes for you. Hence it does not do load balancing if fewer than 20 nodes are selected, and if no nodes in HSLayer2Nodes are currently available for use, Tor will not work. Please use extreme care if you are setting this option manually. ’ ‹ allowed to be used as the third hop in all client and service-side Onion Service circuits. This option mitigates attacks where the adversary runs middle nodes and induces your client or service to create many circuits, in order to discover your primary or Layer2 guard nodes. (Default: Any node in the network may be used in the third hop.)
(Example: HSLayer3Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8)
When this is set by itself, the resulting hidden service paths will look like:
C - G - M - L3 - Rend
C - G - M - L3 - M - HSDir
C - G - M - L3 - M - Intro
S - G - M - L3 - M - Rend
S - G - M - L3 - HSDir
S - G - M - L3 - Intro
where C is this client, S is the service, G is the Guard node, L2 is a node from this option, and M is a random middle node. Rend, HSDir, and Intro point selection is not affected by this option.
While it is possible to use this option by itself, it should be combined with HSLayer2Nodes to create paths of the form:
C - G - L2 - L3 - Rend
C - G - L2 - L3 - M - HSDir
C - G - L2 - L3 - M - Intro
S - G - L2 - L3 - M - Rend
S - G - L2 - L3 - HSDir
S - G - L2 - L3 - Intro
ExcludeNodes have higher priority than HSLayer3Nodes, which means that nodes specified in ExcludeNodes will not be picked.
When either this option or HSLayer2Nodes are set, the /16 subnet and node family restrictions are removed for hidden service circuits. Additionally, we allow the guard node to be present as the Rend, HSDir, and IP node, and as the hop before it. This is done to prevent the adversary from inferring information about our guard, layer2, and layer3 node choices at later points in the path.
This option is meant to be managed by a Tor controller such as https://github.com/mikeperry-tor/vanguards that selects and updates this set of nodes for you. Hence it does not do load balancing if fewer than 20 nodes are selected, and if no nodes in HSLayer3Nodes are currently available for use, Tor will not work. Please use extreme care if you are setting this option manually. “
v äe ì v s --
PATHBIASWARNRATEPathBiasWarnRateClientNUMFraction of circuits that must succeed before logging a warning —v 11
PATHBIASNOTICERATEPathBiasNoticeRateClientNUMFraction of circuits that must succeed before logging a notice –| 77
PATHBIASCIRCTHRESHOLDPathBiasCircThresholdClientNUMNumber of circuits through a guard before applying bias checks •„ 33 }†OUSEMICRODESCRIPTORSUseMicrodescriptorsClient0|1|autoRetrieve microdescriptors rather than server descriptorsMicrodescriptors are a smaller version of the information that Tor needs in order to build its circuits. Using microdescriptors makes Tor clients download less directory information, thus saving bandwidth. Directory caches need to fetch regular descriptors and microdescriptors, so this option doesn't save any bandwidth for them. For legacy reasons, auto is accepted, but it has the same effect as 1. (Default: auto) ”
¾ …":¼> ¾ } 99
PATHBIASEXTREMEUSERATEPathBiasExtremeUseRateClientNUMFraction of streams that must succeed before logging an error { 77
PATHBIASNOTICEUSERATEPathBiasNoticeUseRateClientNUMFraction of streams that must succeed before logging a notice œ{ 55
PATHBIASUSETHRESHOLDPathBiasUseThresholdClientNUMNumber of streams through a circuit before applying bias checks ›‰\
99 ‘GPATHBIASSCALETHRESHOLDPathBiasScaleThresholdClientNUMCircuits through a guard before scaling past observations downThese options override the default behavior of Tor's (currently experimental) path bias detection a Ž`11_
PATHBIASDROPGUARDSPathBiasDropGuardsClientNUMDrop guards failing to establish circuits ™x 33
PATHBIASEXTREMERATEPathBiasExtremeRateClientNUMFraction of circuits that must succeed before logging an error ˜ lgorithm. To try to find broken or misbehaving guard nodes, Tor looks for nodes where more than a certain fraction of circuits through that guard fail to get built.
The PathBiasCircThreshold option controls how many circuits we need to build through a guard before we make these checks. The PathBiasNoticeRate, PathBiasWarnRate and PathBiasExtremeRate options control what fraction of circuits must succeed through a guard so we won't write log messages. If less than PathBiasExtremeRate circuits succeed and PathBiasDropGuards is set to 1, we disable use of that guard.
When we have seen more than PathBiasScaleThreshold circuits through a guard, we scale our observations by 0.5 (governed by the consensus) so that new observations don't get swamped by old ones.
By default, or if a negative value is provided for one of these options, Tor uses reasonable defaults from the networkstatus consensus document. If no defaults are available there, these options default to 150, .70, .50, .30, 0, and 300 respectively. š
o o ‡
?? ŒPATHBIASSCALEUSETHRESHOLDPathBiasScaleUseThresholdClientNUMStreams through a circuit before scaling past observations downSimilar to the above options, these options override the default behavior of Tor's (currently experimental) path use bias detection algorithm.
Where as the path bias parameters govern thresholds for successfully building circuits, these four path use bias parameters govern thresholds only for circuit usage. Circuits which receive no stream usage are not counted by this detection algorithm. A used circuit is considered successful if it is capable of carrying streams or otherwise receiving well-formed responses to RELAY cells.
By default, or if a negative value is provided for one of these options, Tor uses reasonable defaults from the networkstatus consensus document. If no defaults are available there, these options default to 20, .80, .60, and 100, respectively. ž
Ë Ë ƒ>! ''{…?CLIENTUSEIPV6ClientUseIPv6Client0|1Allow IPv6 connections to guards and fetching consensusIf this option is set to 1, Tor might connect to directory servers or entry nodes over IPv6. For IPv6 only hosts, you need to also set ClientUseIPv4 to 0 to disable IPv4. Note that clients configured with an IPv6 address in a Bridge, proxy, or pluggable transportline will try connecting over IPv6 even if ClientUseIPv6 is set to 0. (Default: 0) ‚o ''{„!CLIENTUSEIPV4ClientUseIPv4Client0|1Allow IPv4 connections to guards and fetching consensusIf this option is set to 0, Tor will avoid connecting to directory servers and entry nodes over IPv4. Note that clients with an IPv4 address in a Bridge, proxy, or pluggable transport line will try connecting over IPv4 even if ClientUseIPv4 is set to 0. (Default: 1) Ÿ
Ô Ô „(" ;; k†qCLIENTPREFERIPV6DIRPORTClientPreferIPv6DirPortClient0|1|autoPerfer relays with IPv6 when fetching consensusIf this option is set to 1, Tor prefers a directory port with an IPv6 address over one with IPv4, for direct connections, if a given directory server has both. (Tor also prefers an IPv6 DirPort if IPv4Client is set to 0.) If this option is set to auto, clients prefer IPv4. Other things may influence the choice. This option breaks a tie to the favor of IPv6. (Default: auto) (DEPRECATED: This option has had no effect for some time.) ¡
‹ ô ‹ ‚e$ 55Y„CLIENTAUTOIPV6ORPORTClientAutoIPv6ORPortClient0|1Connect to IPv6 ORPorts when availableIf this option is set to 1, Tor clients randomly prefer a node's IPv4 or IPv6 ORPort. The random preference is set every time a node is loaded from a new consensus or bridge config. When this option is set to 1, ClientPreferIPv6ORPort is ignored. (Default: 0) £„# 99 k†5CLIENTPREFERIPV6ORPORTClientPreferIPv6ORPortClient0|1|autoPrefer a guard's IPv6 rather than IPv4 endpointIf this option is set to 1, Tor prefers an OR port with an IPv6 address over one with IPv4 if a given entry node has both. (Tor also prefers an IPv6 ORPort if IPv4Client is set to 0.) If this option is set to auto, Tor bridge clients prefer the configured bridge address, and other clients prefer IPv4. Other things may influence the choice. This option breaks a tie to the favor of IPv6. (Default: auto) ¢
" ( e©•òÞÅ Ý ¾&ãƾ¨‘~k\A) ï ¨2ò e?$äÏÀµ ž‹v ’býJ ,[MINMEASUREDBWSFORAUTHTOIGNOREADVERTISED-OFFLINEMASTERKEY Ý)MAXMEMINQUEUES Ú" ?KEYDIRECTORYGROUPREADABLE ß%KEYDIRECTORY Þ ;MAXCONSENSUSAGEFORDIFFS å =MAXCLIENTCIRCUITSPENDINGo3MAXCIRCUITDIRTINESSn9MAXADVERTISEDBANDWIDTH5!MAPADDRESSl'MAINLOOPSTATS Â)LONGLIVEDPORTSk1LOGTIMEGRANULARITY4/LOGMESSAGEDOMAINS3LOG2 =LEARNCIRCUITBUILDTIMEOUTT7KISTSOCKBUFSIZEFACTORF ORPORT ½ NUMCPUS ¼
NICKNAME »
MYFAMILY º1MAXONIONQUEUEDELAY ¹3OUTBOUNDBINDADDRESS8)OPTIMISTICDATA ’-NUMPRIMARYGUARDS~)NUMENTRYGUARDS}1NUMDIRECTORYGUARDS
NOEXEC7!NODEFAMILYp-NEWCIRCUITPERIODm
NATDPORT ‰#MIDDLENODESa CMAXUNPARSEABLEDESCSIZETOLOG6` 5KISTSCHEDRUNINTERVALE CMINUPTIMEHIDSERVDIRECTORYV2 ì 5 )HTTPTUNNELPORT †;HTTPSPROXYAUTHENTICATOR/5KEEPBINDCAPABILITIES1+KEEPALIVEPERIOD0
IPV6EXIT ¸
² ² †J%
AA‹ PATHSNEEDEDTOBUILDCIRCUITSPathsNeededToBuildCircuitsClientNUMPortion of relays to require information for before making circuitsTor clients don't build circuits for user traffic until they know about enough of the network so that they could potentially construct enough of the possible paths through the network. If this option is set to a fraction between 0.25 and 0.95, Tor won't build circuits until it has enough descriptors or microdescriptors to construct that fraction of possible paths. Note that setting this option too low can make your Tor client less anonymous, and setting it too high can prevent your Tor client from bootstrapping. If this option is negative, Tor will use a default value chosen by the directory authorities. If the directory authorities do not choose a value, Tor will default to 0.6. (Default: -1) ¤
£ £ „Y&
ww †5CLIENTBOOTSTRAPCONSENSUSAUTHORITYDOWNLOADINITIALDELAYClientBootstrapConsensusAuthorityDownloadInitialDelayClientNDelay when bootstrapping before downloading descriptors from authoritiesInitial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients fetching from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures. (Default: 6) ¥
˜ ˜ „d'
uu†SCLIENTBOOTSTRAPCONSENSUSFALLBACKDOWNLOADINITIALDELAYClientBootstrapConsensusFallbackDownloadInitialDelayClientNDelay when bootstrapping before downloading descriptors from fallbacksInitial delay in seconds for when clients should download consensuses from fallback directory mirrors if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients fetching from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures. (Default: 0) ¦
E n E ‚%) aa{‚CLIENTBOOTSTRAPCONSENSUSMAXINPROGRESSTRIESClientBootstrapConsensusMaxInProgressTriesClientNUMDescriptor documents that can be downloaded in parallelTry this many simultaneous connections to download a consensus before waiting for one to complete, timeout, or error out. (Default: 3) ¨…(
I†cCLIENTBOOTSTRAPCONSENSUSAUTHORITYONLYDOWNLOADINITIALDELAYClientBootstrapConsensusAuthorityOnlyDownloadInitialDelayClientNDelay when bootstrapping before downloading descriptors from authorities if fallbacks disabledInitial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients which don't have or won't fetch from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures. (Default: 0) §
% t% ‚K+ SSiƒDORMANTTIMEOUTDISABLEDBYIDLESTREAMSDormantTimeoutDisabledByIdleStreamsClient0|1Include idle streams when determining dormancyIf true, then any open client stream (even one not reading or writing) counts as client activity for the purpose of DormantClientTimeout. If false, then only network activity counts. (Default: 1) ªƒ* 55A}„DORMANTCLIENTTIMEOUTDormantClientTimeoutClientN minutes|hours|days|weeksBecome dormant when unused as a client for this durationIf Tor spends this much time without any client activity, enter a dormant state where automatic circuits are not built, and directory information is not fetched. Does not affect servers or onion services. Must be at least 10 minutes. (Default: 24 hours) ©
Ø Ø „$, 77?‡'DORMANTONFIRSTSTARTUPDormantOnFirstStartupClient0|1Begin tor in dormant modeIf true, then the first time Tor starts up with a fresh DataDirectory, it starts in dormant mode, and takes no actions until the user has made a request. (This mode is recommended if installing a Tor client for a user who might not actually use it.) If false, Tor bootstraps the first time it is started, whether it sees a user request or not.
After the first time Tor starts, it begins in dormant mode if it was dormant before, and not otherwise. (Default: 0) «
Œ Œ †p- ==_ŒDORMANTCANCELEDBYSTARTUPDormantCanceledByStartupClient0|1Disable dormant mode when tor's restartedBy default, Tor starts in active mode if it was active the last time it was shut down, and in dormant mode if it was dormant. But if this option is true, Tor treats every startup event as user activity, and Tor will never start in Dormant mode, even if it has been unused for a long time on previous runs. (Default: 0)
Note: Packagers and application developers should change the value of this option only with great caution: it has the potential to create spurious traffic on the network. This option should only be used if Tor is started by an affirmative user activity (like clicking on an applcation or running a command), and not if Tor is launched for some other reason (for example, by a startup process, or by an application that launches itself on every login.) ¬
k ü k ƒ
/ ++Q…ASSUMEREACHABLEAssumeReachableRelay0|1Skips reachability test at startupThis option is used when bootstrapping a new Tor network. If set to 1, don't do self-reachability testing; just upload your server descriptor immediately. If AuthoritativeDirectory is also set, this option instructs the dirserver to bypass remote reachability testing too and list all connected servers as running. ®„ . y†WADDRESSAddressRelayaddressOverwrites address others will use to reach this relayThe IPv4 address of this server, or a fully qualified domain name of this server that resolves to an IPv4 address. You can leave this unset, and Tor will try to guess your IPv4 address. This IPv4 address is the one used to tell clients and other servers where to find your Tor server; it doesn't affect the address that your server binds to. To bind to a different address, use the ORPort and OutboundBindAddress options.
Å n Å ƒ%1 11„qBRIDGEDISTRIBUTIONBridgeDistributionRelaystringDistribution method BrideDB should provide our address byIf set along with BridgeRelay, Tor will include a new line in its bridge descriptor which indicates to the BridgeDB service how it would like its bridge address to be given out. Set it to "none" if you want BridgeDB to avoid distributing your bridge address, or "any" to let BridgeDB decide. (Default: any) °ƒ0 ##+…9BRIDGERELAYBridgeRelayRelay0|1Act as a bridgeSets the relay to act as a "bridge" with respect to relaying connections from bridge users to the Tor network. It mainly causes Tor to publish a server descriptor to the bridge database, rather than to the public directory authorities.
Note: make sure that no MyFamily lines are present in your torrc when relay is configured in bridge mode. ¯
s s … 2 ##'QˆuCONTACTINFOContactInfoRelayemail_addressContact information for this relayAdministrative contact information for this relay or bridge. This line can be used to contact you if your relay or bridge is misconfigured or something else goes wrong. Note that we archive and publish all descriptors containing these lines and that Google indexes them, so spammers might also collect them. You may want to obscure the fact that it's an email address and/or generate a new address for this purpose.
ContactInfo must be set to a working address if you run more than one relay or bridge. (Really, everybody running a relay or bridge should set it.) ±
ñ ñ † 3 I‹EXITRELAYExitRelayRelay0|1|autoAllow relaying of exit trafficTells Tor whether to run as an exit relay. If Tor is running as a non-bridge server, and ExitRelay is set to 1, then Tor allows traffic to exit according to the ExitPolicy option, the ReducedExitPolicy option, or the default ExitPolicy (if no other exit policy option is specified).
If ExitRelay is set to 0, no traffic is allowed to exit, and the ExitPolicy, ReducedExitPolicy, and IPv6Exit options are ignored.
If ExitRelay is set to "auto", then Tor checks the ExitPolicy, ReducedExitPolicy, and IPv6Exit options. If at least one of these options is set, Tor behaves as if ExitRelay were set to 1. If none of these exit policy options are set, Tor behaves as if ExitRelay were set to 0. (Default: auto) ²
! à æÏ´œƒgO4ùßÉ©–„xc'FöݾŸ†lO8 î × Ã ~ r c )RENDPOSTPERIOD1RELAYBANDWIDTHRATE@3RELAYBANDWIDTHBURST?5REJECTPLAINTEXTPORTS ‘1REFUSEUNKNOWNEXITS Æ/REDUCEDEXITPOLICY · =REDUCEDCONNECTIONPADDINGZ7REDUCEDCIRCUITPADDING\3RECOMMENDEDVERSIONS é ?RECOMMENDEDSERVERVERSIONS í ?RECOMMENDEDCLIENTVERSIONS ê5REACHABLEORADDRESSESh7REACHABLEDIRADDRESSESg1REACHABLEADDRESSESf ?PUBLISHHIDSERVDESCRIPTORS ;PUBLISHSERVERDESCRIPTOR ¾-PROTOCOLWARNINGS> PIDFILE='PERCONNBWRATE<)PERCONNBWBURST; APATHSNEEDEDTOBUILDCIRCUITS ¥-PATHBIASWARNRATE ˜5PATHBIASUSETHRESHOLD œ ?PATHBIASSCALEUSETHRESHOLD Ÿ9PATHBIASSCALETHRESHOLD ›7PATHBIASNOTICEUSERATE 1PATHBIASNOTICERATE —9PATHBIASEXTREMEUSERATE ž3PATHBIASEXTREMERATE ™1PATHBIASDROPGUARDS š7PATHBIASCIRCTHRESHOLD –/PADDINGSTATISTICS Ò7OUTBOUNDBINDADDRESSOR: ¡ccept any other IPv4 or IPv6 traffic.
Tor also allows IPv6 exit policy entries. For instance, "reject6 [FC00::]/7:*" rejects all destinations that share 7 most significant bit prefix with address FC00::. Respectively, "accept6 [C000::]/3:*" accepts all destinations that share 3 most significant bit prefix with address C000::.
accept6 and reject6 only produce IPv6 exit policy entries. Using an IPv4 address with accept6 or reject6 is ignored and generates a warning. accept/reject allows either IPv4 or IPv6 addresses. Use *4 as an IPv4 wildcard address, and *6 as an IPv6 wildcard address. accept/reject * expands to matching IPv4 and IPv6 wildcard address rules.
To specify all IPv4 and IPv6 internal and link-local networks (including 0.0.0.0/8, 169.254.0.0/16, 127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, [::]/8, [FC00::]/7, [FE80::]/10, [FEC0::]/10, [FF00::]/8, and [::]/127), you can use the "private" alias instead of an address. ("private" always produces rules for IPv4 and IPv6 addresses, even ¢ when used with accept6/reject6.)
Private addresses are rejected by default (at the beginning of your exit policy), along with any configured primary public IPv4 and IPv6 addresses. These private addresses are rejected unless you set the ExitPolicyRejectPrivate config option to 0. For example, once you've done that, you could allow HTTP to 127.0.0.1 and block all other connections to internal networks with "accept 127.0.0.1:80,reject private:*", though that may also allow connections to your own computer that are addressed to its public (external) IP address. See RFC 1918 and RFC 3330 for more details about internal and reserved IP address space. See ExitPolicyRejectLocalInterfaces if you want to block every address on the relay, even those that aren't advertised in the descriptor.
This directive can be specified multiple times so you don't have to put it all on one line.
Policies are considered first to last, and the first match wins. If you want to allow the same ports on IPv4 and IPv6, write your ru les using accept/reject *. If you want to allow different ports on IPv4 and IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules using accept/reject *4. If you want to _replace_ the default exit policy, end your exit policy with either a reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) the default exit policy.
If you want to use a reduced exit policy rather than the default exit policy, set "ReducedExitPolicy 1". If you want to replace the default exit policy with your custom exit policy, end your exit policy with either a reject : or an accept :. Otherwise, you're augmenting (prepending to) the default or reduced exit policy.
The default exit policy is:
reject *:25
reject *:119
reject *:135-139
reject *:445
reject *:563
reject *:1214
reject *:4661-4666
reject *:6346-6429
reject *:6699
reject *:6881-6999
accept *:*
Since the default exit policy uses accept/reject *, it applies to both IPv4 and IPv6 addresses. ³
.
‚ 5 ;;U‚}EXITPOLICYREJECTPRIVATEExitPolicyRejectPrivateRelay0|1Prevent exiting on the local networkReject all private (local) networks, along with the relay's advertised public IPv4 and IPv6 addresses, at the beginning of your exit policy. See above entry on ExitPolicy. (Default: 1) ´>4 !!/q¹;EXITPOLICYExitPolicyRelaypolicy,policy,...Traffic destinations that can exit from this relaySet an exit policy for this server. Each policy is of the form "accept[6]|reject[6] ADDR[/MASK][:PORT]". If /MASK is omitted then this policy just applies to the host given. Instead of giving a host or network you can also use "*" to denote the universe (0.0.0.0/0 and ::/0), or *4 to denote all IPv4 addresses, and *6 to denote all IPv6 addresses. PORT can be a single port number, an interval of ports "FROM_PORT-TO_PORT", or "*". If PORT is omitted, that means "*".
For example, "accept 18.7.22.69:*,reject 18.0.0.0/8:*,accept *:*" would reject any IPv4 traffic destined for MIT except for web.mit.edu, and a
M M …/6 KKˆWEXITPOLICYREJECTLOCALINTERFACESExitPolicyRejectLocalInterfacesRelay0|1More extensive prevention of exiting on the local networkReject all IPv4 and IPv6 addresses that the relay knows about, at the beginning of your exit policy. This includes any OutboundBindAddress, the bind addresses of any port options, such as ControlPort or DNSPort, and any public IPv4 and IPv6 addresses on any interface on the relay. (If IPv6Exit is not set, all IPv6 addresses will be rejected anyway.) See above entry on ExitPolicy. This option is off by default, because it lists all public relay IP addresses in the ExitPolicy, even those relay operators might prefer not to disclose. (Default: 0) µ 02-904
accept *:981
accept *:989-990
accept *:991
accept *:992
accept *:993
accept *:994
accept *:995
accept *:1194
accept *:1220
accept *:1293
accept *:1500
accept *:1533
accept *:1677
accept *:1723
accept *:1755
accept *:1863
accept *:2082
accept *:2083
accept *:2086-2087
accept *:2095-2096
accept *:2102-2104
accept *:3128
accept *:3389
accept *:3690
accept *:4321
accept *:4643
accept *:5050
accept *:5190
accept *:5222-5223
accept *:5228
accept *:5900
accept *:6660-6669
accept *:6679
accept *:6697
accept *:8000
accept *:8008
accept *:8074
accept *:8080
accept *:8082
accept *:8087-8088
accept *:8232-8233
accept *:8332-8333
accept *:8443
accept *:8888
accept *:9418
accept *:9999
accept *:10000
accept *:11371
accept *:19294
accept *:19638
accept *:50002
accept *:64738
reject *:*
(Default: 0) ¶
d d 7 //IREDUCEDEXITPOLICYReducedExitPolicyRelay0|1Customized reduced exit policyIf set, use a reduced exit policy rather than the default one.
The reduced exit policy is an alternative to the default exit policy. It allows as many Internet services as possible while still blocking the majority of TCP ports. Currently, the policy allows approximately 65 ports. This reduces the odds that your node will be used for peer-to-peer applications.
The reduced exit policy is:
accept *:20-21
accept *:22
accept *:23
accept *:43
accept *:53
accept *:79
accept *:80-81
accept *:88
accept *:110
accept *:143
accept *:194
accept *:220
accept *:389
accept *:443
accept *:464
accept *:465
accept *:531
accept *:543-544
accept *:554
accept *:563
accept *:587
accept *:636
accept *:706
accept *:749
accept *:873
accept *:9 ¥
S ýŽ S ‚7; ?„NICKNAMENicknameRelaynameIdentifier for this relaySet the server's nickname to 'name'. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a-zA-Z0-9]. If not set, Unnamed will be used. Relays can always be uniquely identified by their identity fingerprints. ºˆ : CYMYFAMILYMyFamilyRelayfingerprint,fingerprint,...Other relays this operator administersDeclare ¨‚
9
11/‚MAXONIONQUEUEDELAYMaxOnionQueueDelayRelayNUM [msec|second]Duration to reject new onionskins if we have more than we can processIf we have more onionskins queued for processing than we can process in this amount of time, reject new ones. (Default: 1750 msec) ¸n8 ]‚SIPV6EXITIPv6ExitRelay0|1Allow clients to use us for IPv6 trafficIf set, and we are an exit node, allow clients to use us for IPv6 traffic. When this option is set and ExitRelay is auto, we act as if ExitRelay is 1. (Default: 0) · that this Tor relay is controlled or administered by a group or organization identical or similar to that of the other relays, defined by their (possibly $-prefixed) identity fingerprints. This option can be repeated many times, for convenience in defining large families: all fingerprints in all MyFamily lines are merged into one list. When two relays both declare that they are in the same 'family', Tor clients will not use them in the same circuit. (Each relay only needs to list the other servers in its family; it doesn't need to list itself, but it won't hurt if it does.) Do not list any bridge relay as it would compromise its concealment.
When listing a node, it's better to list it by fingerprint than by nickname: fingerprints are more reliable.
If you run more than one relay, the MyFamily option on each relay must list all other relays, as described above.
Note: do not use MyFamily when configuring your Tor instance as a brigde. ¹
¾ Þ¾ Š= CO“ORPORTORPortRelay[address:]PORT|auto [flags]Port used to accept relay trafficAdvertise this port to listen for connections from Tor clients and servers. This option is required to be a Tor server. Set it to "auto" to have Tor pick a port for you. Set it to 0 to not run a ª‚ < aƒ3NUMCPUSNumCPUsRelaynumNumber of processes spawned for decryptionHow many processes to use at once for decrypting onionskins and other parallelizable operations. If this is set to 0, Tor will try to detect how many CPUs you have, defaulting to 1 if it can't tell. (Default: 0) » n ORPort at all. This option can occur more than once. (Default: 0)
Tor recognizes these flags on each ORPort:
NoAdvertise
By default, we bind to a port and tell our users about it. If NoAdvertise is specified, we don't advertise, but listen anyway. This can be useful if the port everybody will be connecting to (for example, one that's opened on our firewall) is somewhere else.
NoListen
By default, we bind to a port and tell our users about it. If NoListen is specified, we don't bind, but advertise anyway. This can be useful if something else (for example, a firewall's port forwarding configuration) is causing connections to reach us.
IPv4Only
If the address is absent, or resolves to both an IPv4 and an IPv6 address, only listen to the IPv4 address.
IPv6Only
If the address is absent, or resolves to both an IPv4 and an IPv6 address, only listen to the IPv6 address.
For obvious reasons, NoAdvertise and NoListen are mutually exclusive, and IPv4Only and IPv6Only are mutually exclusive. ¼
ô ô †> ;;/IŠCPUBLISHSERVERDESCRIPTORPublishServerDescriptorRelay0|1|v3|bridge,...Types of descriptors publishedThis option specifies which descriptors Tor will publish when acting as a relay. You can choose multiple arguments, separated by commas.
If this option is set to 0, Tor will not publish its descriptors to any directories. (This is useful if you're testing out your server, or if you're using a Tor controller that handles directory publishing for you.) Otherwise, Tor will publish its descriptors of all type(s) specified. The default is "1", which means "if running as a relay or bridge, publish descriptors to the appropriate authorities". Other possibilities are "v3", meaning "publish as if you're a relay", and "bridge", meaning "publish as if you're a bridge". ½
š ºš ‚ @ ))AO‚wSSLKEYLIFETIMESSLKeyLifetimeRelayN minutes|hours|days|weeksLifetime for our link certificateWhen creating a link certificate for our outermost SSL handshake, set its lifetime to this amount of time. If set to 0, Tor will choose some reasonable random defaults. (Default: 0) ¿‚B? 11wƒ9SHUTDOWNWAITLENGTHShutdownWaitLengthRelayNUMDelay before quitting after receiving a SIGINT signalWhen we get a SIGINT and we're a server, we begin shutting down: we close listeners and start refusing new circuits. After NUM seconds, we exit. If we get a second SIGINT, we exit immediately. (Default: 30 seconds) ¾
K gK ‚B
''‚]MAINLOOPSTATSMainloopStatsRelay0|1Include development information from the main loop with heartbeatsLog main loop statistics every HeartbeatPeriod seconds. This is a log level notice message designed to help developers instrumenting Tor's main event loop. (Default: 0) ÁƒA ++Aw„=HEARTBEATPERIODHeartbeatPeriodRelayN minutes|hours|days|weeksRate at which an INFO level heartbeat message is sentLog a heartbeat message every HeartbeatPeriod seconds. This is a log level notice message, designed to let you know your Tor server is still alive and doing useful things. Settings this to 0 will disable the heartbeat. Otherwise, it must be at least 30 minutes. (Default: 6 hours) À ng. It will only hibernate once one of the two reaches 1 TByte. This can be changed to use the sum of the both bytes received and sent by setting the AccountingRule option to "sum" (total bandwidth in/out). When the number of bytes remaining gets low, Tor will stop accepting new connections and circuits. When the number of bytes is exhausted, Tor will hibernate until some time in the next accounting period. To prevent all servers from waking at the same time, Tor will also wait until a random point in each period before waking up. If you have bandwidth cost issues, enabling hibernation is preferable to setting a low bandwidth, since it provides users with a collection of fast servers that are up some of the time, which is more useful than a set of slow servers that are always "available".
Note that (as also described in the Bandwidth section) Tor uses powers of two, not powers of ten: 1 GByte is 1024*1024*1024, not one billion. Be careful: some internet service providers might count GBytes differently. Â
Ó Ó Œ!C
''U–;ACCOUNTINGMAXAccountingMaxRelayN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsAmount of traffic before hibernatingLimits the max number of bytes sent and received within a set time period using a given calculation rule (see: AccountingStart, AccountingRule). Useful if you need to stay under a specific bandwidth. By default, the number used for calculation is the max of either the bytes sent or received. For example, with AccountingMax set to 1 TByte, a server could send 900 GBytes and receive 800 GBytes and continue runni ®
ð ð „ D )))}†AACCOUNTINGRULEAccountingRuleRelaysum|max|in|outMethod to determine when the accounting limit is reachedHow we determine when our AccountingMax has been reached (when we should hibernate) during a time interval. Set to "max" to calculate using the higher of either the sent or received bytes (this is the default functionality). Set to "sum" to calculate using the sent plus received bytes. Set to "in" to calculate using only the received bytes. Set to "out" to calculate using only the sent bytes. (Default: max) Ã
ë ë †E ++AMŠ_ACCOUNTINGSTARTAccountingStartRelayday|week|month [day] HH:MMDuration of an accounting periodSpecify how long accounting periods last. If month is given, each accounting period runs from the time HH:MM on the dayth day of one month to the same day and time of the next. The relay will go at full speed, use all the quota you specify, then hibernate for the rest of the period. (The day must be between 1 and 28.) If week is given, each accounting period runs from the time HH:MM of the dayth day of one week to the same day and time of the next week, with Monday as day 1 and Sunday as day 7. If day is given, each accounting period runs from the time HH:MM each day to the same time on the next day. All times are local, and given in 24-hour time. (Default: "month 1 0:00") Ä
- : - „ G ;; w†)SERVERDNSRESOLVCONFFILEServerDNSResolvConfFileRelayfilenameOverriding resolver config for DNS queries we provideOverrides the default DNS configuration with the configuration in filename. The file format is the same as the standard Unix "resolv.conf" file (7). This option, like all other ServerDNS options, only affects name lookups that your server does on behalf of clients. (Defaults to use the system DNS configuration or a localhost DNS service in case no nameservers are found in a given configuration.) ƃBF
11 … REFUSEUNKNOWNEXITSRefuseUnknownExitsRelay0|1|autoPrevents relays not in the consensus from using us as an exitPrevent nodes that don't appear in the consensus from exiting using this relay. If the option is 1, we always block exit attempts from such nodes; if it's 0, we never do, and if the option is "auto", then we do whatever the authorities suggest in the consensus (and block if the consensus is quiet on the issue). (Default: auto) Å
£ { £ ƒTI
99…/SERVERDNSSEARCHDOMAINSServerDNSSearchDomainsRelay0|1Toggles if our DNS queries search for addresses in the local domainIf set to 1, then we will search for addresses in the local search domain. For example, if this system is configured to believe it is in "example.com", and a client tries to connect to "www", the client will be connected to "www.example.com". This option only affects name lookups that your server does on behalf of clients. (Default: 0) ȃH
AAƒ}SERVERDNSALLOWBROKENCONFIGServerDNSAllowBrokenConfigRelay0|1Toggles if we persist despite configuration parsing errors or notIf this option is false, Tor exits immediately if there are problems parsing the system DNS configuration or connecting to nameservers. Otherwise, Tor continues to periodically retry the system nameservers until it eventually succeeds. (Default: 1) Ç
\ S \ ƒsK
997
…OSERVERDNSTESTADDRESSESServerDNSTestAddressesRelayhostname,hostname,...Addresses to test to see if valid DNS queries are being hijackedWhen we're detecting DNS hijacking, make sure that these valid addresses aren't getting redirected. If they are, then our DNS is completely useless, and we'll reset our exit policy to "reject *:*". This option only affects name lookups that your server does on behalf of clients. (Default: "www.google.com, www.mit.edu, www.yahoo.com, www.slashdot.org") ʃ)J ==O…SERVERDNSDETECTHIJACKINGServerDNSDetectHijackingRelay0|1Toggles testing for DNS hijackingWhen this option is set to 1, we will test periodically to determine whether our local nameservers have been configured to hijack failing DNS requests (usually to an advertising site). If they are, we will attempt to correct this. This option only affects name lookups that your server does on behalf of clients. (Default: 1) É
W * W ƒOM AA]…MBRIDGERECORDUSAGEBYCOUNTRYBridgeRecordUsageByCountryRelay0|1Tracks geoip information on bridge usageWhen this option is enabled and BridgeRelay is also enabled, and we have GeoIP data, Tor keeps a per-country count of how many client addresses have contacted it so that it can help the bridge authority guess which countries have blocked access to it. If ExtraInfoStatistics is enabled, it will be published as part of extra-info document. (Default: 1) ̃RL MM}…SERVERDNSALLOWNONRFC953HOSTNAMESServerDNSAllowNonRFC953HostnamesRelay0|1Toggles if we reject DNS queries with invalid charactersWhen this option is disabled, Tor does not try to resolve hostnames containing illegal characters (like @ and :) rather than sending them to an exit node to be resolved. This helps trap accidental attempts to resolve URLs and so on. This option only affects name lookups that your server does on behalf of clients. (Default: 0) Ë
² \ ² &P ## i!GEOIPV6FILEGeoIPv6FileRelayfilenamePath to file containing IPv6 geoip informationA filename containing IPv6 GeoIP data, for use with by-country statistics. Ï"O i!GEOIPFILEGeoIPFileRelayfilenamePath to file containing IPv4 geoip informationA filename containing IPv4 GeoIP data, for use with by-country statistics. ΃zN 99U†;SERVERDNSRANDOMIZECASEServerDNSRandomizeCaseRelay0|1Toggles DNS query case randomizationWhen this option is set, Tor sets the case of each character randomly in outgoing DNS requests, and makes sure that the case matches in DNS replies. This so-called "0x20 hack" helps resist some types of DNS poisoning attack. For more information, see "Increased DNS Forgery Resistance through 0x20-Bit Encoding". This option only affects name lookups that your server does on behalf of clients. (Default: 1) Í
ó ó „ Q ))i†eCELLSTATISTICSCellStatisticsRelay0|1Toggles storing circuit queue duration to diskRelays only. When this option is enabled, Tor collects statistics about cell processing (i.e. mean time a cell is spending in a queue, mean number of cells in a queue and mean number of processed cells per circuit) and writes them into disk every 24 hours. Onion router operators may use the statistics for performance monitoring. If ExtraInfoStatistics is enabled, it will published as part of extra-info document. (Default: 0) Ð
ƒvS
--†DIRREQSTATISTICSDirReqStatisticsRelay0|1Toggles storing network status counts and performance to diskRelays and bridges only. When this option is enabled, a Tor directory writes statistics on the number and response time of network status requests to disk every 24 hours. Enables relay and bridge operators to monitor how much their server is being used by clients to learn about Tor network. If ExtraInfoStatistics is enabled, it will published as part of extra-info document. (Default: 1) ÒƒhR //I†7PADDINGSTATISTICSPaddingStatisticsRelay0|1Toggles storing padding countsRelays and bridges only. When this option is enabled, Tor collects statistics for padding cells sent and received by this relay, in addition to total cell counts. These statistics are rounded, and omitted if traffic is low. This information is important for load balancing decisions related to padding. If ExtraInfoStatistics is enabled, it will be published as a part of extra-info document. (Default: 1) Ñ
/ / ƒbU 11s…}EXITPORTSTATISTICSExitPortStatisticsRelay0|1Toggles storing traffic and port usage data to diskExit relays only. When this option is enabled, Tor writes statistics on the number of relayed bytes and opened stream per exit port to disk every 24 hours. Enables exit relay operators to measure and monitor amounts of traffic that leaves Tor network through their exit node. If ExtraInfoStatistics is enabled, it will be published as part of extra-info document. (Default: 0) ÔƒgT ++m†ENTRYSTATISTICSEntryStatisticsRelay0|1Toggles storing client connection counts to diskRelays only. When this option is enabled, Tor writes statistics on the number of directly connecting clients to disk every 24 hours. Enables relay operators to monitor how much inbound traffic that originates from Tor clients passes through their server to go further down the Tor network. If ExtraInfoStatistics is enabled, it will be published as part of extra-info document. (Default: 0) Ó
Š 0 Š ƒ"W ;;e„wHIDDENSERVICESTATISTICSHiddenServiceStatisticsRelay0|1Toggles storing hidden service stats to diskRelays only. When this option is enabled, a Tor relay writes obfuscated statistics on its role as hidden-service directory, introduction point, or rendezvous point to disk every 24 hours. If ExtraInfoStatistics is also enabled, these statistics are further published to the directory authorities. (Default: 1) ÖƒLV ;;Y…WCONNDIRECTIONSTATISTICSConnDirectionStatisticsRelay0|1Toggles storing connection use to diskRelays only. When this option is enabled, Tor writes statistics on the amounts of traffic it passes between itself and other relays to disk every 24 hours. Enables relay operators to monitor how much their relay is being used as middle node in the circuit. If ExtraInfoStatistics is enabled, it will be published as part of extra-info document. (Default: 0) Õ
ü ü „ X 33u†3EXTRAINFOSTATISTICSExtraInfoStatisticsRelay0|1Publishes statistic data in the extra-info documentsWhen this option is enabled, Tor includes previously gathered statistics in its extra-info documents that it uploads to the directory authorities. Disabling this option also removes bandwidth usage statistics, and GeoIPFile and GeoIPv6File hashes from the extra-info file. Bridge ServerTransportPlugin lines are always includes in the extra-info file, because they are required by BridgeDB. (Default: 1) ×
Ô Ô „(Y CCq†gEXTENDALLOWPRIVATEADDRESSESExtendAllowPrivateAddressesRelay0|1Allow circuits to be extended to the local networkWhen this option is enabled, Tor will connect to relays on localhost, RFC1918 addresses, and so on. In particular, Tor will make direct OR connections, and Tor routers allow EXTEND requests, to these private addresses. (Tor will always allow connections to bridges, proxies, and pluggable transports configured on private addresses.) Enabling this option can create security issues; you should probably leave it off. (Default: 0) Ø
> > …>Z
))E'ˆ]MAXMEMINQUEUESMaxMemInQueuesRelayN bytes|KBytes|MBytes|GBytesThreshold at which tor will terminate circuits to avoid running out of memoryThis option configures a threshold above which Tor will assume that it needs to stop queueing or buffering data because it's about to run out of memory. If it hits this threshold, it will begin killing circuits until it has recovered at least 10% of this memory. Do not set this option too low, or your relay may be unreliable under load. This option only affects some queues, so the actual process size will be larger than this. If this option is set to 0, Tor will try to pick a reasonable default based on your system's physical memory. (Default: 0) Ù
6 ¤6 ‚j\ 113gƒySIGNINGKEYLIFETIMESigningKeyLifetimeRelayN days|weeks|monthsDuration the Ed25519 signing key is valid forFor how long should each Ed25519 signing key be valid? Tor uses a permanent master identity key that can be kept offline, and periodically generates new "signing" keys that it uses online. This option configures their lifetime. (Default: 30 days) Û‚X[ ++sƒuDISABLEOOSCHECKDisableOOSCheckRelay0|1Don't close connections when running out of socketsThis option disables the code that closes connections when Tor notices that it is running low on sockets. Right now, it is on by default, since the existing out-of-sockets mechanism tends to kill OR connections more than it should. (Default: 1) Ú
¥Ý ƒJ_ ?? s…'KEYDIRECTORYGROUPREADABLEKeyDirectoryGroupReadableRelay0|1|autoGroup read permissions for the secret key directoryIf this option is set to 0, don't allow the filesystem group to read the KeyDirectory. If the option is set to 1, make the KeyDirectory readable by the default GID. If the option is "auto", then we use the setting for DataDirectoryGroupReadable when the KeyDirectory is the same as the DataDirectory, and 0 otherwise. (Default: auto) ÞD^ %%Q{KEYDIRECTORYKeyDirectoryRelayDIRDirectory where secret keys resideStore secret keys in DIR. Can not be changed while tor is running. (Default: the "keys" subdirectory of DataDirectory.) Ý‚W] --U„
OFFLINEMASTERKEYOfflineMasterKeyRelay0|1Don't generate the master secret keyIf non-zero, the Tor relay will never generate or load its master secret key. Instead, you'll have to use "tor --keygen" to manage the permanent ed25519 master identity key, as well as the corresponding temporary signing keys and certificates. (Default: 0) Ü
M ±M ‚`a -- W„ DIRPORTFRONTPAGEDirPortFrontPageDirectoryFILENAMEPublish this html file on the DirPortWhen this option is set, it takes an HTML file and publishes it as "/" on the DirPort. Now relay operators can provide a disclaimer without needing to set up a separate webserver. There's a sample disclaimer in contrib/operator-tools/tor-exit-notice.html. à‚K` --Qkƒ!REPHISTTRACKTIMERephistTrackTimeRelayN seconds|minutes|hours|days|weeksDiscards old, unchanged reliability informationTells an authority, or other node tracking node reliability and history, that fine-grained information about nodes can be discarded when it hasn't changed for a given amount of time. (Default: 24 hours) ß
ý O ý ‚Nc /G„DIRPOLICYDirPolicyDirectorypolicy,policy,...Access policy for the DirPortSet an entrance policy for this server, to limit who can connect to the directory ports. The policies have the same form as exit policies above, except that port specifiers are ignored. Any address not matched by some entry in the policy is accepted. âƒ-b CI…1DIRPORTDirPortDirectory[address:]PORT|auto [flags]Port for directory connectionsIf this option is nonzero, advertise the directory service on this port. Set it to "auto" to have Tor pick a port for you. This option can occur more than once, but only one advertised DirPort is supported: all but one DirPort must have the NoAdvertise flag set. (Default: 0)
The same flags are supported here as are supported by ORPort. á
" ˜ ðàÑ û ì Ì«qT8 þãɱ™‰yaI9+öൠ° ˜…^. Š ¹
1TESTINGAUTHKEYSLOP=9TESTINGAUTHKEYLIFETIME; ASERVERDNSALLOWBROKENCONFIG È!SCHEDULERSD SANDBOXC&OTESTINGCLIENTDOWNLOADINITIALDELAY*/aTESTINGCLIENTCONSENSUSDOWNLOADINITIALDELAY,&OTESTINGBRIDGEDOWNLOADINITIALDELAY-/aTESTINGBRIDGEBOOTSTRAPDOWNLOADINITIALDELAY.*WTESTINGAUTHDIRTIMETOLEARNREACHABILITY&/SYSLOGIDENTITYTAGN#STRICTNODESc)SSLKEYLIFETIME À%SOCKSTIMEOUTt
SOCKSPORTr#SOCKSPOLICYs3SOCKS5PROXYUSERNAMEL3SOCKS5PROXYPASSWORDM#SOCKS5PROXYK#SOCKS4PROXYJ1SIGNINGKEYLIFETIME Ü1SHUTDOWNWAITLENGTH ¿7SERVERTRANSPORTPLUGINI9SERVERTRANSPORTOPTIONSH ?SERVERTRANSPORTLISTENADDRG9SERVERDNSTESTADDRESSES Ë9SERVERDNSSEARCHDOMAINS É ;SERVERDNSRESOLVCONFFILE Ç9SERVERDNSRANDOMIZECASE Î =SERVERDNSDETECTHIJACKING Ê%MSERVERDNSALLOWNONRFC953HOSTNAMES Ì SAFESOCKS #SAFELOGGINGB#RUNASDAEMONA
ƒod }†-DIRCACHEDirCacheDirectory0|1Provide cached descriptor information to other tor usersWhen this option is set, Tor caches all current directory documents except extra info documents, and accepts client requests for them. If DownloadExtraInfo is set, cached extra info documents are also cached. Setting DirPort is not required for DirCache, because clients connect via the ORPort by default. Setting either DirPort or BridgeRelay and setting DirCache to 0 is not supported. (Default: 1) ã
' À ' ƒf 99 E„yAUTHORITATIVEDIRECTORYAuthoritativeDirectoryAuthority0|1Act as a directory authorityWhen this option is set to 1, Tor operates as an authoritative directory server. Instead of caching the directory, it generates its own list of good servers, signs it, and sends that to the clients. Unless the clients already have you listed as a trusted directory, you probably do not want to set this option. å„ identity keypair. In all cases, Tor records every keypair it accepts in a journal if it is new, or if it differs from the most recently accepted pinning for one of the keys it contains. (Default: 1) ù‚Ty
;; [‚kAUTHDIRGUARDBWGUARANTEEAuthDirGuardBWGuaranteeAuthorityN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsAdvertised rate necessary to be a guardAuthoritative directories only. If non-zero, this advertised capacity or more is always sufficient to satisfy the bandwidth requirement for the Guard flag. (Default: 2 MBytes) ø
¬ ¬ ƒO| AA k…7AUTHDIRTESTED25519LINKKEYSAuthDirTestEd25519LinkKeysAuthority0|1Require proper Ed25519 key for the Running flagAuthoritative directories only. If this option is set to 0, then we treat relays as "Running" if their RSA key is correct when we probe them, regardless of their Ed25519 key. We should only ever set this option to 0 if there is some major bug in Ed25519 link authentication that causes us to label all the relays as not Running. (Default: 1) û‚}{ ;; ]„-AUTHDIRSHAREDRANDOMNESSAuthDirSharedRandomnessAuthority0|1Participates in shared randomness votingAuthoritative directories only. Switch for the shared random protocol. If zero, the authority won't participate in the protocol. If non-zero (default), the flag "shared-rand-participate" is added to the authority vote indicating participation in the protocol. (Default: 1) ú
“ “ ‚n~ 55 +?„!V3AUTHVOTINGINTERVALV3AuthVotingIntervalAuthorityN minutes|hoursConsensus voting intervalV3 authoritative directories only. Configures the server's preferred voting interval. Note that voting will actually happen at an interval chosen by consensus from all the authorities' preferred intervals. This time SHOULD divide evenly into a day. (Default: 1 hour) ýƒw} )) a†7BRIDGEPASSWORDBridgePasswordAuthorityPasswordPassword for requesting bridge informationIf set, contains an HTTP authenticator that tells a bridge authority to serve all requested bridge information. Used by the (only partially implemented) "bridge community" design, where a community of bridge relay operators all use an alternate bridge directory authority, and their target user audience can periodically fetch the list of available community bridges to stay up-to-date. (Default: not set) ü
« f « ƒ7‚ ++ +}… V3AUTHDISTDELAYV3AuthDistDelayAuthorityN minutes|hoursWait time to collect the signatures of other authoritiesV3 authoritative directories only. Configures the server's preferred delay between publishing its consensus and signature and assuming it has all the signatures from all the other authorities. Note that the actual time used is not the server's preferred time, but the consensus of all preferences. (Default: 5 minutes) ÿƒ ++ +k„YV3AUTHVOTEDELAYV3AuthVoteDelayAuthorityN minutes|hoursWait time to collect votes of other authoritiesV3 authoritative directories only. Configures the server's preferred delay between publishing its vote and assuming it has all the votes from all the other authorities. Note that the actual time used is not the server's preferred time, but the consensus of all preferences. (Default: 5 minutes) þ
f f ƒ ‚ -- s„gV3BANDWIDTHSFILEV3BandwidthsFileAuthorityFILENAMEPath to a file containing measured relay bandwidthsV3 authoritative directories only. Configures the location of the bandwidth-authority generated file storing information on relays' measured bandwidth capacities. To avoid inconsistent reads, bandwidth data should be written to temporary file, then renamed to the configured filename. (Default: unset)ƒv‚ 77 s†V3AUTHNINTERVALSVALIDV3AuthNIntervalsValidAuthorityNUMNumber of voting intervals a consensus is valid forV3 authoritative directories only. Configures the number of VotingIntervals for which each consensus should be valid for. Choosing high numbers increases network partitioning risks; choosing low numbers increases directory traffic. Note that the actual number of intervals used is not the server's preferred number, but the consensus of all preferences. Must be at least 2. (Default: 3)
Ð ˆ Ð ‹,‚
AA ”SAUTHDIRHASIPV6CONNECTIVITYAuthDirHasIPv6ConnectivityAuthority0|1Descriptors can be retrieved over the authority's IPv6 ORPortAuthoritative directories only. When set to 0, OR ports with an IPv6 address are not included in the authority's votes. When set to 1, IPv6 OR ports are tested for reachability like IPv4 OR ports. If the reachability test succeeds, the authority votes for the IPv6 ORPort, and votes Running for th Ò‚t‚ 11 w„V3AUTHUSELEGACYKEYV3AuthUseLegacyKeyAuthority0|1Signs consensus with both the current and legacy keysIf set, the directory authority will sign consensuses not only with its own signing key, but also with a "legacy" key and certificate with a different identity. This feature is used to migrate directory authority keys in the event of a compromise. (Default: 0) e relay. If the reachability test fails, the authority does not vote for the IPv6 ORPort, and does not vote Running (Default: 0)
The content of the consensus depends on the number of voting authorities
that set AuthDirHasIPv6Connectivity:
If no authorities set AuthDirHasIPv6Connectivity 1, there will be no
IPv6 ORPorts in the consensus.
If a minority of authorities set AuthDirHasIPv6Connectivity 1,
unreachable IPv6 ORPorts will be removed from the consensus. But the
majority of IPv4-only authorities will still vote the relay as Running.
Reachable IPv6 ORPort lines will be included in the consensus
If a majority of voting authorities set AuthDirHasIPv6Connectivity 1,
relays with unreachable IPv6 ORPorts will not be listed as Running.
Reachable IPv6 ORPort lines will be included in the consensus
(To ensure that any valid majority will vote relays with unreachable
IPv6 ORPorts not Running, 75% of authorities must set
AuthDirHasIPv6Connectivity 1.)
t t ƒ‚
[[ #ƒ?MINMEASUREDBWSFORAUTHTOIGNOREADVERTISEDMinMeasuredBWsForAuthToIgnoreAdvertisedAuthorityNTotal measured value before advertised bandwidths are treated as unreliableA total value, in abstract bandwidth units, describing how much measured total bandwidth an authority should have observed on the network before it will treat advertised bandwidths as wholly unreliable. (Default: 500)
K K …1‚ --) _‰HIDDENSERVICEDIRHiddenServiceDirHidden ServiceDIRECTORYDirectory contents for the hidden serviceStore data files for a hidden service in DIRECTORY. Every hidden service must have a separate directory. You may use this option multiple times to specify multiple services. If DIRECTORY does not exist, Tor will create it. Please note that you cannot add new Onion Service to already running Tor instance if Sandbox is enabled. (Note: in current versions of Tor, if DIRECTORY is a relative path, it will be relative to the current working directory of Tor instance, not to its DataDirectory. Do not rely on this behavior; it is not guaranteed to remain the same in future versions.) H‘ …ûöñìçâÝØÓÎÉÄ¿ºµ°«¦¡œ—’ˆƒ~ytoje`[VQLGB=83.)$ ü÷òíèãÞÙÔÏÊÅÀ»µ¯©£—‘‹…ysmga[UOIC=71+%
ûõïéãÝ×ÑËÅ¿¹³§¡›•‰ƒ}wqke_YSMGA;5/)# „
ƒ ‚ € } { z y} x{ wy vv uu tt lq ko hm gj fi eh dg cf be ac `b ]a \^ Z\ YZ XX WW UU SS RO QL PH OE MC LB KA J? I> H; G9 F8 E7 D5 C4 A2 @0 ?. >, <* 9' 7% 6" 5 3 2 0 / . - + ) ( ' &
$ # " ! Xð ÷úôîèâÜÖÐÊľ¸²¬¦ š”Žˆ‚|vpjd^XRLF@:4.("
þøòìæàÚÔÎȼ¶°ª¤ž˜’Œ†€ztnhb\VPJD>82,& üöð ö‚< õ‚8 ó‚5 ò‚3 ñ‚1 ð‚/ ï‚- î‚* í‚' ì‚$ ë‚! é‚ è‚ ç‚ æ‚ å‚ ã‚ â‚ à‚ ß‚ Þ‚ Ý‚ Ü‚ Ø‚
ׂ Ô‚ Ó‚ Ñ‚ Ђ Ï‚ Î~ Í| Ìz Ëx Êu Éq Èo Çm Æj Åh Äf Ãd Ác Àa ¿_ ¾\ ½Z ¼Y »X ºW ¹U ¸S ·Q ¶P µM ´K ³I ²G ±E °D ¯C B ¬@ «> ©= §; ¦7 ¤6 £5 ž3 2 œ1 ›/ š- ™, ˜+ —) –' •& ”% ’$ ‘" ! Œ ‡ †
Ø Ø †$‚ //)/YŠqHIDDENSERVICEPORTHiddenServicePortHidden ServiceVIRTPORT [TARGET]Port the hidden service is provided onConfigure a virtual port VIRTPORT for a hidden service. You may use this option multiple times; each time applies to the service using the most recent HiddenServiceDir. By default, this option maps the virtual port to the same port on 127.0.0.1 over TCP. You may override the target port, address, or both by specifying a target of addr, port, addr:port, or unix:path. (You can specify an IPv6 target as [addr]:port. Unix paths may be quoted, and may use standard C escapes.) You may also have multiple lines with the same VIRTPORT: when a user connects to that VIRTPORT, one of the TARGETs from those lines will be chosen at random. Note that address-port pairs have to be comma-separated.
ýŽ ƒ‚
II)k„ HIDDENSERVICEALLOWUNKNOWNPORTSHiddenServiceAllowUnknownPortsHidden Service0|1Allow rendezvous circuits on unrecognized portsIf set to 1, then connections to unrecognized ports do not cause the current hidden service to close rendezvous circuits. (Setting this to 0 is not an authorization mechanism; it is instead meant to be a mild inconvenience to port-scanners.) (Default: 0) ‡‚ EE)WYSHIDDENSERVICEAUTHORIZECLIENTHiddenServiceAuthorizeClientHidden Serviceauth-type client-name,cl Ù‚ 55)m‚#HIDDENSERVICEVERSIONHiddenServiceVersionHidden Service2|3Version for published hidden service descriptorsA list of rendezvous service descriptor versions to publish for the hidden service. Currently, versions 2 and 3 are supported. (Default: 3) ient-name,...Restricts access to the hidden serviceIf configured, the v2 hidden service is accessible for authorized clients only. The auth-type can either be 'basic' for a general-purpose authorization protocol or 'stealth' for a less scalable protocol that also hides service activity from unauthorized clients. Only clients that are listed here are authorized to access the hidden service. Valid client names are 1 to 16 characters long and only use characters in A-Za-z0-9+-_ (no spaces). If this option is set, the hidden service is not accessible for clients without authorization any more. Generated authorization data can be found in the hostname file. Clients need to put this authorization data in their configuration file using HidServAuth. This option is only for v2 services; v3 services configure client authentication in a subdirectory of HiddenServiceDir instead (see the Client Authorization section).
ž ôײ•pN0Ñ Ñ ¹ î°€Y žB üÔ°¡ƒpWH4 ÷ Ý Ç ¡ … i Q 7TESTINGSIGNINGKEYSLOP>1TESTINGLINKKEYSLOP< ;TESTINGLINKCERTLIFETIME: CTESTINGMINEXITFLAGTHRESHOLD9 CTESTINGENABLECELLSTATSEVENT8 =TESTINGENABLECONNBWEVENT7!ETESTINGDIRCONNECTIONMAXSTALL0$KTESTINGDIRAUTHVOTEHSDIRISSTRICT6 ;TESTINGDIRAUTHVOTEHSDIR5$KTESTINGDIRAUTHVOTEGUARDISSTRICT4 ;TESTINGDIRAUTHVOTEGUARD3#ITESTINGDIRAUTHVOTEEXITISSTRICT29TESTINGDIRAUTHVOTEEXIT1)TRANSPROXYTYPE ˆ TRANSPORT ‡5TRACKHOSTEXITSEXPIREw)TRACKHOSTEXITSv ?TOKENBUCKETREFILLINTERVALu TESTSOCKS ‚#ITESTINGV3AUTHVOTINGSTARTOFFSET%'QTESTINGV3AUTHINITIALVOTINGINTERVAL""GTESTINGV3AUTHINITIALVOTEDELAY#"GTESTINGV3AUTHINITIALDISTDELAY$/TESTINGTORNETWORK!&OTESTINGSERVERDOWNLOADINITIALDELAY)/aTESTINGSERVERCONSENSUSDOWNLOADINITIALDELAY+ CTESTINGMINFASTFLAGTHRESHOLD(._TESTINGESTIMATEDDESCRIPTORPROPAGATIONTIME'
The haproxy option works in the following way: when the feature is enabled, the Tor process will write a header line when a client is connecting to the onion service. The header will look like this:
"PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n"
We encode the "global circuit identifier" as the last 32-bits of the first IPv6 address. All other values in the header can safely be ignored. You can compute the global circuit identifier using the following formula given the IPv6 address "fc00:dead:beef:4dad::AABB:CCDD":
global_circuit_id = (0xAA << 24) + (0xBB << 16) + (0xCC << 8) + 0xDD;
In the case above, where the last 32-bits are 0xffffffff, the global circuit identifier would be 4294967295. You can use this value together with Tor's control port to terminate particular circuits using their global circuit identifiers. For more information about this see control-spec.txt.
The HAProxy version 1 protocol is described in detail at https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
O ŽO ‚;‚ ;;)Yƒ'HIDDENSERVICEMAXSTREAMSHiddenServiceMaxStreamsHidden ServiceNMaximum streams per rendezvous circuitThe maximum number of simultaneous streams (connections) per rendezvous circuit. The maximum value allowed is 65535. (Setting this to 0 will allow an unlimited number of simultaneous streams.) (Default: 0) Šf‚ EE) {“9HIDDENSERVICEEXPORTCIRCUITIDHiddenServiceExportCircuitIDHidden ServiceprotocolExposes incoming client circuits via the given protocolThe onion service will use the given protocol to expose the global circuit identifier of each inbound client circuit. The only protocol supported right now 'haproxy'. This option is only for v3 services. (Default: none)
Û
Ë ƒ Ë ƒ4‚
)))Q
„ERENDPOSTPERIODRendPostPeriodHidden ServiceN seconds|minutes|hours|days|weeksPeriod at which the rendezvous service descriptors are refreshedEvery time the specified period elapses, Tor uploads any rendezvous service descriptors to the directory servers. This information is also uploaded whenever it changes. Minimum value allowed is 10 minutes and maximum is 3.5 days. This option is only for v2 services. (Default: 1 hour)
‚y‚
SS)ƒ1HIDDENSERVICEMAXSTREAMSCLOSECIRCUITHiddenServiceMaxStreamsCloseCircuitHidden Service0|1Closes rendezvous circuits that exceed the maximum number of streamsIf set to 1, then exceeding HiddenServiceMaxStreams will cause the offending rendezvous circuit to be torn down, as opposed to stream creation requests that exceed the limit being silently ignored. (Default: 0)
e †e ‚ ‚
QQ)‚HIDDENSERVICENUMINTRODUCTIONPOINTSHiddenServiceNumIntroductionPointsHidden ServiceNUMNumber of introduction points the hidden service will haveNumber of introduction points the hidden service will have. You can't have more than 10 for v2 service and 20 for v3. (Default: 3)‚v‚ GG){ƒ_HIDDENSERVICEDIRGROUPREADABLEHiddenServiceDirGroupReadableHidden Service0|1Group read permissions for the hidden service directoryIf this option is set to 1, allow the filesystem group to read the hidden service directory and hostname file. If the option is set to 0, only owner is able to read the hidden service directory. (Default: 0) Has no effect on Windows.
" ¤ " ‚~‚ WW)kƒ_HIDDENSERVICEENABLEINTRODOSRATEPERSECHiddenServiceEnableIntroDoSRatePerSecHidden ServiceNUMRequest rate allowed for the introduction pointThe allowed client introduction rate per second at the introduction point. If this option is 0, it is considered infinite and thus if HiddenServiceEnableIntroDoSDefense is set, it then effectively disables the defenses. (Default: 25)„X‚ QQ)O‡;HIDDENSERVICEENABLEINTRODOSDEFENSEHiddenServiceEnableIntroDoSDefenseHidden Service0|1Introduction point DoS protectionEnable DoS defense at the intropoint level. When this is enabled, the rate and burst parameter (see below) will be sent to the intro point which will then use them to apply rate limiting for introduction request to this service.
The introduction point honors the consensus parameters except if this is specifically set by the service operator using this option. The service never looks at the consensus parameters in order to enable or disable this defense. (Default: 0)
ô | ô ƒ‚
??))ƒ[PUBLISHHIDSERVDESCRIPTORSPublishHidServDescriptorsHidden Service0|1Toggles automated publishing of the hidden service to the rendezvous directoryIf set to 0, Tor will run any hidden services you configure, but it won't advertise them to the rendezvous directory. This option is only useful if you're using a Tor controller that handles hidserv publishing for you. (Default: 1)ƒ ‚ YY)gƒcHIDDENSERVICEENABLEINTRODOSBURSTPERSECHiddenServiceEnableIntroDoSBurstPerSecHidden ServiceNUMBurst rate allowed for the introduction pointThe allowed client introduction burst per second at the introduction point. If this option is 0, it is considered infinite and thus if HiddenServiceEnableIntroDoSDefense is set, it then effectively disables the defenses. (Default: 200) nstance hosted by a tor instance a Single Onion Service. One-hop circuits make Single Onion servers easily locatable, but clients remain location-anonymous. However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable.
WARNING: Once a hidden service directory has been used by a tor instance in HiddenServiceSingleHopMode, it can NEVER be used again for a hidden service. It is best practice to create a new hidden service directory, key, and address for each new Single Onion Service and Hidden Service. It is not possible to run Single Onion Services and Hidden Services from the same tor instance: they should be run on different servers with different IP addresses.
HiddenServiceSingleHopMode requires HiddenServiceNonAnonymousMode to be set to 1. Since a Single Onion service is non-anonymous, you can not configure a SOCKSPort on a tor instance that is running in HiddenServiceSingleHopMode. Can not be changed while tor is running. (Default: 0)
ƒr‚ GG)e…mHIDDENSERVICENONANONYMOUSMODEHiddenServiceNonAnonymousModeHidden Service0|1Enables HiddenServiceSingleHopMode to be setMakes hidden services non-anonymous on this tor instance. Allows the non-anonymous HiddenServiceSingleHopMode. Enables direct connections in the server-side hidden service protocol. If you are using this option, you need to disable all client-side services on your Tor instance, including setting SOCKSPort to "0". Can not be changed while tor is running. (Default: 0)‹c‚ AA)i•WHIDDENSERVICESINGLEHOPMODEHiddenServiceSingleHopModeHidden Service0|1Allow non-anonymous single hop hidden servicesExperimental - Non Anonymous Hidden Services on a tor instance in HiddenServiceSingleHopMode make one-hop (direct) circuits between the onion service server, and the introduction and rendezvous points. (Onion service descriptors are still posted using 3-hop paths, to avoid onion service directories blocking the service.) This option makes every hidden service i á
½ ½ „?‚ ??/ [‡DOSCIRCUITCREATIONENABLEDDoSCircuitCreationEnabledDenial Of Service0|1|autoEnables circuit creation DoS mitigationEnable circuit creation DoS mitigation. If set to 1 (enabled), tor will cache client IPs along with statistics in order to detect circuit DoS attacks. If an address is positively identified, tor will activate defenses against the address. See the DoSCircuitCreationDefenseType option for more details. This is a client to relay detection only. "auto" means use the consensus parameter. If not defined in the consensus, the value is 0. (Default: auto)
U Õ³–mJ" ë䤑~pU 9HTTPPROXYAUTHENTICATOR-
HTTPPROXY,'HSLAYER3NODES ”'HSLAYER2NODES “#HIDSERVAUTHi5HIDDENSERVICEVERSION ;HIDDENSERVICESTATISTICS × AHIDDENSERVICESINGLEHOPMODE/HIDDENSERVICEPORT'QHIDDENSERVICENUMINTRODUCTIONPOINTS"GHIDDENSERVICENONANONYMOUSMODE(SHIDDENSERVICEMAXSTREAMSCLOSECIRCUIT
;HIDDENSERVICEMAXSTREAMS !EHIDDENSERVICEEXPORTCIRCUITID *WHIDDENSERVICEENABLEINTRODOSRATEPERSEC
× × ‚-‚ 99/Uƒ DOSCIRCUITCREATIONRATEDoSCircuitCreationRateDenial Of ServiceNUMAcceptable rate for circuit creationThe allowed circuit creation rate per second applied per client IP address. If this option is 0, it obeys a consensus parameter. If not defined in the consensus, the value is 3. (Default: 0)ƒt‚ MM/m…WDOSCIRCUITCREATIONMINCONNECTIONSDoSCircuitCreationMinConnectionsDenial Of ServiceNUMConnection rate when clients are a suspected DoSMinimum threshold of concurrent connections before a client address can be flagged as executing a circuit creation DoS. In other words, once a client address reaches the circuit rate and has a minimum of NUM concurrent connections, a detection is positive. "0" means use the consensus parameter. If not defined in the consensus, the value is 3. (Default: 0)
Ê y Ê ƒ+‚ GG/a„]DOSCIRCUITCREATIONDEFENSETYPEDoSCircuitCreationDefenseTypeDenial Of ServiceNUMMethod for mitigating circuit creation DoSThis is the type of defense applied to a detected client address. The possible values are:
1: No defense.
2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time.
"0" means use the consensus parameter. If not defined in the consensus, the value is 2. (Default: 0)ƒ‚ ;;/m„DOSCIRCUITCREATIONBURSTDoSCircuitCreationBurstDenial Of ServiceNUMAccept burst of circuit creation up to this rateThe allowed circuit creation burst per client IP address. If the circuit rate and the burst are reached, a client is marked as executing a circuit creation DoS. "0" means use the consensus parameter. If not defined in the consensus, the value is 90. (Default: 0)
 [  ƒ‚ 55/ O„]DOSCONNECTIONENABLEDDoSConnectionEnabledDenial Of Service0|1|autoEnables connection DoS mitigationEnable the connection DoS mitigation. If set to 1 (enabled), for client address only, this allows tor to mitigate against large number of concurrent connections made by a single IP address. "auto" means use the consensus parameter. If not defined in the consensus, the value is 0. (Default: auto) ƒ!‚ SS/;A„)DOSCIRCUITCREATIONDEFENSETIMEPERIODDoSCircuitCreationDefenseTimePeriodDenial Of ServiceN seconds|minutes|hoursDuration of DoS mitigationThe base time period in seconds that the DoS defense is activated for. The actual value is selected randomly for each activation from N+1 to 3/2 * N. "0" means use the consensus parameter. If not defined in the consensus, the value is 3600 seconds (1 hour). (Default: 0)
÷ ƒ ÷ ƒ‚ ==/U„7DOSCONNECTIONDEFENSETYPEDoSConnectionDefenseTypeDenial Of ServiceNUMMethod for mitigating connection DoSThis is the type of defense applied to a detected client address for the connection mitigation. The possible values are:
1: No defense.
2: Immediately close new connections.
"0" means use the consensus parameter. If not defined in the consensus, the value is 2. (Default: 0) ‚y‚ KK/M„DOSCONNECTIONMAXCONCURRENTCOUNTDoSConnectionMaxConcurrentCountDenial Of ServiceNUMAcceptable number of connectionsThe maximum threshold of concurrent connection from a client IP address. Above this limit, a defense selected by DoSConnectionDefenseType is applied. "0" means use the consensus parameter. If not defined in the consensus, the value is 100. (Default: 0)
8 8 ƒD‚ QQ/ w„[DOSREFUSESINGLEHOPCLIENTRENDEZVOUSDoSRefuseSingleHopClientRendezvousDenial Of Service0|1|autoPrevent establishment of single hop rendezvous pointsRefuse establishment of rendezvous points for single hop clients. In other words, if a client directly connects to the relay and sends an ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the consensus parameter. If not defined in the consensus, the value is 0. (Default: auto) AuthorityOnlyDownloadInitialDelay 0
ClientDNSRejectInternalAddresses 0
ClientRejectInternalAddresses 0
CountPrivateBandwidth 1
ExitPolicyRejectPrivate 0
ExtendAllowPrivateAddresses 1
V3AuthVotingInterval 5 minutes
V3AuthVoteDelay 20 seconds
V3AuthDistDelay 20 seconds
MinUptimeHidServDirectoryV2 0 seconds
TestingV3AuthInitialVotingInterval 5 minutes
TestingV3AuthInitialVoteDelay 20 seconds
TestingV3AuthInitialDistDelay 20 seconds
TestingAuthDirTimeToLearnReachability 0 minutes
TestingEstimatedDescriptorPropagationTime 0 minutes
TestingServerDownloadInitialDelay 0
TestingClientDownloadInitialDelay 0
TestingServerConsensusDownloadInitialDelay 0
TestingClientConsensusDownloadInitialDelay 0
TestingBridgeDownloadInitialDelay 10
TestingBridgeBootstrapDownloadInitialDelay 0
TestingClientMaxIntervalWithoutRequest 5 seconds
TestingDirConnectionMaxStall 30 seconds
TestingEnableConnBwEvent 1
TestingEnableCellStatsEvent 1
Y Y ‚! //k˜wTESTINGTORNETWORKTestingTorNetworkTesting0|1Overrides other options to be a testing networkIf set to 1, Tor adjusts default values of the configuration options below, so that it is easier to set up a testing Tor network. May only be set if non-default set of DirAuthorities is set. Cannot be unset while Tor is running. (Default: 0)
ServerDNSAllowBrokenConfig 1
DirAllowPrivateAddresses 1
EnforceDistinctSubnets 0
AssumeReachable 1
AuthDirMaxServersPerAddr 0
AuthDirMaxServersPerAuthAddr 0
ClientBootstrapConsensusAuthorityDownloadInitialDelay 0
ClientBootstrapConsensusFallbackDownloadInitialDelay 0
ClientBootstrapConsensus ê
®b ‚H‚$
GG+ ‚gTESTINGV3AUTHINITIALDISTDELAYTestingV3AuthInitialDistDelayTestingN minutes|hoursOverrides TestingV3AuthInitialDistDelay for the first consensusLike V3AuthDistDelay, but for initial voting interval before the first consensus has been created. Changing this requires that TestingTorNetwork is set. (Default: 5 minutes)#‚H‚#
GG+ ‚gTESTINGV3AUTHINITIALVOTEDELAYTestingV3AuthInitialVoteDelayTestingN minutes|hoursOverrides TestingV3AuthInitialVoteDelay for the first consensusLike V3AuthVoteDelay, but for initial voting interval before the first consensus has been created. Changing this requires that TestingTorNetwork is set. (Default: 5 minutes)"‚N‚" QQ+y‚sTESTINGV3AUTHINITIALVOTINGINTERVALTestingV3AuthInitialVotingIntervalTestingN minutes|hoursOverrides V3AuthVotingInterval for the first consensusLike V3AuthVotingInterval, but for initial voting interval before the first consensus has been created. Changing this requires that TestingTorNetwork is set. (Default: 30 minutes)!
çr ‚X‚'
__+‚GTESTINGESTIMATEDDESCRIPTORPROPAGATIONTIMETestingEstimatedDescriptorPropagationTimeTestingN minutes|hoursDelay before clients attempt to fetch descriptors from directory cachesClients try downloading server descriptors from directory caches after this time. Changing this requires that TestingTorNetwork is set. (Default: 10 minutes)&‚q‚&
WW+ƒTESTINGAUTHDIRTIMETOLEARNREACHABILITYTestingAuthDirTimeToLearnReachabilityTestingN minutes|hoursDelay until opinions are given about which relays are running or notAfter starting as an authority, do not make claims about whether routers are Running until this much time has passed. Changing this requires that TestingTorNetwork is set. (Default: 30 minutes)%‚‚% II;o‚ TESTINGV3AUTHVOTINGSTARTOFFSETTestingV3AuthVotingStartOffsetTestingN seconds|minutes|hoursOffset for the point at which the authority votesDirectory authorities offset voting start time by this much. Changing this requires that TestingTorNetwork is set. (Default: 0)$
¢ Ô½ ¢ ‚‚* OOs‚+TESTINGCLIENTDOWNLOADINITIALDELAYTestingClientDownloadInitialDelayTestingNDelay before downloading resources for client usageInitial delay in seconds for when clients should download things in general. Changing this requires that TestingTorNetwork is set. (Default: 0))‚‚) OOk‚+TESTINGSERVERDOWNLOADINITIALDELAYTestingServerDownloadInitialDelayTestingNDelay before downloading resources for relayingInitial delay in seconds for when servers should download things in general. Changing this requires that TestingTorNetwork is set. (Default: 0)(‚(‚(
CCK‚TESTINGMINFASTFLAGTHRESHOLDTestingMinFastFlagThresholdTestingN bytes|KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsMinimum value for the Fast flagMinimum value for the Fast flag. Overrides the ordinary minimum taken from the consensus when TestingTorNetwork is set. (Default: 0.)'
N Û² N ‚`‚- OOcƒMTESTINGBRIDGEDOWNLOADINITIALDELAYTestingBridgeDownloadInitialDelayTestingNDelay before downloading bridge descriptorsInitial delay in seconds for when clients should download each bridge descriptor when they know that one or more of their configured bridges are running. Changing this requires that TestingTorNetwork is set. (Default: 10800),‚%‚, aaw‚ TESTINGCLIENTCONSENSUSDOWNLOADINITIALDELAYTestingClientConsensusDownloadInitialDelayTestingNDelay before downloading descriptors for client usageInitial delay in seconds for when clients should download consensuses. Changing this requires that TestingTorNetwork is set. (Default: 0)+‚!‚+ aao‚ TESTINGSERVERCONSENSUSDOWNLOADINITIALDELAYTestingServerConsensusDownloadInitialDelayTestingNDelay before downloading descriptors for relayingInitial delay in seconds for when servers should download consensuses. Changing this requires that TestingTorNetwork is set. (Default: 0)*
è s è ƒ‚/
YY/ ƒ?TESTINGCLIENTMAXINTERVALWITHOUTREQUESTTestingClientMaxIntervalWithoutRequestTestingN seconds|minutesMaximum time to wait to batch requests for missing descriptorsWhen directory clients have only a few descriptors to request, they batch them until they have more, or until this amount of time has passed. Changing this requires that TestingTorNetwork is set. (Default: 10 minutes).ƒ ‚.
aa ƒSTESTINGBRIDGEBOOTSTRAPDOWNLOADINITIALDELAYTestingBridgeBootstrapDownloadInitialDelayTestingNDelay before downloading bridge descriptors when first startedInitial delay in seconds for when clients should download each bridge descriptor when they have just started, or when they can not contact any of their bridges. Changing this requires that TestingTorNetwork is set. (Default: 0)-
ô Ú ô ƒb‚1 99'K…}TESTINGDIRAUTHVOTEEXITTestingDirAuthVoteExitTestingnode,node,...Relays to give the Exit flag toA list of identity fingerprints, country codes, and address patterns of nodes to vote Exit for regardless of their uptime, bandwidth, or exit policy. See the ExcludeNodes option for more information on how to specify nodes.
In order for this option to have any effect, TestingTorNetwork has to be set. See the ExcludeNodes option for more information on how to specify nodes.0‚"‚0
EE/‚ TESTINGDIRCONNECTIONMAXSTALLTestingDirConnectionMaxStallTestingN seconds|minutesDuration to let directory connections stall before timing outLet a directory connection stall this long before expiring it. Changing this requires that TestingTorNetwork is set. (Default: 5 minutes)/
ß t ß ƒ‚3 ;;'M„UTESTINGDIRAUTHVOTEGUARDTestingDirAuthVoteGuardTestingnode,node,...Relays to give the Guard flag toA list of identity fingerprints and country codes and address patterns of nodes to vote Guard for regardless of their uptime and bandwidth. See the ExcludeNodes option for more information on how to specify nodes.
In order for this option to have any effect, TestingTorNetwork has to be set.2ƒ‚2
IIƒsTESTINGDIRAUTHVOTEEXITISSTRICTTestingDirAuthVoteExitIsStrictTesting0|1Only grant the Exit flag to relays listed by TestingDirAuthVoteExitIf True (1), a node will never receive the Exit flag unless it is specified in the TestingDirAuthVoteExit list, regardless of its uptime, bandwidth, or exit policy.
In order for this option to have any effect, TestingTorNetwork has to be set.1
ê { ê ƒ
‚5 ;;'M„MTESTINGDIRAUTHVOTEHSDIRTestingDirAuthVoteHSDirTestingnode,node,...Relays to give the HSDir flag toA list of identity fingerprints and country codes and address patterns of nodes to vote HSDir for regardless of their uptime and DirPort. See the ExcludeNodes option for more information on how to specify nodes.
In order for this option to have any effect, TestingTorNetwork must be set.4ƒ‚4
KKƒ]TESTINGDIRAUTHVOTEGUARDISSTRICTTestingDirAuthVoteGuardIsStrictTesting0|1Only grant the Guard flag to relays listed by TestingDirAuthVoteGuardIf True (1), a node will never receive the Guard flag unless it is specified in the TestingDirAuthVoteGuard list, regardless of its uptime and bandwidth.
In order for this option to have any effect, TestingTorNetwork has to be set.3
1 åÆ·œ‰t[R="ì×½§eI1 1WARNPLAINTEXTPORTS 9VIRTUALADDRNETWORKIPV6 „9VIRTUALADDRNETWORKIPV4 ƒ%MVERSIONINGAUTHORITATIVEDIRECTORY è-V3BANDWIDTHSFILE5V3AUTHVOTINGINTERVAL þ+V3AUTHVOTEDELAY ÿ1V3AUTHUSELEGACYKEY =V3AUTHORITATIVEDIRECTORY ç7V3AUTHNINTERVALSVALID+V3AUTHDISTDELAY USERR3USEMICRODESCRIPTORS •-USEGUARDFRACTION|)USEENTRYGUARDSz9USEDEFAULTFALLBACKDIRSQ!USEBRIDGESy AUPDATEBRIDGESFROMAUTHORITYx9UNIXSOCKSGROUPWRITABLEP
k }z k ‚ ‚8 CCi‚1TESTINGENABLECELLSTATSEVENTTestingEnableCellStatsEventTesting0|1Allow controllers to request CELL_STATS eventsIf this option is set, then Tor controllers may register for CELL_STATS events. Changing this requires that TestingTorNetwork is set. (Default: 0)7‚7 ==c‚+TESTINGENABLECONNBWEVENTTestingEnableConnBwEventTesting0|1Allow controllers to request CONN_BW eventsIf this option is set, then Tor controllers may register for CONN_BW events. Changing this requires that TestingTorNetwork is set. (Default: 0)6‚‚6
KKƒYTESTINGDIRAUTHVOTEHSDIRISSTRICTTestingDirAuthVoteHSDirIsStrictTesting0|1Only grant the HSDir flag to relays listed by TestingDirAuthVoteHSDirIf True (1), a node will never receive the HSDir flag unless it is specified in the TestingDirAuthVoteHSDir list, regardless of its uptime and DirPort.
In order for this option to have any effect, TestingTorNetwork has to be set.5
¶› © ‚< 11;
TESTINGLINKKEYSLOPTestingLinkKeySlopTestingN seconds|minutes|hoursTime before expiration that we replace our ed25519 link key;n‚; 99_USTESTINGAUTHKEYLIFETIMETestingAuthKeyLifetimeTestingN seconds|minutes|hours|days|weeks|monthsDuration for our ed25519 signing keyOverrides the default lifetime for a signing Ed25519 TLS Link authentication key. (Default: 2 days):‚‚: ;;_S‚#TESTINGLINKCERTLIFETIMETestingLinkCertLifetimeTestingN seconds|minutes|hours|days|weeks|monthsDuration of our ed25519 certificateOverrides the default lifetime for the certificates used to authenticate our X509 link cert with our ed25519 signing key. (Default: 2 days)9‚F‚9 CCw[‚QTESTINGMINEXITFLAGTHRESHOLDTestingMinExitFlagThresholdTestingN KBytes|MBytes|GBytes|TBytes|KBits|MBits|GBits|TBitsLower bound for assigning the Exit flagSets a lower-bound for assigning an exit flag when running as an authority on a testing network. Overrides the usual default lower bound of 4 KBytes. (Default: 0)8
1 j1 ‚5‚>
77; ‚STESTINGSIGNINGKEYSLOPTestingSigningKeySlopTestingN seconds|minutes|hoursTime before expiration that we replace our ed25519 signing keyHow early before the official expiration of a an Ed25519 signing key do we replace it and issue a new key? (Default: 3 hours for link and auth; 1 day for signing.)=‚= 11;
TESTINGAUTHKEYSLOPTestingAuthKeySlopTestingN seconds|minutes|hoursTime before expiration that we replace our ed25519 authentication key 2 or (major_version == 2 and minor_version >= 7)
def is_python_3():
"""
Checks if we're in the 3.0 - 3.x range.
.. deprecated:: 1.8.0
Stem 2.x will remove this method along with Python 2.x support.
:returns: **True** if we meet this requirement and **False** otherwise
"""
return sys.version_info[0] == 3
def is_pypy():
"""
Checks if we're running PyPy.
.. versionadded:: 1.7.0
:returns: **True** if running pypy, **False** otherwise
"""
return platform.python_implementation() == 'PyPy'
def is_sqlite_available():
"""
Checks if the sqlite3 module is available. Usually this is built in, but some
platforms such as FreeBSD and Gentoo exclude it by default.
.. versionadded:: 1.6.0
:returns: **True** if we can use the sqlite3 module and **False** otherwise
"""
try:
import sqlite3
return True
except ImportError:
return False
def is_crypto_available(ed25519 = False):
"""
Checks if the cryptography functions we use are available. This is used for
verifying relay descriptor signatures.
:param bool ed25519: check for `ed25519 support
`_,
which requires both cryptography version 2.6 and OpenSSL support
:returns: **True** if we can use the cryptography module and **False**
otherwise
"""
from stem.util import log
try:
from cryptography.utils import int_from_bytes, int_to_bytes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.backends.openssl.backend import backend
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.serialization import load_der_public_key
if not hasattr(rsa.RSAPrivateKey, 'sign'):
raise ImportError()
if ed25519:
# The following import confirms cryptography support (ie. version 2.6+),
# whereas ed25519_supported() checks for OpenSSL bindings.
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
if not hasattr(backend, 'ed25519_supported') or not backend.ed25519_supported():
log.log_once('stem.prereq._is_crypto_ed25519_supported', log.INFO, ED25519_UNSUPPORTED)
return False
return True
except ImportError:
log.log_once('stem.prereq.is_crypto_available', log.INFO, CRYPTO_UNAVAILABLE)
return False
def is_zstd_available():
"""
Checks if the `zstd module `_ is
available.
.. versionadded:: 1.7.0
:returns: **True** if we can use the zstd module and **False** otherwise
"""
try:
# Unfortunately the zstandard module uses the same namespace as another
# zstd module (https://pypi.org/project/zstd/), so we need to
# differentiate them.
import zstd
return hasattr(zstd, 'ZstdDecompressor')
except ImportError:
from stem.util import log
log.log_once('stem.prereq.is_zstd_available', log.INFO, ZSTD_UNAVAILABLE)
return False
def is_lzma_available():
"""
Checks if the `lzma module `_ is
available. This was added as a builtin in Python 3.3.
.. versionadded:: 1.7.0
:returns: **True** if we can use the lzma module and **False** otherwise
"""
try:
import lzma
return True
except ImportError:
from stem.util import log
log.log_once('stem.prereq.is_lzma_available', log.INFO, LZMA_UNAVAILABLE)
return False
def is_mock_available():
"""
Checks if the mock module is available. In python 3.3 and up it is a builtin
unittest module, but before this it needed to be `installed separately
`_. Imports should be as follows....
::
try:
# added in python 3.3
from unittest.mock import Mock
except ImportError:
from mock import Mock
:returns: **True** if the mock module is available and **False** otherwise
"""
try:
# checks for python 3.3 version
import unittest.mock
return True
except ImportError:
pass
try:
import mock
# check for mock's patch.dict() which was introduced in version 0.7.0
if not hasattr(mock.patch, 'dict'):
raise ImportError()
# check for mock's new_callable argument for patch() which was introduced in version 0.8.0
if 'new_callable' not in inspect.getargspec(mock.patch).args:
raise ImportError()
return True
except ImportError:
return False
def _is_lru_cache_available():
"""
Functools added lru_cache to the standard library in Python 3.2. Prior to
this using a bundled implementation. We're also using this with Python 3.5
due to a buggy implementation. (:trac:`26412`)
"""
major_version, minor_version = sys.version_info[0:2]
if major_version == 3 and minor_version == 5:
return False
else:
return hasattr(functools, 'lru_cache')
def _is_sha3_available():
"""
Check if hashlib has sha3 support. This requires Python 3.6+ *or* the `pysha3
module `_.
"""
# If pysha3 is present then importing sha3 will monkey patch the methods we
# want onto hashlib.
if not hasattr(hashlib, 'sha3_256') or not hasattr(hashlib, 'shake_256'):
try:
import sha3
except ImportError:
pass
return hasattr(hashlib, 'sha3_256') and hasattr(hashlib, 'shake_256')
stem-1.8.0/stem/response/ 0000775 0001750 0001750 00000000000 13602232262 016016 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/response/add_onion.py 0000664 0001750 0001750 00000003461 13501272761 020334 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import stem.response
class AddOnionResponse(stem.response.ControlMessage):
"""
ADD_ONION response.
:var str service_id: hidden service address without the '.onion' suffix
:var str private_key: base64 encoded hidden service private key
:var str private_key_type: crypto used to generate the hidden service private
key (such as RSA1024)
:var dict client_auth: newly generated client credentials the service accepts
"""
def _parse_message(self):
# Example:
# 250-ServiceID=gfzprpioee3hoppz
# 250-PrivateKey=RSA1024:MIICXgIBAAKBgQDZvYVxv...
# 250-ClientAuth=bob:l4BT016McqV2Oail+Bwe6w
# 250 OK
self.service_id = None
self.private_key = None
self.private_key_type = None
self.client_auth = {}
if not self.is_ok():
raise stem.ProtocolError("ADD_ONION response didn't have an OK status: %s" % self)
if not str(self).startswith('ServiceID='):
raise stem.ProtocolError('ADD_ONION response should start with the service id: %s' % self)
for line in list(self):
if '=' in line:
key, value = line.split('=', 1)
if key == 'ServiceID':
self.service_id = value
elif key == 'PrivateKey':
if ':' not in value:
raise stem.ProtocolError("ADD_ONION PrivateKey lines should be of the form 'PrivateKey=[type]:[key]: %s" % self)
self.private_key_type, self.private_key = value.split(':', 1)
elif key == 'ClientAuth':
if ':' not in value:
raise stem.ProtocolError("ADD_ONION ClientAuth lines should be of the form 'ClientAuth=[username]:[credential]: %s" % self)
username, credential = value.split(':', 1)
self.client_auth[username] = credential
stem-1.8.0/stem/response/getinfo.py 0000664 0001750 0001750 00000005354 13501272761 020040 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import stem.response
import stem.socket
class GetInfoResponse(stem.response.ControlMessage):
"""
Reply for a GETINFO query.
:var dict entries: mapping between the queried options and their bytes values
"""
def _parse_message(self):
# Example:
# 250-version=0.2.3.11-alpha-dev (git-ef0bc7f8f26a917c)
# 250+config-text=
# ControlPort 9051
# DataDirectory /home/atagar/.tor
# ExitPolicy reject *:*
# Log notice stdout
# Nickname Unnamed
# ORPort 9050
# .
# 250 OK
self.entries = {}
remaining_lines = [content for (code, div, content) in self.content(get_bytes = True)]
if not self.is_ok() or not remaining_lines.pop() == b'OK':
unrecognized_keywords = []
error_code, error_msg = None, None
for code, _, line in self.content():
if code != '250':
error_code = code
error_msg = line
if code == '552' and line.startswith('Unrecognized key "') and line.endswith('"'):
unrecognized_keywords.append(line[18:-1])
if unrecognized_keywords:
raise stem.InvalidArguments('552', 'GETINFO request contained unrecognized keywords: %s\n' % ', '.join(unrecognized_keywords), unrecognized_keywords)
elif error_code:
raise stem.OperationFailed(error_code, error_msg)
else:
raise stem.ProtocolError("GETINFO response didn't have an OK status:\n%s" % self)
while remaining_lines:
try:
key, value = remaining_lines.pop(0).split(b'=', 1)
except ValueError:
raise stem.ProtocolError('GETINFO replies should only contain parameter=value mappings:\n%s' % self)
if stem.prereq.is_python_3():
key = stem.util.str_tools._to_unicode(key)
# if the value is a multiline value then it *must* be of the form
# '=\n'
if b'\n' in value:
if not value.startswith(b'\n'):
raise stem.ProtocolError("GETINFO response contained a multi-line value that didn't start with a newline:\n%s" % self)
value = value[1:]
self.entries[key] = value
def _assert_matches(self, params):
"""
Checks if we match a given set of parameters, and raise a ProtocolError if not.
:param set params: parameters to assert that we contain
:raises:
* :class:`stem.ProtocolError` if parameters don't match this response
"""
reply_params = set(self.entries.keys())
if params != reply_params:
requested_label = ', '.join(params)
reply_label = ', '.join(reply_params)
raise stem.ProtocolError("GETINFO reply doesn't match the parameters that we requested. Queried '%s' but got '%s'." % (requested_label, reply_label))
stem-1.8.0/stem/response/getconf.py 0000664 0001750 0001750 00000003547 13501272761 020034 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import stem.response
import stem.socket
class GetConfResponse(stem.response.ControlMessage):
"""
Reply for a GETCONF query.
Note that configuration parameters won't match what we queried for if it's one
of the special mapping options (ex. 'HiddenServiceOptions').
:var dict entries: mapping between the config parameter (**str**) and their
values (**list** of **str**)
"""
def _parse_message(self):
# Example:
# 250-CookieAuthentication=0
# 250-ControlPort=9100
# 250-DataDirectory=/home/neena/.tor
# 250 DirPort
self.entries = {}
remaining_lines = list(self)
if self.content() == [('250', ' ', 'OK')]:
return
if not self.is_ok():
unrecognized_keywords = []
for code, _, line in self.content():
if code == '552' and line.startswith('Unrecognized configuration key "') and line.endswith('"'):
unrecognized_keywords.append(line[32:-1])
if unrecognized_keywords:
raise stem.InvalidArguments('552', 'GETCONF request contained unrecognized keywords: %s' % ', '.join(unrecognized_keywords), unrecognized_keywords)
else:
raise stem.ProtocolError('GETCONF response contained a non-OK status code:\n%s' % self)
while remaining_lines:
line = remaining_lines.pop(0)
if line.is_next_mapping():
key, value = line.split('=', 1)
else:
key, value = (line.pop(), None)
# Tor's CommaList and RouterList have a bug where they map to an empty
# string when undefined rather than None...
#
# https://trac.torproject.org/projects/tor/ticket/18263
if value == '':
value = None
if key not in self.entries:
self.entries[key] = []
if value is not None:
self.entries[key].append(value)
stem-1.8.0/stem/response/protocolinfo.py 0000664 0001750 0001750 00000012367 13501272761 021124 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import sys
import stem.prereq
import stem.response
import stem.socket
import stem.version
import stem.util.str_tools
from stem.connection import AuthMethod
from stem.util import log
class ProtocolInfoResponse(stem.response.ControlMessage):
"""
Version one PROTOCOLINFO query response.
The protocol_version is the only mandatory data for a valid PROTOCOLINFO
response, so all other values are None if undefined or empty if a collection.
:var int protocol_version: protocol version of the response
:var stem.version.Version tor_version: version of the tor process
:var tuple auth_methods: :data:`stem.connection.AuthMethod` types that tor will accept
:var tuple unknown_auth_methods: strings of unrecognized auth methods
:var str cookie_path: path of tor's authentication cookie
"""
def _parse_message(self):
# Example:
# 250-PROTOCOLINFO 1
# 250-AUTH METHODS=COOKIE COOKIEFILE="/home/atagar/.tor/control_auth_cookie"
# 250-VERSION Tor="0.2.1.30"
# 250 OK
self.protocol_version = None
self.tor_version = None
self.auth_methods = ()
self.unknown_auth_methods = ()
self.cookie_path = None
auth_methods, unknown_auth_methods = [], []
remaining_lines = list(self)
if not self.is_ok() or not remaining_lines.pop() == 'OK':
raise stem.ProtocolError("PROTOCOLINFO response didn't have an OK status:\n%s" % self)
# sanity check that we're a PROTOCOLINFO response
if not remaining_lines[0].startswith('PROTOCOLINFO'):
raise stem.ProtocolError('Message is not a PROTOCOLINFO response:\n%s' % self)
while remaining_lines:
line = remaining_lines.pop(0)
line_type = line.pop()
if line_type == 'PROTOCOLINFO':
# Line format:
# FirstLine = "PROTOCOLINFO" SP PIVERSION CRLF
# PIVERSION = 1*DIGIT
if line.is_empty():
raise stem.ProtocolError("PROTOCOLINFO response's initial line is missing the protocol version: %s" % line)
try:
self.protocol_version = int(line.pop())
except ValueError:
raise stem.ProtocolError('PROTOCOLINFO response version is non-numeric: %s' % line)
# The piversion really should be '1' but, according to the spec, tor
# does not necessarily need to provide the PROTOCOLINFO version that we
# requested. Log if it's something we aren't expecting but still make
# an effort to parse like a v1 response.
if self.protocol_version != 1:
log.info("We made a PROTOCOLINFO version 1 query but got a version %i response instead. We'll still try to use it, but this may cause problems." % self.protocol_version)
elif line_type == 'AUTH':
# Line format:
# AuthLine = "250-AUTH" SP "METHODS=" AuthMethod *("," AuthMethod)
# *(SP "COOKIEFILE=" AuthCookieFile) CRLF
# AuthMethod = "NULL" / "HASHEDPASSWORD" / "COOKIE"
# AuthCookieFile = QuotedString
# parse AuthMethod mapping
if not line.is_next_mapping('METHODS'):
raise stem.ProtocolError("PROTOCOLINFO response's AUTH line is missing its mandatory 'METHODS' mapping: %s" % line)
for method in line.pop_mapping()[1].split(','):
if method == 'NULL':
auth_methods.append(AuthMethod.NONE)
elif method == 'HASHEDPASSWORD':
auth_methods.append(AuthMethod.PASSWORD)
elif method == 'COOKIE':
auth_methods.append(AuthMethod.COOKIE)
elif method == 'SAFECOOKIE':
auth_methods.append(AuthMethod.SAFECOOKIE)
else:
unknown_auth_methods.append(method)
message_id = 'stem.response.protocolinfo.unknown_auth_%s' % method
log.log_once(message_id, log.INFO, "PROTOCOLINFO response included a type of authentication that we don't recognize: %s" % method)
# our auth_methods should have a single AuthMethod.UNKNOWN entry if
# any unknown authentication methods exist
if AuthMethod.UNKNOWN not in auth_methods:
auth_methods.append(AuthMethod.UNKNOWN)
# parse optional COOKIEFILE mapping (quoted and can have escapes)
if line.is_next_mapping('COOKIEFILE', True, True):
self.cookie_path = line.pop_mapping(True, True, get_bytes = True)[1].decode(sys.getfilesystemencoding())
if stem.prereq.is_python_3():
self.cookie_path = stem.util.str_tools._to_unicode(self.cookie_path) # normalize back to str
elif line_type == 'VERSION':
# Line format:
# VersionLine = "250-VERSION" SP "Tor=" TorVersion OptArguments CRLF
# TorVersion = QuotedString
if not line.is_next_mapping('Tor', True):
raise stem.ProtocolError("PROTOCOLINFO response's VERSION line is missing its mandatory tor version mapping: %s" % line)
try:
self.tor_version = stem.version.Version(line.pop_mapping(True)[1])
except ValueError as exc:
raise stem.ProtocolError(exc)
else:
log.debug("Unrecognized PROTOCOLINFO line type '%s', ignoring it: %s" % (line_type, line))
self.auth_methods = tuple(auth_methods)
self.unknown_auth_methods = tuple(unknown_auth_methods)
stem-1.8.0/stem/response/__init__.py 0000664 0001750 0001750 00000045004 13567605365 020154 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Parses replies from the control socket.
**Module Overview:**
::
convert - translates a ControlMessage into a particular response subclass
ControlMessage - Message that's read from the control socket.
|- SingleLineResponse - Simple tor response only including a single line of information.
|
|- from_str - provides a ControlMessage for the given string
|- is_ok - response had a 250 status
|- content - provides the parsed message content
+- raw_content - unparsed socket data
ControlLine - String subclass with methods for parsing controller responses.
|- remainder - provides the unparsed content
|- is_empty - checks if the remaining content is empty
|- is_next_quoted - checks if the next entry is a quoted value
|- is_next_mapping - checks if the next entry is a KEY=VALUE mapping
|- peek_key - provides the key of the next entry
|- pop - removes and returns the next entry
+- pop_mapping - removes and returns the next entry as a KEY=VALUE mapping
"""
import codecs
import io
import re
import time
import threading
import stem.socket
import stem.util
import stem.util.str_tools
__all__ = [
'add_onion',
'events',
'getinfo',
'getconf',
'protocolinfo',
'authchallenge',
'convert',
'ControlMessage',
'ControlLine',
'SingleLineResponse',
]
KEY_ARG = re.compile('^(\\S+)=')
def convert(response_type, message, **kwargs):
"""
Converts a :class:`~stem.response.ControlMessage` into a particular kind of
tor response. This does an in-place conversion of the message from being a
:class:`~stem.response.ControlMessage` to a subclass for its response type.
Recognized types include...
=================== =====
response_type Class
=================== =====
**ADD_ONION** :class:`stem.response.add_onion.AddOnionResponse`
**AUTHCHALLENGE** :class:`stem.response.authchallenge.AuthChallengeResponse`
**EVENT** :class:`stem.response.events.Event` subclass
**GETCONF** :class:`stem.response.getconf.GetConfResponse`
**GETINFO** :class:`stem.response.getinfo.GetInfoResponse`
**MAPADDRESS** :class:`stem.response.mapaddress.MapAddressResponse`
**PROTOCOLINFO** :class:`stem.response.protocolinfo.ProtocolInfoResponse`
**SINGLELINE** :class:`stem.response.SingleLineResponse`
=================== =====
:param str response_type: type of tor response to convert to
:param stem.response.ControlMessage message: message to be converted
:param kwargs: optional keyword arguments to be passed to the parser method
:raises:
* :class:`stem.ProtocolError` the message isn't a proper response of
that type
* :class:`stem.InvalidArguments` the arguments given as input are
invalid, this is can only be raised if the response_type is: **GETINFO**,
**GETCONF**
* :class:`stem.InvalidRequest` the arguments given as input are
invalid, this is can only be raised if the response_type is:
**MAPADDRESS**
* :class:`stem.OperationFailed` if the action the event represents failed,
this is can only be raised if the response_type is: **MAPADDRESS**
* **TypeError** if argument isn't a :class:`~stem.response.ControlMessage`
or response_type isn't supported
"""
import stem.response.add_onion
import stem.response.authchallenge
import stem.response.events
import stem.response.getinfo
import stem.response.getconf
import stem.response.mapaddress
import stem.response.protocolinfo
if not isinstance(message, ControlMessage):
raise TypeError('Only able to convert stem.response.ControlMessage instances')
response_types = {
'ADD_ONION': stem.response.add_onion.AddOnionResponse,
'AUTHCHALLENGE': stem.response.authchallenge.AuthChallengeResponse,
'EVENT': stem.response.events.Event,
'GETCONF': stem.response.getconf.GetConfResponse,
'GETINFO': stem.response.getinfo.GetInfoResponse,
'MAPADDRESS': stem.response.mapaddress.MapAddressResponse,
'PROTOCOLINFO': stem.response.protocolinfo.ProtocolInfoResponse,
'SINGLELINE': SingleLineResponse,
}
try:
response_class = response_types[response_type]
except TypeError:
raise TypeError('Unsupported response type: %s' % response_type)
message.__class__ = response_class
message._parse_message(**kwargs)
class ControlMessage(object):
"""
Message from the control socket. This is iterable and can be stringified for
individual message components stripped of protocol formatting. Messages are
never empty.
:var int arrived_at: unix timestamp for when the message arrived
.. versionchanged:: 1.7.0
Implemented equality and hashing.
.. versionchanged:: 1.8.0
Moved **arrived_at** from the Event class up to this base ControlMessage.
"""
@staticmethod
def from_str(content, msg_type = None, normalize = False, **kwargs):
"""
Provides a ControlMessage for the given content.
.. versionadded:: 1.1.0
.. versionchanged:: 1.6.0
Added the normalize argument.
:param str content: message to construct the message from
:param str msg_type: type of tor reply to parse the content as
:param bool normalize: ensures expected carriage return and ending newline
are present
:param kwargs: optional keyword arguments to be passed to the parser method
:returns: stem.response.ControlMessage instance
"""
if normalize:
if not content.endswith('\n'):
content += '\n'
content = re.sub('([\r]?)\n', '\r\n', content)
msg = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes(content)), arrived_at = kwargs.pop('arrived_at', None))
if msg_type is not None:
convert(msg_type, msg, **kwargs)
return msg
def __init__(self, parsed_content, raw_content, arrived_at = None):
if not parsed_content:
raise ValueError("ControlMessages can't be empty")
self.arrived_at = arrived_at if arrived_at else int(time.time())
self._parsed_content = parsed_content
self._raw_content = raw_content
self._str = None
self._hash = stem.util._hash_attr(self, '_raw_content')
def is_ok(self):
"""
Checks if any of our lines have a 250 response.
:returns: **True** if any lines have a 250 response code, **False** otherwise
"""
for code, _, _ in self._parsed_content:
if code == '250':
return True
return False
def content(self, get_bytes = False):
"""
Provides the parsed message content. These are entries of the form...
::
(status_code, divider, content)
**status_code**
Three character code for the type of response (defined in section 4 of
the control-spec).
**divider**
Single character to indicate if this is mid-reply, data, or an end to the
message (defined in section 2.3 of the control-spec).
**content**
The following content is the actual payload of the line.
For data entries the content is the full multi-line payload with newline
linebreaks and leading periods unescaped.
The **status_code** and **divider** are both strings (**bytes** in python
2.x and **unicode** in python 3.x). The **content** however is **bytes** if
**get_bytes** is **True**.
.. versionchanged:: 1.1.0
Added the get_bytes argument.
:param bool get_bytes: provides **bytes** for the **content** rather than a **str**
:returns: **list** of (str, str, str) tuples for the components of this message
"""
if stem.prereq.is_python_3() and not get_bytes:
return [(code, div, stem.util.str_tools._to_unicode(content)) for (code, div, content) in self._parsed_content]
else:
return list(self._parsed_content)
def raw_content(self, get_bytes = False):
"""
Provides the unparsed content read from the control socket.
.. versionchanged:: 1.1.0
Added the get_bytes argument.
:param bool get_bytes: if **True** then this provides **bytes** rather than a **str**
:returns: **str** of the socket data used to generate this message
"""
if stem.prereq.is_python_3() and not get_bytes:
return stem.util.str_tools._to_unicode(self._raw_content)
else:
return self._raw_content
def __str__(self):
"""
Content of the message, stripped of status code and divider protocol
formatting.
"""
if self._str is None:
self._str = '\n'.join(list(self))
return self._str
def __iter__(self):
"""
Provides :class:`~stem.response.ControlLine` instances for the content of
the message. This is stripped of status codes and dividers, for instance...
::
250+info/names=
desc/id/* -- Router descriptors by ID.
desc/name/* -- Router descriptors by nickname.
.
250 OK
Would provide two entries...
::
1st - "info/names=
desc/id/* -- Router descriptors by ID.
desc/name/* -- Router descriptors by nickname."
2nd - "OK"
"""
for _, _, content in self._parsed_content:
if stem.prereq.is_python_3():
content = stem.util.str_tools._to_unicode(content)
yield ControlLine(content)
def __len__(self):
"""
:returns: number of ControlLines
"""
return len(self._parsed_content)
def __getitem__(self, index):
"""
:returns: :class:`~stem.response.ControlLine` at the index
"""
content = self._parsed_content[index][2]
if stem.prereq.is_python_3():
content = stem.util.str_tools._to_unicode(content)
return ControlLine(content)
def __hash__(self):
return self._hash
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, ControlMessage) else False
def __ne__(self, other):
return not self == other
class ControlLine(str):
"""
String subclass that represents a line of controller output. This behaves as
a normal string with additional methods for parsing and popping entries from
a space delimited series of elements like a stack.
None of these additional methods effect ourselves as a string (which is still
immutable). All methods are thread safe.
"""
def __new__(self, value):
return str.__new__(self, value)
def __init__(self, value):
self._remainder = value
self._remainder_lock = threading.RLock()
def remainder(self):
"""
Provides our unparsed content. This is an empty string after we've popped
all entries.
:returns: **str** of the unparsed content
"""
return self._remainder
def is_empty(self):
"""
Checks if we have further content to pop or not.
:returns: **True** if we have additional content, **False** otherwise
"""
return self._remainder == ''
def is_next_quoted(self, escaped = False):
"""
Checks if our next entry is a quoted value or not.
:param bool escaped: unescapes the string
:returns: **True** if the next entry can be parsed as a quoted value, **False** otherwise
"""
start_quote, end_quote = _get_quote_indices(self._remainder, escaped)
return start_quote == 0 and end_quote != -1
def is_next_mapping(self, key = None, quoted = False, escaped = False):
"""
Checks if our next entry is a KEY=VALUE mapping or not.
:param str key: checks that the key matches this value, skipping the check if **None**
:param bool quoted: checks that the mapping is to a quoted value
:param bool escaped: unescapes the string
:returns: **True** if the next entry can be parsed as a key=value mapping,
**False** otherwise
"""
remainder = self._remainder # temp copy to avoid locking
key_match = KEY_ARG.match(remainder)
if key_match:
if key and key != key_match.groups()[0]:
return False
if quoted:
# checks that we have a quoted value and that it comes after the 'key='
start_quote, end_quote = _get_quote_indices(remainder, escaped)
return start_quote == key_match.end() and end_quote != -1
else:
return True # we just needed to check for the key
else:
return False # doesn't start with a key
def peek_key(self):
"""
Provides the key of the next entry, providing **None** if it isn't a
key/value mapping.
:returns: **str** with the next entry's key
"""
remainder = self._remainder
key_match = KEY_ARG.match(remainder)
if key_match:
return key_match.groups()[0]
else:
return None
def pop(self, quoted = False, escaped = False):
"""
Parses the next space separated entry, removing it and the space from our
remaining content. Examples...
::
>>> line = ControlLine("\\"We're all mad here.\\" says the grinning cat.")
>>> print line.pop(True)
"We're all mad here."
>>> print line.pop()
"says"
>>> print line.remainder()
"the grinning cat."
>>> line = ControlLine("\\"this has a \\\\\\" and \\\\\\\\ in it\\" foo=bar more_data")
>>> print line.pop(True, True)
"this has a \\" and \\\\ in it"
:param bool quoted: parses the next entry as a quoted value, removing the quotes
:param bool escaped: unescapes the string
:returns: **str** of the next space separated entry
:raises:
* **ValueError** if quoted is True without the value being quoted
* **IndexError** if we don't have any remaining content left to parse
"""
with self._remainder_lock:
next_entry, remainder = _parse_entry(self._remainder, quoted, escaped, False)
self._remainder = remainder
return next_entry
def pop_mapping(self, quoted = False, escaped = False, get_bytes = False):
"""
Parses the next space separated entry as a KEY=VALUE mapping, removing it
and the space from our remaining content.
.. versionchanged:: 1.6.0
Added the get_bytes argument.
:param bool quoted: parses the value as being quoted, removing the quotes
:param bool escaped: unescapes the string
:param bool get_bytes: provides **bytes** for the **value** rather than a **str**
:returns: **tuple** of the form (key, value)
:raises: **ValueError** if this isn't a KEY=VALUE mapping or if quoted is
**True** without the value being quoted
:raises: **IndexError** if there's nothing to parse from the line
"""
with self._remainder_lock:
if self.is_empty():
raise IndexError('no remaining content to parse')
key_match = KEY_ARG.match(self._remainder)
if not key_match:
raise ValueError("the next entry isn't a KEY=VALUE mapping: " + self._remainder)
# parse off the key
key = key_match.groups()[0]
remainder = self._remainder[key_match.end():]
next_entry, remainder = _parse_entry(remainder, quoted, escaped, get_bytes)
self._remainder = remainder
return (key, next_entry)
def _parse_entry(line, quoted, escaped, get_bytes):
"""
Parses the next entry from the given space separated content.
:param str line: content to be parsed
:param bool quoted: parses the next entry as a quoted value, removing the quotes
:param bool escaped: unescapes the string
:returns: **tuple** of the form (entry, remainder)
:raises:
* **ValueError** if quoted is True without the next value being quoted
* **IndexError** if there's nothing to parse from the line
"""
if line == '':
raise IndexError('no remaining content to parse')
next_entry, remainder = '', line
if quoted:
# validate and parse the quoted value
start_quote, end_quote = _get_quote_indices(remainder, escaped)
if start_quote != 0 or end_quote == -1:
raise ValueError("the next entry isn't a quoted value: " + line)
next_entry, remainder = remainder[1:end_quote], remainder[end_quote + 1:]
else:
# non-quoted value, just need to check if there's more data afterward
if ' ' in remainder:
next_entry, remainder = remainder.split(' ', 1)
else:
next_entry, remainder = remainder, ''
if escaped:
# Tor does escaping in its 'esc_for_log' function of 'common/util.c'. It's
# hard to tell what controller functions use this in practice, but direct
# users are...
#
# * 'COOKIEFILE' field of PROTOCOLINFO responses
# * logged messages about bugs
# * the 'getinfo_helper_listeners' function of control.c
#
# Ideally we'd use "next_entry.decode('string_escape')" but it was removed
# in python 3.x and 'unicode_escape' isn't quite the same...
#
# https://stackoverflow.com/questions/14820429/how-do-i-decodestring-escape-in-python3
next_entry = codecs.escape_decode(next_entry)[0]
if stem.prereq.is_python_3() and not get_bytes:
next_entry = stem.util.str_tools._to_unicode(next_entry) # normalize back to str
if get_bytes:
next_entry = stem.util.str_tools._to_bytes(next_entry)
return (next_entry, remainder.lstrip())
def _get_quote_indices(line, escaped):
"""
Provides the indices of the next two quotes in the given content.
:param str line: content to be parsed
:param bool escaped: unescapes the string
:returns: **tuple** of two ints, indices being -1 if a quote doesn't exist
"""
indices, quote_index = [], -1
for _ in range(2):
quote_index = line.find('"', quote_index + 1)
# if we have escapes then we need to skip any r'\"' entries
if escaped:
# skip check if index is -1 (no match) or 0 (first character)
while quote_index >= 1 and line[quote_index - 1] == '\\':
quote_index = line.find('"', quote_index + 1)
indices.append(quote_index)
return tuple(indices)
class SingleLineResponse(ControlMessage):
"""
Reply to a request that performs an action rather than querying data. These
requests only contain a single line, which is 'OK' if successful, and a
description of the problem if not.
:var str code: status code for our line
:var str message: content of the line
"""
def is_ok(self, strict = False):
"""
Checks if the response code is "250". If strict is **True** then this
checks if the response is "250 OK"
:param bool strict: checks for a "250 OK" message if **True**
:returns:
* If strict is **False**: **True** if the response code is "250", **False** otherwise
* If strict is **True**: **True** if the response is "250 OK", **False** otherwise
"""
if strict:
return self.content()[0] == ('250', ' ', 'OK')
return self.content()[0][0] == '250'
def _parse_message(self):
content = self.content()
if len(content) > 1:
raise stem.ProtocolError('Received multi-line response')
elif len(content) == 0:
raise stem.ProtocolError('Received empty response')
else:
self.code, _, self.message = content[0]
stem-1.8.0/stem/response/authchallenge.py 0000664 0001750 0001750 00000003572 13501272761 021211 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import binascii
import stem.response
import stem.socket
import stem.util.str_tools
import stem.util.tor_tools
class AuthChallengeResponse(stem.response.ControlMessage):
"""
AUTHCHALLENGE query response.
:var str server_hash: server hash provided by tor
:var str server_nonce: server nonce provided by tor
"""
def _parse_message(self):
# Example:
# 250 AUTHCHALLENGE SERVERHASH=680A73C9836C4F557314EA1C4EDE54C285DB9DC89C83627401AEF9D7D27A95D5 SERVERNONCE=F8EA4B1F2C8B40EF1AF68860171605B910E3BBCABADF6FC3DB1FA064F4690E85
self.server_hash = None
self.server_nonce = None
if not self.is_ok():
raise stem.ProtocolError("AUTHCHALLENGE response didn't have an OK status:\n%s" % self)
elif len(self) > 1:
raise stem.ProtocolError('Received multiline AUTHCHALLENGE response:\n%s' % self)
line = self[0]
# sanity check that we're a AUTHCHALLENGE response
if not line.pop() == 'AUTHCHALLENGE':
raise stem.ProtocolError('Message is not an AUTHCHALLENGE response (%s)' % self)
if line.is_next_mapping('SERVERHASH'):
value = line.pop_mapping()[1]
if not stem.util.tor_tools.is_hex_digits(value, 64):
raise stem.ProtocolError('SERVERHASH has an invalid value: %s' % value)
self.server_hash = binascii.unhexlify(stem.util.str_tools._to_bytes(value))
else:
raise stem.ProtocolError('Missing SERVERHASH mapping: %s' % line)
if line.is_next_mapping('SERVERNONCE'):
value = line.pop_mapping()[1]
if not stem.util.tor_tools.is_hex_digits(value, 64):
raise stem.ProtocolError('SERVERNONCE has an invalid value: %s' % value)
self.server_nonce = binascii.unhexlify(stem.util.str_tools._to_bytes(value))
else:
raise stem.ProtocolError('Missing SERVERNONCE mapping: %s' % line)
stem-1.8.0/stem/response/mapaddress.py 0000664 0001750 0001750 00000002456 13501272761 020530 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import stem.response
import stem.socket
class MapAddressResponse(stem.response.ControlMessage):
"""
Reply for a MAPADDRESS query.
Doesn't raise an exception unless no addresses were mapped successfully.
:var dict entries: mapping between the original and replacement addresses
:raises:
* :class:`stem.OperationFailed` if Tor was unable to satisfy the request
* :class:`stem.InvalidRequest` if the addresses provided were invalid
"""
def _parse_message(self):
# Example:
# 250-127.192.10.10=torproject.org
# 250 1.2.3.4=tor.freehaven.net
if not self.is_ok():
for code, _, message in self.content():
if code == '512':
raise stem.InvalidRequest(code, message)
elif code == '451':
raise stem.OperationFailed(code, message)
else:
raise stem.ProtocolError('MAPADDRESS returned unexpected response code: %s', code)
self.entries = {}
for code, _, message in self.content():
if code == '250':
try:
key, value = message.split('=', 1)
self.entries[key] = value
except ValueError:
raise stem.ProtocolError(None, "MAPADDRESS returned '%s', which isn't a mapping" % message)
stem-1.8.0/stem/response/events.py 0000664 0001750 0001750 00000144001 13567605212 017705 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
import io
import re
import stem
import stem.control
import stem.descriptor.router_status_entry
import stem.prereq
import stem.response
import stem.util
import stem.version
from stem.util import connection, log, str_tools, tor_tools
# Matches keyword=value arguments. This can't be a simple "(.*)=(.*)" pattern
# because some positional arguments, like circuit paths, can have an equal
# sign.
KW_ARG = re.compile('^(.*) ([A-Za-z0-9_]+)=(\\S*)$')
QUOTED_KW_ARG = re.compile('^(.*) ([A-Za-z0-9_]+)="(.*)"$')
CELL_TYPE = re.compile('^[a-z0-9_]+$')
PARSE_NEWCONSENSUS_EVENTS = True
# TODO: We can remove the following when we drop python2.6 support.
INT_TYPE = int if stem.prereq.is_python_3() else long
class Event(stem.response.ControlMessage):
"""
Base for events we receive asynchronously, as described in section 4.1 of the
`control-spec
`_.
:var str type: event type
:var list positional_args: positional arguments of the event
:var dict keyword_args: key/value arguments of the event
"""
_POSITIONAL_ARGS = () # attribute names for recognized positional arguments
_KEYWORD_ARGS = {} # map of 'keyword => attribute' for recognized attributes
_QUOTED = () # positional arguments that are quoted
_OPTIONALLY_QUOTED = () # positional arguments that may or may not be quoted
_SKIP_PARSING = False # skip parsing contents into our positional_args and keyword_args
_VERSION_ADDED = stem.version.Version('0.1.1.1-alpha') # minimum version with control-spec V1 event support
def _parse_message(self):
if not str(self).strip():
raise stem.ProtocolError('Received a blank tor event. Events must at the very least have a type.')
self.type = str(self).split()[0]
self.positional_args = []
self.keyword_args = {}
# if we're a recognized event type then translate ourselves into that subclass
if self.type in EVENT_TYPE_TO_CLASS:
self.__class__ = EVENT_TYPE_TO_CLASS[self.type]
if not self._SKIP_PARSING:
self._parse_standard_attr()
self._parse()
def __hash__(self):
return stem.util._hash_attr(self, 'arrived_at', parent = stem.response.ControlMessage, cache = True)
def _parse_standard_attr(self):
"""
Most events are of the form...
650 *( positional_args ) *( key "=" value )
This parses this standard format, populating our **positional_args** and
**keyword_args** attributes and creating attributes if it's in our event's
**_POSITIONAL_ARGS** and **_KEYWORD_ARGS**.
"""
# Tor events contain some number of positional arguments followed by
# key/value mappings. Parsing keyword arguments from the end until we hit
# something that isn't a key/value mapping. The rest are positional.
content = str(self)
while True:
match = QUOTED_KW_ARG.match(content)
if not match:
match = KW_ARG.match(content)
if match:
content, keyword, value = match.groups()
self.keyword_args[keyword] = value
else:
break
# Setting attributes for the fields that we recognize.
self.positional_args = content.split()[1:]
positional = list(self.positional_args)
for attr_name in self._POSITIONAL_ARGS:
attr_value = None
if positional:
if attr_name in self._QUOTED or (attr_name in self._OPTIONALLY_QUOTED and positional[0].startswith('"')):
attr_values = [positional.pop(0)]
if not attr_values[0].startswith('"'):
raise stem.ProtocolError("The %s value should be quoted, but didn't have a starting quote: %s" % (attr_name, self))
while True:
if not positional:
raise stem.ProtocolError("The %s value should be quoted, but didn't have an ending quote: %s" % (attr_name, self))
attr_values.append(positional.pop(0))
if attr_values[-1].endswith('"'):
break
attr_value = ' '.join(attr_values)[1:-1]
else:
attr_value = positional.pop(0)
setattr(self, attr_name, attr_value)
for controller_attr_name, attr_name in self._KEYWORD_ARGS.items():
setattr(self, attr_name, self.keyword_args.get(controller_attr_name))
def _iso_timestamp(self, timestamp):
"""
Parses an iso timestamp (ISOTime2Frac in the control-spec).
:param str timestamp: timestamp to parse
:returns: **datetime** with the parsed timestamp
:raises: :class:`stem.ProtocolError` if timestamp is malformed
"""
if timestamp is None:
return None
try:
return str_tools._parse_iso_timestamp(timestamp)
except ValueError as exc:
raise stem.ProtocolError('Unable to parse timestamp (%s): %s' % (exc, self))
# method overwritten by our subclasses for special handling that they do
def _parse(self):
pass
def _log_if_unrecognized(self, attr, attr_enum):
"""
Checks if an attribute exists in a given enumeration, logging a message if
it isn't. Attributes can either be for a string or collection of strings
:param str attr: name of the attribute to check
:param stem.util.enum.Enum enum: enumeration to check against
"""
attr_values = getattr(self, attr)
if attr_values:
if stem.util._is_str(attr_values):
attr_values = [attr_values]
for value in attr_values:
if value not in attr_enum:
log_id = 'event.%s.unknown_%s.%s' % (self.type.lower(), attr, value)
unrecognized_msg = "%s event had an unrecognized %s (%s). Maybe a new addition to the control protocol? Full Event: '%s'" % (self.type, attr, value, self)
log.log_once(log_id, log.INFO, unrecognized_msg)
class AddrMapEvent(Event):
"""
Event that indicates a new address mapping.
The ADDRMAP event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha.
.. versionchanged:: 1.1.0
Added the cached attribute.
:var str hostname: address being resolved
:var str destination: destination of the resolution, this is usually an ip,
but could be a hostname if TrackHostExits is enabled or **NONE** if the
resolution failed
:var datetime expiry: expiration time of the resolution in local time
:var str error: error code if the resolution failed
:var datetime utc_expiry: expiration time of the resolution in UTC
:var bool cached: **True** if the resolution will be kept until it expires,
**False** otherwise or **None** if undefined
"""
_POSITIONAL_ARGS = ('hostname', 'destination', 'expiry')
_KEYWORD_ARGS = {
'error': 'error',
'EXPIRES': 'utc_expiry',
'CACHED': 'cached',
}
_OPTIONALLY_QUOTED = ('expiry')
def _parse(self):
if self.destination == '':
self.destination = None
if self.expiry is not None:
if self.expiry == 'NEVER':
self.expiry = None
else:
try:
self.expiry = stem.util.str_tools._parse_timestamp(self.expiry)
except ValueError:
raise stem.ProtocolError('Unable to parse date in ADDRMAP event: %s' % self)
if self.utc_expiry is not None:
self.utc_expiry = stem.util.str_tools._parse_timestamp(self.utc_expiry)
if self.cached is not None:
if self.cached == 'YES':
self.cached = True
elif self.cached == 'NO':
self.cached = False
else:
raise stem.ProtocolError("An ADDRMAP event's CACHED mapping can only be 'YES' or 'NO': %s" % self)
class AuthDirNewDescEvent(Event):
"""
Event specific to directory authorities, indicating that we just received new
descriptors. The descriptor type contained within this event is unspecified
so the descriptor contents are left unparsed.
The AUTHDIR_NEWDESCS event was introduced in tor version 0.1.1.10-alpha and
removed in 0.3.2.1-alpha. (:spec:`6e887ba`)
.. deprecated:: 1.6.0
Tor dropped this event as of version 0.3.2.1. (:spec:`6e887ba`)
:var stem.AuthDescriptorAction action: what is being done with the descriptor
:var str message: explanation of why we chose this action
:var str descriptor: content of the descriptor
"""
_SKIP_PARSING = True
_VERSION_ADDED = stem.version.Requirement.EVENT_AUTHDIR_NEWDESCS
def _parse(self):
lines = str(self).split('\n')
if len(lines) < 5:
raise stem.ProtocolError("AUTHDIR_NEWDESCS events must contain lines for at least the type, action, message, descriptor, and terminating 'OK'")
elif lines[-1] != 'OK':
raise stem.ProtocolError("AUTHDIR_NEWDESCS doesn't end with an 'OK'")
# TODO: For stem 2.0.0 we should consider changing 'descriptor' to a
# ServerDescriptor instance.
self.action = lines[1]
self.message = lines[2]
self.descriptor = '\n'.join(lines[3:-1])
class BandwidthEvent(Event):
"""
Event emitted every second with the bytes sent and received by tor.
The BW event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha.
:var int read: bytes received by tor that second
:var int written: bytes sent by tor that second
"""
_POSITIONAL_ARGS = ('read', 'written')
def _parse(self):
if not self.read:
raise stem.ProtocolError('BW event is missing its read value')
elif not self.written:
raise stem.ProtocolError('BW event is missing its written value')
elif not self.read.isdigit() or not self.written.isdigit():
raise stem.ProtocolError("A BW event's bytes sent and received should be a positive numeric value, received: %s" % self)
self.read = INT_TYPE(self.read)
self.written = INT_TYPE(self.written)
class BuildTimeoutSetEvent(Event):
"""
Event indicating that the timeout value for a circuit has changed. This was
first added in tor version 0.2.2.7.
The BUILDTIMEOUT_SET event was introduced in tor version 0.2.2.7-alpha.
:var stem.TimeoutSetType set_type: way in which the timeout is changing
:var int total_times: circuit build times tor used to determine the timeout
:var int timeout: circuit timeout value in milliseconds
:var int xm: Pareto parameter Xm in milliseconds
:var float alpha: Pareto parameter alpha
:var float quantile: CDF quantile cutoff point
:var float timeout_rate: ratio of circuits that have time out
:var int close_timeout: duration to keep measurement circuits in milliseconds
:var float close_rate: ratio of measurement circuits that are closed
"""
_POSITIONAL_ARGS = ('set_type',)
_KEYWORD_ARGS = {
'TOTAL_TIMES': 'total_times',
'TIMEOUT_MS': 'timeout',
'XM': 'xm',
'ALPHA': 'alpha',
'CUTOFF_QUANTILE': 'quantile',
'TIMEOUT_RATE': 'timeout_rate',
'CLOSE_MS': 'close_timeout',
'CLOSE_RATE': 'close_rate',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_BUILDTIMEOUT_SET
def _parse(self):
# convert our integer and float parameters
for param in ('total_times', 'timeout', 'xm', 'close_timeout'):
param_value = getattr(self, param)
if param_value is not None:
try:
setattr(self, param, int(param_value))
except ValueError:
raise stem.ProtocolError('The %s of a BUILDTIMEOUT_SET should be an integer: %s' % (param, self))
for param in ('alpha', 'quantile', 'timeout_rate', 'close_rate'):
param_value = getattr(self, param)
if param_value is not None:
try:
setattr(self, param, float(param_value))
except ValueError:
raise stem.ProtocolError('The %s of a BUILDTIMEOUT_SET should be a float: %s' % (param, self))
self._log_if_unrecognized('set_type', stem.TimeoutSetType)
class CircuitEvent(Event):
"""
Event that indicates that a circuit has changed.
The fingerprint or nickname values in our 'path' may be **None** if the
VERBOSE_NAMES feature isn't enabled. The option was first introduced in tor
version 0.1.2.2, and on by default after 0.2.2.1.
The CIRC event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha.
.. versionchanged:: 1.4.0
Added the socks_username and socks_password attributes which is used for
`stream isolation
`_.
:var str id: circuit identifier
:var stem.CircStatus status: reported status for the circuit
:var tuple path: relays involved in the circuit, these are
**(fingerprint, nickname)** tuples
:var tuple build_flags: :data:`~stem.CircBuildFlag` attributes
governing how the circuit is built
:var stem.CircPurpose purpose: purpose that the circuit is intended for
:var stem.HiddenServiceState hs_state: status if this is a hidden service circuit
:var str rend_query: circuit's rendezvous-point if this is hidden service related
:var datetime created: time when the circuit was created or cannibalized
:var stem.CircClosureReason reason: reason for the circuit to be closed
:var stem.CircClosureReason remote_reason: remote side's reason for the circuit to be closed
:var str socks_username: username for using this circuit
:var str socks_password: password for using this circuit
"""
_POSITIONAL_ARGS = ('id', 'status', 'path')
_KEYWORD_ARGS = {
'BUILD_FLAGS': 'build_flags',
'PURPOSE': 'purpose',
'HS_STATE': 'hs_state',
'REND_QUERY': 'rend_query',
'TIME_CREATED': 'created',
'REASON': 'reason',
'REMOTE_REASON': 'remote_reason',
'SOCKS_USERNAME': 'socks_username',
'SOCKS_PASSWORD': 'socks_password',
}
def _parse(self):
self.path = tuple(stem.control._parse_circ_path(self.path))
self.created = self._iso_timestamp(self.created)
if self.build_flags is not None:
self.build_flags = tuple(self.build_flags.split(','))
if not tor_tools.is_valid_circuit_id(self.id):
raise stem.ProtocolError("Circuit IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
self._log_if_unrecognized('status', stem.CircStatus)
self._log_if_unrecognized('build_flags', stem.CircBuildFlag)
self._log_if_unrecognized('purpose', stem.CircPurpose)
self._log_if_unrecognized('hs_state', stem.HiddenServiceState)
self._log_if_unrecognized('reason', stem.CircClosureReason)
self._log_if_unrecognized('remote_reason', stem.CircClosureReason)
def _compare(self, other, method):
# sorting circuit events by their identifier
if not isinstance(other, CircuitEvent):
return False
my_id = getattr(self, 'id')
their_id = getattr(other, 'id')
return method(my_id, their_id) if my_id != their_id else method(hash(self), hash(other))
def __gt__(self, other):
return self._compare(other, lambda s, o: s > o)
def __ge__(self, other):
return self._compare(other, lambda s, o: s >= o)
class CircMinorEvent(Event):
"""
Event providing information about minor changes in our circuits. This was
first added in tor version 0.2.3.11.
The CIRC_MINOR event was introduced in tor version 0.2.3.11-alpha.
:var str id: circuit identifier
:var stem.CircEvent event: type of change in the circuit
:var tuple path: relays involved in the circuit, these are
**(fingerprint, nickname)** tuples
:var tuple build_flags: :data:`~stem.CircBuildFlag` attributes
governing how the circuit is built
:var stem.CircPurpose purpose: purpose that the circuit is intended for
:var stem.HiddenServiceState hs_state: status if this is a hidden service circuit
:var str rend_query: circuit's rendezvous-point if this is hidden service related
:var datetime created: time when the circuit was created or cannibalized
:var stem.CircPurpose old_purpose: prior purpose for the circuit
:var stem.HiddenServiceState old_hs_state: prior status as a hidden service circuit
"""
_POSITIONAL_ARGS = ('id', 'event', 'path')
_KEYWORD_ARGS = {
'BUILD_FLAGS': 'build_flags',
'PURPOSE': 'purpose',
'HS_STATE': 'hs_state',
'REND_QUERY': 'rend_query',
'TIME_CREATED': 'created',
'OLD_PURPOSE': 'old_purpose',
'OLD_HS_STATE': 'old_hs_state',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_CIRC_MINOR
def _parse(self):
self.path = tuple(stem.control._parse_circ_path(self.path))
self.created = self._iso_timestamp(self.created)
if self.build_flags is not None:
self.build_flags = tuple(self.build_flags.split(','))
if not tor_tools.is_valid_circuit_id(self.id):
raise stem.ProtocolError("Circuit IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
self._log_if_unrecognized('event', stem.CircEvent)
self._log_if_unrecognized('build_flags', stem.CircBuildFlag)
self._log_if_unrecognized('purpose', stem.CircPurpose)
self._log_if_unrecognized('hs_state', stem.HiddenServiceState)
self._log_if_unrecognized('old_purpose', stem.CircPurpose)
self._log_if_unrecognized('old_hs_state', stem.HiddenServiceState)
class ClientsSeenEvent(Event):
"""
Periodic event on bridge relays that provides a summary of our users.
The CLIENTS_SEEN event was introduced in tor version 0.2.1.10-alpha.
:var datetime start_time: time in UTC that we started collecting these stats
:var dict locales: mapping of country codes to a rounded count for the number of users
:var dict ip_versions: mapping of ip protocols to a rounded count for the number of users
"""
_KEYWORD_ARGS = {
'TimeStarted': 'start_time',
'CountrySummary': 'locales',
'IPVersions': 'ip_versions',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_CLIENTS_SEEN
def _parse(self):
if self.start_time is not None:
self.start_time = stem.util.str_tools._parse_timestamp(self.start_time)
if self.locales is not None:
locale_to_count = {}
for entry in self.locales.split(','):
if '=' not in entry:
raise stem.ProtocolError("The CLIENTS_SEEN's CountrySummary should be a comma separated listing of '=' mappings: %s" % self)
locale, count = entry.split('=', 1)
if len(locale) != 2:
raise stem.ProtocolError("Locales should be a two character code, got '%s': %s" % (locale, self))
elif not count.isdigit():
raise stem.ProtocolError('Locale count was non-numeric (%s): %s' % (count, self))
elif locale in locale_to_count:
raise stem.ProtocolError("CountrySummary had multiple mappings for '%s': %s" % (locale, self))
locale_to_count[locale] = int(count)
self.locales = locale_to_count
if self.ip_versions is not None:
protocol_to_count = {}
for entry in self.ip_versions.split(','):
if '=' not in entry:
raise stem.ProtocolError("The CLIENTS_SEEN's IPVersions should be a comma separated listing of '=' mappings: %s" % self)
protocol, count = entry.split('=', 1)
if not count.isdigit():
raise stem.ProtocolError('IP protocol count was non-numeric (%s): %s' % (count, self))
protocol_to_count[protocol] = int(count)
self.ip_versions = protocol_to_count
class ConfChangedEvent(Event):
"""
Event that indicates that our configuration changed, either in response to a
SETCONF or RELOAD signal.
The CONF_CHANGED event was introduced in tor version 0.2.3.3-alpha.
.. deprecated:: 1.7.0
Deprecated the *config* attribute. Some tor configuration options (like
ExitPolicy) can have multiple values, so a simple 'str => str' mapping
meant that we only provided the last.
.. versionchanged:: 1.7.0
Added the changed and unset attributes.
:var dict changed: mapping of configuration options to a list of their new
values
:var list unset: configuration options that have been unset
"""
_SKIP_PARSING = True
_VERSION_ADDED = stem.version.Requirement.EVENT_CONF_CHANGED
def _parse(self):
self.changed = {}
self.unset = []
self.config = {} # TODO: remove in stem 2.0
# Skip first and last line since they're the header and footer. For
# instance...
#
# 650-CONF_CHANGED
# 650-ExitNodes=caerSidi
# 650-ExitPolicy
# 650-MaxCircuitDirtiness=20
# 650 OK
for line in str(self).splitlines()[1:-1]:
if '=' in line:
key, value = line.split('=', 1)
self.changed.setdefault(key, []).append(value)
else:
key, value = line, None
self.unset.append(key)
self.config[key] = value
class DescChangedEvent(Event):
"""
Event that indicates that our descriptor has changed.
The DESCCHANGED event was introduced in tor version 0.1.2.2-alpha.
"""
_VERSION_ADDED = stem.version.Requirement.EVENT_DESCCHANGED
class GuardEvent(Event):
"""
Event that indicates that our guard relays have changed. The 'endpoint' could
be either a...
* fingerprint
* 'fingerprint=nickname' pair
The derived 'endpoint_*' attributes are generally more useful.
The GUARD event was introduced in tor version 0.1.2.5-alpha.
:var stem.GuardType guard_type: purpose the guard relay is for
:var str endpoint: relay that the event concerns
:var str endpoint_fingerprint: endpoint's finterprint
:var str endpoint_nickname: endpoint's nickname if it was provided
:var stem.GuardStatus status: status of the guard relay
"""
_VERSION_ADDED = stem.version.Requirement.EVENT_GUARD
_POSITIONAL_ARGS = ('guard_type', 'endpoint', 'status')
def _parse(self):
self.endpoint_fingerprint = None
self.endpoint_nickname = None
try:
self.endpoint_fingerprint, self.endpoint_nickname = \
stem.control._parse_circ_entry(self.endpoint)
except stem.ProtocolError:
raise stem.ProtocolError("GUARD's endpoint doesn't match a ServerSpec: %s" % self)
self._log_if_unrecognized('guard_type', stem.GuardType)
self._log_if_unrecognized('status', stem.GuardStatus)
class HSDescEvent(Event):
"""
Event triggered when we fetch a hidden service descriptor that currently isn't in our cache.
The HS_DESC event was introduced in tor version 0.2.5.2-alpha.
.. versionadded:: 1.2.0
.. versionchanged:: 1.3.0
Added the reason attribute.
.. versionchanged:: 1.5.0
Added the replica attribute.
.. versionchanged:: 1.7.0
Added the index attribute.
:var stem.HSDescAction action: what is happening with the descriptor
:var str address: hidden service address
:var stem.HSAuth authentication: service's authentication method
:var str directory: hidden service directory servicing the request
:var str directory_fingerprint: hidden service directory's finterprint
:var str directory_nickname: hidden service directory's nickname if it was provided
:var str descriptor_id: descriptor identifier
:var stem.HSDescReason reason: reason the descriptor failed to be fetched
:var int replica: replica number the descriptor involves
:var str index: computed index of the HSDir the descriptor was uploaded to or fetched from
"""
_VERSION_ADDED = stem.version.Requirement.EVENT_HS_DESC
_POSITIONAL_ARGS = ('action', 'address', 'authentication', 'directory', 'descriptor_id')
_KEYWORD_ARGS = {'REASON': 'reason', 'REPLICA': 'replica', 'HSDIR_INDEX': 'index'}
def _parse(self):
self.directory_fingerprint = None
self.directory_nickname = None
if self.directory != 'UNKNOWN':
try:
self.directory_fingerprint, self.directory_nickname = \
stem.control._parse_circ_entry(self.directory)
except stem.ProtocolError:
raise stem.ProtocolError("HS_DESC's directory doesn't match a ServerSpec: %s" % self)
if self.replica is not None:
if not self.replica.isdigit():
raise stem.ProtocolError('HS_DESC event got a non-numeric replica count (%s): %s' % (self.replica, self))
self.replica = int(self.replica)
self._log_if_unrecognized('action', stem.HSDescAction)
self._log_if_unrecognized('authentication', stem.HSAuth)
class HSDescContentEvent(Event):
"""
Provides the content of hidden service descriptors we fetch.
The HS_DESC_CONTENT event was introduced in tor version 0.2.7.1-alpha.
.. versionadded:: 1.4.0
:var str address: hidden service address
:var str descriptor_id: descriptor identifier
:var str directory: hidden service directory servicing the request
:var str directory_fingerprint: hidden service directory's finterprint
:var str directory_nickname: hidden service directory's nickname if it was provided
:var stem.descriptor.hidden_service.HiddenServiceDescriptorV2 descriptor: descriptor that was retrieved
"""
_VERSION_ADDED = stem.version.Requirement.EVENT_HS_DESC_CONTENT
_POSITIONAL_ARGS = ('address', 'descriptor_id', 'directory')
def _parse(self):
if self.address == 'UNKNOWN':
self.address = None
self.directory_fingerprint = None
self.directory_nickname = None
try:
self.directory_fingerprint, self.directory_nickname = \
stem.control._parse_circ_entry(self.directory)
except stem.ProtocolError:
raise stem.ProtocolError("HS_DESC_CONTENT's directory doesn't match a ServerSpec: %s" % self)
# skip the first line (our positional arguments) and last ('OK')
desc_content = str_tools._to_bytes('\n'.join(str(self).splitlines()[1:-1]))
self.descriptor = None
if desc_content:
self.descriptor = list(stem.descriptor.hidden_service._parse_file(io.BytesIO(desc_content)))[0]
class LogEvent(Event):
"""
Tor logging event. These are the most visible kind of event since, by
default, tor logs at the NOTICE :data:`~stem.Runlevel` to stdout.
The logging events were some of the first Control Protocol V1 events
and were introduced in tor version 0.1.1.1-alpha.
:var stem.Runlevel runlevel: runlevel of the logged message
:var str message: logged message
"""
_SKIP_PARSING = True
def _parse(self):
self.runlevel = self.type
self._log_if_unrecognized('runlevel', stem.Runlevel)
# message is our content, minus the runlevel and ending "OK" if a
# multi-line message
self.message = str(self)[len(self.runlevel) + 1:].rstrip('\nOK')
class NetworkStatusEvent(Event):
"""
Event for when our copy of the consensus has changed. This was introduced in
tor version 0.1.2.3.
The NS event was introduced in tor version 0.1.2.3-alpha.
:var list desc: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` for the changed descriptors
"""
_SKIP_PARSING = True
_VERSION_ADDED = stem.version.Requirement.EVENT_NS
def _parse(self):
content = str(self).lstrip('NS\n').rstrip('\nOK')
# TODO: For stem 2.0.0 consider changing 'desc' to 'descriptors' to match
# our other events.
self.desc = list(stem.descriptor.router_status_entry._parse_file(
io.BytesIO(str_tools._to_bytes(content)),
False,
entry_class = stem.descriptor.router_status_entry.RouterStatusEntryV3,
))
class NetworkLivenessEvent(Event):
"""
Event for when the network becomes reachable or unreachable.
The NETWORK_LIVENESS event was introduced in tor version 0.2.7.2-alpha.
.. versionadded:: 1.5.0
:var str status: status of the network ('UP', 'DOWN', or possibly other
statuses in the future)
"""
_VERSION_ADDED = stem.version.Requirement.EVENT_NETWORK_LIVENESS
_POSITIONAL_ARGS = ('status',)
class NewConsensusEvent(Event):
"""
Event for when we have a new consensus. This is similar to
:class:`~stem.response.events.NetworkStatusEvent`, except that it contains
the whole consensus so anything not listed is implicitly no longer
recommended.
The NEWCONSENSUS event was introduced in tor version 0.2.1.13-alpha.
.. versionchanged:: 1.6.0
Added the consensus_content attribute.
.. deprecated:: 1.6.0
In Stem 2.0 we'll remove the desc attribute, so this event only provides
the unparsed consensus. Callers can then parse it if they'd like. To drop
parsing before then you can set...
::
stem.response.events.PARSE_NEWCONSENSUS_EVENTS = False
:var str consensus_content: consensus content
:var list desc: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` for the changed descriptors
"""
_SKIP_PARSING = True
_VERSION_ADDED = stem.version.Requirement.EVENT_NEWCONSENSUS
def _parse(self):
self.consensus_content = str(self).lstrip('NEWCONSENSUS\n').rstrip('\nOK')
# TODO: For stem 2.0.0 consider changing 'desc' to 'descriptors' to match
# our other events.
if PARSE_NEWCONSENSUS_EVENTS:
self.desc = list(stem.descriptor.router_status_entry._parse_file(
io.BytesIO(str_tools._to_bytes(self.consensus_content)),
False,
entry_class = stem.descriptor.router_status_entry.RouterStatusEntryV3,
))
else:
self.desc = None
class NewDescEvent(Event):
"""
Event that indicates that a new descriptor is available.
The fingerprint or nickname values in our 'relays' may be **None** if the
VERBOSE_NAMES feature isn't enabled. The option was first introduced in tor
version 0.1.2.2, and on by default after 0.2.2.1.
The NEWDESC event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha.
:var tuple relays: **(fingerprint, nickname)** tuples for the relays with
new descriptors
"""
def _parse(self):
self.relays = tuple([stem.control._parse_circ_entry(entry) for entry in str(self).split()[1:]])
class ORConnEvent(Event):
"""
Event that indicates a change in a relay connection. The 'endpoint' could be
any of several things including a...
* fingerprint
* nickname
* 'fingerprint=nickname' pair
* address:port
The derived 'endpoint_*' attributes are generally more useful.
The ORCONN event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha. Its id attribute was added in
version 0.2.5.2-alpha.
.. versionchanged:: 1.2.0
Added the id attribute.
:var str id: connection identifier
:var str endpoint: relay that the event concerns
:var str endpoint_fingerprint: endpoint's finterprint if it was provided
:var str endpoint_nickname: endpoint's nickname if it was provided
:var str endpoint_address: endpoint's address if it was provided
:var int endpoint_port: endpoint's port if it was provided
:var stem.ORStatus status: state of the connection
:var stem.ORClosureReason reason: reason for the connection to be closed
:var int circ_count: number of established and pending circuits
"""
_POSITIONAL_ARGS = ('endpoint', 'status')
_KEYWORD_ARGS = {
'REASON': 'reason',
'NCIRCS': 'circ_count',
'ID': 'id',
}
def _parse(self):
self.endpoint_fingerprint = None
self.endpoint_nickname = None
self.endpoint_address = None
self.endpoint_port = None
try:
self.endpoint_fingerprint, self.endpoint_nickname = \
stem.control._parse_circ_entry(self.endpoint)
except stem.ProtocolError:
if ':' not in self.endpoint:
raise stem.ProtocolError("ORCONN endpoint is neither a relay nor 'address:port': %s" % self)
address, port = self.endpoint.rsplit(':', 1)
if not connection.is_valid_port(port):
raise stem.ProtocolError("ORCONN's endpoint location's port is invalid: %s" % self)
self.endpoint_address = address
self.endpoint_port = int(port)
if self.circ_count is not None:
if not self.circ_count.isdigit():
raise stem.ProtocolError('ORCONN event got a non-numeric circuit count (%s): %s' % (self.circ_count, self))
self.circ_count = int(self.circ_count)
if self.id and not tor_tools.is_valid_connection_id(self.id):
raise stem.ProtocolError("Connection IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
self._log_if_unrecognized('status', stem.ORStatus)
self._log_if_unrecognized('reason', stem.ORClosureReason)
class SignalEvent(Event):
"""
Event that indicates that tor has received and acted upon a signal being sent
to the process. As of tor version 0.2.4.6 the only signals conveyed by this
event are...
* RELOAD
* DUMP
* DEBUG
* NEWNYM
* CLEARDNSCACHE
The SIGNAL event was introduced in tor version 0.2.3.1-alpha.
:var stem.Signal signal: signal that tor received
"""
_POSITIONAL_ARGS = ('signal',)
_VERSION_ADDED = stem.version.Requirement.EVENT_SIGNAL
def _parse(self):
# log if we recieved an unrecognized signal
expected_signals = (
stem.Signal.RELOAD,
stem.Signal.DUMP,
stem.Signal.DEBUG,
stem.Signal.NEWNYM,
stem.Signal.CLEARDNSCACHE,
)
self._log_if_unrecognized('signal', expected_signals)
class StatusEvent(Event):
"""
Notification of a change in tor's state. These are generally triggered for
the same sort of things as log messages of the NOTICE level or higher.
However, unlike :class:`~stem.response.events.LogEvent` these contain well
formed data.
The STATUS_GENERAL, STATUS_CLIENT, STATUS_SERVER events were introduced
in tor version 0.1.2.3-alpha.
:var stem.StatusType status_type: category of the status event
:var stem.Runlevel runlevel: runlevel of the logged message
:var str action: activity that caused this message
:var dict arguments: attributes about the event
"""
_POSITIONAL_ARGS = ('runlevel', 'action')
_VERSION_ADDED = stem.version.Requirement.EVENT_STATUS
def _parse(self):
if self.type == 'STATUS_GENERAL':
self.status_type = stem.StatusType.GENERAL
elif self.type == 'STATUS_CLIENT':
self.status_type = stem.StatusType.CLIENT
elif self.type == 'STATUS_SERVER':
self.status_type = stem.StatusType.SERVER
else:
raise ValueError("BUG: Unrecognized status type (%s), likely an EVENT_TYPE_TO_CLASS addition without revising how 'status_type' is assigned." % self.type)
# Just an alias for our parent class' keyword_args since that already
# parses these for us. Unlike our other event types Tor commonly supplies
# arbitrary key/value pairs for these, so making an alias here to better
# draw attention that the StatusEvent will likely have them.
self.arguments = self.keyword_args
self._log_if_unrecognized('runlevel', stem.Runlevel)
class StreamEvent(Event):
"""
Event that indicates that a stream has changed.
The STREAM event was one of the first Control Protocol V1 events and was
introduced in tor version 0.1.1.1-alpha.
:var str id: stream identifier
:var stem.StreamStatus status: reported status for the stream
:var str circ_id: circuit that the stream is attached to, this is **None** of
the stream is unattached
:var str target: destination of the stream
:var str target_address: destination address (ip, hostname, or '(Tor_internal)')
:var int target_port: destination port
:var stem.StreamClosureReason reason: reason for the stream to be closed
:var stem.StreamClosureReason remote_reason: remote side's reason for the stream to be closed
:var stem.StreamSource source: origin of the REMAP request
:var str source_addr: requester of the connection
:var str source_address: requester address (ip or hostname)
:var int source_port: requester port
:var stem.StreamPurpose purpose: purpose for the stream
"""
_POSITIONAL_ARGS = ('id', 'status', 'circ_id', 'target')
_KEYWORD_ARGS = {
'REASON': 'reason',
'REMOTE_REASON': 'remote_reason',
'SOURCE': 'source',
'SOURCE_ADDR': 'source_addr',
'PURPOSE': 'purpose',
}
def _parse(self):
if self.target is None:
raise stem.ProtocolError("STREAM event didn't have a target: %s" % self)
else:
if ':' not in self.target:
raise stem.ProtocolError("Target location must be of the form 'address:port': %s" % self)
address, port = self.target.rsplit(':', 1)
if not connection.is_valid_port(port, allow_zero = True):
raise stem.ProtocolError("Target location's port is invalid: %s" % self)
self.target_address = address
self.target_port = int(port)
if self.source_addr is None:
self.source_address = None
self.source_port = None
else:
if ':' not in self.source_addr:
raise stem.ProtocolError("Source location must be of the form 'address:port': %s" % self)
address, port = self.source_addr.rsplit(':', 1)
if not connection.is_valid_port(port, allow_zero = True):
raise stem.ProtocolError("Source location's port is invalid: %s" % self)
self.source_address = address
self.source_port = int(port)
# spec specifies a circ_id of zero if the stream is unattached
if self.circ_id == '0':
self.circ_id = None
self._log_if_unrecognized('reason', stem.StreamClosureReason)
self._log_if_unrecognized('remote_reason', stem.StreamClosureReason)
self._log_if_unrecognized('purpose', stem.StreamPurpose)
class StreamBwEvent(Event):
"""
Event (emitted approximately every second) with the bytes sent and received
by the application since the last such event on this stream.
The STREAM_BW event was introduced in tor version 0.1.2.8-beta.
.. versionchanged:: 1.6.0
Added the time attribute.
:var str id: stream identifier
:var int written: bytes sent by the application
:var int read: bytes received by the application
:var datetime time: time when the measurement was recorded
"""
_POSITIONAL_ARGS = ('id', 'written', 'read', 'time')
_VERSION_ADDED = stem.version.Requirement.EVENT_STREAM_BW
def _parse(self):
if not tor_tools.is_valid_stream_id(self.id):
raise stem.ProtocolError("Stream IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
elif not self.written:
raise stem.ProtocolError('STREAM_BW event is missing its written value')
elif not self.read:
raise stem.ProtocolError('STREAM_BW event is missing its read value')
elif not self.read.isdigit() or not self.written.isdigit():
raise stem.ProtocolError("A STREAM_BW event's bytes sent and received should be a positive numeric value, received: %s" % self)
self.read = INT_TYPE(self.read)
self.written = INT_TYPE(self.written)
self.time = self._iso_timestamp(self.time)
class TransportLaunchedEvent(Event):
"""
Event triggered when a pluggable transport is launched.
The TRANSPORT_LAUNCHED event was introduced in tor version 0.2.5.0-alpha.
.. versionadded:: 1.1.0
:var str type: 'server' or 'client'
:var str name: name of the pluggable transport
:var str address: IPv4 or IPv6 address where the transport is listening for
connections
:var int port: port where the transport is listening for connections
"""
_POSITIONAL_ARGS = ('type', 'name', 'address', 'port')
_VERSION_ADDED = stem.version.Requirement.EVENT_TRANSPORT_LAUNCHED
def _parse(self):
if self.type not in ('server', 'client'):
raise stem.ProtocolError("Transport type should either be 'server' or 'client': %s" % self)
if not connection.is_valid_ipv4_address(self.address) and \
not connection.is_valid_ipv6_address(self.address):
raise stem.ProtocolError("Transport address isn't a valid IPv4 or IPv6 address: %s" % self)
if not connection.is_valid_port(self.port):
raise stem.ProtocolError('Transport port is invalid: %s' % self)
self.port = int(self.port)
class ConnectionBandwidthEvent(Event):
"""
Event emitted every second with the bytes sent and received by tor on a
per-connection basis.
The CONN_BW event was introduced in tor version 0.2.5.2-alpha.
.. versionadded:: 1.2.0
.. versionchanged:: 1.6.0
Renamed 'type' attribute to 'conn_type' so it wouldn't be override parent
class attribute with the same name.
:var str id: connection identifier
:var stem.ConnectionType conn_type: connection type
:var int read: bytes received by tor that second
:var int written: bytes sent by tor that second
"""
_KEYWORD_ARGS = {
'ID': 'id',
'TYPE': 'conn_type',
'READ': 'read',
'WRITTEN': 'written',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_CONN_BW
def _parse(self):
if not self.id:
raise stem.ProtocolError('CONN_BW event is missing its id')
elif not self.conn_type:
raise stem.ProtocolError('CONN_BW event is missing its connection type')
elif not self.read:
raise stem.ProtocolError('CONN_BW event is missing its read value')
elif not self.written:
raise stem.ProtocolError('CONN_BW event is missing its written value')
elif not self.read.isdigit() or not self.written.isdigit():
raise stem.ProtocolError("A CONN_BW event's bytes sent and received should be a positive numeric value, received: %s" % self)
elif not tor_tools.is_valid_connection_id(self.id):
raise stem.ProtocolError("Connection IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
self.read = INT_TYPE(self.read)
self.written = INT_TYPE(self.written)
self._log_if_unrecognized('conn_type', stem.ConnectionType)
class CircuitBandwidthEvent(Event):
"""
Event emitted every second with the bytes sent and received by tor on a
per-circuit basis.
The CIRC_BW event was introduced in tor version 0.2.5.2-alpha.
.. versionadded:: 1.2.0
.. versionchanged:: 1.6.0
Added the time attribute.
.. versionchanged:: 1.7.0
Added the delivered_read, delivered_written, overhead_read, and
overhead_written attributes.
:var str id: circuit identifier
:var int read: bytes received by tor that second
:var int written: bytes sent by tor that second
:var int delivered_read: user payload received by tor that second
:var int delivered_written: user payload sent by tor that second
:var int overhead_read: padding so read cells will have a fixed length
:var int overhead_written: padding so written cells will have a fixed length
:var datetime time: time when the measurement was recorded
"""
_KEYWORD_ARGS = {
'ID': 'id',
'READ': 'read',
'WRITTEN': 'written',
'DELIVERED_READ': 'delivered_read',
'DELIVERED_WRITTEN': 'delivered_written',
'OVERHEAD_READ': 'overhead_read',
'OVERHEAD_WRITTEN': 'overhead_written',
'TIME': 'time',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_CIRC_BW
def _parse(self):
if not self.id:
raise stem.ProtocolError('CIRC_BW event is missing its id')
elif not self.read:
raise stem.ProtocolError('CIRC_BW event is missing its read value')
elif not self.written:
raise stem.ProtocolError('CIRC_BW event is missing its written value')
elif not self.read.isdigit():
raise stem.ProtocolError("A CIRC_BW event's bytes received should be a positive numeric value, received: %s" % self)
elif not self.written.isdigit():
raise stem.ProtocolError("A CIRC_BW event's bytes sent should be a positive numeric value, received: %s" % self)
elif self.delivered_read and not self.delivered_read.isdigit():
raise stem.ProtocolError("A CIRC_BW event's delivered bytes received should be a positive numeric value, received: %s" % self)
elif self.delivered_written and not self.delivered_written.isdigit():
raise stem.ProtocolError("A CIRC_BW event's delivered bytes sent should be a positive numeric value, received: %s" % self)
elif self.overhead_read and not self.overhead_read.isdigit():
raise stem.ProtocolError("A CIRC_BW event's overhead bytes received should be a positive numeric value, received: %s" % self)
elif self.overhead_written and not self.overhead_written.isdigit():
raise stem.ProtocolError("A CIRC_BW event's overhead bytes sent should be a positive numeric value, received: %s" % self)
elif not tor_tools.is_valid_circuit_id(self.id):
raise stem.ProtocolError("Circuit IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
self.time = self._iso_timestamp(self.time)
for attr in ('read', 'written', 'delivered_read', 'delivered_written', 'overhead_read', 'overhead_written'):
value = getattr(self, attr)
if value:
setattr(self, attr, INT_TYPE(value))
class CellStatsEvent(Event):
"""
Event emitted every second with a count of the number of cells types broken
down by the circuit. **These events are only emitted if TestingTorNetwork is
set.**
The CELL_STATS event was introduced in tor version 0.2.5.2-alpha.
.. versionadded:: 1.2.0
:var str id: circuit identifier
:var str inbound_queue: inbound queue identifier
:var str inbound_connection: inbound connection identifier
:var dict inbound_added: mapping of added inbound cell types to their count
:var dict inbound_removed: mapping of removed inbound cell types to their count
:var dict inbound_time: mapping of inbound cell types to the time they took to write in milliseconds
:var str outbound_queue: outbound queue identifier
:var str outbound_connection: outbound connection identifier
:var dict outbound_added: mapping of added outbound cell types to their count
:var dict outbound_removed: mapping of removed outbound cell types to their count
:var dict outbound_time: mapping of outbound cell types to the time they took to write in milliseconds
"""
_KEYWORD_ARGS = {
'ID': 'id',
'InboundQueue': 'inbound_queue',
'InboundConn': 'inbound_connection',
'InboundAdded': 'inbound_added',
'InboundRemoved': 'inbound_removed',
'InboundTime': 'inbound_time',
'OutboundQueue': 'outbound_queue',
'OutboundConn': 'outbound_connection',
'OutboundAdded': 'outbound_added',
'OutboundRemoved': 'outbound_removed',
'OutboundTime': 'outbound_time',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_CELL_STATS
def _parse(self):
if self.id and not tor_tools.is_valid_circuit_id(self.id):
raise stem.ProtocolError("Circuit IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
elif self.inbound_queue and not tor_tools.is_valid_circuit_id(self.inbound_queue):
raise stem.ProtocolError("Queue IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.inbound_queue, self))
elif self.inbound_connection and not tor_tools.is_valid_connection_id(self.inbound_connection):
raise stem.ProtocolError("Connection IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.inbound_connection, self))
elif self.outbound_queue and not tor_tools.is_valid_circuit_id(self.outbound_queue):
raise stem.ProtocolError("Queue IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.outbound_queue, self))
elif self.outbound_connection and not tor_tools.is_valid_connection_id(self.outbound_connection):
raise stem.ProtocolError("Connection IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.outbound_connection, self))
self.inbound_added = _parse_cell_type_mapping(self.inbound_added)
self.inbound_removed = _parse_cell_type_mapping(self.inbound_removed)
self.inbound_time = _parse_cell_type_mapping(self.inbound_time)
self.outbound_added = _parse_cell_type_mapping(self.outbound_added)
self.outbound_removed = _parse_cell_type_mapping(self.outbound_removed)
self.outbound_time = _parse_cell_type_mapping(self.outbound_time)
class TokenBucketEmptyEvent(Event):
"""
Event emitted when refilling an empty token bucket. **These events are only
emitted if TestingTorNetwork is set.**
The TB_EMPTY event was introduced in tor version 0.2.5.2-alpha.
.. versionadded:: 1.2.0
:var stem.TokenBucket bucket: bucket being refilled
:var str id: connection identifier
:var int read: time in milliseconds since the read bucket was last refilled
:var int written: time in milliseconds since the write bucket was last refilled
:var int last_refill: time in milliseconds the bucket has been empty since last refilled
"""
_POSITIONAL_ARGS = ('bucket',)
_KEYWORD_ARGS = {
'ID': 'id',
'READ': 'read',
'WRITTEN': 'written',
'LAST': 'last_refill',
}
_VERSION_ADDED = stem.version.Requirement.EVENT_TB_EMPTY
def _parse(self):
if self.id and not tor_tools.is_valid_connection_id(self.id):
raise stem.ProtocolError("Connection IDs must be one to sixteen alphanumeric characters, got '%s': %s" % (self.id, self))
elif not self.read.isdigit():
raise stem.ProtocolError("A TB_EMPTY's READ value should be a positive numeric value, received: %s" % self)
elif not self.written.isdigit():
raise stem.ProtocolError("A TB_EMPTY's WRITTEN value should be a positive numeric value, received: %s" % self)
elif not self.last_refill.isdigit():
raise stem.ProtocolError("A TB_EMPTY's LAST value should be a positive numeric value, received: %s" % self)
self.read = int(self.read)
self.written = int(self.written)
self.last_refill = int(self.last_refill)
self._log_if_unrecognized('bucket', stem.TokenBucket)
def _parse_cell_type_mapping(mapping):
"""
Parses a mapping of the form...
key1:value1,key2:value2...
... in which keys are strings and values are integers.
:param str mapping: value to be parsed
:returns: dict of **str => int** mappings
:rasies: **stem.ProtocolError** if unable to parse the mapping
"""
if mapping is None:
return None
results = {}
for entry in mapping.split(','):
if ':' not in entry:
raise stem.ProtocolError("Mappings are expected to be of the form 'key:value', got '%s': %s" % (entry, mapping))
key, value = entry.rsplit(':', 1)
if not CELL_TYPE.match(key):
raise stem.ProtocolError("Key had invalid characters, got '%s': %s" % (key, mapping))
elif not value.isdigit():
raise stem.ProtocolError("Values should just be integers, got '%s': %s" % (value, mapping))
results[key] = int(value)
return results
EVENT_TYPE_TO_CLASS = {
'ADDRMAP': AddrMapEvent,
'AUTHDIR_NEWDESCS': AuthDirNewDescEvent,
'BUILDTIMEOUT_SET': BuildTimeoutSetEvent,
'BW': BandwidthEvent,
'CELL_STATS': CellStatsEvent,
'CIRC': CircuitEvent,
'CIRC_BW': CircuitBandwidthEvent,
'CIRC_MINOR': CircMinorEvent,
'CLIENTS_SEEN': ClientsSeenEvent,
'CONF_CHANGED': ConfChangedEvent,
'CONN_BW': ConnectionBandwidthEvent,
'DEBUG': LogEvent,
'DESCCHANGED': DescChangedEvent,
'ERR': LogEvent,
'GUARD': GuardEvent,
'HS_DESC': HSDescEvent,
'HS_DESC_CONTENT': HSDescContentEvent,
'INFO': LogEvent,
'NETWORK_LIVENESS': NetworkLivenessEvent,
'NEWCONSENSUS': NewConsensusEvent,
'NEWDESC': NewDescEvent,
'NOTICE': LogEvent,
'NS': NetworkStatusEvent,
'ORCONN': ORConnEvent,
'SIGNAL': SignalEvent,
'STATUS_CLIENT': StatusEvent,
'STATUS_GENERAL': StatusEvent,
'STATUS_SERVER': StatusEvent,
'STREAM': StreamEvent,
'STREAM_BW': StreamBwEvent,
'TB_EMPTY': TokenBucketEmptyEvent,
'TRANSPORT_LAUNCHED': TransportLaunchedEvent,
'WARN': LogEvent,
# accounting for a bug in tor 0.2.0.22
'STATUS_SEVER': StatusEvent,
}
stem-1.8.0/stem/directory.py 0000664 0001750 0001750 00000055523 13526623720 016560 0 ustar atagar atagar 0000000 0000000 # Copyright 2018-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Directories that provide `relay descriptor information
<../tutorials/mirror_mirror_on_the_wall.html>`_. At a very high level tor works
as follows...
1. Volunteer starts a new tor relay, during which it sends a `server
descriptor `_ to each of the directory
authorities.
2. Each hour the directory authorities make a `vote
`_ that says who they think the active
relays are in the network and some attributes about them.
3. The directory authorities send each other their votes, and compile that
into the `consensus `_. This document is very
similar to the votes, the only difference being that the majority of the
authorities agree upon and sign this document. The idividual relay entries
in the vote or consensus is called `router status entries
`_.
4. Tor clients (people using the service) download the consensus from an
authority, fallback, or other mirror to determine who the active relays in
the network are. They then use this to construct circuits and use the
network.
::
Directory - Relay we can retrieve descriptor information from
| |- from_cache - Provides cached information bundled with Stem.
| +- from_remote - Downloads the latest directory information from tor.
|
|- Authority - Tor directory authority
+- Fallback - Mirrors that can be used instead of the authorities
.. versionadded:: 1.7.0
"""
import os
import re
import sys
import stem
import stem.util
import stem.util.conf
from stem.util import connection, str_tools, tor_tools
try:
# added in python 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
GITWEB_AUTHORITY_URL = 'https://gitweb.torproject.org/tor.git/plain/src/app/config/auth_dirs.inc'
GITWEB_FALLBACK_URL = 'https://gitweb.torproject.org/tor.git/plain/src/app/config/fallback_dirs.inc'
FALLBACK_CACHE_PATH = os.path.join(os.path.dirname(__file__), 'cached_fallbacks.cfg')
AUTHORITY_NAME = re.compile('"(\\S+) orport=(\\d+) .*"')
AUTHORITY_V3IDENT = re.compile('"v3ident=([\\dA-F]{40}) "')
AUTHORITY_IPV6 = re.compile('"ipv6=\\[([\\da-f:]+)\\]:(\\d+) "')
AUTHORITY_ADDR = re.compile('"([\\d\\.]+):(\\d+) ([\\dA-F ]{49})",')
FALLBACK_DIV = '/* ===== */'
FALLBACK_MAPPING = re.compile('/\\*\\s+(\\S+)=(\\S*)\\s+\\*/')
FALLBACK_ADDR = re.compile('"([\\d\\.]+):(\\d+) orport=(\\d+) id=([\\dA-F]{40}).*')
FALLBACK_NICKNAME = re.compile('/\\* nickname=(\\S+) \\*/')
FALLBACK_EXTRAINFO = re.compile('/\\* extrainfo=([0-1]) \\*/')
FALLBACK_IPV6 = re.compile('" ipv6=\\[([\\da-f:]+)\\]:(\\d+)"')
def _match_with(lines, regexes, required = None):
"""
Scans the given content against a series of regex matchers, providing back a
mapping of regexes to their capture groups. This maping is with the value if
the regex has just a single capture group, and a tuple otherwise.
:param list lines: text to parse
:param list regexes: regexes to match against
:param list required: matches that must be in the content
:returns: **dict** mapping matchers against their capture groups
:raises: **ValueError** if a required match is not present
"""
matches = {}
for line in lines:
for matcher in regexes:
m = matcher.search(str_tools._to_unicode(line))
if m:
match_groups = m.groups()
matches[matcher] = match_groups if len(match_groups) > 1 else match_groups[0]
if required:
for required_matcher in required:
if required_matcher not in matches:
raise ValueError('Failed to parse mandatory data from:\n\n%s' % '\n'.join(lines))
return matches
def _directory_entries(lines, pop_section_func, regexes, required = None):
next_section = pop_section_func(lines)
while next_section:
yield _match_with(next_section, regexes, required)
next_section = pop_section_func(lines)
class Directory(object):
"""
Relay we can contact for descriptor information.
Our :func:`~stem.directory.Directory.from_cache` and
:func:`~stem.directory.Directory.from_remote` functions key off a
different identifier based on our subclass...
* :class:`~stem.directory.Authority` keys off the nickname.
* :class:`~stem.directory.Fallback` keys off fingerprints.
This is because authorities are highly static and canonically known by their
names, whereas fallbacks vary more and don't necessarily have a nickname to
key off of.
:var str address: IPv4 address of the directory
:var int or_port: port on which the relay services relay traffic
:var int dir_port: port on which directory information is available
:var str fingerprint: relay fingerprint
:var str nickname: relay nickname
:var str orport_v6: **(address, port)** tuple for the directory's IPv6
ORPort, or **None** if it doesn't have one
"""
def __init__(self, address, or_port, dir_port, fingerprint, nickname, orport_v6):
identifier = '%s (%s)' % (fingerprint, nickname) if nickname else fingerprint
if not connection.is_valid_ipv4_address(address):
raise ValueError('%s has an invalid IPv4 address: %s' % (identifier, address))
elif not connection.is_valid_port(or_port):
raise ValueError('%s has an invalid ORPort: %s' % (identifier, or_port))
elif not connection.is_valid_port(dir_port):
raise ValueError('%s has an invalid DirPort: %s' % (identifier, dir_port))
elif not tor_tools.is_valid_fingerprint(fingerprint):
raise ValueError('%s has an invalid fingerprint: %s' % (identifier, fingerprint))
elif nickname and not tor_tools.is_valid_nickname(nickname):
raise ValueError('%s has an invalid nickname: %s' % (fingerprint, nickname))
if orport_v6:
if not isinstance(orport_v6, tuple) or len(orport_v6) != 2:
raise ValueError('%s orport_v6 should be a two value tuple: %s' % (identifier, str(orport_v6)))
elif not connection.is_valid_ipv6_address(orport_v6[0]):
raise ValueError('%s has an invalid IPv6 address: %s' % (identifier, orport_v6[0]))
elif not connection.is_valid_port(orport_v6[1]):
raise ValueError('%s has an invalid IPv6 port: %s' % (identifier, orport_v6[1]))
self.address = address
self.or_port = int(or_port)
self.dir_port = int(dir_port)
self.fingerprint = fingerprint
self.nickname = nickname
self.orport_v6 = (orport_v6[0], int(orport_v6[1])) if orport_v6 else None
@staticmethod
def from_cache():
"""
Provides cached Tor directory information. This information is hardcoded
into Tor and occasionally changes, so the information provided by this
method may not necessarily match the latest version of tor.
.. versionadded:: 1.5.0
.. versionchanged:: 1.7.0
Support added to the :class:`~stem.directory.Authority` class.
:returns: **dict** of **str** identifiers to
:class:`~stem.directory.Directory` instances
"""
raise NotImplementedError('Unsupported Operation: this should be implemented by the Directory subclass')
@staticmethod
def from_remote(timeout = 60):
"""
Reads and parses tor's directory data `from gitweb.torproject.org `_.
Note that while convenient, this reliance on GitWeb means you should alway
call with a fallback, such as...
::
try:
authorities = stem.directory.Authority.from_remote()
except IOError:
authorities = stem.directory.Authority.from_cache()
.. versionadded:: 1.5.0
.. versionchanged:: 1.7.0
Support added to the :class:`~stem.directory.Authority` class.
:param int timeout: seconds to wait before timing out the request
:returns: **dict** of **str** identifiers to their
:class:`~stem.directory.Directory`
:raises: **IOError** if unable to retrieve the fallback directories
"""
raise NotImplementedError('Unsupported Operation: this should be implemented by the Directory subclass')
def __hash__(self):
return stem.util._hash_attr(self, 'address', 'or_port', 'dir_port', 'fingerprint', 'nickname', 'orport_v6')
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Directory) else False
def __ne__(self, other):
return not self == other
class Authority(Directory):
"""
Tor directory authority, a special type of relay `hardcoded into tor
`_
to enumerate the relays in the network.
.. versionchanged:: 1.3.0
Added the is_bandwidth_authority attribute.
.. versionchanged:: 1.7.0
Added the orport_v6 attribute.
.. deprecated:: 1.7.0
The is_bandwidth_authority attribute is deprecated and will be removed in
the future.
:var str v3ident: identity key fingerprint used to sign votes and consensus
"""
def __init__(self, address = None, or_port = None, dir_port = None, fingerprint = None, nickname = None, orport_v6 = None, v3ident = None, is_bandwidth_authority = False):
super(Authority, self).__init__(address, or_port, dir_port, fingerprint, nickname, orport_v6)
if v3ident and not tor_tools.is_valid_fingerprint(v3ident):
identifier = '%s (%s)' % (fingerprint, nickname) if nickname else fingerprint
raise ValueError('%s has an invalid v3ident: %s' % (identifier, v3ident))
self.v3ident = v3ident
self.is_bandwidth_authority = is_bandwidth_authority
@staticmethod
def from_cache():
return dict(DIRECTORY_AUTHORITIES)
@staticmethod
def from_remote(timeout = 60):
try:
lines = str_tools._to_unicode(urllib.urlopen(GITWEB_AUTHORITY_URL, timeout = timeout).read()).splitlines()
if not lines:
raise IOError('no content')
except:
exc, stacktrace = sys.exc_info()[1:3]
message = "Unable to download tor's directory authorities from %s: %s" % (GITWEB_AUTHORITY_URL, exc)
raise stem.DownloadFailed(GITWEB_AUTHORITY_URL, exc, stacktrace, message)
# Entries look like...
#
# "moria1 orport=9101 "
# "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 "
# "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31",
try:
results = {}
for matches in _directory_entries(lines, Authority._pop_section, (AUTHORITY_NAME, AUTHORITY_V3IDENT, AUTHORITY_IPV6, AUTHORITY_ADDR), required = (AUTHORITY_NAME, AUTHORITY_ADDR)):
nickname, or_port = matches.get(AUTHORITY_NAME)
address, dir_port, fingerprint = matches.get(AUTHORITY_ADDR)
results[nickname] = Authority(
address = address,
or_port = or_port,
dir_port = dir_port,
fingerprint = fingerprint.replace(' ', ''),
nickname = nickname,
orport_v6 = matches.get(AUTHORITY_IPV6),
v3ident = matches.get(AUTHORITY_V3IDENT),
)
except ValueError as exc:
raise IOError(str(exc))
return results
@staticmethod
def _pop_section(lines):
"""
Provides the next authority entry.
"""
section_lines = []
if lines:
section_lines.append(lines.pop(0))
while lines and lines[0].startswith(' '):
section_lines.append(lines.pop(0))
return section_lines
def __hash__(self):
return stem.util._hash_attr(self, 'v3ident', 'is_bandwidth_authority', parent = Directory, cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Authority) else False
def __ne__(self, other):
return not self == other
class Fallback(Directory):
"""
Particularly stable relays tor can instead of authorities when
bootstrapping. These relays are `hardcoded in tor
`_.
For example, the following checks the performance of tor's fallback directories...
::
import time
from stem.descriptor.remote import get_consensus
from stem.directory import Fallback
for fallback in Fallback.from_cache().values():
start = time.time()
get_consensus(endpoints = [(fallback.address, fallback.dir_port)]).run()
print('Downloading the consensus took %0.2f from %s' % (time.time() - start, fallback.fingerprint))
::
% python example.py
Downloading the consensus took 5.07 from 0AD3FA884D18F89EEA2D89C019379E0E7FD94417
Downloading the consensus took 3.59 from C871C91489886D5E2E94C13EA1A5FDC4B6DC5204
Downloading the consensus took 4.16 from 74A910646BCEEFBCD2E874FC1DC997430F968145
...
.. versionadded:: 1.5.0
.. versionchanged:: 1.7.0
Added the has_extrainfo and header attributes which are part of
the `second version of the fallback directories
`_.
:var bool has_extrainfo: **True** if the relay should be able to provide
extrainfo descriptors, **False** otherwise.
:var collections.OrderedDict header: metadata about the fallback directory file this originated from
"""
def __init__(self, address = None, or_port = None, dir_port = None, fingerprint = None, nickname = None, has_extrainfo = False, orport_v6 = None, header = None):
super(Fallback, self).__init__(address, or_port, dir_port, fingerprint, nickname, orport_v6)
self.has_extrainfo = has_extrainfo
self.header = OrderedDict(header) if header else OrderedDict()
@staticmethod
def from_cache(path = FALLBACK_CACHE_PATH):
conf = stem.util.conf.Config()
conf.load(path)
headers = OrderedDict([(k.split('.', 1)[1], conf.get(k)) for k in conf.keys() if k.startswith('header.')])
results = {}
for fingerprint in set([key.split('.')[0] for key in conf.keys()]):
if fingerprint in ('tor_commit', 'stem_commit', 'header'):
continue
attr = {}
for attr_name in ('address', 'or_port', 'dir_port', 'nickname', 'has_extrainfo', 'orport6_address', 'orport6_port'):
key = '%s.%s' % (fingerprint, attr_name)
attr[attr_name] = conf.get(key)
if not attr[attr_name] and attr_name not in ('nickname', 'has_extrainfo', 'orport6_address', 'orport6_port'):
raise IOError("'%s' is missing from %s" % (key, FALLBACK_CACHE_PATH))
if attr['orport6_address'] and attr['orport6_port']:
orport_v6 = (attr['orport6_address'], int(attr['orport6_port']))
else:
orport_v6 = None
results[fingerprint] = Fallback(
address = attr['address'],
or_port = int(attr['or_port']),
dir_port = int(attr['dir_port']),
fingerprint = fingerprint,
nickname = attr['nickname'],
has_extrainfo = attr['has_extrainfo'] == 'true',
orport_v6 = orport_v6,
header = headers,
)
return results
@staticmethod
def from_remote(timeout = 60):
try:
lines = str_tools._to_unicode(urllib.urlopen(GITWEB_FALLBACK_URL, timeout = timeout).read()).splitlines()
if not lines:
raise IOError('no content')
except:
exc, stacktrace = sys.exc_info()[1:3]
message = "Unable to download tor's fallback directories from %s: %s" % (GITWEB_FALLBACK_URL, exc)
raise stem.DownloadFailed(GITWEB_FALLBACK_URL, exc, stacktrace, message)
# header metadata
if lines[0] != '/* type=fallback */':
raise IOError('%s does not have a type field indicating it is fallback directory metadata' % GITWEB_FALLBACK_URL)
header = {}
for line in Fallback._pop_section(lines):
mapping = FALLBACK_MAPPING.match(line)
if mapping:
header[mapping.group(1)] = mapping.group(2)
else:
raise IOError('Malformed fallback directory header line: %s' % line)
Fallback._pop_section(lines) # skip human readable comments
# Entries look like...
#
# "5.9.110.236:9030 orport=9001 id=0756B7CD4DFC8182BE23143FAC0642F515182CEB"
# " ipv6=[2a01:4f8:162:51e2::2]:9001"
# /* nickname=rueckgrat */
# /* extrainfo=1 */
try:
results = {}
for matches in _directory_entries(lines, Fallback._pop_section, (FALLBACK_ADDR, FALLBACK_NICKNAME, FALLBACK_EXTRAINFO, FALLBACK_IPV6), required = (FALLBACK_ADDR,)):
address, dir_port, or_port, fingerprint = matches[FALLBACK_ADDR]
results[fingerprint] = Fallback(
address = address,
or_port = int(or_port),
dir_port = int(dir_port),
fingerprint = fingerprint,
nickname = matches.get(FALLBACK_NICKNAME),
has_extrainfo = matches.get(FALLBACK_EXTRAINFO) == '1',
orport_v6 = matches.get(FALLBACK_IPV6),
header = header,
)
except ValueError as exc:
raise IOError(str(exc))
return results
@staticmethod
def _pop_section(lines):
"""
Provides lines up through the next divider. This excludes lines with just a
comma since they're an artifact of these being C strings.
"""
section_lines = []
if lines:
line = lines.pop(0)
while lines and line != FALLBACK_DIV:
if line.strip() != ',':
section_lines.append(line)
line = lines.pop(0)
return section_lines
@staticmethod
def _write(fallbacks, tor_commit, stem_commit, headers, path = FALLBACK_CACHE_PATH):
"""
Persists fallback directories to a location in a way that can be read by
from_cache().
:param dict fallbacks: mapping of fingerprints to their fallback directory
:param str tor_commit: tor commit the fallbacks came from
:param str stem_commit: stem commit the fallbacks came from
:param dict headers: metadata about the file these came from
:param str path: location fallbacks will be persisted to
"""
conf = stem.util.conf.Config()
conf.set('tor_commit', tor_commit)
conf.set('stem_commit', stem_commit)
for k, v in headers.items():
conf.set('header.%s' % k, v)
for directory in sorted(fallbacks.values(), key = lambda x: x.fingerprint):
fingerprint = directory.fingerprint
conf.set('%s.address' % fingerprint, directory.address)
conf.set('%s.or_port' % fingerprint, str(directory.or_port))
conf.set('%s.dir_port' % fingerprint, str(directory.dir_port))
conf.set('%s.nickname' % fingerprint, directory.nickname)
conf.set('%s.has_extrainfo' % fingerprint, 'true' if directory.has_extrainfo else 'false')
if directory.orport_v6:
conf.set('%s.orport6_address' % fingerprint, str(directory.orport_v6[0]))
conf.set('%s.orport6_port' % fingerprint, str(directory.orport_v6[1]))
conf.save(path)
def __hash__(self):
return stem.util._hash_attr(self, 'has_extrainfo', 'header', parent = Directory, cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Fallback) else False
def __ne__(self, other):
return not self == other
def _fallback_directory_differences(previous_directories, new_directories):
"""
Provides a description of how fallback directories differ.
"""
lines = []
added_fp = set(new_directories.keys()).difference(previous_directories.keys())
removed_fp = set(previous_directories.keys()).difference(new_directories.keys())
for fp in added_fp:
directory = new_directories[fp]
orport_v6 = '%s:%s' % directory.orport_v6 if directory.orport_v6 else '[none]'
lines += [
'* Added %s as a new fallback directory:' % directory.fingerprint,
' address: %s' % directory.address,
' or_port: %s' % directory.or_port,
' dir_port: %s' % directory.dir_port,
' nickname: %s' % directory.nickname,
' has_extrainfo: %s' % directory.has_extrainfo,
' orport_v6: %s' % orport_v6,
'',
]
for fp in removed_fp:
lines.append('* Removed %s as a fallback directory' % fp)
for fp in new_directories:
if fp in added_fp or fp in removed_fp:
continue # already discussed these
previous_directory = previous_directories[fp]
new_directory = new_directories[fp]
if previous_directory != new_directory:
for attr in ('address', 'or_port', 'dir_port', 'fingerprint', 'orport_v6'):
old_attr = getattr(previous_directory, attr)
new_attr = getattr(new_directory, attr)
if old_attr != new_attr:
lines.append('* Changed the %s of %s from %s to %s' % (attr, fp, old_attr, new_attr))
return '\n'.join(lines)
DIRECTORY_AUTHORITIES = {
'moria1': Authority(
nickname = 'moria1',
address = '128.31.0.39',
or_port = 9101,
dir_port = 9131,
fingerprint = '9695DFC35FFEB861329B9F1AB04C46397020CE31',
v3ident = 'D586D18309DED4CD6D57C18FDB97EFA96D330566',
),
'tor26': Authority(
nickname = 'tor26',
address = '86.59.21.38',
or_port = 443,
dir_port = 80,
fingerprint = '847B1F850344D7876491A54892F904934E4EB85D',
orport_v6 = ('2001:858:2:2:aabb:0:563b:1526', 443),
v3ident = '14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4',
),
'dizum': Authority(
nickname = 'dizum',
address = '45.66.33.45',
or_port = 443,
dir_port = 80,
fingerprint = '7EA6EAD6FD83083C538F44038BBFA077587DD755',
v3ident = 'E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58',
),
'gabelmoo': Authority(
nickname = 'gabelmoo',
address = '131.188.40.189',
or_port = 443,
dir_port = 80,
fingerprint = 'F2044413DAC2E02E3D6BCF4735A19BCA1DE97281',
orport_v6 = ('2001:638:a000:4140::ffff:189', 443),
v3ident = 'ED03BB616EB2F60BEC80151114BB25CEF515B226',
),
'dannenberg': Authority(
nickname = 'dannenberg',
address = '193.23.244.244',
or_port = 443,
dir_port = 80,
orport_v6 = ('2001:678:558:1000::244', 443),
fingerprint = '7BE683E65D48141321C5ED92F075C55364AC7123',
v3ident = '0232AF901C31A04EE9848595AF9BB7620D4C5B2E',
),
'maatuska': Authority(
nickname = 'maatuska',
address = '171.25.193.9',
or_port = 80,
dir_port = 443,
fingerprint = 'BD6A829255CB08E66FBE7D3748363586E46B3810',
orport_v6 = ('2001:67c:289c::9', 80),
v3ident = '49015F787433103580E3B66A1707A00E60F2D15B',
),
'Faravahar': Authority(
nickname = 'Faravahar',
address = '154.35.175.225',
or_port = 443,
dir_port = 80,
fingerprint = 'CF6D0AAFB385BE71B8E111FC5CFF4B47923733BC',
v3ident = 'EFCBE720AB3A82B99F9E953CD5BF50F7EEFC7B97',
),
'longclaw': Authority(
nickname = 'longclaw',
address = '199.58.81.140',
or_port = 443,
dir_port = 80,
fingerprint = '74A910646BCEEFBCD2E874FC1DC997430F968145',
v3ident = '23D15D965BC35114467363C165C4F724B64B4F66',
),
'bastet': Authority(
nickname = 'bastet',
address = '204.13.164.118',
or_port = 443,
dir_port = 80,
fingerprint = '24E2F139121D4394C54B5BCC368B3B411857C413',
orport_v6 = ('2620:13:4000:6000::1000:118', 443),
v3ident = '27102BC123E7AF1D4741AE047E160C91ADC76B21',
),
'Serge': Authority(
nickname = 'Serge',
address = '66.111.2.131',
or_port = 9001,
dir_port = 9030,
fingerprint = 'BA44A889E64B93FAA2B114E02C2A279A8555C533',
v3ident = None, # does not vote in the consensus
),
}
stem-1.8.0/stem/control.py 0000664 0001750 0001750 00000444434 13601502033 016222 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Module for interacting with the Tor control socket. The
:class:`~stem.control.Controller` is a wrapper around a
:class:`~stem.socket.ControlSocket`, retaining many of its methods (connect,
close, is_alive, etc) in addition to providing its own for working with the
socket at a higher level.
Stem has `several ways <../faq.html#how-do-i-connect-to-tor>`_ of getting a
:class:`~stem.control.Controller`, but the most flexible are
:func:`~stem.control.Controller.from_port` and
:func:`~stem.control.Controller.from_socket_file`. These static
:class:`~stem.control.Controller` methods give you an **unauthenticated**
Controller you can then authenticate yourself using its
:func:`~stem.control.Controller.authenticate` method. For example...
::
import getpass
import sys
import stem
import stem.connection
from stem.control import Controller
if __name__ == '__main__':
try:
controller = Controller.from_port()
except stem.SocketError as exc:
print("Unable to connect to tor on port 9051: %s" % exc)
sys.exit(1)
try:
controller.authenticate()
except stem.connection.MissingPassword:
pw = getpass.getpass("Controller password: ")
try:
controller.authenticate(password = pw)
except stem.connection.PasswordAuthFailed:
print("Unable to authenticate, password is incorrect")
sys.exit(1)
except stem.connection.AuthenticationFailure as exc:
print("Unable to authenticate: %s" % exc)
sys.exit(1)
print("Tor is running version %s" % controller.get_version())
controller.close()
If you're fine with allowing your script to raise exceptions then this can be more nicely done as...
::
from stem.control import Controller
if __name__ == '__main__':
with Controller.from_port() as controller:
controller.authenticate()
print("Tor is running version %s" % controller.get_version())
**Module Overview:**
::
event_description - brief description of a tor event type
Controller - General controller class intended for direct use
| |- from_port - Provides a Controller based on a port connection.
| +- from_socket_file - Provides a Controller based on a socket file connection.
|
|- authenticate - authenticates this controller with tor
|- reconnect - reconnects and authenticates to socket
|
|- get_info - issues a GETINFO query for a parameter
|- get_version - provides our tor version
|- get_exit_policy - provides our exit policy
|- get_ports - provides the local ports where tor is listening for connections
|- get_listeners - provides the addresses and ports where tor is listening for connections
|- get_accounting_stats - provides stats related to relaying limits
|- get_protocolinfo - information about the controller interface
|- get_user - provides the user tor is running as
|- get_pid - provides the pid of our tor process
|- get_start_time - timestamp when the tor process began
|- get_uptime - duration tor has been running
|- is_user_traffic_allowed - checks if we send or receive direct user traffic
|
|- get_microdescriptor - querying the microdescriptor for a relay
|- get_microdescriptors - provides all currently available microdescriptors
|- get_server_descriptor - querying the server descriptor for a relay
|- get_server_descriptors - provides all currently available server descriptors
|- get_network_status - querying the router status entry for a relay
|- get_network_statuses - provides all presently available router status entries
|- get_hidden_service_descriptor - queries the given hidden service descriptor
|
|- get_conf - gets the value of a configuration option
|- get_conf_map - gets the values of multiple configuration options
|- is_set - determines if an option differs from its default
|- set_conf - sets the value of a configuration option
|- reset_conf - reverts configuration options to their default values
|- set_options - sets or resets the values of multiple configuration options
|
|- get_hidden_service_conf - provides our hidden service configuration
|- set_hidden_service_conf - sets our hidden service configuration
|- create_hidden_service - creates a new hidden service or adds a new port
|- remove_hidden_service - removes a hidden service or drops a port
|
|- list_ephemeral_hidden_services - list ephemeral hidden serivces
|- create_ephemeral_hidden_service - create a new ephemeral hidden service
|- remove_ephemeral_hidden_service - removes an ephemeral hidden service
|
|- add_event_listener - attaches an event listener to be notified of tor events
|- remove_event_listener - removes a listener so it isn't notified of further events
|
|- is_caching_enabled - true if the controller has enabled caching
|- set_caching - enables or disables caching
|- clear_cache - clears any cached results
|
|- load_conf - loads configuration information as if it was in the torrc
|- save_conf - saves configuration information to the torrc
|
|- is_feature_enabled - checks if a given controller feature is enabled
|- enable_feature - enables a controller feature that has been disabled by default
|
|- get_circuit - provides an active circuit
|- get_circuits - provides a list of active circuits
|- new_circuit - create new circuits
|- extend_circuit - create new circuits and extend existing ones
|- repurpose_circuit - change a circuit's purpose
|- close_circuit - close a circuit
|
|- get_streams - provides a list of active streams
|- attach_stream - attach a stream to a circuit
|- close_stream - close a stream
|
|- signal - sends a signal to the tor client
|- is_newnym_available - true if tor would currently accept a NEWNYM signal
|- get_newnym_wait - seconds until tor would accept a NEWNYM signal
|- get_effective_rate - provides our effective relaying rate limit
|- is_geoip_unavailable - true if we've discovered our geoip db to be unavailable
|- map_address - maps one address to another such that connections to the original are replaced with the other
+- drop_guards - drops our set of guard relays and picks a new set
BaseController - Base controller class asynchronous message handling
|- msg - communicates with the tor process
|- is_alive - reports if our connection to tor is open or closed
|- is_localhost - returns if the connection is for the local system or not
|- connection_time - time when we last connected or disconnected
|- is_authenticated - checks if we're authenticated to tor
|- connect - connects or reconnects to tor
|- close - shuts down our connection to the tor process
|- get_socket - provides the socket used for control communication
|- get_latest_heartbeat - timestamp for when we last heard from tor
|- add_status_listener - notifies a callback of changes in our status
+- remove_status_listener - prevents further notification of status changes
.. data:: State (enum)
Enumeration for states that a controller can have.
========== ===========
State Description
========== ===========
**INIT** new control connection
**RESET** received a reset/sighup signal
**CLOSED** control connection closed
========== ===========
.. data:: EventType (enum)
Known types of events that the
:func:`~stem.control.Controller.add_event_listener` method of the
:class:`~stem.control.Controller` can listen for.
The most frequently listened for event types tend to be the logging events
(**DEBUG**, **INFO**, **NOTICE**, **WARN**, and **ERR**), bandwidth usage
(**BW**), and circuit or stream changes (**CIRC** and **STREAM**).
Enums are mapped to :class:`~stem.response.events.Event` subclasses as
follows...
.. deprecated:: 1.6.0
Tor dropped EventType.AUTHDIR_NEWDESCS as of version 0.3.2.1.
(:spec:`6e887ba`)
======================= ===========
EventType Event Class
======================= ===========
**ADDRMAP** :class:`stem.response.events.AddrMapEvent`
**AUTHDIR_NEWDESCS** :class:`stem.response.events.AuthDirNewDescEvent`
**BUILDTIMEOUT_SET** :class:`stem.response.events.BuildTimeoutSetEvent`
**BW** :class:`stem.response.events.BandwidthEvent`
**CELL_STATS** :class:`stem.response.events.CellStatsEvent`
**CIRC** :class:`stem.response.events.CircuitEvent`
**CIRC_BW** :class:`stem.response.events.CircuitBandwidthEvent`
**CIRC_MINOR** :class:`stem.response.events.CircMinorEvent`
**CLIENTS_SEEN** :class:`stem.response.events.ClientsSeenEvent`
**CONF_CHANGED** :class:`stem.response.events.ConfChangedEvent`
**CONN_BW** :class:`stem.response.events.ConnectionBandwidthEvent`
**DEBUG** :class:`stem.response.events.LogEvent`
**DESCCHANGED** :class:`stem.response.events.DescChangedEvent`
**ERR** :class:`stem.response.events.LogEvent`
**GUARD** :class:`stem.response.events.GuardEvent`
**HS_DESC** :class:`stem.response.events.HSDescEvent`
**HS_DESC_CONTENT** :class:`stem.response.events.HSDescContentEvent`
**INFO** :class:`stem.response.events.LogEvent`
**NETWORK_LIVENESS** :class:`stem.response.events.NetworkLivenessEvent`
**NEWCONSENSUS** :class:`stem.response.events.NewConsensusEvent`
**NEWDESC** :class:`stem.response.events.NewDescEvent`
**NOTICE** :class:`stem.response.events.LogEvent`
**NS** :class:`stem.response.events.NetworkStatusEvent`
**ORCONN** :class:`stem.response.events.ORConnEvent`
**SIGNAL** :class:`stem.response.events.SignalEvent`
**STATUS_CLIENT** :class:`stem.response.events.StatusEvent`
**STATUS_GENERAL** :class:`stem.response.events.StatusEvent`
**STATUS_SERVER** :class:`stem.response.events.StatusEvent`
**STREAM** :class:`stem.response.events.StreamEvent`
**STREAM_BW** :class:`stem.response.events.StreamBwEvent`
**TB_EMPTY** :class:`stem.response.events.TokenBucketEmptyEvent`
**TRANSPORT_LAUNCHED** :class:`stem.response.events.TransportLaunchedEvent`
**WARN** :class:`stem.response.events.LogEvent`
======================= ===========
.. data:: Listener (enum)
Purposes for inbound connections that Tor handles.
.. versionchanged:: 1.8.0
Added the EXTOR and HTTPTUNNEL listeners.
=============== ===========
Listener Description
=============== ===========
**OR** traffic we're relaying as a member of the network (torrc's **ORPort** and **ORListenAddress**)
**DIR** mirroring for tor descriptor content (torrc's **DirPort** and **DirListenAddress**)
**SOCKS** client traffic we're sending over Tor (torrc's **SocksPort** and **SocksListenAddress**)
**TRANS** transparent proxy handling (torrc's **TransPort** and **TransListenAddress**)
**NATD** forwarding for ipfw NATD connections (torrc's **NatdPort** and **NatdListenAddress**)
**DNS** DNS lookups for our traffic (torrc's **DNSPort** and **DNSListenAddress**)
**CONTROL** controller applications (torrc's **ControlPort** and **ControlListenAddress**)
**EXTOR** pluggable transport for Extended ORPorts (torrc's **ExtORPort**)
**HTTPTUNNEL** http tunneling proxy (torrc's **HTTPTunnelPort**)
=============== ===========
"""
import calendar
import collections
import functools
import inspect
import io
import os
import threading
import time
try:
# Added in 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
try:
# Added in 3.x
import queue
except ImportError:
import Queue as queue
import stem.descriptor.microdescriptor
import stem.descriptor.reader
import stem.descriptor.router_status_entry
import stem.descriptor.server_descriptor
import stem.exit_policy
import stem.response
import stem.response.events
import stem.socket
import stem.util
import stem.util.conf
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
import stem.util.system
import stem.util.tor_tools
import stem.version
from stem import UNDEFINED, CircStatus, Signal
from stem.util import log
# When closing the controller we attempt to finish processing enqueued events,
# but if it takes longer than this we terminate.
EVENTS_LISTENING_TIMEOUT = 0.1
MALFORMED_EVENTS = 'MALFORMED_EVENTS'
# state changes a control socket can have
State = stem.util.enum.Enum('INIT', 'RESET', 'CLOSED')
# TODO: consider merging this with stem.response.event in stem 2.x? (#32689)
EventType = stem.util.enum.UppercaseEnum(
'ADDRMAP',
'AUTHDIR_NEWDESCS',
'BUILDTIMEOUT_SET',
'BW',
'CELL_STATS',
'CIRC',
'CIRC_BW',
'CIRC_MINOR',
'CONF_CHANGED',
'CONN_BW',
'CLIENTS_SEEN',
'DEBUG',
'DESCCHANGED',
'ERR',
'GUARD',
'HS_DESC',
'HS_DESC_CONTENT',
'INFO',
'NETWORK_LIVENESS',
'NEWCONSENSUS',
'NEWDESC',
'NOTICE',
'NS',
'ORCONN',
'SIGNAL',
'STATUS_CLIENT',
'STATUS_GENERAL',
'STATUS_SERVER',
'STREAM',
'STREAM_BW',
'TB_EMPTY',
'TRANSPORT_LAUNCHED',
'WARN',
)
Listener = stem.util.enum.UppercaseEnum(
'OR',
'DIR',
'SOCKS',
'TRANS',
'NATD',
'DNS',
'CONTROL',
'EXTOR',
'HTTPTUNNEL',
)
# torrc options that cannot be changed once tor's running
IMMUTABLE_CONFIG_OPTIONS = set(map(stem.util.str_tools._to_unicode, map(str.lower, (
'AccelDir',
'AccelName',
'DataDirectory',
'DisableAllSwap',
'DisableDebuggerAttachment',
'HardwareAccel',
'HiddenServiceNonAnonymousMode',
'HiddenServiceSingleHopMode',
'KeepBindCapabilities',
'PidFile',
'RunAsDaemon',
'Sandbox',
'SyslogIdentityTag',
'TokenBucketRefillInterval',
'User',
))))
LOG_CACHE_FETCHES = True # provide trace level logging for cache hits
# Configuration options that are fetched by a special key. The keys are
# lowercase to make case insensitive lookups easier.
MAPPED_CONFIG_KEYS = {
'hiddenservicedir': 'HiddenServiceOptions',
'hiddenserviceport': 'HiddenServiceOptions',
'hiddenserviceversion': 'HiddenServiceOptions',
'hiddenserviceauthorizeclient': 'HiddenServiceOptions',
'hiddenserviceoptions': 'HiddenServiceOptions',
}
# unchangeable GETINFO parameters
CACHEABLE_GETINFO_PARAMS = (
'address',
'version',
'config-file',
'exit-policy/default',
'fingerprint',
'config/names',
'config/defaults',
'info/names',
'events/names',
'features/names',
'process/descriptor-limit',
'status/version/current',
)
CACHEABLE_GETINFO_PARAMS_UNTIL_SETCONF = (
'accounting/enabled',
)
# GETCONF parameters we shouldn't cache. This includes hidden service
# perameters due to the funky way they're set and retrieved (for instance,
# 'SETCONF HiddenServiceDir' effects 'GETCONF HiddenServiceOptions').
UNCACHEABLE_GETCONF_PARAMS = (
'hiddenserviceoptions',
'hiddenservicedir',
'hiddenserviceport',
'hiddenserviceversion',
'hiddenserviceauthorizeclient',
)
SERVER_DESCRIPTORS_UNSUPPORTED = "Tor is currently not configured to retrieve \
server descriptors. As of Tor version 0.2.3.25 it downloads microdescriptors \
instead unless you set 'UseMicrodescriptors 0' in your torrc."
EVENT_DESCRIPTIONS = None
class AccountingStats(collections.namedtuple('AccountingStats', ['retrieved', 'status', 'interval_end', 'time_until_reset', 'read_bytes', 'read_bytes_left', 'read_limit', 'written_bytes', 'write_bytes_left', 'write_limit'])):
"""
Accounting information, determining the limits where our relay suspends
itself.
:var float retrieved: unix timestamp for when this was fetched
:var str status: hibernation status of 'awake', 'soft', or 'hard'
:var datetime interval_end: time when our limits reset
:var int time_until_reset: seconds until our limits reset
:var int read_bytes: number of bytes we've read relaying
:var int read_bytes_left: number of bytes we can read until we suspend
:var int read_limit: reading threshold where we suspend
:var int written_bytes: number of bytes we've written relaying
:var int write_bytes_left: number of bytes we can write until we suspend
:var int write_limit: writing threshold where we suspend
"""
class UserTrafficAllowed(collections.namedtuple('UserTrafficAllowed', ['inbound', 'outbound'])):
"""
Indicates if we're likely to be servicing direct user traffic or not.
:var bool inbound: if **True** we're likely providing guard or bridge connnections
:var bool outbound: if **True** we're likely providng exit connections
"""
class CreateHiddenServiceOutput(collections.namedtuple('CreateHiddenServiceOutput', ['path', 'hostname', 'hostname_for_client', 'config'])):
"""
Attributes of a hidden service we've created.
Both the **hostnames** and **hostname_for_client** attributes can only be
provided if we're able to read the hidden service directory. If the method
was called with **client_names** then we may provide the
**hostname_for_client**, and otherwise can provide the **hostnames**.
:var str path: hidden service directory
:var str hostname: content of the hostname file if available
:var dict hostname_for_client: mapping of client names to their onion address
if available
:var dict config: tor's new hidden service configuration
"""
def with_default(yields = False):
"""
Provides a decorator to support having a default value. This should be
treated as private.
"""
def decorator(func):
def get_default(func, args, kwargs):
arg_names = inspect.getargspec(func).args[1:] # drop 'self'
default_position = arg_names.index('default') if 'default' in arg_names else None
if default_position is not None and default_position < len(args):
return args[default_position]
else:
return kwargs.get('default', UNDEFINED)
if not yields:
@functools.wraps(func)
def wrapped(self, *args, **kwargs):
try:
return func(self, *args, **kwargs)
except:
default = get_default(func, args, kwargs)
if default == UNDEFINED:
raise
else:
return default
else:
@functools.wraps(func)
def wrapped(self, *args, **kwargs):
try:
for val in func(self, *args, **kwargs):
yield val
except:
default = get_default(func, args, kwargs)
if default == UNDEFINED:
raise
else:
if default is not None:
for val in default:
yield val
return wrapped
return decorator
def event_description(event):
"""
Provides a description for Tor events.
:param str event: the event for which a description is needed
:returns: **str** The event description or **None** if this is an event name
we don't have a description for
"""
global EVENT_DESCRIPTIONS
if EVENT_DESCRIPTIONS is None:
config = stem.util.conf.Config()
config_path = os.path.join(os.path.dirname(__file__), 'settings.cfg')
try:
config.load(config_path)
EVENT_DESCRIPTIONS = dict([(key.lower()[18:], config.get_value(key)) for key in config.keys() if key.startswith('event.description.')])
except Exception as exc:
log.warn("BUG: stem failed to load its internal manual information from '%s': %s" % (config_path, exc))
return None
return EVENT_DESCRIPTIONS.get(event.lower())
class BaseController(object):
"""
Controller for the tor process. This is a minimal base class for other
controllers, providing basic process communication and event listing. Don't
use this directly - subclasses like the :class:`~stem.control.Controller`
provide higher level functionality.
It's highly suggested that you don't interact directly with the
:class:`~stem.socket.ControlSocket` that we're constructed from - use our
wrapper methods instead.
If the **control_socket** is already authenticated to Tor then the caller
should provide the **is_authenticated** flag. Otherwise, we will treat the
socket as though it hasn't yet been authenticated.
"""
def __init__(self, control_socket, is_authenticated = False):
self._socket = control_socket
self._msg_lock = threading.RLock()
self._status_listeners = [] # tuples of the form (callback, spawn_thread)
self._status_listeners_lock = threading.RLock()
# queues where incoming messages are directed
self._reply_queue = queue.Queue()
self._event_queue = queue.Queue()
# thread to continually pull from the control socket
self._reader_thread = None
# thread to pull from the _event_queue and call handle_event
self._event_notice = threading.Event()
self._event_thread = None
# saves our socket's prior _connect() and _close() methods so they can be
# called along with ours
self._socket_connect = self._socket._connect
self._socket_close = self._socket._close
self._socket._connect = self._connect
self._socket._close = self._close
self._last_heartbeat = 0.0 # timestamp for when we last heard from tor
self._is_authenticated = False
self._state_change_threads = [] # threads we've spawned to notify of state changes
if self._socket.is_alive():
self._launch_threads()
if is_authenticated:
self._post_authentication()
def msg(self, message):
"""
Sends a message to our control socket and provides back its reply.
:param str message: message to be formatted and sent to tor
:returns: :class:`~stem.response.ControlMessage` with the response
:raises:
* :class:`stem.ProtocolError` the content from the socket is
malformed
* :class:`stem.SocketError` if a problem arises in using the
socket
* :class:`stem.SocketClosed` if the socket is shut down
"""
with self._msg_lock:
# If our _reply_queue isn't empty then one of a few things happened...
#
# - Our connection was closed and probably re-restablished. This was
# in reply to pulling for an asynchronous event and getting this is
# expected - ignore it.
#
# - Pulling for asynchronous events produced an error. If this was a
# ProtocolError then it's a tor bug, and if a non-closure SocketError
# then it was probably a socket glitch. Deserves an INFO level log
# message.
#
# - This is a leftover response for a msg() call. We can't tell who an
# exception was earmarked for, so we only know that this was the case
# if it's a ControlMessage.
#
# This is the most concerning situation since it indicates that one of
# our callers didn't get their reply. However, this is still a
# perfectly viable use case. For instance...
#
# 1. We send a request.
# 2. The reader thread encounters an exception, for instance a socket
# error. We enqueue the exception.
# 3. The reader thread receives the reply.
# 4. We raise the socket error, and have an undelivered message.
#
# Thankfully this only seems to arise in edge cases around rapidly
# closing/reconnecting the socket.
while not self._reply_queue.empty():
try:
response = self._reply_queue.get_nowait()
if isinstance(response, stem.SocketClosed):
pass # this is fine
elif isinstance(response, stem.ProtocolError):
log.info('Tor provided a malformed message (%s)' % response)
elif isinstance(response, stem.ControllerError):
log.info('Socket experienced a problem (%s)' % response)
elif isinstance(response, stem.response.ControlMessage):
log.info('Failed to deliver a response: %s' % response)
except queue.Empty:
# the empty() method is documented to not be fully reliable so this
# isn't entirely surprising
break
try:
self._socket.send(message)
response = self._reply_queue.get()
# If the message we received back had an exception then re-raise it to the
# caller. Otherwise return the response.
if isinstance(response, stem.ControllerError):
raise response
else:
return response
except stem.SocketClosed:
# If the recv() thread caused the SocketClosed then we could still be
# in the process of closing. Calling close() here so that we can
# provide an assurance to the caller that when we raise a SocketClosed
# exception we are shut down afterward for realz.
self.close()
raise
def is_alive(self):
"""
Checks if our socket is currently connected. This is a pass-through for our
socket's :func:`~stem.socket.BaseSocket.is_alive` method.
:returns: **bool** that's **True** if our socket is connected and **False** otherwise
"""
return self._socket.is_alive()
def is_localhost(self):
"""
Returns if the connection is for the local system or not.
.. versionadded:: 1.3.0
:returns: **bool** that's **True** if the connection is for the local host and **False** otherwise
"""
return self._socket.is_localhost()
def connection_time(self):
"""
Provides the unix timestamp for when our socket was either connected or
disconnected. That is to say, the time we connected if we're currently
connected and the time we disconnected if we're not connected.
.. versionadded:: 1.3.0
:returns: **float** for when we last connected or disconnected, zero if
we've never connected
"""
return self._socket.connection_time()
def is_authenticated(self):
"""
Checks if our socket is both connected and authenticated.
:returns: **bool** that's **True** if our socket is authenticated to tor
and **False** otherwise
"""
return self._is_authenticated if self.is_alive() else False
def connect(self):
"""
Reconnects our control socket. This is a pass-through for our socket's
:func:`~stem.socket.ControlSocket.connect` method.
:raises: :class:`stem.SocketError` if unable to make a socket
"""
self._socket.connect()
def close(self):
"""
Closes our socket connection. This is a pass-through for our socket's
:func:`~stem.socket.BaseSocket.close` method.
"""
self._socket.close()
# Join on any outstanding state change listeners. Closing is a state change
# of its own, so if we have any listeners it's quite likely there's some
# work in progress.
#
# It's important that we do this outside of our locks so those daemons have
# access to us. This is why we're doing this here rather than _close().
for t in self._state_change_threads:
if t.is_alive() and threading.current_thread() != t:
t.join()
def get_socket(self):
"""
Provides the socket used to speak with the tor process. Communicating with
the socket directly isn't advised since it may confuse this controller.
:returns: :class:`~stem.socket.ControlSocket` we're communicating with
"""
return self._socket
def get_latest_heartbeat(self):
"""
Provides the unix timestamp for when we last heard from tor. This is zero
if we've never received a message.
:returns: float for the unix timestamp of when we last heard from tor
"""
return self._last_heartbeat
def add_status_listener(self, callback, spawn = True):
"""
Notifies a given function when the state of our socket changes. Functions
are expected to be of the form...
::
my_function(controller, state, timestamp)
The state is a value from the :data:`stem.control.State` enum. Functions
**must** allow for new values. The timestamp is a float for the unix time
when the change occurred.
This class only provides **State.INIT** and **State.CLOSED** notifications.
Subclasses may provide others.
If spawn is **True** then the callback is notified via a new daemon thread.
If **False** then the notice is under our locks, within the thread where
the change occurred. In general this isn't advised, especially if your
callback could block for a while. If still outstanding these threads are
joined on as part of closing this controller.
:param function callback: function to be notified when our state changes
:param bool spawn: calls function via a new thread if **True**, otherwise
it's part of the connect/close method call
"""
with self._status_listeners_lock:
self._status_listeners.append((callback, spawn))
def remove_status_listener(self, callback):
"""
Stops listener from being notified of further events.
:param function callback: function to be removed from our listeners
:returns: **bool** that's **True** if we removed one or more occurrences of
the callback, **False** otherwise
"""
with self._status_listeners_lock:
new_listeners, is_changed = [], False
for listener, spawn in self._status_listeners:
if listener != callback:
new_listeners.append((listener, spawn))
else:
is_changed = True
self._status_listeners = new_listeners
return is_changed
def __enter__(self):
return self
def __exit__(self, exit_type, value, traceback):
self.close()
def _handle_event(self, event_message):
"""
Callback to be overwritten by subclasses for event listening. This is
notified whenever we receive an event from the control socket.
:param stem.response.ControlMessage event_message: message received from
the control socket
"""
pass
def _connect(self):
self._launch_threads()
self._notify_status_listeners(State.INIT)
self._socket_connect()
self._is_authenticated = False
def _close(self):
# Our is_alive() state is now false. Our reader thread should already be
# awake from recv() raising a closure exception. Wake up the event thread
# too so it can end.
self._event_notice.set()
self._is_authenticated = False
# joins on our threads if it's safe to do so
for t in (self._reader_thread, self._event_thread):
if t and t.is_alive() and threading.current_thread() != t:
t.join()
self._notify_status_listeners(State.CLOSED)
self._socket_close()
def _post_authentication(self):
# actions to be taken after we have a newly authenticated connection
self._is_authenticated = True
def _notify_status_listeners(self, state):
"""
Informs our status listeners that a state change occurred.
:param stem.control.State state: state change that has occurred
"""
# Any changes to our is_alive() state happen under the send lock, so we
# need to have it to ensure it doesn't change beneath us.
with self._socket._get_send_lock():
with self._status_listeners_lock:
# States imply that our socket is either alive or not, which may not
# hold true when multiple events occur in quick succession. For
# instance, a sighup could cause two events (State.RESET for the sighup
# and State.CLOSE if it causes tor to crash). However, there's no
# guarantee of the order in which they occur, and it would be bad if
# listeners got the State.RESET last, implying that we were alive.
expect_alive = None
if state in (State.INIT, State.RESET):
expect_alive = True
elif state == State.CLOSED:
expect_alive = False
change_timestamp = time.time()
if expect_alive is not None and expect_alive != self.is_alive():
return
self._state_change_threads = list(filter(lambda t: t.is_alive(), self._state_change_threads))
for listener, spawn in self._status_listeners:
if spawn:
args = (self, state, change_timestamp)
notice_thread = threading.Thread(target = listener, args = args, name = '%s notification' % state)
notice_thread.setDaemon(True)
notice_thread.start()
self._state_change_threads.append(notice_thread)
else:
listener(self, state, change_timestamp)
def _launch_threads(self):
"""
Initializes daemon threads. Threads can't be reused so we need to recreate
them if we're restarted.
"""
# In theory concurrent calls could result in multiple start() calls on a
# single thread, which would cause an unexpected exception. Best be safe.
with self._socket._get_send_lock():
if not self._reader_thread or not self._reader_thread.is_alive():
self._reader_thread = threading.Thread(target = self._reader_loop, name = 'Tor listener')
self._reader_thread.setDaemon(True)
self._reader_thread.start()
if not self._event_thread or not self._event_thread.is_alive():
self._event_thread = threading.Thread(target = self._event_loop, name = 'Event notifier')
self._event_thread.setDaemon(True)
self._event_thread.start()
def _reader_loop(self):
"""
Continually pulls from the control socket, directing the messages into
queues based on their type. Controller messages come in two varieties...
* Responses to messages we've sent (GETINFO, SETCONF, etc).
* Asynchronous events, identified by a status code of 650.
"""
while self.is_alive():
try:
control_message = self._socket.recv()
self._last_heartbeat = time.time()
if control_message.content()[-1][0] == '650':
# asynchronous message, adds to the event queue and wakes up its handler
self._event_queue.put(control_message)
self._event_notice.set()
else:
# response to a msg() call
self._reply_queue.put(control_message)
except stem.ControllerError as exc:
# Assume that all exceptions belong to the reader. This isn't always
# true, but the msg() call can do a better job of sorting it out.
#
# Be aware that the msg() method relies on this to unblock callers.
self._reply_queue.put(exc)
def _event_loop(self):
"""
Continually pulls messages from the _event_queue and sends them to our
handle_event callback. This is done via its own thread so subclasses with a
lengthy handle_event implementation don't block further reading from the
socket.
"""
socket_closed_at = None
while True:
try:
event_message = self._event_queue.get_nowait()
self._handle_event(event_message)
self._event_queue.task_done()
# Attempt to finish processing enqueued events when our controller closes
if not self.is_alive():
if not socket_closed_at:
socket_closed_at = time.time()
elif time.time() - socket_closed_at > EVENTS_LISTENING_TIMEOUT:
break
except queue.Empty:
if not self.is_alive():
break
self._event_notice.wait(0.05)
self._event_notice.clear()
class Controller(BaseController):
"""
Connection with Tor's control socket. This is built on top of the
BaseController and provides a more user friendly API for library users.
"""
@staticmethod
def from_port(address = '127.0.0.1', port = 'default'):
"""
Constructs a :class:`~stem.socket.ControlPort` based Controller.
If the **port** is **'default'** then this checks on both 9051 (default
for relays) and 9151 (default for the Tor Browser). This default may change
in the future.
.. versionchanged:: 1.5.0
Use both port 9051 and 9151 by default.
:param str address: ip address of the controller
:param int port: port number of the controller
:returns: :class:`~stem.control.Controller` attached to the given port
:raises: :class:`stem.SocketError` if we're unable to establish a connection
"""
import stem.connection
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError('Invalid IP address: %s' % address)
elif port != 'default' and not stem.util.connection.is_valid_port(port):
raise ValueError('Invalid port: %s' % port)
if port == 'default':
control_port = stem.connection._connection_for_default_port(address)
else:
control_port = stem.socket.ControlPort(address, port)
return Controller(control_port)
@staticmethod
def from_socket_file(path = '/var/run/tor/control'):
"""
Constructs a :class:`~stem.socket.ControlSocketFile` based Controller.
:param str path: path where the control socket is located
:returns: :class:`~stem.control.Controller` attached to the given socket file
:raises: :class:`stem.SocketError` if we're unable to establish a connection
"""
control_socket = stem.socket.ControlSocketFile(path)
return Controller(control_socket)
def __init__(self, control_socket, is_authenticated = False):
self._is_caching_enabled = True
self._request_cache = {}
self._last_newnym = 0.0
self._cache_lock = threading.RLock()
# mapping of event types to their listeners
self._event_listeners = {}
self._event_listeners_lock = threading.RLock()
self._enabled_features = []
self._is_geoip_unavailable = None
self._last_address_exc = None
self._last_fingerprint_exc = None
super(Controller, self).__init__(control_socket, is_authenticated)
def _sighup_listener(event):
if event.signal == Signal.RELOAD:
self.clear_cache()
self._notify_status_listeners(State.RESET)
self.add_event_listener(_sighup_listener, EventType.SIGNAL)
def _confchanged_listener(event):
if self.is_caching_enabled():
to_cache_changed = dict((k.lower(), v) for k, v in event.changed.items())
to_cache_unset = dict((k.lower(), []) for k in event.unset) # [] represents None value in cache
to_cache = {}
to_cache.update(to_cache_changed)
to_cache.update(to_cache_unset)
self._set_cache(to_cache, 'getconf')
self._confchanged_cache_invalidation(to_cache)
self.add_event_listener(_confchanged_listener, EventType.CONF_CHANGED)
def _address_changed_listener(event):
if event.action in ('EXTERNAL_ADDRESS', 'DNS_USELESS'):
self._set_cache({'exit_policy': None})
self._set_cache({'address': None}, 'getinfo')
self._last_address_exc = None
self.add_event_listener(_address_changed_listener, EventType.STATUS_SERVER)
def close(self):
self.clear_cache()
super(Controller, self).close()
def authenticate(self, *args, **kwargs):
"""
A convenience method to authenticate the controller. This is just a
pass-through to :func:`stem.connection.authenticate`.
"""
import stem.connection
stem.connection.authenticate(self, *args, **kwargs)
def reconnect(self, *args, **kwargs):
"""
Reconnects and authenticates to our control socket.
.. versionadded:: 1.5.0
:raises:
* :class:`stem.SocketError` if unable to re-establish socket
* :class:`stem.connection.AuthenticationFailure` if unable to authenticate
"""
with self._msg_lock:
self.connect()
self.clear_cache()
self.authenticate(*args, **kwargs)
@with_default()
def get_info(self, params, default = UNDEFINED, get_bytes = False):
"""
get_info(params, default = UNDEFINED, get_bytes = False)
Queries the control socket for the given GETINFO option. If provided a
default then that's returned if the GETINFO option is undefined or the
call fails for any reason (error response, control port closed, initiated,
etc).
.. versionchanged:: 1.1.0
Added the get_bytes argument.
.. versionchanged:: 1.7.0
Errors commonly provided a :class:`stem.ProtocolError` when we should
raise a :class:`stem.OperationFailed`.
:param str,list params: GETINFO option or options to be queried
:param object default: response if the query fails
:param bool get_bytes: provides **bytes** values rather than a **str** under python 3.x
:returns:
Response depends upon how we were called as follows...
* **str** with the response if our param was a **str**
* **dict** with the 'param => response' mapping if our param was a **list**
* default if one was provided and our call failed
:raises:
* :class:`stem.ControllerError` if the call fails and we weren't
provided a default response
* :class:`stem.InvalidArguments` if the 'params' requested was
invalid
* :class:`stem.ProtocolError` if the geoip database is unavailable
"""
start_time = time.time()
reply = {}
if stem.util._is_str(params):
is_multiple = False
params = set([params])
else:
if not params:
return {}
is_multiple = True
params = set(params)
for param in params:
if param.startswith('ip-to-country/') and param != 'ip-to-country/0.0.0.0' and self.is_geoip_unavailable():
raise stem.ProtocolError('Tor geoip database is unavailable')
elif param == 'address' and self._last_address_exc:
raise self._last_address_exc # we already know we can't resolve an address
elif param == 'fingerprint' and self._last_fingerprint_exc and self.get_conf('ORPort', None) is None:
raise self._last_fingerprint_exc # we already know we're not a relay
# check for cached results
from_cache = [param.lower() for param in params]
cached_results = self._get_cache_map(from_cache, 'getinfo')
for key in cached_results:
user_expected_key = _case_insensitive_lookup(params, key)
reply[user_expected_key] = cached_results[key]
params.remove(user_expected_key)
# if everything was cached then short circuit making the query
if not params:
if LOG_CACHE_FETCHES:
log.trace('GETINFO %s (cache fetch)' % ' '.join(reply.keys()))
if is_multiple:
return reply
else:
return list(reply.values())[0]
try:
response = self.msg('GETINFO %s' % ' '.join(params))
stem.response.convert('GETINFO', response)
response._assert_matches(params)
# usually we want unicode values under python 3.x
if stem.prereq.is_python_3() and not get_bytes:
response.entries = dict((k, stem.util.str_tools._to_unicode(v)) for (k, v) in response.entries.items())
reply.update(response.entries)
if self.is_caching_enabled():
to_cache = {}
for key, value in response.entries.items():
key = key.lower() # make case insensitive
if key in CACHEABLE_GETINFO_PARAMS or key in CACHEABLE_GETINFO_PARAMS_UNTIL_SETCONF:
to_cache[key] = value
elif key.startswith('ip-to-country/'):
to_cache[key] = value
self._set_cache(to_cache, 'getinfo')
if 'address' in params:
self._last_address_exc = None
if 'fingerprint' in params:
self._last_fingerprint_exc = None
log.debug('GETINFO %s (runtime: %0.4f)' % (' '.join(params), time.time() - start_time))
if is_multiple:
return reply
else:
return list(reply.values())[0]
except stem.ControllerError as exc:
if 'address' in params:
self._last_address_exc = exc
if 'fingerprint' in params:
self._last_fingerprint_exc = exc
log.debug('GETINFO %s (failed: %s)' % (' '.join(params), exc))
raise
@with_default()
def get_version(self, default = UNDEFINED):
"""
get_version(default = UNDEFINED)
A convenience method to get tor version that current controller is
connected to.
:param object default: response if the query fails
:returns: :class:`~stem.version.Version` of the tor instance that we're
connected to
:raises:
* :class:`stem.ControllerError` if unable to query the version
* **ValueError** if unable to parse the version
An exception is only raised if we weren't provided a default response.
"""
version = self._get_cache('version')
if not version:
version_str = self.get_info('version')
version = stem.version.Version(version_str[4:] if version_str.startswith('Tor ') else version_str)
self._set_cache({'version': version})
return version
@with_default()
def get_exit_policy(self, default = UNDEFINED):
"""
get_exit_policy(default = UNDEFINED)
Effective ExitPolicy for our relay.
.. versionchanged:: 1.7.0
Policies retrieved through 'GETINFO exit-policy/full' rather than
parsing the user's torrc entries. This should be more reliable for
some edge cases. (:trac:`25739`)
:param object default: response if the query fails
:returns: :class:`~stem.exit_policy.ExitPolicy` of the tor instance that
we're connected to
:raises:
* :class:`stem.ControllerError` if unable to query the policy
* **ValueError** if unable to parse the policy
An exception is only raised if we weren't provided a default response.
"""
policy = self._get_cache('exit_policy')
if not policy:
try:
policy = stem.exit_policy.ExitPolicy(*self.get_info('exit-policy/full').splitlines())
self._set_cache({'exit_policy': policy})
except stem.OperationFailed:
# There's a few situations where 'GETINFO exit-policy/full' will fail,
# most commonly...
#
# * Error 551: Descriptor still rebuilding - not ready yet
#
# Tor hasn't yet finished making our server descriptor. This often
# arises when tor has first started.
#
# * Error 552: Not running in server mode
#
# We're not configured to be a relay (no ORPort), or haven't yet
# been able to determine our externally facing IP address.
#
# When these arise best we can do is infer our policy from the torrc.
# Skipping caching so we'll retry GETINFO policy resolution next time
# we're called.
rules = []
if self.get_conf('ExitRelay') == '0':
rules.append('reject *:*')
if self.get_conf('ExitPolicyRejectPrivate') == '1':
rules.append('reject private:*')
for policy_line in self.get_conf('ExitPolicy', multiple = True):
rules += policy_line.split(',')
rules += self.get_info('exit-policy/default').split(',')
policy = stem.exit_policy.get_config_policy(rules, self.get_info('address', None))
return policy
@with_default()
def get_ports(self, listener_type, default = UNDEFINED):
"""
get_ports(listener_type, default = UNDEFINED)
Provides the local ports where tor is listening for the given type of
connections. This is similar to
:func:`~stem.control.Controller.get_listeners`, but doesn't provide
addresses nor include non-local endpoints.
.. versionadded:: 1.2.0
:param stem.control.Listener listener_type: connection type being handled
by the ports we return
:param object default: response if the query fails
:returns: **list** of **ints** for the local ports where tor handles
connections of the given type
:raises: :class:`stem.ControllerError` if unable to determine the ports
and no default was provided
"""
def is_localhost(address):
if stem.util.connection.is_valid_ipv4_address(address):
return address == '0.0.0.0' or address.startswith('127.')
elif stem.util.connection.is_valid_ipv6_address(address):
return stem.util.connection.expand_ipv6_address(address) in (
'0000:0000:0000:0000:0000:0000:0000:0000',
'0000:0000:0000:0000:0000:0000:0000:0001',
)
else:
log.info("Request for %s ports got an address that's neither IPv4 or IPv6: %s" % (listener_type, address))
return False
return [port for (addr, port) in self.get_listeners(listener_type) if is_localhost(addr)]
@with_default()
def get_listeners(self, listener_type, default = UNDEFINED):
"""
get_listeners(listener_type, default = UNDEFINED)
Provides the addresses and ports where tor is listening for connections of
the given type. This is similar to
:func:`~stem.control.Controller.get_ports` but includes listener addresses
and non-local endpoints.
.. versionadded:: 1.2.0
.. versionchanged:: 1.5.0
Recognize listeners with IPv6 addresses.
:param stem.control.Listener listener_type: connection type being handled
by the listeners we return
:param object default: response if the query fails
:returns: **list** of **(address, port)** tuples for the available
listeners
:raises: :class:`stem.ControllerError` if unable to determine the listeners
and no default was provided
"""
listeners = self._get_cache(listener_type, 'listeners')
if listeners is None:
proxy_addrs = []
query = 'net/listeners/%s' % listener_type.lower()
try:
for listener in self.get_info(query).split():
if not (listener.startswith('"') and listener.endswith('"')):
raise stem.ProtocolError("'GETINFO %s' responses are expected to be quoted: %s" % (query, listener))
elif ':' not in listener:
raise stem.ProtocolError("'GETINFO %s' had a listener without a colon: %s" % (query, listener))
listener = listener[1:-1] # strip quotes
addr, port = listener.rsplit(':', 1)
# Skip unix sockets, for instance...
#
# GETINFO net/listeners/control
# 250-net/listeners/control="unix:/tmp/tor/socket"
# 250 OK
if addr == 'unix':
continue
if addr.startswith('[') and addr.endswith(']'):
addr = addr[1:-1] # unbracket ipv6 address
proxy_addrs.append((addr, port))
except stem.InvalidArguments:
# Tor version is old (pre-tor-0.2.2.26-beta), use get_conf() instead.
# Some options (like the ORPort) can have optional attributes after the
# actual port number.
port_option = {
Listener.OR: 'ORPort',
Listener.DIR: 'DirPort',
Listener.SOCKS: 'SocksPort',
Listener.TRANS: 'TransPort',
Listener.NATD: 'NatdPort',
Listener.DNS: 'DNSPort',
Listener.CONTROL: 'ControlPort',
}[listener_type]
listener_option = {
Listener.OR: 'ORListenAddress',
Listener.DIR: 'DirListenAddress',
Listener.SOCKS: 'SocksListenAddress',
Listener.TRANS: 'TransListenAddress',
Listener.NATD: 'NatdListenAddress',
Listener.DNS: 'DNSListenAddress',
Listener.CONTROL: 'ControlListenAddress',
}[listener_type]
port_value = self.get_conf(port_option).split()[0]
for listener in self.get_conf(listener_option, multiple = True):
if ':' in listener:
addr, port = listener.rsplit(':', 1)
if addr.startswith('[') and addr.endswith(']'):
addr = addr[1:-1] # unbracket ipv6 address
proxy_addrs.append((addr, port))
else:
proxy_addrs.append((listener, port_value))
# validate that address/ports are valid, and convert ports to ints
for addr, port in proxy_addrs:
if not stem.util.connection.is_valid_ipv4_address(addr) and not stem.util.connection.is_valid_ipv6_address(addr):
raise stem.ProtocolError('Invalid address for a %s listener: %s' % (listener_type, addr))
elif not stem.util.connection.is_valid_port(port):
raise stem.ProtocolError('Invalid port for a %s listener: %s' % (listener_type, port))
listeners = [(addr, int(port)) for (addr, port) in proxy_addrs]
self._set_cache({listener_type: listeners}, 'listeners')
return listeners
@with_default()
def get_accounting_stats(self, default = UNDEFINED):
"""
get_accounting_stats(default = UNDEFINED)
Provides stats related to our relaying limitations if AccountingMax was set
in our torrc.
.. versionadded:: 1.3.0
:param object default: response if the query fails
:returns: :class:`~stem.control.AccountingStats` with our accounting stats
:raises: :class:`stem.ControllerError` if unable to determine the listeners
and no default was provided
"""
if self.get_info('accounting/enabled') != '1':
raise stem.ControllerError("Accounting isn't enabled")
retrieved = time.time()
status = self.get_info('accounting/hibernating')
interval_end = self.get_info('accounting/interval-end')
used = self.get_info('accounting/bytes')
left = self.get_info('accounting/bytes-left')
interval_end = stem.util.str_tools._parse_timestamp(interval_end)
used_read, used_written = [int(val) for val in used.split(' ', 1)]
left_read, left_written = [int(val) for val in left.split(' ', 1)]
return AccountingStats(
retrieved = retrieved,
status = status,
interval_end = interval_end,
time_until_reset = max(0, calendar.timegm(interval_end.timetuple()) - int(retrieved)),
read_bytes = used_read,
read_bytes_left = left_read,
read_limit = used_read + left_read,
written_bytes = used_written,
write_bytes_left = left_written,
write_limit = used_written + left_written,
)
def get_socks_listeners(self, default = UNDEFINED):
"""
Provides the SOCKS **(address, port)** tuples that tor has open.
.. deprecated:: 1.2.0
Use :func:`~stem.control.Controller.get_listeners` with
**Listener.SOCKS** instead.
:param object default: response if the query fails
:returns: list of **(address, port)** tuples for the available SOCKS
listeners
:raises: :class:`stem.ControllerError` if unable to determine the listeners
and no default was provided
"""
return self.get_listeners(Listener.SOCKS, default)
@with_default()
def get_protocolinfo(self, default = UNDEFINED):
"""
get_protocolinfo(default = UNDEFINED)
A convenience method to get the protocol info of the controller.
:param object default: response if the query fails
:returns: :class:`~stem.response.protocolinfo.ProtocolInfoResponse` provided by tor
:raises:
* :class:`stem.ProtocolError` if the PROTOCOLINFO response is
malformed
* :class:`stem.SocketError` if problems arise in establishing or
using the socket
An exception is only raised if we weren't provided a default response.
"""
import stem.connection
return stem.connection.get_protocolinfo(self)
@with_default()
def get_user(self, default = UNDEFINED):
"""
get_user(default = UNDEFINED)
Provides the user tor is running as. This often only works if tor is
running locally. Also, most of its checks are platform dependent, and hence
are not entirely reliable.
.. versionadded:: 1.1.0
:param object default: response if the query fails
:returns: str with the username tor is running as
"""
user = self._get_cache('user')
if user:
return user
user = self.get_info('process/user', None)
if not user and self.is_localhost():
pid = self.get_pid(None)
if pid:
user = stem.util.system.user(pid)
if user:
self._set_cache({'user': user})
return user
else:
raise ValueError("Unable to resolve tor's user" if self.is_localhost() else "Tor isn't running locally")
@with_default()
def get_pid(self, default = UNDEFINED):
"""
get_pid(default = UNDEFINED)
Provides the process id of tor. This often only works if tor is running
locally. Also, most of its checks are platform dependent, and hence are not
entirely reliable.
.. versionadded:: 1.1.0
:param object default: response if the query fails
:returns: **int** for tor's pid
:raises: **ValueError** if unable to determine the pid and no default was
provided
"""
pid = self._get_cache('pid')
if pid:
return pid
getinfo_pid = self.get_info('process/pid', None)
if getinfo_pid and getinfo_pid.isdigit():
pid = int(getinfo_pid)
if not pid and self.is_localhost():
pid_file_path = self.get_conf('PidFile', None)
if pid_file_path is not None:
with open(pid_file_path) as pid_file:
pid_file_contents = pid_file.read().strip()
if pid_file_contents.isdigit():
pid = int(pid_file_contents)
if not pid:
pid = stem.util.system.pid_by_name('tor')
if not pid:
control_socket = self.get_socket()
if isinstance(control_socket, stem.socket.ControlPort):
pid = stem.util.system.pid_by_port(control_socket.port)
elif isinstance(control_socket, stem.socket.ControlSocketFile):
pid = stem.util.system.pid_by_open_file(control_socket.path)
if pid:
self._set_cache({'pid': pid})
return pid
else:
raise ValueError("Unable to resolve tor's pid" if self.is_localhost() else "Tor isn't running locally")
@with_default()
def get_start_time(self, default = UNDEFINED):
"""
get_start_time(default = UNDEFINED)
Provides when the tor process began.
.. versionadded:: 1.8.0
:param object default: response if the query fails
:returns: **float** for the unix timestamp of when the tor process began
:raises: **ValueError** if unable to determine when the process began and
no default was provided
"""
start_time = self._get_cache('start_time')
if start_time:
return start_time
if self.get_version() >= stem.version.Requirement.GETINFO_UPTIME:
uptime = self.get_info('uptime', None)
if uptime:
if not uptime.isdigit():
raise ValueError("'GETINFO uptime' did not provide a valid numeric response: %s" % uptime)
start_time = time.time() - float(uptime)
if not start_time and self.is_localhost():
# Tor doesn't yet support this GETINFO option, attempt to determine the
# uptime of the process ourselves.
if not self.is_localhost():
raise ValueError('Unable to determine the uptime when tor is not running locally')
pid = self.get_pid(None)
if not pid:
raise ValueError('Unable to determine the pid of the tor process')
start_time = stem.util.system.start_time(pid)
if start_time:
self._set_cache({'start_time': start_time})
return start_time
else:
raise ValueError("Unable to resolve when tor began" if self.is_localhost() else "Tor isn't running locally")
@with_default()
def get_uptime(self, default = UNDEFINED):
"""
get_uptime(default = UNDEFINED)
Provides the duration in seconds that tor has been running.
.. versionadded:: 1.8.0
:param object default: response if the query fails
:returns: **float** for the number of seconds tor has been running
:raises: **ValueError** if unable to determine the uptime and no default
was provided
"""
return time.time() - self.get_start_time()
def is_user_traffic_allowed(self):
"""
Checks if we're likely to service direct user traffic. This essentially
boils down to...
* If we're a bridge or guard relay, inbound connections are possibly from
users.
* If our exit policy allows traffic then output connections are possibly
from users.
Note the word 'likely'. These is a decent guess in practice, but not always
correct. For instance, information about which flags we have are only
fetched periodically.
This method is intended to help you avoid eavesdropping on user traffic.
Monitoring user connections is not only unethical, but likely a violation
of wiretapping laws.
.. versionadded:: 1.5.0
:returns: :class:`~stem.cotroller.UserTrafficAllowed` with **inbound** and
**outbound** boolean attributes to indicate if we're likely servicing
direct user traffic
"""
inbound_allowed, outbound_allowed = False, False
if self.get_conf('BridgeRelay', None) == '1':
inbound_allowed = True
if self.get_conf('ORPort', None):
if not inbound_allowed:
consensus_entry = self.get_network_status(default = None)
inbound_allowed = consensus_entry and 'Guard' in consensus_entry.flags
exit_policy = self.get_exit_policy(None)
outbound_allowed = exit_policy and exit_policy.is_exiting_allowed()
return UserTrafficAllowed(inbound_allowed, outbound_allowed)
@with_default()
def get_microdescriptor(self, relay = None, default = UNDEFINED):
"""
get_microdescriptor(relay = None, default = UNDEFINED)
Provides the microdescriptor for the relay with the given fingerprint or
nickname. If the relay identifier could be either a fingerprint *or*
nickname then it's queried as a fingerprint.
If no **relay** is provided then this defaults to ourselves. Remember that
this requires that we've retrieved our own descriptor from remote
authorities so this both won't be available for newly started relays and
may be up to around an hour out of date.
.. versionchanged:: 1.3.0
Changed so we'd fetch our own descriptor if no 'relay' is provided.
:param str relay: fingerprint or nickname of the relay to be queried
:param object default: response if the query fails
:returns: :class:`~stem.descriptor.microdescriptor.Microdescriptor` for the given relay
:raises:
* :class:`stem.DescriptorUnavailable` if unable to provide a descriptor
for the given relay
* :class:`stem.ControllerError` if unable to query the descriptor
* **ValueError** if **relay** doesn't conform with the pattern for being
a fingerprint or nickname
An exception is only raised if we weren't provided a default response.
"""
if relay is None:
try:
relay = self.get_info('fingerprint')
except stem.ControllerError as exc:
raise stem.ControllerError('Unable to determine our own fingerprint: %s' % exc)
if stem.util.tor_tools.is_valid_fingerprint(relay):
query = 'md/id/%s' % relay
elif stem.util.tor_tools.is_valid_nickname(relay):
query = 'md/name/%s' % relay
else:
raise ValueError("'%s' isn't a valid fingerprint or nickname" % relay)
try:
desc_content = self.get_info(query, get_bytes = True)
except stem.InvalidArguments as exc:
if str(exc).startswith('GETINFO request contained unrecognized keywords:'):
raise stem.DescriptorUnavailable("Tor was unable to provide the descriptor for '%s'" % relay)
else:
raise
if not desc_content:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
return stem.descriptor.microdescriptor.Microdescriptor(desc_content)
@with_default(yields = True)
def get_microdescriptors(self, default = UNDEFINED):
"""
get_microdescriptors(default = UNDEFINED)
Provides an iterator for all of the microdescriptors that tor currently
knows about.
Prior to Tor 0.3.5.1 this information was not available via the control
protocol. When connected to prior versions we read the microdescriptors
directly from disk instead, which will not work remotely or if our process
lacks read permissions.
:param list default: items to provide if the query fails
:returns: iterates over
:class:`~stem.descriptor.microdescriptor.Microdescriptor` for relays in
the tor network
:raises: :class:`stem.ControllerError` if unable to query tor and no
default was provided
"""
if self.get_version() >= stem.version.Requirement.GETINFO_MICRODESCRIPTORS:
desc_content = self.get_info('md/all', get_bytes = True)
if not desc_content:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
for desc in stem.descriptor.microdescriptor._parse_file(io.BytesIO(desc_content)):
yield desc
else:
# TODO: remove when tor versions that require this are obsolete
data_directory = self.get_conf('DataDirectory', None)
if data_directory is None:
raise stem.OperationFailed(message = "Unable to determine tor's data directory")
if not os.path.exists(data_directory):
raise stem.OperationFailed(message = "Data directory reported by tor doesn't exist (%s)" % data_directory)
microdescriptor_file = None
for filename in ('cached-microdescs', 'cached-microdescs.new'):
cached_descriptors = os.path.join(data_directory, filename)
if os.path.exists(cached_descriptors):
microdescriptor_file = cached_descriptors
break
if microdescriptor_file is None:
raise stem.OperationFailed(message = "Data directory doesn't contain cached microdescriptors (%s)" % data_directory)
for desc in stem.descriptor.parse_file(microdescriptor_file):
# It shouldn't be possible for these to be something other than
# microdescriptors but as the saying goes: trust but verify.
if not isinstance(desc, stem.descriptor.microdescriptor.Microdescriptor):
raise stem.OperationFailed(message = 'BUG: Descriptor reader provided non-microdescriptor content (%s)' % type(desc))
yield desc
@with_default()
def get_server_descriptor(self, relay = None, default = UNDEFINED):
"""
get_server_descriptor(relay = None, default = UNDEFINED)
Provides the server descriptor for the relay with the given fingerprint or
nickname. If the relay identifier could be either a fingerprint *or*
nickname then it's queried as a fingerprint.
If no **relay** is provided then this defaults to ourselves. Remember that
this requires that we've retrieved our own descriptor from remote
authorities so this both won't be available for newly started relays and
may be up to around an hour out of date.
**As of Tor version 0.2.3.25 relays no longer get server descriptors by
default.** It's advised that you use microdescriptors instead, but if you
really need server descriptors then you can get them by setting
'UseMicrodescriptors 0'.
.. versionchanged:: 1.3.0
Changed so we'd fetch our own descriptor if no 'relay' is provided.
:param str relay: fingerprint or nickname of the relay to be queried
:param object default: response if the query fails
:returns: :class:`~stem.descriptor.server_descriptor.RelayDescriptor` for the given relay
:raises:
* :class:`stem.DescriptorUnavailable` if unable to provide a descriptor
for the given relay
* :class:`stem.ControllerError` if unable to query the descriptor
* **ValueError** if **relay** doesn't conform with the pattern for being
a fingerprint or nickname
An exception is only raised if we weren't provided a default response.
"""
try:
if relay is None:
try:
relay = self.get_info('fingerprint')
except stem.ControllerError as exc:
raise stem.ControllerError('Unable to determine our own fingerprint: %s' % exc)
if stem.util.tor_tools.is_valid_fingerprint(relay):
query = 'desc/id/%s' % relay
elif stem.util.tor_tools.is_valid_nickname(relay):
query = 'desc/name/%s' % relay
else:
raise ValueError("'%s' isn't a valid fingerprint or nickname" % relay)
try:
desc_content = self.get_info(query, get_bytes = True)
except stem.InvalidArguments as exc:
if str(exc).startswith('GETINFO request contained unrecognized keywords:'):
raise stem.DescriptorUnavailable("Tor was unable to provide the descriptor for '%s'" % relay)
else:
raise
if not desc_content:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
return stem.descriptor.server_descriptor.RelayDescriptor(desc_content)
except:
if not self._is_server_descriptors_available():
raise ValueError(SERVER_DESCRIPTORS_UNSUPPORTED)
raise
@with_default(yields = True)
def get_server_descriptors(self, default = UNDEFINED):
"""
get_server_descriptors(default = UNDEFINED)
Provides an iterator for all of the server descriptors that tor currently
knows about.
**As of Tor version 0.2.3.25 relays no longer get server descriptors by
default.** It's advised that you use microdescriptors instead, but if you
really need server descriptors then you can get them by setting
'UseMicrodescriptors 0'.
:param list default: items to provide if the query fails
:returns: iterates over
:class:`~stem.descriptor.server_descriptor.RelayDescriptor` for relays in
the tor network
:raises: :class:`stem.ControllerError` if unable to query tor and no
default was provided
"""
# TODO: We should iterate over the descriptors as they're read from the
# socket rather than reading the whole thing into memory.
#
# https://trac.torproject.org/8248
desc_content = self.get_info('desc/all-recent', get_bytes = True)
if not desc_content:
if not self._is_server_descriptors_available():
raise stem.ControllerError(SERVER_DESCRIPTORS_UNSUPPORTED)
else:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
for desc in stem.descriptor.server_descriptor._parse_file(io.BytesIO(desc_content)):
yield desc
def _is_server_descriptors_available(self):
"""
Checks to see if tor server descriptors should be available or not.
"""
# TODO: Replace with a 'GETINFO desc/download-enabled' request when they're
# widely available...
#
# https://gitweb.torproject.org/torspec.git/commit/?id=378699c
return self.get_version() < stem.version.Requirement.MICRODESCRIPTOR_IS_DEFAULT or \
self.get_conf('UseMicrodescriptors', None) == '0'
@with_default()
def get_network_status(self, relay = None, default = UNDEFINED):
"""
get_network_status(relay = None, default = UNDEFINED)
Provides the router status entry for the relay with the given fingerprint
or nickname. If the relay identifier could be either a fingerprint *or*
nickname then it's queried as a fingerprint.
If no **relay** is provided then this defaults to ourselves. Remember that
this requires that we've retrieved our own descriptor from remote
authorities so this both won't be available for newly started relays and
may be up to around an hour out of date.
.. versionchanged:: 1.3.0
Changed so we'd fetch our own descriptor if no 'relay' is provided.
:param str relay: fingerprint or nickname of the relay to be queried
:param object default: response if the query fails
:returns: :class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3`
for the given relay
:raises:
* :class:`stem.DescriptorUnavailable` if unable to provide a descriptor
for the given relay
* :class:`stem.ControllerError` if unable to query the descriptor
* **ValueError** if **relay** doesn't conform with the pattern for being
a fingerprint or nickname
An exception is only raised if we weren't provided a default response.
"""
if relay is None:
try:
relay = self.get_info('fingerprint')
except stem.ControllerError as exc:
raise stem.ControllerError('Unable to determine our own fingerprint: %s' % exc)
if stem.util.tor_tools.is_valid_fingerprint(relay):
query = 'ns/id/%s' % relay
elif stem.util.tor_tools.is_valid_nickname(relay):
query = 'ns/name/%s' % relay
else:
raise ValueError("'%s' isn't a valid fingerprint or nickname" % relay)
try:
desc_content = self.get_info(query, get_bytes = True)
except stem.InvalidArguments as exc:
if str(exc).startswith('GETINFO request contained unrecognized keywords:'):
raise stem.DescriptorUnavailable("Tor was unable to provide the descriptor for '%s'" % relay)
else:
raise
if not desc_content:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
return stem.descriptor.router_status_entry.RouterStatusEntryV3(desc_content)
@with_default(yields = True)
def get_network_statuses(self, default = UNDEFINED):
"""
get_network_statuses(default = UNDEFINED)
Provides an iterator for all of the router status entries that tor
currently knows about.
:param list default: items to provide if the query fails
:returns: iterates over
:class:`~stem.descriptor.router_status_entry.RouterStatusEntryV3` for
relays in the tor network
:raises: :class:`stem.ControllerError` if unable to query tor and no
default was provided
"""
# TODO: We should iterate over the descriptors as they're read from the
# socket rather than reading the whole thing into memory.
#
# https://trac.torproject.org/8248
desc_content = self.get_info('ns/all', get_bytes = True)
if not desc_content:
raise stem.DescriptorUnavailable('Descriptor information is unavailable, tor might still be downloading it')
desc_iterator = stem.descriptor.router_status_entry._parse_file(
io.BytesIO(desc_content),
False,
entry_class = stem.descriptor.router_status_entry.RouterStatusEntryV3,
)
for desc in desc_iterator:
yield desc
@with_default()
def get_hidden_service_descriptor(self, address, default = UNDEFINED, servers = None, await_result = True, timeout = None):
"""
get_hidden_service_descriptor(address, default = UNDEFINED, servers = None, await_result = True)
Provides the descriptor for a hidden service. The **address** is the
'.onion' address of the hidden service (for instance 3g2upl4pq6kufc4m.onion
for DuckDuckGo).
If **await_result** is **True** then this blocks until we either receive
the descriptor or the request fails. If **False** this returns right away.
**This method only supports v2 hidden services, not v3.** (:trac:`25417`)
.. versionadded:: 1.4.0
.. versionchanged:: 1.7.0
Added the timeout argument.
:param str address: address of the hidden service descriptor, the '.onion' suffix is optional
:param object default: response if the query fails
:param list servers: requrest the descriptor from these specific servers
:param float timeout: seconds to wait when **await_result** is **True**
:returns: :class:`~stem.descriptor.hidden_service.HiddenServiceDescriptorV2`
for the given service if **await_result** is **True**, or **None** otherwise
:raises:
* :class:`stem.DescriptorUnavailable` if **await_result** is **True** and
unable to provide a descriptor for the given service
* :class:`stem.Timeout` if **timeout** was reached
* :class:`stem.ControllerError` if unable to query the descriptor
* **ValueError** if **address** doesn't conform with the pattern of a
hidden service address
An exception is only raised if we weren't provided a default response.
"""
if address.endswith('.onion'):
address = address[:-6]
if not stem.util.tor_tools.is_valid_hidden_service_address(address):
raise ValueError("'%s.onion' isn't a valid hidden service address" % address)
if self.get_version() < stem.version.Requirement.HSFETCH:
raise stem.UnsatisfiableRequest(message = 'HSFETCH was added in tor version %s' % stem.version.Requirement.HSFETCH)
hs_desc_queue, hs_desc_listener = queue.Queue(), None
hs_desc_content_queue, hs_desc_content_listener = queue.Queue(), None
start_time = time.time()
if await_result:
def hs_desc_listener(event):
hs_desc_queue.put(event)
def hs_desc_content_listener(event):
hs_desc_content_queue.put(event)
self.add_event_listener(hs_desc_listener, EventType.HS_DESC)
self.add_event_listener(hs_desc_content_listener, EventType.HS_DESC_CONTENT)
try:
request = 'HSFETCH %s' % address
if servers:
request += ' ' + ' '.join(['SERVER=%s' % s for s in servers])
response = self.msg(request)
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
raise stem.ProtocolError('HSFETCH returned unexpected response code: %s' % response.code)
if not await_result:
return None # not waiting, so nothing to provide back
else:
while True:
event = _get_with_timeout(hs_desc_content_queue, timeout, start_time)
if event.address == address:
if event.descriptor:
return event.descriptor
else:
# no descriptor, looking through HS_DESC to figure out why
while True:
event = _get_with_timeout(hs_desc_queue, timeout, start_time)
if event.address == address and event.action == stem.HSDescAction.FAILED:
if event.reason == stem.HSDescReason.NOT_FOUND:
raise stem.DescriptorUnavailable('No running hidden service at %s.onion' % address)
else:
raise stem.DescriptorUnavailable('Unable to retrieve the descriptor for %s.onion (retrieved from %s): %s' % (address, event.directory_fingerprint, event.reason))
finally:
if hs_desc_listener:
self.remove_event_listener(hs_desc_listener)
if hs_desc_content_listener:
self.remove_event_listener(hs_desc_content_listener)
def get_conf(self, param, default = UNDEFINED, multiple = False):
"""
get_conf(param, default = UNDEFINED, multiple = False)
Queries the current value for a configuration option. Some configuration
options (like the ExitPolicy) can have multiple values. This provides a
**list** with all of the values if **multiple** is **True**. Otherwise this
will be a **str** with the first value.
If provided with a **default** then that is provided if the configuration
option was unset or the query fails (invalid configuration option, error
response, control port closed, initiated, etc).
If the configuration value is unset and no **default** was given then this
provides **None** if **multiple** was **False** and an empty list if it was
**True**.
:param str param: configuration option to be queried
:param object default: response if the option is unset or the query fails
:param bool multiple: if **True** then provides a list with all of the
present values (this is an empty list if the config option is unset)
:returns:
Response depends upon how we were called as follows...
* **str** with the configuration value if **multiple** was **False**,
**None** if it was unset
* **list** with the response strings if multiple was **True**
* default if one was provided and the configuration option was either
unset or our call failed
:raises:
* :class:`stem.ControllerError` if the call fails and we weren't
provided a default response
* :class:`stem.InvalidArguments` if the configuration option
requested was invalid
"""
# Config options are case insensitive and don't contain whitespace. Using
# strip so the following check will catch whitespace-only params.
param = param.lower().strip()
if not param:
return default if default != UNDEFINED else None
entries = self.get_conf_map(param, default, multiple)
return _case_insensitive_lookup(entries, param, default)
def get_conf_map(self, params, default = UNDEFINED, multiple = True):
"""
get_conf_map(params, default = UNDEFINED, multiple = True)
Similar to :func:`~stem.control.Controller.get_conf` but queries multiple
configuration options, providing back a mapping of those options to their
values.
There are three use cases for GETCONF:
1. a single value is provided (e.g. **ControlPort**)
2. multiple values are provided for the option (e.g. **ExitPolicy**)
3. a set of options that weren't necessarily requested are returned (for
instance querying **HiddenServiceOptions** gives **HiddenServiceDir**,
**HiddenServicePort**, etc)
The vast majority of the options fall into the first two categories, in
which case calling :func:`~stem.control.Controller.get_conf` is sufficient.
However, for batch queries or the special options that give a set of values
this provides back the full response. As of tor version 0.2.1.25
**HiddenServiceOptions** was the only option that falls into the third
category.
**Note:** HiddenServiceOptions are best retrieved via the
:func:`~stem.control.Controller.get_hidden_service_conf` method instead.
:param str,list params: configuration option(s) to be queried
:param object default: value for the mappings if the configuration option
is either undefined or the query fails
:param bool multiple: if **True** then the values provided are lists with
all of the present values
:returns:
**dict** of the 'config key => value' mappings. The value is a...
* **str** if **multiple** is **False**, **None** if the configuration
option is unset
* **list** if **multiple** is **True**
* the **default** if it was set and the value was either undefined or our
lookup failed
:raises:
* :class:`stem.ControllerError` if the call fails and we weren't provided
a default response
* :class:`stem.InvalidArguments` if the configuration option requested
was invalid
"""
start_time = time.time()
reply = {}
if stem.util._is_str(params):
params = [params]
# remove strings which contain only whitespace
params = [entry for entry in params if entry.strip()]
if params == []:
return {}
# translate context sensitive options
lookup_params = set([MAPPED_CONFIG_KEYS.get(entry, entry) for entry in params])
# check for cached results
from_cache = [param.lower() for param in lookup_params]
cached_results = self._get_cache_map(from_cache, 'getconf')
for key in cached_results:
user_expected_key = _case_insensitive_lookup(lookup_params, key)
reply[user_expected_key] = cached_results[key]
lookup_params.remove(user_expected_key)
# if everything was cached then short circuit making the query
if not lookup_params:
if LOG_CACHE_FETCHES:
log.trace('GETCONF %s (cache fetch)' % ' '.join(reply.keys()))
return self._get_conf_dict_to_response(reply, default, multiple)
try:
response = self.msg('GETCONF %s' % ' '.join(lookup_params))
stem.response.convert('GETCONF', response)
reply.update(response.entries)
if self.is_caching_enabled():
to_cache = dict((k.lower(), v) for k, v in response.entries.items())
self._set_cache(to_cache, 'getconf')
# Maps the entries back to the parameters that the user requested so the
# capitalization matches (ie, if they request "exitpolicy" then that
# should be the key rather than "ExitPolicy"). When the same
# configuration key is provided multiple times this determines the case
# based on the first and ignores the rest.
#
# This retains the tor provided camel casing of MAPPED_CONFIG_KEYS
# entries since the user didn't request those by their key, so we can't
# be sure what they wanted.
for key in list(reply):
if not key.lower() in MAPPED_CONFIG_KEYS.values():
user_expected_key = _case_insensitive_lookup(params, key, key)
if key != user_expected_key:
reply[user_expected_key] = reply[key]
del reply[key]
log.debug('GETCONF %s (runtime: %0.4f)' % (' '.join(lookup_params), time.time() - start_time))
return self._get_conf_dict_to_response(reply, default, multiple)
except stem.ControllerError as exc:
log.debug('GETCONF %s (failed: %s)' % (' '.join(lookup_params), exc))
if default != UNDEFINED:
return dict((param, default) for param in params)
else:
raise
def _get_conf_dict_to_response(self, config_dict, default, multiple):
"""
Translates a dictionary of 'config key => [value1, value2...]' into the
return value of :func:`~stem.control.Controller.get_conf_map`, taking into
account what the caller requested.
"""
return_dict = {}
for key, values in list(config_dict.items()):
if values == []:
# config option was unset
if default != UNDEFINED:
return_dict[key] = default
else:
return_dict[key] = [] if multiple else None
else:
return_dict[key] = values if multiple else values[0]
return return_dict
@with_default()
def is_set(self, param, default = UNDEFINED):
"""
is_set(param, default = UNDEFINED)
Checks if a configuration option differs from its default or not.
.. versionadded:: 1.5.0
:param str param: configuration option to check
:param object default: response if the query fails
:returns: **True** if option differs from its default and **False**
otherwise
:raises: :class:`stem.ControllerError` if the call fails and we weren't
provided a default response
"""
return param in self._get_custom_options()
def _get_custom_options(self):
result = self._get_cache('get_custom_options')
if not result:
config_lines = self.get_info('config-text').splitlines()
# Tor provides some config options even if they haven't been set...
#
# https://trac.torproject.org/projects/tor/ticket/2362
# https://trac.torproject.org/projects/tor/ticket/17909
default_lines = (
'Log notice stdout',
'Log notice file /var/log/tor/log',
'DataDirectory /home/%s/.tor' % self.get_user('undefined'),
'HiddenServiceStatistics 0',
)
for line in default_lines:
if line in config_lines:
config_lines.remove(line)
result = dict([line.split(' ', 1) for line in config_lines])
self._set_cache({'get_custom_options': result})
return result
def set_conf(self, param, value):
"""
Changes the value of a tor configuration option. Our value can be any of
the following...
* a string to set a single value
* a list of strings to set a series of values (for instance the ExitPolicy)
* None to either set the value to 0/NULL
:param str param: configuration option to be set
:param str,list value: value to set the parameter to
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.InvalidArguments` if configuration options
requested was invalid
* :class:`stem.InvalidRequest` if the configuration setting is
impossible or if there's a syntax error in the configuration values
"""
self.set_options({param: value}, False)
def reset_conf(self, *params):
"""
Reverts one or more parameters to their default values.
:param str params: configuration option to be reset
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.InvalidArguments` if configuration options requested was invalid
* :class:`stem.InvalidRequest` if the configuration setting is
impossible or if there's a syntax error in the configuration values
"""
self.set_options(dict([(entry, None) for entry in params]), True)
def set_options(self, params, reset = False):
"""
Changes multiple tor configuration options via either a SETCONF or
RESETCONF query. Both behave identically unless our value is None, in which
case SETCONF sets the value to 0 or NULL, and RESETCONF returns it to its
default value. This accepts str, list, or None values in a similar fashion
to :func:`~stem.control.Controller.set_conf`. For example...
::
my_controller.set_options({
'Nickname': 'caerSidi',
'ExitPolicy': ['accept *:80', 'accept *:443', 'reject *:*'],
'ContactInfo': 'caerSidi-exit@someplace.com',
'Log': None,
})
The params can optionally be a list of key/value tuples, though the only
reason this type of argument would be useful is for hidden service
configuration (those options are order dependent).
:param dict,list params: mapping of configuration options to the values
we're setting it to
:param bool reset: issues a RESETCONF, returning **None** values to their
defaults if **True**
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.InvalidArguments` if configuration options
requested was invalid
* :class:`stem.InvalidRequest` if the configuration setting is
impossible or if there's a syntax error in the configuration values
"""
start_time = time.time()
# constructs the SETCONF or RESETCONF query
query_comp = ['RESETCONF' if reset else 'SETCONF']
if isinstance(params, dict):
params = list(params.items())
for param, value in params:
if isinstance(value, str):
query_comp.append('%s="%s"' % (param, value.strip()))
elif isinstance(value, collections.Iterable):
query_comp.extend(['%s="%s"' % (param, val.strip()) for val in value])
elif not value:
query_comp.append(param)
else:
raise ValueError('Cannot set %s to %s since the value was a %s but we only accept strings' % (param, value, type(value).__name__))
query = ' '.join(query_comp)
response = self.msg(query)
stem.response.convert('SINGLELINE', response)
if response.is_ok():
log.debug('%s (runtime: %0.4f)' % (query, time.time() - start_time))
if self.is_caching_enabled():
# clear cache for params; the CONF_CHANGED event will set cache for changes
to_cache = dict((k.lower(), None) for k, v in params)
self._set_cache(to_cache, 'getconf')
self._confchanged_cache_invalidation(dict(params))
else:
log.debug('%s (failed, code: %s, message: %s)' % (query, response.code, response.message))
immutable_params = [k for k, v in params if stem.util.str_tools._to_unicode(k).lower() in IMMUTABLE_CONFIG_OPTIONS]
if immutable_params:
raise stem.InvalidArguments(message = "%s cannot be changed while tor's running" % ', '.join(sorted(immutable_params)), arguments = immutable_params)
if response.code == '552':
if response.message.startswith("Unrecognized option: Unknown option '"):
key = response.message[37:response.message.find("'", 37)]
raise stem.InvalidArguments(response.code, response.message, [key])
raise stem.InvalidRequest(response.code, response.message)
elif response.code in ('513', '553'):
raise stem.InvalidRequest(response.code, response.message)
else:
raise stem.ProtocolError('Returned unexpected status code: %s' % response.code)
@with_default()
def get_hidden_service_conf(self, default = UNDEFINED):
"""
get_hidden_service_conf(default = UNDEFINED)
This provides a mapping of hidden service directories to their
attribute's key/value pairs. All hidden services are assured to have a
'HiddenServicePort', but other entries may or may not exist.
::
{
"/var/lib/tor/hidden_service_empty/": {
"HiddenServicePort": [
]
},
"/var/lib/tor/hidden_service_with_two_ports/": {
"HiddenServiceAuthorizeClient": "stealth a, b",
"HiddenServicePort": [
(8020, "127.0.0.1", 8020), # the ports order is kept
(8021, "127.0.0.1", 8021)
],
"HiddenServiceVersion": "2"
},
}
.. versionadded:: 1.3.0
:param object default: response if the query fails
:returns: **dict** with the hidden service configuration
:raises: :class:`stem.ControllerError` if the call fails and we weren't
provided a default response
"""
service_dir_map = self._get_cache('hidden_service_conf')
if service_dir_map is not None:
if LOG_CACHE_FETCHES:
log.trace('GETCONF HiddenServiceOptions (cache fetch)')
return service_dir_map
start_time = time.time()
try:
response = self.msg('GETCONF HiddenServiceOptions')
stem.response.convert('GETCONF', response)
log.debug('GETCONF HiddenServiceOptions (runtime: %0.4f)' %
(time.time() - start_time))
except stem.ControllerError as exc:
log.debug('GETCONF HiddenServiceOptions (failed: %s)' % exc)
raise
service_dir_map = OrderedDict()
directory = None
for status_code, divider, content in response.content():
if content == 'HiddenServiceOptions':
continue
if '=' not in content:
continue
k, v = content.split('=', 1)
if k == 'HiddenServiceDir':
directory = v
service_dir_map[directory] = {'HiddenServicePort': []}
elif k == 'HiddenServicePort':
port = target_port = v
target_address = '127.0.0.1'
if not v.isdigit():
port, target = v.split()
if target.isdigit():
target_port = target
else:
target_address, target_port = target.rsplit(':', 1)
if not stem.util.connection.is_valid_port(port):
raise stem.ProtocolError('GETCONF provided an invalid HiddenServicePort port (%s): %s' % (port, content))
elif not stem.util.connection.is_valid_ipv4_address(target_address):
raise stem.ProtocolError('GETCONF provided an invalid HiddenServicePort target address (%s): %s' % (target_address, content))
elif not stem.util.connection.is_valid_port(target_port):
raise stem.ProtocolError('GETCONF provided an invalid HiddenServicePort target port (%s): %s' % (target_port, content))
service_dir_map[directory]['HiddenServicePort'].append((int(port), target_address, int(target_port)))
else:
service_dir_map[directory][k] = v
self._set_cache({'hidden_service_conf': service_dir_map})
return service_dir_map
def set_hidden_service_conf(self, conf):
"""
Update all the configured hidden services from a dictionary having
the same format as
:func:`~stem.control.Controller.get_hidden_service_conf`.
For convenience the HiddenServicePort entries can be an integer, string, or
tuple. If an **int** then we treat it as just a port. If a **str** we pass
that directly as the HiddenServicePort. And finally, if a **tuple** then
it's expected to be the **(port, target_address, target_port)** as provided
by :func:`~stem.control.Controller.get_hidden_service_conf`.
This is to say the following three are equivalent...
::
"HiddenServicePort": [
80,
'80 127.0.0.1:80',
(80, '127.0.0.1', 80),
]
.. versionadded:: 1.3.0
:param dict conf: configuration dictionary
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.InvalidArguments` if configuration options
requested was invalid
* :class:`stem.InvalidRequest` if the configuration setting is
impossible or if there's a syntax error in the configuration values
"""
# If we're not adding or updating any hidden services then call RESETCONF
# so we drop existing values. Otherwise calling SETCONF is a no-op.
if not conf:
self.reset_conf('HiddenServiceDir')
return
# Convert conf dictionary into a list of ordered config tuples
hidden_service_options = []
for directory in conf:
hidden_service_options.append(('HiddenServiceDir', directory))
for k, v in list(conf[directory].items()):
if k == 'HiddenServicePort':
for entry in v:
if isinstance(entry, int):
entry = '%s 127.0.0.1:%s' % (entry, entry)
elif isinstance(entry, str):
pass # just pass along what the user gave us
elif isinstance(entry, tuple):
port, target_address, target_port = entry
entry = '%s %s:%s' % (port, target_address, target_port)
hidden_service_options.append(('HiddenServicePort', entry))
else:
hidden_service_options.append((k, str(v)))
self.set_options(hidden_service_options)
def create_hidden_service(self, path, port, target_address = None, target_port = None, auth_type = None, client_names = None):
"""
Create a new hidden service. If the directory is already present, a
new port is added.
Our *.onion address is fetched by reading the hidden service directory.
However, this directory is only readable by the tor user, so if unavailable
the **hostname** will be **None**.
**As of Tor 0.2.7.1 there's two ways for creating hidden services, and this
method is no longer recommended.** Rather, try using
:func:`~stem.control.Controller.create_ephemeral_hidden_service` instead.
.. versionadded:: 1.3.0
.. versionchanged:: 1.4.0
Added the auth_type and client_names arguments.
:param str path: path for the hidden service's data directory
:param int port: hidden service port
:param str target_address: address of the service, by default 127.0.0.1
:param int target_port: port of the service, by default this is the same as
**port**
:param str auth_type: authentication type: basic, stealth or None to disable auth
:param list client_names: client names (1-16 characters "A-Za-z0-9+-_")
:returns: :class:`~stem.cotroller.CreateHiddenServiceOutput` if we create
or update a hidden service, **None** otherwise
:raises: :class:`stem.ControllerError` if the call fails
"""
if not stem.util.connection.is_valid_port(port):
raise ValueError("%s isn't a valid port number" % port)
elif target_address and not stem.util.connection.is_valid_ipv4_address(target_address):
raise ValueError("%s isn't a valid IPv4 address" % target_address)
elif target_port is not None and not stem.util.connection.is_valid_port(target_port):
raise ValueError("%s isn't a valid port number" % target_port)
elif auth_type not in (None, 'basic', 'stealth'):
raise ValueError("%s isn't a recognized type of authentication" % auth_type)
port = int(port)
target_address = target_address if target_address else '127.0.0.1'
target_port = port if target_port is None else int(target_port)
conf = self.get_hidden_service_conf()
if path in conf and (port, target_address, target_port) in conf[path]['HiddenServicePort']:
return None
conf.setdefault(path, OrderedDict()).setdefault('HiddenServicePort', []).append((port, target_address, target_port))
if auth_type and client_names:
hsac = "%s %s" % (auth_type, ','.join(client_names))
conf[path]['HiddenServiceAuthorizeClient'] = hsac
# Tor 0.3.5 changes its default for HS creation from v2 to v3. This is
# fine, but there's a couple options that are incompatible with v3. If
# creating a service with one of those we should explicitly create a v2
# service instead.
#
# https://trac.torproject.org/projects/tor/ticket/27446
for path in conf:
if 'HiddenServiceAuthorizeClient' in conf[path] or 'RendPostPeriod' in conf[path]:
conf[path]['HiddenServiceVersion'] = '2'
self.set_hidden_service_conf(conf)
hostname, hostname_for_client = None, {}
if self.is_localhost():
hostname_path = os.path.join(path, 'hostname')
if not os.path.isabs(hostname_path):
cwd = stem.util.system.cwd(self.get_pid(None))
if cwd:
hostname_path = stem.util.system.expand_path(hostname_path, cwd)
if os.path.isabs(hostname_path):
start_time = time.time()
while not os.path.exists(hostname_path):
wait_time = time.time() - start_time
if wait_time >= 3:
break
else:
time.sleep(0.05)
try:
with open(hostname_path) as hostname_file:
hostname = hostname_file.read().strip()
if client_names and '\n' in hostname:
# When there's multiple clients this looks like...
#
# ndisjxzkgcdhrwqf.onion sjUwjTSPznqWLdOPuwRUzg # client: c1
# ndisjxzkgcdhrwqf.onion sUu92axuL5bKnA76s2KRfw # client: c2
for line in hostname.splitlines():
if ' # client: ' in line:
address = line.split()[0]
client = line.split(' # client: ', 1)[1]
if len(address) == 22 and address.endswith('.onion'):
hostname_for_client[client] = address
except:
pass
return CreateHiddenServiceOutput(
path = path,
hostname = hostname,
hostname_for_client = hostname_for_client,
config = conf,
)
def remove_hidden_service(self, path, port = None):
"""
Discontinues a given hidden service.
.. versionadded:: 1.3.0
:param str path: path for the hidden service's data directory
:param int port: hidden service port
:returns: **True** if the hidden service is discontinued, **False** if it
wasn't running in the first place
:raises: :class:`stem.ControllerError` if the call fails
"""
if port and not stem.util.connection.is_valid_port(port):
raise ValueError("%s isn't a valid port number" % port)
port = int(port) if port else None
conf = self.get_hidden_service_conf()
if path not in conf:
return False
if not port:
del conf[path]
else:
to_remove = [entry for entry in conf[path]['HiddenServicePort'] if entry[0] == port]
if not to_remove:
return False
for entry in to_remove:
conf[path]['HiddenServicePort'].remove(entry)
if not conf[path]['HiddenServicePort']:
del conf[path] # no ports left
self.set_hidden_service_conf(conf)
return True
@with_default()
def list_ephemeral_hidden_services(self, default = UNDEFINED, our_services = True, detached = False):
"""
list_ephemeral_hidden_services(default = UNDEFINED, our_services = True, detached = False)
Lists hidden service addresses created by
:func:`~stem.control.Controller.create_ephemeral_hidden_service`.
.. versionadded:: 1.4.0
.. versionchanged:: 1.6.0
Tor change caused this to start providing empty strings if unset
(:trac:`21329`).
:param object default: response if the query fails
:param bool our_services: include services created with this controller
that weren't flagged as 'detached'
:param bool detached: include services whos contiuation isn't tied to a
controller
:returns: **list** of hidden service addresses without their '.onion'
suffix
:raises: :class:`stem.ControllerError` if the call fails and we weren't
provided a default response
"""
if self.get_version() < stem.version.Requirement.ADD_ONION:
raise stem.UnsatisfiableRequest(message = 'Ephemeral hidden services were added in tor version %s' % stem.version.Requirement.ADD_ONION)
result = []
if our_services:
try:
result += self.get_info('onions/current').split('\n')
except (stem.ProtocolError, stem.OperationFailed) as exc:
# TODO: Tor's behavior around this was changed in Feb 2017, we should
# drop it when all versions that did this are deprecated...
#
# https://trac.torproject.org/projects/tor/ticket/21329
if 'No onion services of the specified type.' not in str(exc):
raise
if detached:
try:
result += self.get_info('onions/detached').split('\n')
except (stem.ProtocolError, stem.OperationFailed) as exc:
if 'No onion services of the specified type.' not in str(exc):
raise
return [r for r in result if r] # drop any empty responses (GETINFO is blank if unset)
def create_ephemeral_hidden_service(self, ports, key_type = 'NEW', key_content = 'BEST', discard_key = False, detached = False, await_publication = False, timeout = None, basic_auth = None, max_streams = None):
"""
Creates a new hidden service. Unlike
:func:`~stem.control.Controller.create_hidden_service` this style of
hidden service doesn't touch disk, carrying with it a lot of advantages.
This is the suggested method for making hidden services.
Our **ports** argument can be a single port...
::
create_ephemeral_hidden_service(80)
... list of ports the service is available on...
::
create_ephemeral_hidden_service([80, 443])
... or a mapping of hidden service ports to their targets...
::
create_ephemeral_hidden_service({80: 80, 443: '173.194.33.133:443'})
If **basic_auth** is provided this service will require basic
authentication to access. This means users must set HidServAuth in their
torrc with credentials to access it.
**basic_auth** is a mapping of usernames to their credentials. If the
credential is **None** one is generated and returned as part of the
response. For instance, only bob can access using the given newly generated
credentials...
::
>>> response = controller.create_ephemeral_hidden_service(80, basic_auth = {'bob': None})
>>> print(response.client_auth)
{'bob': 'nKwfvVPmTNr2k2pG0pzV4g'}
... while both alice and bob can access with existing credentials in the
following...
::
controller.create_ephemeral_hidden_service(80, basic_auth = {
'alice': 'l4BT016McqV2Oail+Bwe6w',
'bob': 'vGnNRpWYiMBFTWD2gbBlcA',
})
To create a **version 3** service simply specify **ED25519-V3** as the
our key type, and to create a **version 2** service use **RSA1024**. The
default version of newly created hidden services is based on the
**HiddenServiceVersion** value in your torrc...
::
response = controller.create_ephemeral_hidden_service(
80,
key_content = 'ED25519-V3',
await_publication = True,
)
print('service established at %s.onion' % response.service_id)
.. versionadded:: 1.4.0
.. versionchanged:: 1.5.0
Added the basic_auth argument.
.. versionchanged:: 1.5.0
Added support for non-anonymous services. To do so set
'HiddenServiceSingleHopMode 1' and 'HiddenServiceNonAnonymousMode 1' in
your torrc.
.. versionchanged:: 1.7.0
Added the timeout and max_streams arguments.
:param int,list,dict ports: hidden service port(s) or mapping of hidden
service ports to their targets
:param str key_type: type of key being provided, generates a new key if
'NEW' (options are: **NEW**, **RSA1024**, and **ED25519-V3**)
:param str key_content: key for the service to use or type of key to be
generated (options when **key_type** is **NEW** are **BEST**,
**RSA1024**, and **ED25519-V3**)
:param bool discard_key: avoid providing the key back in our response
:param bool detached: continue this hidden service even after this control
connection is closed if **True**
:param bool await_publication: blocks until our descriptor is successfully
published if **True**
:param float timeout: seconds to wait when **await_result** is **True**
:param dict basic_auth: required user credentials to access this service
:param int max_streams: maximum number of streams the hidden service will
accept, unlimited if zero or not set
:returns: :class:`~stem.response.add_onion.AddOnionResponse` with the response
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.Timeout` if **timeout** was reached
"""
if self.get_version() < stem.version.Requirement.ADD_ONION:
raise stem.UnsatisfiableRequest(message = 'Ephemeral hidden services were added in tor version %s' % stem.version.Requirement.ADD_ONION)
hs_desc_queue, hs_desc_listener = queue.Queue(), None
start_time = time.time()
if await_publication:
def hs_desc_listener(event):
hs_desc_queue.put(event)
self.add_event_listener(hs_desc_listener, EventType.HS_DESC)
request = 'ADD_ONION %s:%s' % (key_type, key_content)
flags = []
if discard_key:
flags.append('DiscardPK')
if detached:
flags.append('Detach')
if basic_auth is not None:
if self.get_version() < stem.version.Requirement.ADD_ONION_BASIC_AUTH:
raise stem.UnsatisfiableRequest(message = 'Basic authentication support was added to ADD_ONION in tor version %s' % stem.version.Requirement.ADD_ONION_BASIC_AUTH)
flags.append('BasicAuth')
if max_streams is not None:
if self.get_version() < stem.version.Requirement.ADD_ONION_MAX_STREAMS:
raise stem.UnsatisfiableRequest(message = 'Limitation of the maximum number of streams to accept was added to ADD_ONION in tor version %s' % stem.version.Requirement.ADD_ONION_MAX_STREAMS)
flags.append('MaxStreamsCloseCircuit')
if self.get_version() >= stem.version.Requirement.ADD_ONION_NON_ANONYMOUS:
if self.get_conf('HiddenServiceSingleHopMode', None) == '1' and self.get_conf('HiddenServiceNonAnonymousMode', None) == '1':
flags.append('NonAnonymous')
if flags:
request += ' Flags=%s' % ','.join(flags)
if max_streams is not None:
request += ' MaxStreams=%s' % max_streams
if isinstance(ports, int):
request += ' Port=%s' % ports
elif isinstance(ports, list):
for port in ports:
request += ' Port=%s' % port
elif isinstance(ports, dict):
for port, target in ports.items():
request += ' Port=%s,%s' % (port, target)
else:
raise ValueError("The 'ports' argument of create_ephemeral_hidden_service() needs to be an int, list, or dict")
if basic_auth is not None:
for client_name, client_blob in basic_auth.items():
if client_blob:
request += ' ClientAuth=%s:%s' % (client_name, client_blob)
else:
request += ' ClientAuth=%s' % client_name
response = self.msg(request)
stem.response.convert('ADD_ONION', response)
if await_publication:
# We should receive five UPLOAD events, followed by up to another five
# UPLOADED to indicate they've finished. Presently tor seems to have an
# issue where the address is provided for UPLOAD but not UPLOADED so need
# to just guess that if it's for the same hidden service authority then
# it's what we're looking for.
directories_uploaded_to, failures = [], []
try:
while True:
event = _get_with_timeout(hs_desc_queue, timeout, start_time)
if event.action == stem.HSDescAction.UPLOAD and event.address == response.service_id:
directories_uploaded_to.append(event.directory_fingerprint)
elif event.action == stem.HSDescAction.UPLOADED and event.directory_fingerprint in directories_uploaded_to:
break # successfully uploaded to a HS authority... maybe
elif event.action == stem.HSDescAction.FAILED and event.directory_fingerprint in directories_uploaded_to:
failures.append('%s (%s)' % (event.directory_fingerprint, event.reason))
if len(directories_uploaded_to) == len(failures):
raise stem.OperationFailed(message = 'Failed to upload our hidden service descriptor to %s' % ', '.join(failures))
finally:
self.remove_event_listener(hs_desc_listener)
return response
def remove_ephemeral_hidden_service(self, service_id):
"""
Discontinues a given hidden service that was created with
:func:`~stem.control.Controller.create_ephemeral_hidden_service`.
.. versionadded:: 1.4.0
:param str service_id: hidden service address without the '.onion' suffix
:returns: **True** if the hidden service is discontinued, **False** if it
wasn't running in the first place
:raises: :class:`stem.ControllerError` if the call fails
"""
if self.get_version() < stem.version.Requirement.ADD_ONION:
raise stem.UnsatisfiableRequest(message = 'Ephemeral hidden services were added in tor version %s' % stem.version.Requirement.ADD_ONION)
response = self.msg('DEL_ONION %s' % service_id)
stem.response.convert('SINGLELINE', response)
if response.is_ok():
return True
elif response.code == '552':
return False # no hidden service to discontinue
else:
raise stem.ProtocolError('DEL_ONION returned unexpected response code: %s' % response.code)
def add_event_listener(self, listener, *events):
"""
Directs further tor controller events to a given function. The function is
expected to take a single argument, which is a
:class:`~stem.response.events.Event` subclass. For instance the following
would print the bytes sent and received by tor over five seconds...
::
import time
from stem.control import Controller, EventType
def print_bw(event):
print('sent: %i, received: %i' % (event.written, event.read))
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
controller.add_event_listener(print_bw, EventType.BW)
time.sleep(5)
If a new control connection is initialized then this listener will be
reattached.
If tor emits a malformed event it can be received by listening for the
stem.control.MALFORMED_EVENTS constant.
.. versionchanged:: 1.7.0
Listener exceptions and malformed events no longer break further event
processing. Added the **MALFORMED_EVENTS** constant.
:param functor listener: function to be called when an event is received
:param stem.control.EventType events: event types to be listened for
:raises: :class:`stem.ProtocolError` if unable to set the events
"""
# first checking that tor supports these event types
with self._event_listeners_lock:
if self.is_authenticated():
for event_type in events:
event_type = stem.response.events.EVENT_TYPE_TO_CLASS.get(event_type)
if event_type and (self.get_version() < event_type._VERSION_ADDED):
raise stem.InvalidRequest(552, '%s event requires Tor version %s or later' % (event_type, event_type._VERSION_ADDED))
for event_type in events:
self._event_listeners.setdefault(event_type, []).append(listener)
failed_events = self._attach_listeners()[1]
# restricted the failures to just things we requested
failed_events = set(failed_events).intersection(set(events))
if failed_events:
raise stem.ProtocolError('SETEVENTS rejected %s' % ', '.join(failed_events))
def remove_event_listener(self, listener):
"""
Stops a listener from being notified of further tor events.
:param stem.control.EventListener listener: listener to be removed
:raises: :class:`stem.ProtocolError` if unable to set the events
"""
with self._event_listeners_lock:
event_types_changed = False
for event_type, event_listeners in list(self._event_listeners.items()):
if listener in event_listeners:
event_listeners.remove(listener)
if len(event_listeners) == 0:
event_types_changed = True
del self._event_listeners[event_type]
if event_types_changed:
response = self.msg('SETEVENTS %s' % ' '.join(self._event_listeners.keys()))
if not response.is_ok():
raise stem.ProtocolError('SETEVENTS received unexpected response\n%s' % response)
def _get_cache(self, param, namespace = None):
"""
Queries our request cache for the given key.
:param str param: key to be queried
:param str namespace: namespace in which to check for the key
:returns: cached value corresponding to key or **None** if the key wasn't found
"""
with self._cache_lock:
if not self.is_caching_enabled():
return None
cache_key = '%s.%s' % (namespace, param) if namespace else param
return self._request_cache.get(cache_key, None)
def _get_cache_map(self, params, namespace = None):
"""
Queries our request cache for multiple entries.
:param list params: keys to be queried
:param str namespace: namespace in which to check for the keys
:returns: **dict** of 'param => cached value' pairs of keys present in cache
"""
with self._cache_lock:
cached_values = {}
if self.is_caching_enabled():
for param in params:
cache_key = '%s.%s' % (namespace, param) if namespace else param
if cache_key in self._request_cache:
cached_values[param] = self._request_cache[cache_key]
return cached_values
def _set_cache(self, params, namespace = None):
"""
Sets the given request cache entries. If the new cache value is **None**
then it is removed from our cache.
:param dict params: **dict** of 'cache_key => value' pairs to be cached
:param str namespace: namespace for the keys
"""
with self._cache_lock:
if not self.is_caching_enabled():
return
# if params is None then clear the namespace
if params is None and namespace:
for cache_key in list(self._request_cache.keys()):
if cache_key.startswith('%s.' % namespace):
del self._request_cache[cache_key]
return
# remove uncacheable items
if namespace == 'getconf':
# shallow copy before edit so as not to change it for the caller
params = params.copy()
for key in UNCACHEABLE_GETCONF_PARAMS:
if key in params:
del params[key]
for key, value in list(params.items()):
if namespace:
cache_key = '%s.%s' % (namespace, key)
else:
cache_key = key
if value is None:
if cache_key in list(self._request_cache.keys()):
del self._request_cache[cache_key]
else:
self._request_cache[cache_key] = value
def _confchanged_cache_invalidation(self, params):
"""
Drops dependent portions of the cache when configuration changes.
:param dict params: **dict** of 'config_key => value' pairs for configs
that changed. The entries' values are currently unused.
"""
with self._cache_lock:
if not self.is_caching_enabled():
return
if any('hidden' in param.lower() for param in params.keys()):
self._set_cache({'hidden_service_conf': None})
# reset any getinfo parameters that can be changed by a SETCONF
self._set_cache(dict([(k.lower(), None) for k in CACHEABLE_GETINFO_PARAMS_UNTIL_SETCONF]), 'getinfo')
self._set_cache(None, 'listeners')
self._set_cache({'get_custom_options': None})
self._set_cache({'exit_policy': None}) # numerous options can change our policy
def is_caching_enabled(self):
"""
**True** if caching has been enabled, **False** otherwise.
:returns: bool to indicate if caching is enabled
"""
return self._is_caching_enabled
def set_caching(self, enabled):
"""
Enables or disables caching of information retrieved from tor.
:param bool enabled: **True** to enable caching, **False** to disable it
"""
self._is_caching_enabled = enabled
if not self._is_caching_enabled:
self.clear_cache()
def clear_cache(self):
"""
Drops any cached results.
"""
with self._cache_lock:
self._request_cache = {}
self._last_newnym = 0.0
self._is_geoip_unavailable = None
def load_conf(self, configtext):
"""
Sends the configuration text to Tor and loads it as if it has been read from
the torrc.
:param str configtext: the configuration text
:raises: :class:`stem.ControllerError` if the call fails
"""
response = self.msg('LOADCONF\n%s' % configtext)
stem.response.convert('SINGLELINE', response)
if response.code in ('552', '553'):
if response.code == '552' and response.message.startswith('Invalid config file: Failed to parse/validate config: Unknown option'):
raise stem.InvalidArguments(response.code, response.message, [response.message[70:response.message.find('.', 70) - 1]])
raise stem.InvalidRequest(response.code, response.message)
elif not response.is_ok():
raise stem.ProtocolError('+LOADCONF Received unexpected response\n%s' % str(response))
def save_conf(self, force = False):
"""
Saves the current configuration options into the active torrc file.
.. versionchanged:: 1.6.0
Added the force argument.
:param bool force: overwrite the configuration even if it includes a
'%include' clause, this is ignored if tor doesn't support it
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.OperationFailed` if the client is unable to save
the configuration file
"""
if self.get_version() < stem.version.Requirement.SAVECONF_FORCE:
force = False
response = self.msg('SAVECONF FORCE' if force else 'SAVECONF')
stem.response.convert('SINGLELINE', response)
if response.is_ok():
return True
elif response.code == '551':
raise stem.OperationFailed(response.code, response.message)
else:
raise stem.ProtocolError('SAVECONF returned unexpected response code')
def is_feature_enabled(self, feature):
"""
Checks if a control connection feature is enabled. These features can be
enabled using :func:`~stem.control.Controller.enable_feature`.
:param str feature: feature to be checked
:returns: **True** if feature is enabled, **False** otherwise
"""
feature = feature.upper()
if feature in self._enabled_features:
return True
else:
# check if this feature is on by default
defaulted_version = None
if feature == 'EXTENDED_EVENTS':
defaulted_version = stem.version.Requirement.FEATURE_EXTENDED_EVENTS
elif feature == 'VERBOSE_NAMES':
defaulted_version = stem.version.Requirement.FEATURE_VERBOSE_NAMES
if defaulted_version:
our_version = self.get_version(None)
if our_version and our_version >= defaulted_version:
self._enabled_features.append(feature)
return feature in self._enabled_features
def enable_feature(self, features):
"""
Enables features that are disabled by default to maintain backward
compatibility. Once enabled, a feature cannot be disabled and a new
control connection must be opened to get a connection with the feature
disabled. Feature names are case-insensitive.
The following features are currently accepted:
* EXTENDED_EVENTS - Requests the extended event syntax
* VERBOSE_NAMES - Replaces ServerID with LongName in events and GETINFO results
:param str,list features: a single feature or a list of features to be enabled
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.InvalidArguments` if features passed were invalid
"""
if stem.util._is_str(features):
features = [features]
response = self.msg('USEFEATURE %s' % ' '.join(features))
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
if response.code == '552':
invalid_feature = []
if response.message.startswith('Unrecognized feature "'):
invalid_feature = [response.message[22:response.message.find('"', 22)]]
raise stem.InvalidArguments(response.code, response.message, invalid_feature)
raise stem.ProtocolError('USEFEATURE provided an invalid response code: %s' % response.code)
self._enabled_features += [entry.upper() for entry in features]
@with_default()
def get_circuit(self, circuit_id, default = UNDEFINED):
"""
get_circuit(circuit_id, default = UNDEFINED)
Provides a circuit currently available from tor.
:param int circuit_id: circuit to be fetched
:param object default: response if the query fails
:returns: :class:`stem.response.events.CircuitEvent` for the given circuit
:raises:
* :class:`stem.ControllerError` if the call fails
* **ValueError** if the circuit doesn't exist
An exception is only raised if we weren't provided a default response.
"""
for circ in self.get_circuits():
if circ.id == circuit_id:
return circ
raise ValueError("Tor currently does not have a circuit with the id of '%s'" % circuit_id)
@with_default()
def get_circuits(self, default = UNDEFINED):
"""
get_circuits(default = UNDEFINED)
Provides tor's currently available circuits.
:param object default: response if the query fails
:returns: **list** of :class:`stem.response.events.CircuitEvent` for our circuits
:raises: :class:`stem.ControllerError` if the call fails and no default was provided
"""
circuits = []
response = self.get_info('circuit-status')
for circ in response.splitlines():
circ_message = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes('650 CIRC %s\r\n' % circ)))
stem.response.convert('EVENT', circ_message)
circuits.append(circ_message)
return circuits
def new_circuit(self, path = None, purpose = 'general', await_build = False, timeout = None):
"""
Requests a new circuit. If the path isn't provided, one is automatically
selected.
.. versionchanged:: 1.7.0
Added the timeout argument.
:param list,str path: one or more relays to make a circuit through
:param str purpose: 'general' or 'controller'
:param bool await_build: blocks until the circuit is built if **True**
:param float timeout: seconds to wait when **await_build** is **True**
:returns: str of the circuit id of the newly created circuit
:raises:
* :class:`stem.ControllerError` if the call fails
* :class:`stem.Timeout` if **timeout** was reached
"""
return self.extend_circuit('0', path, purpose, await_build, timeout)
def extend_circuit(self, circuit_id = '0', path = None, purpose = 'general', await_build = False, timeout = None):
"""
Either requests the creation of a new circuit or extends an existing one.
When called with a circuit value of zero (the default) a new circuit is
created, and when non-zero the circuit with that id is extended. If the
path isn't provided, one is automatically selected.
A python interpreter session used to create circuits could look like this...
::
>>> controller.extend_circuit('0', ['718BCEA286B531757ACAFF93AE04910EA73DE617', '30BAB8EE7606CBD12F3CC269AE976E0153E7A58D', '2765D8A8C4BBA3F89585A9FFE0E8575615880BEB'])
19
>>> controller.extend_circuit('0')
20
>>> print(controller.get_info('circuit-status'))
20 EXTENDED $718BCEA286B531757ACAFF93AE04910EA73DE617=KsmoinOK,$649F2D0ACF418F7CFC6539AB2257EB2D5297BAFA=Eskimo BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2012-12-06T13:51:11.433755
19 BUILT $718BCEA286B531757ACAFF93AE04910EA73DE617=KsmoinOK,$30BAB8EE7606CBD12F3CC269AE976E0153E7A58D=Pascal1,$2765D8A8C4BBA3F89585A9FFE0E8575615880BEB=Anthracite PURPOSE=GENERAL TIME_CREATED=2012-12-06T13:50:56.969938
.. versionchanged:: 1.7.0
Added the timeout argument.
:param str circuit_id: id of a circuit to be extended
:param list,str path: one or more relays to make a circuit through, this is
required if the circuit id is non-zero
:param str purpose: 'general' or 'controller'
:param bool await_build: blocks until the circuit is built if **True**
:param float timeout: seconds to wait when **await_build** is **True**
:returns: str of the circuit id of the created or extended circuit
:raises:
* :class:`stem.InvalidRequest` if one of the parameters were invalid
* :class:`stem.CircuitExtensionFailed` if we were waiting for the circuit
to build but it failed
* :class:`stem.Timeout` if **timeout** was reached
* :class:`stem.ControllerError` if the call fails
"""
# Attaches a temporary listener for CIRC events if we'll be waiting for it
# to build. This is icky, but we can't reliably do this via polling since
# we then can't get the failure if it can't be created.
circ_queue, circ_listener = queue.Queue(), None
start_time = time.time()
if await_build:
def circ_listener(event):
circ_queue.put(event)
self.add_event_listener(circ_listener, EventType.CIRC)
try:
# we might accidently get integer circuit ids
circuit_id = str(circuit_id)
if path is None and circuit_id == '0':
path_opt_version = stem.version.Requirement.EXTENDCIRCUIT_PATH_OPTIONAL
if not self.get_version() >= path_opt_version:
raise stem.InvalidRequest(512, 'EXTENDCIRCUIT requires the path prior to version %s' % path_opt_version)
args = [circuit_id]
if stem.util._is_str(path):
path = [path]
if path:
args.append(','.join(path))
if purpose:
args.append('purpose=%s' % purpose)
response = self.msg('EXTENDCIRCUIT %s' % ' '.join(args))
stem.response.convert('SINGLELINE', response)
if response.code in ('512', '552'):
raise stem.InvalidRequest(response.code, response.message)
elif not response.is_ok():
raise stem.ProtocolError('EXTENDCIRCUIT returned unexpected response code: %s' % response.code)
if not response.message.startswith('EXTENDED '):
raise stem.ProtocolError('EXTENDCIRCUIT response invalid:\n%s', response)
new_circuit = response.message.split(' ', 1)[1]
if await_build:
while True:
circ = _get_with_timeout(circ_queue, timeout, start_time)
if circ.id == new_circuit:
if circ.status == CircStatus.BUILT:
break
elif circ.status == CircStatus.FAILED:
raise stem.CircuitExtensionFailed('Circuit failed to be created: %s' % circ.reason, circ)
elif circ.status == CircStatus.CLOSED:
raise stem.CircuitExtensionFailed('Circuit was closed prior to build', circ)
return new_circuit
finally:
if circ_listener:
self.remove_event_listener(circ_listener)
def repurpose_circuit(self, circuit_id, purpose):
"""
Changes a circuit's purpose. Currently, two purposes are recognized...
* general
* controller
:param str circuit_id: id of the circuit whose purpose is to be changed
:param str purpose: purpose (either 'general' or 'controller')
:raises: :class:`stem.InvalidArguments` if the circuit doesn't exist or if the purpose was invalid
"""
response = self.msg('SETCIRCUITPURPOSE %s purpose=%s' % (circuit_id, purpose))
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
if response.code == '552':
raise stem.InvalidRequest(response.code, response.message)
else:
raise stem.ProtocolError('SETCIRCUITPURPOSE returned unexpected response code: %s' % response.code)
def close_circuit(self, circuit_id, flag = ''):
"""
Closes the specified circuit.
:param str circuit_id: id of the circuit to be closed
:param str flag: optional value to modify closing, the only flag available
is 'IfUnused' which will not close the circuit unless it is unused
:raises: :class:`stem.InvalidArguments` if the circuit is unknown
:raises: :class:`stem.InvalidRequest` if not enough information is provided
"""
response = self.msg('CLOSECIRCUIT %s %s' % (circuit_id, flag))
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
if response.code in ('512', '552'):
if response.message.startswith('Unknown circuit '):
raise stem.InvalidArguments(response.code, response.message, [circuit_id])
raise stem.InvalidRequest(response.code, response.message)
else:
raise stem.ProtocolError('CLOSECIRCUIT returned unexpected response code: %s' % response.code)
@with_default()
def get_streams(self, default = UNDEFINED):
"""
get_streams(default = UNDEFINED)
Provides the list of streams tor is currently handling.
:param object default: response if the query fails
:returns: list of :class:`stem.response.events.StreamEvent` objects
:raises: :class:`stem.ControllerError` if the call fails and no default was
provided
"""
streams = []
response = self.get_info('stream-status')
for stream in response.splitlines():
message = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes('650 STREAM %s\r\n' % stream)))
stem.response.convert('EVENT', message)
streams.append(message)
return streams
def attach_stream(self, stream_id, circuit_id, exiting_hop = None):
"""
Attaches a stream to a circuit.
Note: Tor attaches streams to circuits automatically unless the
__LeaveStreamsUnattached configuration variable is set to '1'
:param str stream_id: id of the stream that must be attached
:param str circuit_id: id of the circuit to which it must be attached
:param int exiting_hop: hop in the circuit where traffic should exit
:raises:
* :class:`stem.InvalidRequest` if the stream or circuit id were unrecognized
* :class:`stem.UnsatisfiableRequest` if the stream isn't in a state where it can be attached
* :class:`stem.OperationFailed` if the stream couldn't be attached for any other reason
"""
query = 'ATTACHSTREAM %s %s' % (stream_id, circuit_id)
if exiting_hop:
query += ' HOP=%s' % exiting_hop
response = self.msg(query)
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
if response.code == '552':
raise stem.InvalidRequest(response.code, response.message)
elif response.code == '551':
raise stem.OperationFailed(response.code, response.message)
elif response.code == '555':
raise stem.UnsatisfiableRequest(response.code, response.message)
else:
raise stem.ProtocolError('ATTACHSTREAM returned unexpected response code: %s' % response.code)
def close_stream(self, stream_id, reason = stem.RelayEndReason.MISC, flag = ''):
"""
Closes the specified stream.
:param str stream_id: id of the stream to be closed
:param stem.RelayEndReason reason: reason the stream is closing
:param str flag: not currently used
:raises:
* :class:`stem.InvalidArguments` if the stream or reason are not recognized
* :class:`stem.InvalidRequest` if the stream and/or reason are missing
"""
# there's a single value offset between RelayEndReason.index_of() and the
# value that tor expects since tor's value starts with the index of one
response = self.msg('CLOSESTREAM %s %s %s' % (stream_id, stem.RelayEndReason.index_of(reason) + 1, flag))
stem.response.convert('SINGLELINE', response)
if not response.is_ok():
if response.code in ('512', '552'):
if response.message.startswith('Unknown stream '):
raise stem.InvalidArguments(response.code, response.message, [stream_id])
elif response.message.startswith('Unrecognized reason '):
raise stem.InvalidArguments(response.code, response.message, [reason])
raise stem.InvalidRequest(response.code, response.message)
else:
raise stem.ProtocolError('CLOSESTREAM returned unexpected response code: %s' % response.code)
def signal(self, signal):
"""
Sends a signal to the Tor client.
:param stem.Signal signal: type of signal to be sent
:raises:
* :class:`stem.ControllerError` if sending the signal failed
* :class:`stem.InvalidArguments` if signal provided wasn't recognized
"""
response = self.msg('SIGNAL %s' % signal)
stem.response.convert('SINGLELINE', response)
if response.is_ok():
if signal == stem.Signal.NEWNYM:
self._last_newnym = time.time()
else:
if response.code == '552':
raise stem.InvalidArguments(response.code, response.message, [signal])
raise stem.ProtocolError('SIGNAL response contained unrecognized status code: %s' % response.code)
def is_newnym_available(self):
"""
Indicates if tor would currently accept a NEWNYM signal. This can only
account for signals sent via this controller.
.. versionadded:: 1.2.0
:returns: **True** if tor would currently accept a NEWNYM signal, **False**
otherwise
"""
if self.is_alive():
return self.get_newnym_wait() == 0.0
else:
return False
def get_newnym_wait(self):
"""
Provides the number of seconds until a NEWNYM signal would be respected.
This can only account for signals sent via this controller.
.. versionadded:: 1.2.0
:returns: **float** for the number of seconds until tor would respect
another NEWNYM signal
"""
return max(0.0, self._last_newnym + 10 - time.time())
@with_default()
def get_effective_rate(self, default = UNDEFINED, burst = False):
"""
get_effective_rate(default = UNDEFINED, burst = False)
Provides the maximum rate this relay is configured to relay in bytes per
second. This is based on multiple torrc parameters if they're set...
* Effective Rate = min(BandwidthRate, RelayBandwidthRate, MaxAdvertisedBandwidth)
* Effective Burst = min(BandwidthBurst, RelayBandwidthBurst)
.. versionadded:: 1.3.0
:param object default: response if the query fails
:param bool burst: provides the burst bandwidth, otherwise this provides
the standard rate
:returns: **int** with the effective bandwidth rate in bytes per second
:raises: :class:`stem.ControllerError` if the call fails and no default was
provided
"""
if not burst:
attributes = ('BandwidthRate', 'RelayBandwidthRate', 'MaxAdvertisedBandwidth')
else:
attributes = ('BandwidthBurst', 'RelayBandwidthBurst')
value = None
for attr in attributes:
attr_value = int(self.get_conf(attr))
if attr_value == 0 and attr.startswith('Relay'):
continue # RelayBandwidthRate and RelayBandwidthBurst default to zero
value = min(value, attr_value) if value else attr_value
return value
def is_geoip_unavailable(self):
"""
Provides **True** if tor's geoip database is unavailable, **False**
otherwise.
.. versionchanged:: 1.6.0
No longer requires previously failed GETINFO requests to determine this.
.. deprecated:: 1.6.0
This is available as of Tor 0.3.2.1 through the following instead...
::
controller.get_info('ip-to-country/ipv4-available', 0) == '1'
:returns: **bool** indicating if we've determined tor's geoip database to
be unavailable or not
"""
if self._is_geoip_unavailable is None:
try:
self.get_info('ip-to-country/0.0.0.0')
self._is_geoip_unavailable = False
except stem.ControllerError as exc:
if 'GeoIP data not loaded' in str(exc):
self._is_geoip_unavailable = True
else:
return False # unexpected issue, fail open and don't cache
return self._is_geoip_unavailable
def map_address(self, mapping):
"""
Map addresses to replacement addresses. Tor replaces subseqent connections
to the original addresses with the replacement addresses.
If the original address is a null address, i.e., one of '0.0.0.0', '::0', or
'.' Tor picks an original address itself and returns it in the reply. If the
original address is already mapped to a different address the mapping is
removed.
:param dict mapping: mapping of original addresses to replacement addresses
:raises:
* :class:`stem.InvalidRequest` if the addresses are malformed
* :class:`stem.OperationFailed` if Tor couldn't fulfill the request
:returns: **dict** with 'original -> replacement' address mappings
"""
mapaddress_arg = ' '.join(['%s=%s' % (k, v) for (k, v) in list(mapping.items())])
response = self.msg('MAPADDRESS %s' % mapaddress_arg)
stem.response.convert('MAPADDRESS', response)
return response.entries
def drop_guards(self):
"""
Drops our present guard nodes and picks a new set.
.. versionadded:: 1.2.0
:raises: :class:`stem.ControllerError` if Tor couldn't fulfill the request
"""
if self.get_version() < stem.version.Requirement.DROPGUARDS:
raise stem.UnsatisfiableRequest(message = 'DROPGUARDS was added in tor version %s' % stem.version.Requirement.DROPGUARDS)
self.msg('DROPGUARDS')
def _post_authentication(self):
super(Controller, self)._post_authentication()
# try to re-attach event listeners to the new instance
with self._event_listeners_lock:
try:
failed_events = self._attach_listeners()[1]
if failed_events:
# remove our listeners for these so we don't keep failing
for event_type in failed_events:
del self._event_listeners[event_type]
logging_id = 'stem.controller.event_reattach-%s' % '-'.join(failed_events)
log.log_once(logging_id, log.WARN, 'We were unable to re-attach our event listeners to the new tor instance for: %s' % ', '.join(failed_events))
except stem.ProtocolError as exc:
log.warn('Unable to issue the SETEVENTS request to re-attach our listeners (%s)' % exc)
# issue TAKEOWNERSHIP if we're the owning process for this tor instance
owning_pid = self.get_conf('__OwningControllerProcess', None)
if owning_pid == str(os.getpid()) and self.is_localhost():
response = self.msg('TAKEOWNERSHIP')
stem.response.convert('SINGLELINE', response)
if response.is_ok():
# Now that tor is tracking our ownership of the process via the control
# connection, we can stop having it check for us via our pid.
try:
self.reset_conf('__OwningControllerProcess')
except stem.ControllerError as exc:
log.warn("We were unable to reset tor's __OwningControllerProcess configuration. It will continue to periodically check if our pid exists. (%s)" % exc)
else:
log.warn('We were unable assert ownership of tor through TAKEOWNERSHIP, despite being configured to be the owning process through __OwningControllerProcess. (%s)' % response)
def _handle_event(self, event_message):
try:
stem.response.convert('EVENT', event_message)
event_type = event_message.type
except stem.ProtocolError as exc:
log.error('Tor sent a malformed event (%s): %s' % (exc, event_message))
event_type = MALFORMED_EVENTS
with self._event_listeners_lock:
for listener_type, event_listeners in list(self._event_listeners.items()):
if listener_type == event_type:
for listener in event_listeners:
try:
listener(event_message)
except Exception as exc:
log.warn('Event listener raised an uncaught exception (%s): %s' % (exc, event_message))
def _attach_listeners(self):
"""
Attempts to subscribe to the self._event_listeners events from tor. This is
a no-op if we're not currently authenticated.
:returns: tuple of the form (set_events, failed_events)
:raises: :class:`stem.ControllerError` if unable to make our request to tor
"""
set_events, failed_events = [], []
with self._event_listeners_lock:
if self.is_authenticated():
# try to set them all
response = self.msg('SETEVENTS %s' % ' '.join(self._event_listeners.keys()))
if response.is_ok():
set_events = list(self._event_listeners.keys())
else:
# One of the following likely happened...
#
# * Our user attached listeners before having an authenticated
# connection, so we couldn't check if we met the version
# requirement.
#
# * User attached listeners to one tor instance, then connected us to
# an older tor instancce.
#
# * Some other controller hiccup (far less likely).
#
# See if we can set some subset of our events.
for event in list(self._event_listeners.keys()):
response = self.msg('SETEVENTS %s' % ' '.join(set_events + [event]))
if response.is_ok():
set_events.append(event)
else:
failed_events.append(event)
return (set_events, failed_events)
def _parse_circ_path(path):
"""
Parses a circuit path as a list of **(fingerprint, nickname)** tuples. Tor
circuit paths are defined as being of the form...
::
Path = LongName *("," LongName)
LongName = Fingerprint [ ( "=" / "~" ) Nickname ]
example:
$999A226EBED397F331B612FE1E4CFAE5C1F201BA=piyaz
... *unless* this is prior to tor version 0.2.2.1 with the VERBOSE_NAMES
feature turned off (or before version 0.1.2.2 where the feature was
introduced). In that case either the fingerprint or nickname in the tuple
will be **None**, depending on which is missing.
::
Path = ServerID *("," ServerID)
ServerID = Nickname / Fingerprint
example:
$E57A476CD4DFBD99B4EE52A100A58610AD6E80B9,hamburgerphone,PrivacyRepublic14
:param str path: circuit path to be parsed
:returns: list of **(fingerprint, nickname)** tuples, fingerprints do not have a proceeding '$'
:raises: :class:`stem.ProtocolError` if the path is malformed
"""
if path:
try:
return [_parse_circ_entry(entry) for entry in path.split(',')]
except stem.ProtocolError as exc:
# include the path with the exception
raise stem.ProtocolError('%s: %s' % (exc, path))
else:
return []
def _parse_circ_entry(entry):
"""
Parses a single relay's 'LongName' or 'ServerID'. See the
:func:`~stem.control._parse_circ_path` function for more information.
:param str entry: relay information to be parsed
:returns: **(fingerprint, nickname)** tuple
:raises: :class:`stem.ProtocolError` if the entry is malformed
"""
if '=' in entry:
# common case
fingerprint, nickname = entry.split('=')
elif '~' in entry:
# this is allowed for by the spec, but I've never seen it used
fingerprint, nickname = entry.split('~')
elif entry[0] == '$':
# old style, fingerprint only
fingerprint, nickname = entry, None
else:
# old style, nickname only
fingerprint, nickname = None, entry
if fingerprint is not None:
if not stem.util.tor_tools.is_valid_fingerprint(fingerprint, True):
raise stem.ProtocolError('Fingerprint in the circuit path is malformed (%s)' % fingerprint)
fingerprint = fingerprint[1:] # strip off the leading '$'
if nickname is not None and not stem.util.tor_tools.is_valid_nickname(nickname):
raise stem.ProtocolError('Nickname in the circuit path is malformed (%s)' % nickname)
return (fingerprint, nickname)
@with_default()
def _case_insensitive_lookup(entries, key, default = UNDEFINED):
"""
Makes a case insensitive lookup within a list or dictionary, providing the
first matching entry that we come across.
:param list,dict entries: list or dictionary to be searched
:param str key: entry or key value to look up
:param object default: value to be returned if the key doesn't exist
:returns: case insensitive match or default if one was provided and key wasn't found
:raises: **ValueError** if no such value exists
"""
if entries is not None:
if isinstance(entries, dict):
for k, v in list(entries.items()):
if k.lower() == key.lower():
return v
else:
for entry in entries:
if entry.lower() == key.lower():
return entry
raise ValueError("key '%s' doesn't exist in dict: %s" % (key, entries))
def _get_with_timeout(event_queue, timeout, start_time):
"""
Pulls an item from a queue with a given timeout.
"""
if timeout:
time_left = timeout - (time.time() - start_time)
if time_left <= 0:
raise stem.Timeout('Reached our %0.1f second timeout' % timeout)
try:
return event_queue.get(True, time_left)
except queue.Empty:
raise stem.Timeout('Reached our %0.1f second timeout' % timeout)
else:
return event_queue.get()
stem-1.8.0/stem/__init__.py 0000664 0001750 0001750 00000074713 13602231125 016302 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Library for working with the tor process.
**Module Overview:**
::
Endpoint - Networking endpoint.
|- ORPort - Tor relay endpoint.
+- DirPort - Descriptor mirror.
ControllerError - Base exception raised when using the controller.
|- ProtocolError - Malformed socket data.
|
|- OperationFailed - Tor was unable to successfully complete the operation.
| |- UnsatisfiableRequest - Tor was unable to satisfy a valid request.
| | |- CircuitExtensionFailed - Attempt to make or extend a circuit failed.
| | |- DescriptorUnavailable - The given relay descriptor is unavailable.
| | +- Timeout - Caller requested timeout was reached.
| |
| |
| +- InvalidRequest - Invalid request.
| +- InvalidArguments - Invalid request parameters.
|
+- SocketError - Communication with the socket failed.
+- SocketClosed - Socket has been shut down.
DownloadFailed - Inability to download a resource.
+- DownloadTimeout - Download timeout reached.
.. data:: Runlevel (enum)
Rating of importance used for event logging.
=========== ===========
Runlevel Description
=========== ===========
**ERR** critical issues that impair tor's ability to function
**WARN** non-critical issues the user should be aware of
**NOTICE** information that may be helpful to the user
**INFO** high level runtime information
**DEBUG** low level runtime information
=========== ===========
.. data:: Signal (enum)
Signals that the tor process will accept.
.. versionchanged:: 1.3.0
Added the HEARTBEAT signal.
.. versionchanged:: 1.8.0
Added the ACTIVE and DORMANT signals. You can check for Tor support for
these signals with the **DORMANT_MODE** :data:`~stem.version.Requirement`
========================= ===========
Signal Description
========================= ===========
**RELOAD** or **HUP** reloads our torrc
**SHUTDOWN** or **INT** shut down, waiting ShutdownWaitLength first if we're a relay
**DUMP** or **USR1** dumps information about open connections and circuits to our log
**DEBUG** or **USR2** switch our logging to the DEBUG runlevel
**HALT** or **TERM** exit tor immediately
**NEWNYM** switch to new circuits, so new application requests don't share any circuits with old ones (this also clears our DNS cache)
**CLEARDNSCACHE** clears cached DNS results
**HEARTBEAT** trigger a heartbeat log message
**DORMANT** enables *dormant mode*, during which tor will avoid cpu and network usage
**ACTIVE** disables *dormant mode*
========================= ===========
.. data:: Flag (enum)
Flag assigned to tor relays by the authorities to indicate various
characteristics.
**Note:** The BADDIRECTORY flag was `removed from tor `_.
.. versionchanged:: 1.5.0
Added the NO_ED_CONSENSUS flag.
.. versionchanged:: 1.8.0
Added the STALE_DESC flag.
=================== ===========
Flag Description
=================== ===========
**AUTHORITY** relay is a directory authority
**BADEXIT** relay shouldn't be used as an exit due to being either problematic or malicious
**BADDIRECTORY** relay shouldn't be used for directory information
**EXIT** relay's exit policy makes it more useful as an exit rather than middle hop
**FAST** relay's suitable for high-bandwidth circuits
**GUARD** relay's suitable for being an entry guard (first hop)
**HSDIR** relay is being used as a v2 hidden service directory
**NAMED** relay can be referred to by its nickname
**NO_ED_CONSENSUS** relay's Ed25519 doesn't reflrect the consensus
**RUNNING** relay is currently usable
**STABLE** relay's suitable for long-lived circuits
**STALE_DESC** relay descriptor is outdated and should be re-uploaded
**UNNAMED** relay isn't currently bound to a nickname
**V2DIR** relay supports the v2 directory protocol
**VALID** relay has been validated
=================== ===========
.. data:: CircStatus (enum)
Statuses that a circuit can be in. Tor may provide statuses not in this enum.
.. versionchanged:: 1.6.0
Added the GUARD_WAIT signal.
============== ===========
CircStatus Description
============== ===========
**LAUNCHED** new circuit was created
**BUILT** circuit finished being created and can accept traffic
**GUARD_WAIT** waiting to see if there's a circuit with a better guard before using
**EXTENDED** circuit has been extended by a hop
**FAILED** circuit construction failed
**CLOSED** circuit has been closed
============== ===========
.. data:: CircBuildFlag (enum)
Attributes about how a circuit is built. These were introduced in tor version
0.2.3.11. Tor may provide flags not in this enum.
================= ===========
CircBuildFlag Description
================= ===========
**ONEHOP_TUNNEL** single hop circuit to fetch directory information
**IS_INTERNAL** circuit that won't be used for client traffic
**NEED_CAPACITY** circuit only includes high capacity relays
**NEED_UPTIME** circuit only includes relays with a high uptime
================= ===========
.. data:: CircPurpose (enum)
Description of what a circuit is intended for. These were introduced in tor
version 0.2.1.6. Tor may provide purposes not in this enum.
==================== ===========
CircPurpose Description
==================== ===========
**GENERAL** client traffic or fetching directory information
**HS_CLIENT_INTRO** client side introduction point for a hidden service circuit
**HS_CLIENT_REND** client side hidden service rendezvous circuit
**HS_SERVICE_INTRO** server side introduction point for a hidden service circuit
**HS_SERVICE_REND** server side hidden service rendezvous circuit
**TESTING** testing to see if we're reachable, so we can be used as a relay
**CONTROLLER** circuit that was built by a controller
**MEASURE_TIMEOUT** circuit being kept around to see how long it takes
==================== ===========
.. data:: CircClosureReason (enum)
Reason that a circuit is being closed or failed to be established. Tor may
provide reasons not in this enum.
========================= ===========
CircClosureReason Description
========================= ===========
**NONE** no reason given
**TORPROTOCOL** violation in the tor protocol
**INTERNAL** internal error
**REQUESTED** requested by the client via a TRUNCATE command
**HIBERNATING** relay is currently hibernating
**RESOURCELIMIT** relay is out of memory, sockets, or circuit IDs
**CONNECTFAILED** unable to contact the relay
**OR_IDENTITY** relay had the wrong OR identification
**OR_CONN_CLOSED** connection failed after being established
**FINISHED** circuit has expired (see tor's MaxCircuitDirtiness config option)
**TIMEOUT** circuit construction timed out
**DESTROYED** circuit unexpectedly closed
**NOPATH** not enough relays to make a circuit
**NOSUCHSERVICE** requested hidden service does not exist
**MEASUREMENT_EXPIRED** same as **TIMEOUT** except that it was left open for measurement purposes
========================= ===========
.. data:: CircEvent (enum)
Type of change reflected in a circuit by a CIRC_MINOR event. Tor may provide
event types not in this enum.
===================== ===========
CircEvent Description
===================== ===========
**PURPOSE_CHANGED** circuit purpose or hidden service state has changed
**CANNIBALIZED** circuit connections are being reused for a different circuit
===================== ===========
.. data:: HiddenServiceState (enum)
State that a hidden service circuit can have. These were introduced in tor
version 0.2.3.11. Tor may provide states not in this enum.
Enumerations fall into four groups based on their prefix...
======= ===========
Prefix Description
======= ===========
HSCI_* client-side introduction-point
HSCR_* client-side rendezvous-point
HSSI_* service-side introduction-point
HSSR_* service-side rendezvous-point
======= ===========
============================= ===========
HiddenServiceState Description
============================= ===========
**HSCI_CONNECTING** connecting to the introductory point
**HSCI_INTRO_SENT** sent INTRODUCE1 and awaiting a reply
**HSCI_DONE** received a reply, circuit is closing
**HSCR_CONNECTING** connecting to the introductory point
**HSCR_ESTABLISHED_IDLE** rendezvous-point established, awaiting an introduction
**HSCR_ESTABLISHED_WAITING** introduction received, awaiting a rend
**HSCR_JOINED** connected to the hidden service
**HSSI_CONNECTING** connecting to the introductory point
**HSSI_ESTABLISHED** established introductory point
**HSSR_CONNECTING** connecting to the introductory point
**HSSR_JOINED** connected to the rendezvous-point
============================= ===========
.. data:: RelayEndReason (enum)
Reasons why the stream is to be closed.
=================== ===========
RelayEndReason Description
=================== ===========
**MISC** none of the following reasons
**RESOLVEFAILED** unable to resolve the hostname
**CONNECTREFUSED** remote host refused the connection
**EXITPOLICY** OR refuses to connect to the destination
**DESTROY** circuit is being shut down
**DONE** connection has been closed
**TIMEOUT** connection timed out
**NOROUTE** routing error while contacting the destination
**HIBERNATING** relay is temporarily hibernating
**INTERNAL** internal error at the relay
**RESOURCELIMIT** relay has insufficient resources to service the request
**CONNRESET** connection was unexpectedly reset
**TORPROTOCOL** violation in the tor protocol
**NOTDIRECTORY** directory information requested from a relay that isn't mirroring it
=================== ===========
.. data:: StreamStatus (enum)
State that a stream going through tor can have. Tor may provide states not in
this enum.
================= ===========
StreamStatus Description
================= ===========
**NEW** request for a new connection
**NEWRESOLVE** request to resolve an address
**REMAP** address is being re-mapped to another
**SENTCONNECT** sent a connect cell along a circuit
**SENTRESOLVE** sent a resolve cell along a circuit
**SUCCEEDED** stream has been established
**FAILED** stream is detached, and won't be re-established
**DETACHED** stream is detached, but might be re-established
**CLOSED** stream has closed
================= ===========
.. data:: StreamClosureReason (enum)
Reason that a stream is being closed or failed to be established. This
includes all values in the :data:`~stem.RelayEndReason` enumeration as
well as the following. Tor may provide reasons not in this enum.
===================== ===========
StreamClosureReason Description
===================== ===========
**END** endpoint has sent a RELAY_END cell
**PRIVATE_ADDR** endpoint was a private address (127.0.0.1, 10.0.0.1, etc)
===================== ===========
.. data:: StreamSource (enum)
Cause of a stream being remapped to another address. Tor may provide sources
not in this enum.
============= ===========
StreamSource Description
============= ===========
**CACHE** tor is remapping because of a cached answer
**EXIT** exit relay requested the remap
============= ===========
.. data:: StreamPurpose (enum)
Purpsoe of the stream. This is only provided with new streams and tor may
provide purposes not in this enum.
================= ===========
StreamPurpose Description
================= ===========
**DIR_FETCH** fetching directory information (descriptors, consensus, etc)
**DIR_UPLOAD** uploading our descriptor to an authority
**DNS_REQUEST** user initiated DNS request
**DIRPORT_TEST** checking that our directory port is reachable externally
**USER** either relaying user traffic or not one of the above categories
================= ===========
.. data:: ORStatus (enum)
State that an OR connection can have. Tor may provide states not in this
enum.
=============== ===========
ORStatus Description
=============== ===========
**NEW** received OR connection, starting server-side handshake
**LAUNCHED** launched outbound OR connection, starting client-side handshake
**CONNECTED** OR connection has been established
**FAILED** attempt to establish OR connection failed
**CLOSED** OR connection has been closed
=============== ===========
.. data:: ORClosureReason (enum)
Reason that an OR connection is being closed or failed to be established. Tor
may provide reasons not in this enum.
=================== ===========
ORClosureReason Description
=================== ===========
**DONE** OR connection shut down cleanly
**CONNECTREFUSED** got a ECONNREFUSED when connecting to the relay
**IDENTITY** identity of the relay wasn't what we expected
**CONNECTRESET** got a ECONNRESET or similar error from relay
**TIMEOUT** got a ETIMEOUT or similar error from relay
**NOROUTE** got a ENOTCONN, ENETUNREACH, ENETDOWN, EHOSTUNREACH, or similar error from relay
**IOERROR** got a different kind of error from relay
**RESOURCELIMIT** relay has insufficient resources to service the request
**MISC** connection refused for another reason
**PT_MISSING** no pluggable transport was available
=================== ===========
.. data:: AuthDescriptorAction (enum)
Actions that directory authorities might take with relay descriptors. Tor may
provide reasons not in this enum.
===================== ===========
AuthDescriptorAction Description
===================== ===========
**ACCEPTED** accepting the descriptor as the newest version
**DROPPED** descriptor rejected without notifying the relay
**REJECTED** relay notified that its descriptor has been rejected
===================== ===========
.. data:: StatusType (enum)
Sources for tor status events. Tor may provide types not in this enum.
============= ===========
StatusType Description
============= ===========
**GENERAL** general tor activity, not specifically as a client or relay
**CLIENT** related to our activity as a tor client
**SERVER** related to our activity as a tor relay
============= ===========
.. data:: GuardType (enum)
Use a guard relay can be for. Tor may provide types not in this enum.
=========== ===========
GuardType Description
=========== ===========
**ENTRY** used to connect to the tor network
=========== ===========
.. data:: GuardStatus (enum)
Status a guard relay can have. Tor may provide types not in this enum.
============= ===========
GuardStatus Description
============= ===========
**NEW** new guard that we weren't previously using
**DROPPED** removed from use as one of our guards
**UP** guard is now reachable
**DOWN** guard is now unreachable
**BAD** consensus or relay considers this relay to be unusable as a guard
**GOOD** consensus or relay considers this relay to be usable as a guard
============= ===========
.. data:: TimeoutSetType (enum)
Way in which the timeout value of a circuit is changing. Tor may provide
types not in this enum.
=============== ===========
TimeoutSetType Description
=============== ===========
**COMPUTED** tor has computed a new timeout based on prior circuits
**RESET** timeout reverted to its default
**SUSPENDED** timeout reverted to its default until network connectivity has recovered
**DISCARD** throwing out timeout value from when the network was down
**RESUME** resumed calculations to determine the proper timeout
=============== ===========
.. data:: ConnectionType (enum)
Purpose for a tor connection. Tor may provide types not in this enum.
The meaning behind these values is a bit unclear, pending :trac:`10086`.
.. versionadded:: 1.2.0
=============== ===========
ConnectionType Description
=============== ===========
**OR** carrying traffic within the tor network
**DIR** fetching or sending tor descriptor data
**EXIT** carrying traffic between the tor network and an external destination
=============== ===========
.. data:: TokenBucket (enum)
Bucket categories of TB_EMPTY events.
.. versionadded:: 1.2.0
=============== ===========
TokenBucket Description
=============== ===========
**GLOBAL** global token bucket
**RELAY** relay token bucket
**ORCONN** bucket used for OR connections
=============== ===========
.. data:: HSDescAction (enum)
Action beeing taken in a HS_DESC event.
.. versionadded:: 1.2.0
.. versionchanged:: 1.4.0
Added the UPLOAD and UPLOADED actions.
.. versionchanged:: 1.5.0
Added the CREATED action.
=============== ===========
HSDescAction Description
=============== ===========
**REQUESTED** uncached hidden service descriptor is being requested
**UPLOAD** descriptor is being uploaded with HSPOST
**RECEIVED** hidden service descriptor has been retrieved
**UPLOADED** descriptor was uploaded with HSPOST
**IGNORE** fetched descriptor was ignored because we already have its v0 descriptor
**FAILED** we were unable to retrieve the descriptor
**CREATED** hidden service descriptor was just created
=============== ===========
.. data:: HSDescReason (enum)
Reason for the hidden service descriptor to fail to be fetched.
.. versionadded:: 1.3.0
.. versionchanged:: 1.4.0
Added the UPLOAD_REJECTED reason.
.. versionchanged:: 1.6.0
Added the QUERY_NO_HSDIR reason.
.. versionchanged:: 1.8.0
Added the QUERY_RATE_LIMITED reason.
======================= ===========
HSDescReason Description
======================= ===========
**BAD_DESC** descriptor was unparseable
**QUERY_REJECTED** hidden service directory refused to provide the descriptor
**UPLOAD_REJECTED** descriptor was rejected by the hidden service directory
**NOT_FOUND** descriptor with the given identifier wasn't found
**QUERY_NO_HSDIR** no hidden service directory was found
**QUERY_RATE_LIMITED** request was throttled
**UNEXPECTED** failure type is unknown
======================= ===========
.. data:: HSAuth (enum)
Type of authentication being used for a HS_DESC event.
.. versionadded:: 1.2.0
================= ===========
HSAuth Description
================= ===========
**NO_AUTH** no authentication
**BASIC_AUTH** general hidden service authentication
**STEALTH_AUTH** authentication method that hides service activity from unauthorized clients
**UNKNOWN** unrecognized method of authentication
================= ===========
"""
import traceback
import stem.util
import stem.util.enum
__version__ = '1.8.0'
__author__ = 'Damian Johnson'
__contact__ = 'atagar@torproject.org'
__url__ = 'https://stem.torproject.org/'
__license__ = 'LGPLv3'
__all__ = [
'client',
'descriptor',
'response',
'util',
'connection',
'control',
'directory',
'exit_policy',
'prereq',
'process',
'socket',
'version',
'ControllerError',
'ProtocolError',
'OperationFailed',
'UnsatisfiableRequest',
'CircuitExtensionFailed',
'DescriptorUnavailable',
'Timeout',
'InvalidRequest',
'InvalidArguments',
'SocketError',
'SocketClosed',
'DownloadFailed',
'DownloadTimeout',
'Runlevel',
'Signal',
'Flag',
'CircStatus',
'CircBuildFlag',
'CircPurpose',
'CircClosureReason',
'CircEvent',
'HiddenServiceState',
'HSAuth',
'HSDescAction',
'HSDescReason',
'RelayEndReason',
'StreamStatus',
'StreamClosureReason',
'StreamSource',
'StreamPurpose',
'ORStatus',
'ORClosureReason',
'AuthDescriptorAction',
'StatusType',
'GuardType',
'GuardStatus',
'TimeoutSetType',
]
# Constant that we use by default for our User-Agent when downloading descriptors
stem.USER_AGENT = 'Stem/%s' % __version__
# Constant to indicate an undefined argument default. Usually we'd use None for
# this, but users will commonly provide None as the argument so need something
# else fairly unique...
UNDEFINED = ''
class Endpoint(object):
"""
Tor endpint that can be connected to.
.. versionadded:: 1.7.0
:var str address: ip address of the endpoint
:var int port: port of the endpoint
"""
def __init__(self, address, port):
if not stem.util.connection.is_valid_ipv4_address(address) and not stem.util.connection.is_valid_ipv6_address(address):
raise ValueError("'%s' isn't a valid IPv4 or IPv6 address" % address)
elif not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port" % port)
self.address = address
self.port = int(port)
def __hash__(self):
return stem.util._hash_attr(self, 'address', 'port', cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Endpoint) else False
def __ne__(self, other):
return not self == other
class ORPort(Endpoint):
"""
Tor relay's ORPort. The endpoint on which Tor accepts relay traffic.
:var list link_protocols: link protocol version we're willing to establish
"""
def __init__(self, address, port, link_protocols = None):
super(ORPort, self).__init__(address, port)
self.link_protocols = link_protocols
def __hash__(self):
return stem.util._hash_attr(self, 'link_protocols', parent = Endpoint, cache = True)
class DirPort(Endpoint):
"""
Tor relay's DirPort. The endpoint on which Tor provides http access for
downloading descriptors.
"""
class ControllerError(Exception):
'Base error for controller communication issues.'
class ProtocolError(ControllerError):
'Malformed content from the control socket.'
class OperationFailed(ControllerError):
"""
Base exception class for failed operations that return an error code
:var str code: error code returned by Tor
:var str message: error message returned by Tor or a human readable error
message
"""
def __init__(self, code = None, message = None):
super(ControllerError, self).__init__(message)
self.code = code
self.message = message
class UnsatisfiableRequest(OperationFailed):
"""
Exception raised if Tor was unable to process our request.
"""
class CircuitExtensionFailed(UnsatisfiableRequest):
"""
An attempt to create or extend a circuit failed.
:var stem.response.CircuitEvent circ: response notifying us of the failure
"""
def __init__(self, message, circ = None):
super(CircuitExtensionFailed, self).__init__(message = message)
self.circ = circ
class DescriptorUnavailable(UnsatisfiableRequest):
"""
Tor was unable to provide a descriptor for the given relay.
.. versionchanged:: 1.7.0
Subclassed under UnsatisfiableRequest rather than OperationFailed.
"""
def __init__(self, message):
super(DescriptorUnavailable, self).__init__(message = message)
class Timeout(UnsatisfiableRequest):
"""
Timeout requested by the caller was reached.
.. versionadded:: 1.7.0
"""
def __init__(self, message):
super(Timeout, self).__init__(message = message)
class InvalidRequest(OperationFailed):
"""
Exception raised when the request was invalid or malformed.
"""
class InvalidArguments(InvalidRequest):
"""
Exception class for requests which had invalid arguments.
:var str code: error code returned by Tor
:var str message: error message returned by Tor or a human readable error
message
:var list arguments: a list of arguments which were invalid
"""
def __init__(self, code = None, message = None, arguments = None):
super(InvalidArguments, self).__init__(code, message)
self.arguments = arguments
class SocketError(ControllerError):
'Error arose while communicating with the control socket.'
class SocketClosed(SocketError):
'Control socket was closed before completing the message.'
class DownloadFailed(IOError):
"""
Inability to download a resource. Python's urllib module raises
a wide variety of undocumented exceptions (urllib2.URLError,
socket.timeout, and others).
This wraps lower level failures in a common exception type that
retains their exception and `stacktrace
`_.
.. versionadded:: 1.8.0
:var str url: url we failed to download from
:var Exception error: original urllib exception
:var traceback stacktrace: original stacktrace
:var str stacktrace_str: string representation of the stacktrace
"""
def __init__(self, url, error, stacktrace, message = None):
if message is None:
# The string representation of exceptions can reside in several places.
# urllib.URLError use a 'reason' attribute that in turn may referrence
# low level structures such as socket.gaierror. Whereas most exceptions
# use a 'message' attribute.
reason = str(error)
all_str_repr = (
getattr(getattr(error, 'reason', None), 'strerror', None),
getattr(error, 'reason', None),
getattr(error, 'message', None),
)
for str_repr in all_str_repr:
if str_repr and isinstance(str_repr, str):
reason = str_repr
break
message = 'Failed to download from %s (%s): %s' % (url, type(error).__name__, reason)
super(DownloadFailed, self).__init__(message)
self.url = url
self.error = error
self.stacktrace = stacktrace
self.stacktrace_str = ''.join(traceback.format_tb(stacktrace))
class DownloadTimeout(DownloadFailed):
"""
Timeout reached while downloading this resource.
.. versionadded:: 1.8.0
"""
def __init__(self, url, error, stacktrace, timeout):
message = 'Failed to download from %s: %0.1f second timeout reached' % (url, timeout)
super(DownloadTimeout, self).__init__(url, error, stacktrace, message)
Runlevel = stem.util.enum.UppercaseEnum(
'DEBUG',
'INFO',
'NOTICE',
'WARN',
'ERR',
)
Flag = stem.util.enum.Enum(
('AUTHORITY', 'Authority'),
('BADEXIT', 'BadExit'),
('BADDIRECTORY', 'BadDirectory'),
('EXIT', 'Exit'),
('FAST', 'Fast'),
('GUARD', 'Guard'),
('HSDIR', 'HSDir'),
('NAMED', 'Named'),
('NO_ED_CONSENSUS', 'NoEdConsensus'),
('RUNNING', 'Running'),
('STABLE', 'Stable'),
('STALE_DESC', 'StaleDesc'),
('UNNAMED', 'Unnamed'),
('V2DIR', 'V2Dir'),
('V3DIR', 'V3Dir'),
('VALID', 'Valid'),
)
Signal = stem.util.enum.UppercaseEnum(
'RELOAD',
'HUP',
'SHUTDOWN',
'INT',
'DUMP',
'USR1',
'DEBUG',
'USR2',
'HALT',
'TERM',
'NEWNYM',
'CLEARDNSCACHE',
'HEARTBEAT',
'ACTIVE',
'DORMANT',
)
CircStatus = stem.util.enum.UppercaseEnum(
'LAUNCHED',
'BUILT',
'GUARD_WAIT',
'EXTENDED',
'FAILED',
'CLOSED',
)
CircBuildFlag = stem.util.enum.UppercaseEnum(
'ONEHOP_TUNNEL',
'IS_INTERNAL',
'NEED_CAPACITY',
'NEED_UPTIME',
)
CircPurpose = stem.util.enum.UppercaseEnum(
'GENERAL',
'HS_CLIENT_INTRO',
'HS_CLIENT_REND',
'HS_SERVICE_INTRO',
'HS_SERVICE_REND',
'TESTING',
'CONTROLLER',
'MEASURE_TIMEOUT',
)
CircClosureReason = stem.util.enum.UppercaseEnum(
'NONE',
'TORPROTOCOL',
'INTERNAL',
'REQUESTED',
'HIBERNATING',
'RESOURCELIMIT',
'CONNECTFAILED',
'OR_IDENTITY',
'OR_CONN_CLOSED',
'FINISHED',
'TIMEOUT',
'DESTROYED',
'NOPATH',
'NOSUCHSERVICE',
'MEASUREMENT_EXPIRED',
)
CircEvent = stem.util.enum.UppercaseEnum(
'PURPOSE_CHANGED',
'CANNIBALIZED',
)
HiddenServiceState = stem.util.enum.UppercaseEnum(
'HSCI_CONNECTING',
'HSCI_INTRO_SENT',
'HSCI_DONE',
'HSCR_CONNECTING',
'HSCR_ESTABLISHED_IDLE',
'HSCR_ESTABLISHED_WAITING',
'HSCR_JOINED',
'HSSI_CONNECTING',
'HSSI_ESTABLISHED',
'HSSR_CONNECTING',
'HSSR_JOINED',
)
RelayEndReason = stem.util.enum.UppercaseEnum(
'MISC',
'RESOLVEFAILED',
'CONNECTREFUSED',
'EXITPOLICY',
'DESTROY',
'DONE',
'TIMEOUT',
'NOROUTE',
'HIBERNATING',
'INTERNAL',
'RESOURCELIMIT',
'CONNRESET',
'TORPROTOCOL',
'NOTDIRECTORY',
)
StreamStatus = stem.util.enum.UppercaseEnum(
'NEW',
'NEWRESOLVE',
'REMAP',
'SENTCONNECT',
'SENTRESOLVE',
'SUCCEEDED',
'FAILED',
'DETACHED',
'CLOSED',
)
# StreamClosureReason is a superset of RelayEndReason
StreamClosureReason = stem.util.enum.UppercaseEnum(*(RelayEndReason.keys() + [
'END',
'PRIVATE_ADDR',
]))
StreamSource = stem.util.enum.UppercaseEnum(
'CACHE',
'EXIT',
)
StreamPurpose = stem.util.enum.UppercaseEnum(
'DIR_FETCH',
'DIR_UPLOAD',
'DNS_REQUEST',
'DIRPORT_TEST',
'USER',
)
ORStatus = stem.util.enum.UppercaseEnum(
'NEW',
'LAUNCHED',
'CONNECTED',
'FAILED',
'CLOSED',
)
ORClosureReason = stem.util.enum.UppercaseEnum(
'DONE',
'CONNECTREFUSED',
'IDENTITY',
'CONNECTRESET',
'TIMEOUT',
'NOROUTE',
'IOERROR',
'RESOURCELIMIT',
'MISC',
'PT_MISSING',
)
AuthDescriptorAction = stem.util.enum.UppercaseEnum(
'ACCEPTED',
'DROPPED',
'REJECTED',
)
StatusType = stem.util.enum.UppercaseEnum(
'GENERAL',
'CLIENT',
'SERVER',
)
GuardType = stem.util.enum.UppercaseEnum(
'ENTRY',
)
GuardStatus = stem.util.enum.UppercaseEnum(
'NEW',
'UP',
'DOWN',
'BAD',
'GOOD',
'DROPPED',
)
TimeoutSetType = stem.util.enum.UppercaseEnum(
'COMPUTED',
'RESET',
'SUSPENDED',
'DISCARD',
'RESUME',
)
ConnectionType = stem.util.enum.UppercaseEnum(
'OR',
'DIR',
'EXIT',
)
TokenBucket = stem.util.enum.UppercaseEnum(
'GLOBAL',
'RELAY',
'ORCONN',
)
HSDescAction = stem.util.enum.UppercaseEnum(
'REQUESTED',
'UPLOAD',
'RECEIVED',
'UPLOADED',
'IGNORE',
'FAILED',
'CREATED',
)
HSDescReason = stem.util.enum.UppercaseEnum(
'BAD_DESC',
'QUERY_REJECTED',
'UPLOAD_REJECTED',
'NOT_FOUND',
'QUERY_NO_HSDIR',
'UNEXPECTED',
)
HSAuth = stem.util.enum.UppercaseEnum(
'NO_AUTH',
'BASIC_AUTH',
'STEALTH_AUTH',
'UNKNOWN',
)
import stem.util.connection # importing afterward to avoid circular dependency
stem-1.8.0/stem/settings.cfg 0000664 0001750 0001750 00000076362 13601502033 016512 0 ustar atagar atagar 0000000 0000000 ################################################################################
#
# Information related to tor configuration options and events...
#
# * manual.important Most commonly used configuration options.
# * manual.summary Short summary describing the option.
# * event.description Descriptions for the events.
#
################################################################################
manual.important BandwidthRate
manual.important BandwidthBurst
manual.important RelayBandwidthRate
manual.important RelayBandwidthBurst
manual.important ControlPort
manual.important HashedControlPassword
manual.important CookieAuthentication
manual.important DataDirectory
manual.important Log
manual.important RunAsDaemon
manual.important User
manual.important Bridge
manual.important ExcludeNodes
manual.important MaxCircuitDirtiness
manual.important SocksPort
manual.important UseBridges
manual.important BridgeRelay
manual.important ContactInfo
manual.important ExitPolicy
manual.important MyFamily
manual.important Nickname
manual.important ORPort
manual.important AccountingMax
manual.important AccountingStart
manual.important DirPortFrontPage
manual.important DirPort
manual.important HiddenServiceDir
manual.important HiddenServicePort
# General Config Options
manual.summary.BandwidthRate Average bandwidth usage limit
manual.summary.BandwidthBurst Maximum bandwidth usage limit
manual.summary.MaxAdvertisedBandwidth Limit for the bandwidth we advertise as being available for relaying
manual.summary.RelayBandwidthRate Average bandwidth usage limit for relaying
manual.summary.RelayBandwidthBurst Maximum bandwidth usage limit for relaying
manual.summary.PerConnBWRate Average relayed bandwidth limit per connection
manual.summary.PerConnBWBurst Maximum relayed bandwidth limit per connection
manual.summary.ClientTransportPlugin Proxy when establishing bridge connections
manual.summary.ServerTransportPlugin Proxy when servicing bridge connections
manual.summary.ServerTransportListenAddr Endpoint for bridge's pluggable transport proxy
manual.summary.ServerTransportOptions Additional arguments for bridge's proxy
manual.summary.ExtORPort Endpoint for extended ORPort connections
manual.summary.ExtORPortCookieAuthFile Location of the ExtORPort's authentication cookie
manual.summary.ExtORPortCookieAuthFileGroupReadable Group read permissions for the ExtORPort's authentication cookie
manual.summary.ConnLimit Minimum number of file descriptors for Tor to start
manual.summary.DisableNetwork Don't accept non-controller connections
manual.summary.ConstrainedSockets Shrinks sockets to ConstrainedSockSize
manual.summary.ConstrainedSockSize Limit for the received and transmit buffers of sockets
manual.summary.ControlPort Port providing access to tor controllers (nyx, vidalia, etc)
manual.summary.ControlSocket Socket providing controller access
manual.summary.ControlSocketsGroupWritable Group read permissions for the control socket
manual.summary.HashedControlPassword Hash of the password for authenticating to the control port
manual.summary.CookieAuthentication If set, authenticates controllers via a cookie
manual.summary.CookieAuthFile Location of the authentication cookie
manual.summary.CookieAuthFileGroupReadable Group read permissions for the authentication cookie
manual.summary.ControlPortWriteToFile Path for a file tor writes containing its control port
manual.summary.ControlPortFileGroupReadable Group read permissions for the control port file
manual.summary.DataDirectory Location for storing runtime data (state, keys, etc)
manual.summary.DataDirectoryGroupReadable Group read permissions for the data directory
manual.summary.CacheDirectory Directory where information is cached
manual.summary.CacheDirectoryGroupReadable Group read permissions for the cache directory
manual.summary.FallbackDir Fallback when unable to retrieve descriptor information
manual.summary.UseDefaultFallbackDirs Use hard-coded fallback directory authorities when needed
manual.summary.DirAuthority Alternative directory authorities
manual.summary.DirAuthorityFallbackRate Rate at which to use fallback directory
manual.summary.AlternateDirAuthority Alternative directory authorities (consensus only)
manual.summary.AlternateBridgeAuthority Alternative directory authorities (bridges only)
manual.summary.DisableAllSwap Locks all allocated memory so they can't be paged out
manual.summary.DisableDebuggerAttachment Limit information applications can retrieve about the process
manual.summary.FetchDirInfoEarly Keeps consensus information up to date, even if unnecessary
manual.summary.FetchDirInfoExtraEarly Updates consensus information when it's first available
manual.summary.FetchHidServDescriptors Toggles if hidden service descriptors are fetched automatically or not
manual.summary.FetchServerDescriptors Toggles if the consensus is fetched automatically or not
manual.summary.FetchUselessDescriptors Toggles if relay descriptors are fetched when they aren't strictly necessary
manual.summary.HTTPProxy HTTP proxy for connecting to tor
manual.summary.HTTPProxyAuthenticator Authentication credentials for HTTPProxy
manual.summary.HTTPSProxy SSL proxy for connecting to tor
manual.summary.HTTPSProxyAuthenticator Authentication credentials for HTTPSProxy
manual.summary.Sandbox Run within a syscall sandbox
manual.summary.Socks4Proxy SOCKS 4 proxy for connecting to tor
manual.summary.Socks5Proxy SOCKS 5 for connecting to tor
manual.summary.Socks5ProxyUsername Username for connecting to the Socks5Proxy
manual.summary.Socks5ProxyPassword Password for connecting to the Socks5Proxy
manual.summary.UnixSocksGroupWritable Group write permissions for the socks socket
manual.summary.KeepalivePeriod Rate at which to send keepalive packets
manual.summary.Log Runlevels and location for tor logging
manual.summary.LogMessageDomains Includes a domain when logging messages
manual.summary.MaxUnparseableDescSizeToLog Size of the dedicated log for unparseable descriptors
manual.summary.OutboundBindAddress Sets the IP used for connecting to tor
manual.summary.OutboundBindAddressOR Make outbound non-exit connections originate from this address
manual.summary.OutboundBindAddressExit Make outbound exit connections originate from this address
manual.summary.PidFile Path for a file tor writes containing its process id
manual.summary.ProtocolWarnings Toggles if protocol errors give warnings or not
manual.summary.RunAsDaemon Toggles if tor runs as a daemon process
manual.summary.LogTimeGranularity limits granularity of log message timestamps
manual.summary.TruncateLogFile Overwrites log file rather than appending when restarted
manual.summary.SyslogIdentityTag Tag logs appended to the syslog as being from tor
manual.summary.AndroidIdentityTag Tag when logging to android subsystem
manual.summary.SafeLogging Toggles if logs are scrubbed of sensitive information
manual.summary.User UID for the process when started
manual.summary.KeepBindCapabilities Retain permission for binding to low valued ports
manual.summary.HardwareAccel Toggles if tor attempts to use hardware acceleration
manual.summary.AccelName OpenSSL engine name for crypto acceleration
manual.summary.AccelDir Crypto acceleration library path
manual.summary.AvoidDiskWrites Toggles if tor avoids frequently writing to disk
manual.summary.CircuitPriorityHalflife Overwrite method for prioritizing traffic among relayed connections
manual.summary.CountPrivateBandwidth Applies rate limiting to private IP addresses
manual.summary.ExtendByEd25519ID Include Ed25519 identifier when extending circuits
manual.summary.NoExec Prevents any launch of other executables
manual.summary.Schedulers Scheduling algorithm by which to send outbound data
manual.summary.KISTSchedRunInterval Scheduling interval if using KIST
manual.summary.KISTSockBufSizeFactor Multiplier for per-socket limit if using KIST
# Client Config Options
manual.summary.Bridge Available bridges
manual.summary.LearnCircuitBuildTimeout Toggles adaptive timeouts for circuit creation
manual.summary.CircuitBuildTimeout Initial timeout for circuit creation
manual.summary.CircuitsAvailableTimeout Time to keep circuits open and unused for
manual.summary.CircuitStreamTimeout Timeout for shifting streams among circuits
manual.summary.ClientOnly Ensures that we aren't used as a relay or directory mirror
manual.summary.ConnectionPadding Pad traffic to help prevent correlation attacks
manual.summary.ReducedConnectionPadding Reduce padding and increase circuit cycling for low bandidth connections
manual.summary.CircuitPadding Pad circuit traffic to help prevent correlation attacks
manual.summary.ReducedCircuitPadding Only use lightweight padding algorithms
manual.summary.ExcludeNodes Relays or locales never to be used in circuits
manual.summary.ExcludeExitNodes Relays or locales never to be used for exits
manual.summary.GeoIPExcludeUnknown Don't use relays with an unknown locale in circuits
manual.summary.ExitNodes Preferred final hop for circuits
manual.summary.MiddleNodes Preferred middle hops for circuits
manual.summary.EntryNodes Preferred first hops for circuits
manual.summary.StrictNodes Never uses notes outside of Entry/ExitNodes
manual.summary.FascistFirewall Only make outbound connections on FirewallPorts
manual.summary.FirewallPorts Ports used by FascistFirewall
manual.summary.HidServAuth Authentication credentials for connecting to a hidden service
manual.summary.ClientOnionAuthDir Path containing hidden service authorization files
manual.summary.ReachableAddresses Rules for bypassing the local firewall
manual.summary.ReachableDirAddresses Rules for bypassing the local firewall (directory fetches)
manual.summary.ReachableORAddresses Rules for bypassing the local firewall (OR connections)
manual.summary.LongLivedPorts Ports requiring highly reliable relays
manual.summary.MapAddress Alias mappings for address requests
manual.summary.NewCircuitPeriod Period for considering the creation of new circuits
manual.summary.MaxCircuitDirtiness Duration for reusing constructed circuits
manual.summary.MaxClientCircuitsPending Number of circuits that can be in construction at once
manual.summary.NodeFamily Define relays as belonging to a family
manual.summary.EnforceDistinctSubnets Prevent use of multiple relays from the same subnet on a circuit
manual.summary.SocksPort Port for using tor as a Socks proxy
manual.summary.SocksPolicy Access policy for the pocks port
manual.summary.SocksTimeout Time until idle or unestablished socks connections are closed
manual.summary.TokenBucketRefillInterval Frequency at which exhausted connections are checked for new traffic
manual.summary.TrackHostExits Maintains use of the same exit whenever connecting to this destination
manual.summary.TrackHostExitsExpire Time until use of an exit for tracking expires
manual.summary.UpdateBridgesFromAuthority Toggles fetching bridge descriptors from the authorities
manual.summary.UseBridges Make use of configured bridges
manual.summary.UseEntryGuards Use guard relays for first hop
manual.summary.GuardfractionFile File containing information with duration of our guards
manual.summary.UseGuardFraction Take guardfraction into account for path selection
manual.summary.NumEntryGuards Pool size of guard relays we'll select from
manual.summary.NumPrimaryGuards Pool size of strongly preferred guard relays we'll select from
manual.summary.NumDirectoryGuards Pool size of directory guards we'll select from
manual.summary.GuardLifetime Minimum time to keep entry guards
manual.summary.SafeSocks Toggles rejecting unsafe variants of the socks protocol
manual.summary.TestSocks Provide notices for if socks connections are of the safe or unsafe variants
manual.summary.VirtualAddrNetworkIPv4 IPv4 address range to use when needing a virtual address
manual.summary.VirtualAddrNetworkIPv6 IPv6 address range to use when needing a virtual address
manual.summary.AllowNonRFC953Hostnames Toggles blocking invalid characters in hostname resolution
manual.summary.HTTPTunnelPort Port on which to allow 'HTTP CONNECT' connections
manual.summary.TransPort Port for transparent proxying if the OS supports it
manual.summary.TransProxyType Proxy type to be used
manual.summary.NATDPort Port for forwarding ipfw NATD connections
manual.summary.AutomapHostsOnResolve Map addresses ending with special suffixes to virtual addresses
manual.summary.AutomapHostsSuffixes Address suffixes recognized by AutomapHostsOnResolve
manual.summary.DNSPort Port from which DNS responses are fetched instead of tor
manual.summary.ClientDNSRejectInternalAddresses Disregards anonymous DNS responses for internal addresses
manual.summary.ClientRejectInternalAddresses Disables use of Tor for internal connections
manual.summary.DownloadExtraInfo Toggles fetching of extra information about relays
manual.summary.WarnPlaintextPorts Toggles warnings for using risky ports
manual.summary.RejectPlaintextPorts Prevents connections on risky ports
manual.summary.OptimisticData Use exits without confirmation that prior connections succeeded
manual.summary.HSLayer2Nodes permissible relays for the second hop of HS circuits
manual.summary.HSLayer3Nodes permissible relays for the third hop of HS circuits
manual.summary.UseMicrodescriptors Retrieve microdescriptors rather than server descriptors
manual.summary.PathBiasCircThreshold Number of circuits through a guard before applying bias checks
manual.summary.PathBiasNoticeRate Fraction of circuits that must succeed before logging a notice
manual.summary.PathBiasWarnRate Fraction of circuits that must succeed before logging a warning
manual.summary.PathBiasExtremeRate Fraction of circuits that must succeed before logging an error
manual.summary.PathBiasDropGuards Drop guards failing to establish circuits
manual.summary.PathBiasScaleThreshold Circuits through a guard before scaling past observations down
manual.summary.PathBiasUseThreshold Number of streams through a circuit before applying bias checks
manual.summary.PathBiasNoticeUseRate Fraction of streams that must succeed before logging a notice
manual.summary.PathBiasExtremeUseRate Fraction of streams that must succeed before logging an error
manual.summary.PathBiasScaleUseThreshold Streams through a circuit before scaling past observations down
manual.summary.ClientUseIPv4 Allow IPv4 connections to guards and fetching consensus
manual.summary.ClientUseIPv6 Allow IPv6 connections to guards and fetching consensus
manual.summary.ClientPreferIPv6DirPort Perfer relays with IPv6 when fetching consensus
manual.summary.ClientPreferIPv6ORPort Prefer a guard's IPv6 rather than IPv4 endpoint
manual.summary.ClientAutoIPv6ORPort Connect to IPv6 ORPorts when available
manual.summary.PathsNeededToBuildCircuits Portion of relays to require information for before making circuits
manual.summary.ClientBootstrapConsensusAuthorityDownloadInitialDelay Delay when bootstrapping before downloading descriptors from authorities
manual.summary.ClientBootstrapConsensusFallbackDownloadInitialDelay Delay when bootstrapping before downloading descriptors from fallbacks
manual.summary.ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay Delay when bootstrapping before downloading descriptors from authorities if fallbacks disabled
manual.summary.ClientBootstrapConsensusMaxInProgressTries Descriptor documents that can be downloaded in parallel
manual.summary.DormantClientTimeout Become dormant when unused as a client for this duration
manual.summary.DormantTimeoutDisabledByIdleStreams Include idle streams when determining dormancy
manual.summary.DormantOnFirstStartup Begin tor in dormant mode
manual.summary.DormantCanceledByStartup Disable dormant mode when tor's restarted
# Server Config Options
manual.summary.Address Overwrites address others will use to reach this relay
manual.summary.AssumeReachable Skips reachability test at startup
manual.summary.BridgeRelay Act as a bridge
manual.summary.BridgeDistribution Distribution method BrideDB should provide our address by
manual.summary.ContactInfo Contact information for this relay
manual.summary.ExitRelay Allow relaying of exit traffic
manual.summary.ExitPolicy Traffic destinations that can exit from this relay
manual.summary.ExitPolicyRejectPrivate Prevent exiting on the local network
manual.summary.ExitPolicyRejectLocalInterfaces More extensive prevention of exiting on the local network
manual.summary.ReducedExitPolicy Customized reduced exit policy
manual.summary.IPv6Exit Allow clients to use us for IPv6 traffic
manual.summary.MaxOnionQueueDelay Duration to reject new onionskins if we have more than we can process
manual.summary.MyFamily Other relays this operator administers
manual.summary.Nickname Identifier for this relay
manual.summary.NumCPUs Number of processes spawned for decryption
manual.summary.ORPort Port used to accept relay traffic
manual.summary.PublishServerDescriptor Types of descriptors published
manual.summary.ShutdownWaitLength Delay before quitting after receiving a SIGINT signal
manual.summary.SSLKeyLifetime Lifetime for our link certificate
manual.summary.HeartbeatPeriod Rate at which an INFO level heartbeat message is sent
manual.summary.MainloopStats Include development information from the main loop with heartbeats
manual.summary.AccountingMax Amount of traffic before hibernating
manual.summary.AccountingRule Method to determine when the accounting limit is reached
manual.summary.AccountingStart Duration of an accounting period
manual.summary.RefuseUnknownExits Prevents relays not in the consensus from using us as an exit
manual.summary.ServerDNSResolvConfFile Overriding resolver config for DNS queries we provide
manual.summary.ServerDNSAllowBrokenConfig Toggles if we persist despite configuration parsing errors or not
manual.summary.ServerDNSSearchDomains Toggles if our DNS queries search for addresses in the local domain
manual.summary.ServerDNSDetectHijacking Toggles testing for DNS hijacking
manual.summary.ServerDNSTestAddresses Addresses to test to see if valid DNS queries are being hijacked
manual.summary.ServerDNSAllowNonRFC953Hostnames Toggles if we reject DNS queries with invalid characters
manual.summary.BridgeRecordUsageByCountry Tracks geoip information on bridge usage
manual.summary.ServerDNSRandomizeCase Toggles DNS query case randomization
manual.summary.GeoIPFile Path to file containing IPv4 geoip information
manual.summary.GeoIPv6File Path to file containing IPv6 geoip information
manual.summary.CellStatistics Toggles storing circuit queue duration to disk
manual.summary.PaddingStatistics Toggles storing padding counts
manual.summary.DirReqStatistics Toggles storing network status counts and performance to disk
manual.summary.EntryStatistics Toggles storing client connection counts to disk
manual.summary.ExitPortStatistics Toggles storing traffic and port usage data to disk
manual.summary.ConnDirectionStatistics Toggles storing connection use to disk
manual.summary.HiddenServiceStatistics Toggles storing hidden service stats to disk
manual.summary.ExtraInfoStatistics Publishes statistic data in the extra-info documents
manual.summary.ExtendAllowPrivateAddresses Allow circuits to be extended to the local network
manual.summary.MaxMemInQueues Threshold at which tor will terminate circuits to avoid running out of memory
manual.summary.DisableOOSCheck Don't close connections when running out of sockets
manual.summary.SigningKeyLifetime Duration the Ed25519 signing key is valid for
manual.summary.OfflineMasterKey Don't generate the master secret key
manual.summary.KeyDirectory Directory where secret keys reside
manual.summary.KeyDirectoryGroupReadable Group read permissions for the secret key directory
# Directory Server Options
manual.summary.DirPortFrontPage Publish this html file on the DirPort
manual.summary.DirPort Port for directory connections
manual.summary.DirPolicy Access policy for the DirPort
manual.summary.DirCache Provide cached descriptor information to other tor users
manual.summary.MaxConsensusAgeForDiffs Time to generate consensus caches for
# Directory Authority Server Options
manual.summary.AuthoritativeDirectory Act as a directory authority
manual.summary.V3AuthoritativeDirectory Generates a version 3 consensus
manual.summary.VersioningAuthoritativeDirectory Provides opinions on recommended versions of tor
manual.summary.RecommendedVersions Suggested versions of tor
manual.summary.RecommendedClientVersions Tor versions believed to be safe for clients
manual.summary.BridgeAuthoritativeDir Acts as a bridge authority
manual.summary.MinUptimeHidServDirectoryV2 Required uptime before accepting hidden service directory
manual.summary.RecommendedServerVersions Tor versions believed to be safe for relays
manual.summary.ConsensusParams Params entry of the networkstatus vote
manual.summary.DirAllowPrivateAddresses Toggles allowing arbitrary input or non-public IPs in descriptors
manual.summary.AuthDirBadExit Relays to be flagged as bad exits
manual.summary.AuthDirInvalid Relays from which the valid flag is withheld
manual.summary.AuthDirReject Relays to be dropped from the consensus
manual.summary.AuthDirBadExitCCs Countries for which to flag all relays as bad exits
manual.summary.AuthDirInvalidCCs Countries for which the valid flag is withheld
manual.summary.AuthDirRejectCCs Countries for which relays aren't accepted into the consensus
manual.summary.AuthDirListBadExits Toggles if we provide an opinion on bad exits
manual.summary.AuthDirMaxServersPerAddr Limit on the number of relays accepted per ip
manual.summary.AuthDirFastGuarantee Advertised rate at which the Fast flag is granted
manual.summary.AuthDirGuardBWGuarantee Advertised rate necessary to be a guard
manual.summary.AuthDirPinKeys Don't accept descriptors with conflicting identity keypairs
manual.summary.AuthDirSharedRandomness Participates in shared randomness voting
manual.summary.AuthDirTestEd25519LinkKeys Require proper Ed25519 key for the Running flag
manual.summary.BridgePassword Password for requesting bridge information
manual.summary.V3AuthVotingInterval Consensus voting interval
manual.summary.V3AuthVoteDelay Wait time to collect votes of other authorities
manual.summary.V3AuthDistDelay Wait time to collect the signatures of other authorities
manual.summary.V3AuthNIntervalsValid Number of voting intervals a consensus is valid for
manual.summary.V3BandwidthsFile Path to a file containing measured relay bandwidths
manual.summary.V3AuthUseLegacyKey Signs consensus with both the current and legacy keys
manual.summary.RephistTrackTime Discards old, unchanged reliability information
manual.summary.AuthDirHasIPv6Connectivity Descriptors can be retrieved over the authority's IPv6 ORPort
manual.summary.MinMeasuredBWsForAuthToIgnoreAdvertised Total measured value before advertised bandwidths are treated as unreliable
# Hidden Service Options
manual.summary.HiddenServiceDir Directory contents for the hidden service
manual.summary.HiddenServicePort Port the hidden service is provided on
manual.summary.PublishHidServDescriptors Toggles automated publishing of the hidden service to the rendezvous directory
manual.summary.HiddenServiceVersion Version for published hidden service descriptors
manual.summary.HiddenServiceAuthorizeClient Restricts access to the hidden service
manual.summary.HiddenServiceAllowUnknownPorts Allow rendezvous circuits on unrecognized ports
manual.summary.HiddenServiceExportCircuitID Exposes incoming client circuits via the given protocol
manual.summary.HiddenServiceMaxStreams Maximum streams per rendezvous circuit
manual.summary.HiddenServiceMaxStreamsCloseCircuit Closes rendezvous circuits that exceed the maximum number of streams
manual.summary.RendPostPeriod Period at which the rendezvous service descriptors are refreshed
manual.summary.HiddenServiceDirGroupReadable Group read permissions for the hidden service directory
manual.summary.HiddenServiceNumIntroductionPoints Number of introduction points the hidden service will have
manual.summary.HiddenServiceEnableIntroDoSDefense Introduction point DoS protection
manual.summary.HiddenServiceEnableIntroDoSRatePerSec Request rate allowed for the introduction point
manual.summary.HiddenServiceEnableIntroDoSBurstPerSec Burst rate allowed for the introduction point
manual.summary.HiddenServiceSingleHopMode Allow non-anonymous single hop hidden services
manual.summary.HiddenServiceNonAnonymousMode Enables HiddenServiceSingleHopMode to be set
# DoS Mitigation Options
manual.summary.DoSCircuitCreationEnabled Enables circuit creation DoS mitigation
manual.summary.DoSCircuitCreationMinConnections Connection rate when clients are a suspected DoS
manual.summary.DoSCircuitCreationRate Acceptable rate for circuit creation
manual.summary.DoSCircuitCreationBurst Accept burst of circuit creation up to this rate
manual.summary.DoSCircuitCreationDefenseType Method for mitigating circuit creation DoS
manual.summary.DoSCircuitCreationDefenseTimePeriod Duration of DoS mitigation
manual.summary.DoSConnectionEnabled Enables connection DoS mitigation
manual.summary.DoSConnectionMaxConcurrentCount Acceptable number of connections
manual.summary.DoSConnectionDefenseType Method for mitigating connection DoS
manual.summary.DoSRefuseSingleHopClientRendezvous Prevent establishment of single hop rendezvous points
# Testing Network Options
manual.summary.TestingTorNetwork Overrides other options to be a testing network
manual.summary.TestingV3AuthInitialVotingInterval Overrides V3AuthVotingInterval for the first consensus
manual.summary.TestingV3AuthInitialVoteDelay Overrides TestingV3AuthInitialVoteDelay for the first consensus
manual.summary.TestingV3AuthInitialDistDelay Overrides TestingV3AuthInitialDistDelay for the first consensus
manual.summary.TestingV3AuthVotingStartOffset Offset for the point at which the authority votes
manual.summary.TestingAuthDirTimeToLearnReachability Delay until opinions are given about which relays are running or not
manual.summary.TestingEstimatedDescriptorPropagationTime Delay before clients attempt to fetch descriptors from directory caches
manual.summary.TestingMinFastFlagThreshold Minimum value for the Fast flag
manual.summary.TestingServerDownloadInitialDelay Delay before downloading resources for relaying
manual.summary.TestingClientDownloadInitialDelay Delay before downloading resources for client usage
manual.summary.TestingServerConsensusDownloadInitialDelay Delay before downloading descriptors for relaying
manual.summary.TestingClientConsensusDownloadInitialDelay Delay before downloading descriptors for client usage
manual.summary.TestingBridgeDownloadInitialDelay Delay before downloading bridge descriptors
manual.summary.TestingBridgeBootstrapDownloadInitialDelay Delay before downloading bridge descriptors when first started
manual.summary.TestingClientMaxIntervalWithoutRequest Maximum time to wait to batch requests for missing descriptors
manual.summary.TestingDirConnectionMaxStall Duration to let directory connections stall before timing out
manual.summary.TestingDirAuthVoteExit Relays to give the Exit flag to
manual.summary.TestingDirAuthVoteExitIsStrict Only grant the Exit flag to relays listed by TestingDirAuthVoteExit
manual.summary.TestingDirAuthVoteGuard Relays to give the Guard flag to
manual.summary.TestingDirAuthVoteGuardIsStrict Only grant the Guard flag to relays listed by TestingDirAuthVoteGuard
manual.summary.TestingDirAuthVoteHSDir Relays to give the HSDir flag to
manual.summary.TestingDirAuthVoteHSDirIsStrict Only grant the HSDir flag to relays listed by TestingDirAuthVoteHSDir
manual.summary.TestingEnableConnBwEvent Allow controllers to request CONN_BW events
manual.summary.TestingEnableCellStatsEvent Allow controllers to request CELL_STATS events
manual.summary.TestingMinExitFlagThreshold Lower bound for assigning the Exit flag
manual.summary.TestingLinkCertLifetime Duration of our ed25519 certificate
manual.summary.TestingAuthKeyLifetime Duration for our ed25519 signing key
manual.summary.TestingLinkKeySlop Time before expiration that we replace our ed25519 link key
manual.summary.TestingAuthKeySlop Time before expiration that we replace our ed25519 authentication key
manual.summary.TestingSigningKeySlop Time before expiration that we replace our ed25519 signing key
# Brief description of tor events
event.description.debug Logging at the debug runlevel. This is low level, high volume information about tor's internals that generally isn't useful to users.
event.description.info Logging at the info runlevel. This is low level information of important internal processes.
event.description.notice Logging at the notice runlevel. This runlevel and above are shown to users by default, and includes general information the user should be aware of.
event.description.warn Logging at the warning runlevel. These are problems the user should be aware of.
event.description.err Logging at the error runlevel. These are critical issues that may prevent tor from working properly.
event.description.addrmap New address mapping for our DNS cache.
event.description.authdir_newdescs Indicates we just received a new descriptor. This is only used by directory authorities.
event.description.buildtimeout_set Indicates the timeout value for a circuit has changed.
event.description.bw Event emitted every second with the bytes sent and received by tor.
event.description.cell_stats Event emitted every second with the count of the number of cell types per circuit.
event.description.circ Indicates that a circuit we've established through the tor network has been created, changed, or closed.
event.description.circ_bw Event emitted every second with the bytes sent and received on a per-circuit basis.
event.description.circ_minor Minor changes to our circuits, such as reuse of existing circuits for a different purpose.
event.description.clients_seen Periodic summary of the countries we've seen users connect from. This is only used by bridge relays.
event.description.conf_changed Indicates that our torrc configuration has changed. This could be in response to a SETCONF or RELOAD signal.
event.description.conn_bw Event emitted every second with the byytes sent and received on a per-connection basis.
event.description.descchanged Indicates that our descriptor has changed.
event.description.guard Indicates that the set of relays we use for our initial connection into the tor network (guards) have changed.
event.description.hs_desc Received a hidden service descriptor that wasn't yet cached.
event.description.hs_desc_content Content of a hidden service descriptor we've fetched.
event.description.network_liveness Emitted when the network becomes reachable or unreachable.
event.description.newconsensus Received a new hourly consensus of relays in the tor network.
event.description.newdesc Indicates that a new descriptor is available.
event.description.ns Consensus information for an individual relay has changed. This could be due to receiving a new consensus or tor locally decides a relay is up or down.
event.description.orconn Change in our connections as a relay.
event.description.signal Indicates that tor has received and acted upon a signal being sent to its process.
event.description.status_client Notification of a change in tor's state as a client (ie user).
event.description.status_general Notification of a change in tor's state.
event.description.status_server Notification of a change in tor's state as a relay.
event.description.stream Communication over a circuit we've established. For instance, Firefox making a connection through tor.
event.description.stream_bw Event emitted every second with the bytes sent and received for a specific stream.
event.description.tb_empty Statistics for when token buckets are refilled. This is only used when TestingTorNetwork is set.
event.description.transport_launched Emitted when a pluggable transport is launched.
stem-1.8.0/stem/socket.py 0000664 0001750 0001750 00000061332 13567605150 016041 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Supports communication with sockets speaking Tor protocols. This
allows us to send messages as basic strings, and receive responses as
:class:`~stem.response.ControlMessage` instances.
**This module only consists of low level components, and is not intended for
users.** See our `tutorials <../tutorials.html>`_ and `Control Module
`_ if you're new to Stem and looking to get started.
With that aside, these can still be used for raw socket communication with
Tor...
::
import stem
import stem.connection
import stem.socket
if __name__ == '__main__':
try:
control_socket = stem.socket.ControlPort(port = 9051)
stem.connection.authenticate(control_socket)
except stem.SocketError as exc:
print 'Unable to connect to tor on port 9051: %s' % exc
sys.exit(1)
except stem.connection.AuthenticationFailure as exc:
print 'Unable to authenticate: %s' % exc
sys.exit(1)
print "Issuing 'GETINFO version' query...\\n"
control_socket.send('GETINFO version')
print control_socket.recv()
::
% python example.py
Issuing 'GETINFO version' query...
version=0.2.4.10-alpha-dev (git-8be6058d8f31e578)
OK
**Module Overview:**
::
BaseSocket - Thread safe socket.
|- RelaySocket - Socket for a relay's ORPort.
| |- send - sends a message to the socket
| +- recv - receives a response from the socket
|
|- ControlSocket - Socket wrapper that speaks the tor control protocol.
| |- ControlPort - Control connection via a port.
| |- ControlSocketFile - Control connection via a local file socket.
| |
| |- send - sends a message to the socket
| +- recv - receives a ControlMessage from the socket
|
|- is_alive - reports if the socket is known to be closed
|- is_localhost - returns if the socket is for the local system or not
|- connection_time - timestamp when socket last connected or disconnected
|- connect - connects a new socket
|- close - shuts down the socket
+- __enter__ / __exit__ - manages socket connection
send_message - Writes a message to a control socket.
recv_message - Reads a ControlMessage from a control socket.
send_formatting - Performs the formatting expected from sent messages.
"""
from __future__ import absolute_import
import re
import socket
import ssl
import threading
import time
import stem.prereq
import stem.response
import stem.util.str_tools
from stem.util import log
MESSAGE_PREFIX = re.compile(b'^[a-zA-Z0-9]{3}[-+ ]')
ERROR_MSG = 'Error while receiving a control message (%s): %s'
# lines to limit our trace logging to, you can disable this by setting it to None
TRUNCATE_LOGS = 10
class BaseSocket(object):
"""
Thread safe socket, providing common socket functionality.
"""
def __init__(self):
self._socket, self._socket_file = None, None
self._is_alive = False
self._connection_time = 0.0 # time when we last connected or disconnected
# Tracks sending and receiving separately. This should be safe, and doing
# so prevents deadlock where we block writes because we're waiting to read
# a message that isn't coming.
self._send_lock = threading.RLock()
self._recv_lock = threading.RLock()
def is_alive(self):
"""
Checks if the socket is known to be closed. We won't be aware if it is
until we either use it or have explicitily shut it down.
In practice a socket derived from a port knows about its disconnection
after failing to receive data, whereas socket file derived connections
know after either sending or receiving data.
This means that to have reliable detection for when we're disconnected
you need to continually pull from the socket (which is part of what the
:class:`~stem.control.BaseController` does).
:returns: **bool** that's **True** if our socket is connected and **False**
otherwise
"""
return self._is_alive
def is_localhost(self):
"""
Returns if the connection is for the local system or not.
:returns: **bool** that's **True** if the connection is for the local host
and **False** otherwise
"""
return False
def connection_time(self):
"""
Provides the unix timestamp for when our socket was either connected or
disconnected. That is to say, the time we connected if we're currently
connected and the time we disconnected if we're not connected.
.. versionadded:: 1.3.0
:returns: **float** for when we last connected or disconnected, zero if
we've never connected
"""
return self._connection_time
def connect(self):
"""
Connects to a new socket, closing our previous one if we're already
attached.
:raises: :class:`stem.SocketError` if unable to make a socket
"""
with self._send_lock:
# Closes the socket if we're currently attached to one. Once we're no
# longer alive it'll be safe to acquire the recv lock because recv()
# calls no longer block (raising SocketClosed instead).
if self.is_alive():
self.close()
with self._recv_lock:
self._socket = self._make_socket()
self._socket_file = self._socket.makefile(mode = 'rwb')
self._is_alive = True
self._connection_time = time.time()
# It's possible for this to have a transient failure...
# SocketError: [Errno 4] Interrupted system call
#
# It's safe to retry, so give it another try if it fails.
try:
self._connect()
except stem.SocketError:
self._connect() # single retry
def close(self):
"""
Shuts down the socket. If it's already closed then this is a no-op.
"""
with self._send_lock:
# Function is idempotent with one exception: we notify _close() if this
# is causing our is_alive() state to change.
is_change = self.is_alive()
if self._socket:
# if we haven't yet established a connection then this raises an error
# socket.error: [Errno 107] Transport endpoint is not connected
try:
self._socket.shutdown(socket.SHUT_RDWR)
except socket.error:
pass
# Suppressing unexpected exceptions from close. For instance, if the
# socket's file has already been closed then with python 2.7 that raises
# with...
# error: [Errno 32] Broken pipe
try:
self._socket.close()
except:
pass
if self._socket_file:
try:
self._socket_file.close()
except:
pass
self._socket = None
self._socket_file = None
self._is_alive = False
self._connection_time = time.time()
if is_change:
self._close()
def _send(self, message, handler):
"""
Send message in a thread safe manner. Handler is expected to be of the form...
::
my_handler(socket, socket_file, message)
"""
with self._send_lock:
try:
if not self.is_alive():
raise stem.SocketClosed()
handler(self._socket, self._socket_file, message)
except stem.SocketClosed:
# if send_message raises a SocketClosed then we should properly shut
# everything down
if self.is_alive():
self.close()
raise
def _recv(self, handler):
"""
Receives a message in a thread safe manner. Handler is expected to be of the form...
::
my_handler(socket, socket_file)
"""
with self._recv_lock:
try:
# makes a temporary reference to the _socket_file because connect()
# and close() may set or unset it
my_socket, my_socket_file = self._socket, self._socket_file
if not my_socket or not my_socket_file:
raise stem.SocketClosed()
return handler(my_socket, my_socket_file)
except stem.SocketClosed:
# If recv_message raises a SocketClosed then we should properly shut
# everything down. However, there's a couple cases where this will
# cause deadlock...
#
# * This SocketClosed was *caused by* a close() call, which is joining
# on our thread.
#
# * A send() call that's currently in flight is about to call close(),
# also attempting to join on us.
#
# To resolve this we make a non-blocking call to acquire the send lock.
# If we get it then great, we can close safely. If not then one of the
# above are in progress and we leave the close to them.
if self.is_alive():
if self._send_lock.acquire(False):
self.close()
self._send_lock.release()
raise
def _get_send_lock(self):
"""
The send lock is useful to classes that interact with us at a deep level
because it's used to lock :func:`stem.socket.ControlSocket.connect` /
:func:`stem.socket.BaseSocket.close`, and by extension our
:func:`stem.socket.BaseSocket.is_alive` state changes.
:returns: **threading.RLock** that governs sending messages to our socket
and state changes
"""
return self._send_lock
def __enter__(self):
return self
def __exit__(self, exit_type, value, traceback):
self.close()
def _connect(self):
"""
Connection callback that can be overwritten by subclasses and wrappers.
"""
pass
def _close(self):
"""
Disconnection callback that can be overwritten by subclasses and wrappers.
"""
pass
def _make_socket(self):
"""
Constructs and connects new socket. This is implemented by subclasses.
:returns: **socket.socket** for our configuration
:raises:
* :class:`stem.SocketError` if unable to make a socket
* **NotImplementedError** if not implemented by a subclass
"""
raise NotImplementedError('Unsupported Operation: this should be implemented by the BaseSocket subclass')
class RelaySocket(BaseSocket):
"""
`Link-level connection
`_ to a Tor
relay.
.. versionadded:: 1.7.0
:var str address: address our socket connects to
:var int port: ORPort our socket connects to
"""
def __init__(self, address = '127.0.0.1', port = 9050, connect = True):
"""
RelaySocket constructor.
:param str address: ip address of the relay
:param int port: orport of the relay
:param bool connect: connects to the socket if True, leaves it unconnected otherwise
:raises: :class:`stem.SocketError` if connect is **True** and we're
unable to establish a connection
"""
super(RelaySocket, self).__init__()
self.address = address
self.port = port
if connect:
self.connect()
def send(self, message):
"""
Sends a message to the relay's ORPort.
:param str message: message to be formatted and sent to the socket
:raises:
* :class:`stem.SocketError` if a problem arises in using the socket
* :class:`stem.SocketClosed` if the socket is known to be shut down
"""
self._send(message, lambda s, sf, msg: _write_to_socket(sf, msg))
def recv(self, timeout = None):
"""
Receives a message from the relay.
:param float timeout: maxiumum number of seconds to await a response, this
blocks indefinitely if **None**
:returns: bytes for the message received
:raises:
* :class:`stem.ProtocolError` the content from the socket is malformed
* :class:`stem.SocketClosed` if the socket closes before we receive a complete message
"""
def wrapped_recv(s, sf):
if timeout is None:
return s.recv()
else:
s.setblocking(0)
s.settimeout(timeout)
try:
return s.recv()
except (socket.timeout, ssl.SSLError, ssl.SSLWantReadError):
return None
finally:
s.setblocking(1)
return self._recv(wrapped_recv)
def is_localhost(self):
return self.address == '127.0.0.1'
def _make_socket(self):
try:
relay_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
relay_socket.connect((self.address, self.port))
return ssl.wrap_socket(relay_socket)
except socket.error as exc:
raise stem.SocketError(exc)
class ControlSocket(BaseSocket):
"""
Wrapper for a socket connection that speaks the Tor control protocol. To the
better part this transparently handles the formatting for sending and
receiving complete messages.
Callers should not instantiate this class directly, but rather use subclasses
which are expected to implement the **_make_socket()** method.
"""
def __init__(self):
super(ControlSocket, self).__init__()
def send(self, message):
"""
Formats and sends a message to the control socket. For more information see
the :func:`~stem.socket.send_message` function.
.. deprecated:: 1.7.0
The **raw** argument was unhelpful and be removed. Use
:func:`stem.socket.send_message` if you need this level of control
instead.
:param str message: message to be formatted and sent to the socket
:raises:
* :class:`stem.SocketError` if a problem arises in using the socket
* :class:`stem.SocketClosed` if the socket is known to be shut down
"""
self._send(message, lambda s, sf, msg: send_message(sf, msg))
def recv(self):
"""
Receives a message from the control socket, blocking until we've received
one. For more information see the :func:`~stem.socket.recv_message` function.
:returns: :class:`~stem.response.ControlMessage` for the message received
:raises:
* :class:`stem.ProtocolError` the content from the socket is malformed
* :class:`stem.SocketClosed` if the socket closes before we receive a complete message
"""
return self._recv(lambda s, sf: recv_message(sf))
class ControlPort(ControlSocket):
"""
Control connection to tor. For more information see tor's ControlPort torrc
option.
:var str address: address our socket connects to
:var int port: ControlPort our socket connects to
"""
def __init__(self, address = '127.0.0.1', port = 9051, connect = True):
"""
ControlPort constructor.
:param str address: ip address of the controller
:param int port: port number of the controller
:param bool connect: connects to the socket if True, leaves it unconnected otherwise
:raises: :class:`stem.SocketError` if connect is **True** and we're
unable to establish a connection
"""
super(ControlPort, self).__init__()
self.address = address
self.port = port
if connect:
self.connect()
def get_address(self):
"""
Provides the ip address our socket connects to.
.. deprecated:: 1.7.0
Use the **address** attribute instead.
:returns: str with the ip address of our socket
"""
return self.address
def get_port(self):
"""
Provides the port our socket connects to.
.. deprecated:: 1.7.0
Use the **port** attribute instead.
:returns: int with the port of our socket
"""
return self.port
def is_localhost(self):
return self.address == '127.0.0.1'
def _make_socket(self):
try:
control_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
control_socket.connect((self.address, self.port))
return control_socket
except socket.error as exc:
raise stem.SocketError(exc)
class ControlSocketFile(ControlSocket):
"""
Control connection to tor. For more information see tor's ControlSocket torrc
option.
:var str path: filesystem path of the socket we connect to
"""
def __init__(self, path = '/var/run/tor/control', connect = True):
"""
ControlSocketFile constructor.
:param str socket_path: path where the control socket is located
:param bool connect: connects to the socket if True, leaves it unconnected otherwise
:raises: :class:`stem.SocketError` if connect is **True** and we're
unable to establish a connection
"""
super(ControlSocketFile, self).__init__()
self.path = path
if connect:
self.connect()
def get_socket_path(self):
"""
Provides the path our socket connects to.
.. deprecated:: 1.7.0
Use the **path** attribute instead.
:returns: str with the path for our control socket
"""
return self.path
def is_localhost(self):
return True
def _make_socket(self):
try:
control_socket = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
control_socket.connect(self.path)
return control_socket
except socket.error as exc:
raise stem.SocketError(exc)
def send_message(control_file, message, raw = False):
"""
Sends a message to the control socket, adding the expected formatting for
single verses multi-line messages. Neither message type should contain an
ending newline (if so it'll be treated as a multi-line message with a blank
line at the end). If the message doesn't contain a newline then it's sent
as...
::
\\r\\n
and if it does contain newlines then it's split on ``\\n`` and sent as...
::
+\\r\\n
\\r\\n
\\r\\n
.\\r\\n
:param file control_file: file derived from the control socket (see the
socket's makefile() method for more information)
:param str message: message to be sent on the control socket
:param bool raw: leaves the message formatting untouched, passing it to the
socket as-is
:raises:
* :class:`stem.SocketError` if a problem arises in using the socket
* :class:`stem.SocketClosed` if the socket is known to be shut down
"""
if not raw:
message = send_formatting(message)
_write_to_socket(control_file, message)
if log.is_tracing():
log_message = message.replace('\r\n', '\n').rstrip()
msg_div = '\n' if '\n' in log_message else ' '
log.trace('Sent to tor:%s%s' % (msg_div, log_message))
def _write_to_socket(socket_file, message):
try:
socket_file.write(stem.util.str_tools._to_bytes(message))
socket_file.flush()
except socket.error as exc:
log.info('Failed to send: %s' % exc)
# When sending there doesn't seem to be a reliable method for
# distinguishing between failures from a disconnect verses other things.
# Just accounting for known disconnection responses.
if str(exc) == '[Errno 32] Broken pipe':
raise stem.SocketClosed(exc)
else:
raise stem.SocketError(exc)
except AttributeError:
# if the control_file has been closed then flush will receive:
# AttributeError: 'NoneType' object has no attribute 'sendall'
log.info('Failed to send: file has been closed')
raise stem.SocketClosed('file has been closed')
def recv_message(control_file, arrived_at = None):
"""
Pulls from a control socket until we either have a complete message or
encounter a problem.
:param file control_file: file derived from the control socket (see the
socket's makefile() method for more information)
:returns: :class:`~stem.response.ControlMessage` read from the socket
:raises:
* :class:`stem.ProtocolError` the content from the socket is malformed
* :class:`stem.SocketClosed` if the socket closes before we receive
a complete message
"""
parsed_content, raw_content, first_line = None, None, True
while True:
try:
line = control_file.readline()
except AttributeError:
# if the control_file has been closed then we will receive:
# AttributeError: 'NoneType' object has no attribute 'recv'
log.info(ERROR_MSG % ('SocketClosed', 'socket file has been closed'))
raise stem.SocketClosed('socket file has been closed')
except (socket.error, ValueError) as exc:
# When disconnected we get...
#
# Python 2:
# socket.error: [Errno 107] Transport endpoint is not connected
#
# Python 3:
# ValueError: I/O operation on closed file.
log.info(ERROR_MSG % ('SocketClosed', 'received exception "%s"' % exc))
raise stem.SocketClosed(exc)
# Parses the tor control lines. These are of the form...
# \r\n
if not line:
# if the socket is disconnected then the readline() method will provide
# empty content
log.info(ERROR_MSG % ('SocketClosed', 'empty socket content'))
raise stem.SocketClosed('Received empty socket content.')
elif not MESSAGE_PREFIX.match(line):
log.info(ERROR_MSG % ('ProtocolError', 'malformed status code/divider, "%s"' % log.escape(line)))
raise stem.ProtocolError('Badly formatted reply line: beginning is malformed')
elif not line.endswith(b'\r\n'):
log.info(ERROR_MSG % ('ProtocolError', 'no CRLF linebreak, "%s"' % log.escape(line)))
raise stem.ProtocolError('All lines should end with CRLF')
status_code, divider, content = line[:3], line[3:4], line[4:-2] # strip CRLF off content
if stem.prereq.is_python_3():
status_code = stem.util.str_tools._to_unicode(status_code)
divider = stem.util.str_tools._to_unicode(divider)
# Most controller responses are single lines, in which case we don't need
# so much overhead.
if first_line:
if divider == ' ':
_log_trace(line)
return stem.response.ControlMessage([(status_code, divider, content)], line, arrived_at = arrived_at)
else:
parsed_content, raw_content, first_line = [], bytearray(), False
raw_content += line
if divider == '-':
# mid-reply line, keep pulling for more content
parsed_content.append((status_code, divider, content))
elif divider == ' ':
# end of the message, return the message
parsed_content.append((status_code, divider, content))
_log_trace(bytes(raw_content))
return stem.response.ControlMessage(parsed_content, bytes(raw_content), arrived_at = arrived_at)
elif divider == '+':
# data entry, all of the following lines belong to the content until we
# get a line with just a period
content_block = bytearray(content)
while True:
try:
line = control_file.readline()
raw_content += line
except socket.error as exc:
log.info(ERROR_MSG % ('SocketClosed', 'received an exception while mid-way through a data reply (exception: "%s", read content: "%s")' % (exc, log.escape(bytes(raw_content)))))
raise stem.SocketClosed(exc)
if not line.endswith(b'\r\n'):
log.info(ERROR_MSG % ('ProtocolError', 'CRLF linebreaks missing from a data reply, "%s"' % log.escape(bytes(raw_content))))
raise stem.ProtocolError('All lines should end with CRLF')
elif line == b'.\r\n':
break # data block termination
line = line[:-2] # strips off the CRLF
# lines starting with a period are escaped by a second period (as per
# section 2.4 of the control-spec)
if line.startswith(b'..'):
line = line[1:]
content_block += b'\n' + line
# joins the content using a newline rather than CRLF separator (more
# conventional for multi-line string content outside the windows world)
parsed_content.append((status_code, divider, bytes(content_block)))
else:
# this should never be reached due to the prefix regex, but might as well
# be safe...
log.warn(ERROR_MSG % ('ProtocolError', "\"%s\" isn't a recognized divider type" % divider))
raise stem.ProtocolError("Unrecognized divider type '%s': %s" % (divider, stem.util.str_tools._to_unicode(line)))
def send_formatting(message):
"""
Performs the formatting expected from sent control messages. For more
information see the :func:`~stem.socket.send_message` function.
:param str message: message to be formatted
:returns: **str** of the message wrapped by the formatting expected from
controllers
"""
# From control-spec section 2.2...
# Command = Keyword OptArguments CRLF / "+" Keyword OptArguments CRLF CmdData
# Keyword = 1*ALPHA
# OptArguments = [ SP *(SP / VCHAR) ]
#
# A command is either a single line containing a Keyword and arguments, or a
# multiline command whose initial keyword begins with +, and whose data
# section ends with a single "." on a line of its own.
# if we already have \r\n entries then standardize on \n to start with
message = message.replace('\r\n', '\n')
if '\n' in message:
return '+%s\r\n.\r\n' % message.replace('\n', '\r\n')
else:
return message + '\r\n'
def _log_trace(response):
if not log.is_tracing():
return
log_message = stem.util.str_tools._to_unicode(response.replace(b'\r\n', b'\n').rstrip())
log_message_lines = log_message.split('\n')
if TRUNCATE_LOGS and len(log_message_lines) > TRUNCATE_LOGS:
log_message = '\n'.join(log_message_lines[:TRUNCATE_LOGS] + ['... %i more lines...' % (len(log_message_lines) - TRUNCATE_LOGS)])
if len(log_message_lines) > 2:
log.trace('Received from tor:\n%s' % log_message)
else:
log.trace('Received from tor: %s' % log_message.replace('\n', '\\n'))
stem-1.8.0/stem/manual.py 0000664 0001750 0001750 00000067523 13601502033 016017 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Information available about Tor from `its manual
`_. This provides three
methods of getting this information...
* :func:`~stem.manual.Manual.from_cache` provides manual content bundled with
Stem. This is the fastest and most reliable method but only as up-to-date as
Stem's release.
* :func:`~stem.manual.Manual.from_man` reads Tor's local man page for
information about it.
* :func:`~stem.manual.Manual.from_remote` fetches the latest manual information
remotely. This is the slowest and least reliable method but provides the most
recent information about Tor.
Manual information includes arguments, signals, and probably most usefully the
torrc configuration options. For example, say we want a little script that told
us what our torrc options do...
.. literalinclude:: /_static/example/manual_config_options.py
:language: python
|
.. image:: /_static/manual_output.png
|
**Module Overview:**
::
query - performs a query on our cached sqlite manual information
is_important - Indicates if a configuration option is of particularly common importance.
download_man_page - Downloads tor's latest man page.
Manual - Information about Tor available from its manual.
| |- from_cache - Provides manual information cached with Stem.
| |- from_man - Retrieves manual information from its man page.
| +- from_remote - Retrieves manual information remotely from tor's latest manual.
|
+- save - writes the manual contents to a given location
.. versionadded:: 1.5.0
"""
import os
import shutil
import sys
import tempfile
import stem
import stem.prereq
import stem.util
import stem.util.conf
import stem.util.enum
import stem.util.log
import stem.util.system
try:
# added in python 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
Category = stem.util.enum.Enum('GENERAL', 'CLIENT', 'RELAY', 'DIRECTORY', 'AUTHORITY', 'HIDDEN_SERVICE', 'DENIAL_OF_SERVICE', 'TESTING', 'UNKNOWN')
GITWEB_MANUAL_URL = 'https://gitweb.torproject.org/tor.git/plain/doc/tor.1.txt'
CACHE_PATH = os.path.join(os.path.dirname(__file__), 'cached_manual.sqlite')
DATABASE = None # cache database connections
HAS_ENCODING_ARG = not stem.util.system.is_mac() and not stem.util.system.is_bsd() and not stem.util.system.is_slackware()
SCHEMA_VERSION = 1 # version of our scheme, bump this if you change the following
SCHEMA = (
'CREATE TABLE schema(version INTEGER)',
'INSERT INTO schema(version) VALUES (%i)' % SCHEMA_VERSION,
'CREATE TABLE metadata(name TEXT, synopsis TEXT, description TEXT, man_commit TEXT, stem_commit TEXT)',
'CREATE TABLE commandline(name TEXT PRIMARY KEY, description TEXT)',
'CREATE TABLE signals(name TEXT PRIMARY KEY, description TEXT)',
'CREATE TABLE files(name TEXT PRIMARY KEY, description TEXT)',
'CREATE TABLE torrc(key TEXT PRIMARY KEY, name TEXT, category TEXT, usage TEXT, summary TEXT, description TEXT, position INTEGER)',
)
CATEGORY_SECTIONS = OrderedDict((
('GENERAL OPTIONS', Category.GENERAL),
('CLIENT OPTIONS', Category.CLIENT),
('SERVER OPTIONS', Category.RELAY),
('DIRECTORY SERVER OPTIONS', Category.DIRECTORY),
('DIRECTORY AUTHORITY SERVER OPTIONS', Category.AUTHORITY),
('HIDDEN SERVICE OPTIONS', Category.HIDDEN_SERVICE),
('DENIAL OF SERVICE MITIGATION OPTIONS', Category.DENIAL_OF_SERVICE),
('TESTING NETWORK OPTIONS', Category.TESTING),
))
class SchemaMismatch(IOError):
"""
Database schema doesn't match what Stem supports.
.. versionadded:: 1.6.0
:var int database_schema: schema of the database
:var tuple supported_schemas: schemas library supports
"""
def __init__(self, message, database_schema, library_schema):
super(SchemaMismatch, self).__init__(message)
self.database_schema = database_schema
self.library_schema = library_schema
def query(query, *param):
"""
Performs the given query on our sqlite manual cache. This database should
be treated as being read-only. File permissions generally enforce this, and
in the future will be enforced by this function as well.
::
>>> import stem.manual
>>> print(stem.manual.query('SELECT description FROM torrc WHERE key=?', 'CONTROLSOCKET').fetchone()[0])
Like ControlPort, but listens on a Unix domain socket, rather than a TCP socket. 0 disables ControlSocket. (Unix and Unix-like systems only.) (Default: 0)
.. versionadded:: 1.6.0
:param str query: query to run on the cache
:param list param: query parameters
:returns: :class:`sqlite3.Cursor` with the query results
:raises:
* **ImportError** if the sqlite3 module is unavailable
* **sqlite3.OperationalError** if query fails
"""
if not stem.prereq.is_sqlite_available():
raise ImportError('Querying requires the sqlite3 module')
import sqlite3
# The only reason to explicitly close the sqlite connection is to ensure
# transactions are committed. Since we're only using read-only access this
# doesn't matter, and can allow interpreter shutdown to do the needful.
#
# TODO: When we only support python 3.4+ we can use sqlite's uri argument
# to enforce a read-only connection...
#
# https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
global DATABASE
if DATABASE is None:
DATABASE = sqlite3.connect(CACHE_PATH)
return DATABASE.execute(query, param)
class ConfigOption(object):
"""
Tor configuration attribute found in its torrc.
:var str name: name of the configuration option
:var stem.manual.Category category: category the config option was listed
under, this is Category.UNKNOWN if we didn't recognize the category
:var str usage: arguments accepted by the option
:var str summary: brief description of what the option does
:var str description: longer manual description with details
"""
def __init__(self, name, category = Category.UNKNOWN, usage = '', summary = '', description = ''):
self.name = name
self.category = category
self.usage = usage
self.summary = summary
self.description = description
def __hash__(self):
return stem.util._hash_attr(self, 'name', 'category', 'usage', 'summary', 'description', cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, ConfigOption) else False
def __ne__(self, other):
return not self == other
@lru_cache()
def _config(lowercase = True):
"""
Provides a dictionary for our settings.cfg. This has a couple categories...
* manual.important (list) - configuration options considered to be important
* manual.summary.* (str) - summary descriptions of config options
:param bool lowercase: uses lowercase keys if **True** to allow for case
insensitive lookups
"""
config = stem.util.conf.Config()
config_path = os.path.join(os.path.dirname(__file__), 'settings.cfg')
try:
config.load(config_path)
config_dict = dict([(key.lower() if lowercase else key, config.get_value(key)) for key in config.keys() if key.startswith('manual.summary.')])
config_dict['manual.important'] = [name.lower() if lowercase else name for name in config.get_value('manual.important', [], multiple = True)]
return config_dict
except Exception as exc:
stem.util.log.warn("BUG: stem failed to load its internal manual information from '%s': %s" % (config_path, exc))
return {}
def _manual_differences(previous_manual, new_manual):
"""
Provides a description of how two manuals differ.
"""
lines = []
for attr in ('name', 'synopsis', 'description', 'commandline_options', 'signals', 'files', 'config_options'):
previous_attr = getattr(previous_manual, attr)
new_attr = getattr(new_manual, attr)
if previous_attr != new_attr:
lines.append("* Manual's %s attribute changed\n" % attr)
if attr in ('name', 'synopsis', 'description'):
lines.append(' Previously...\n\n%s\n' % previous_attr)
lines.append(' Updating to...\n\n%s' % new_attr)
elif attr == 'config_options':
for config_name, config_attr in new_attr.items():
previous = previous_attr.get(config_name)
if previous is None:
lines.append(' adding new config option => %s' % config_name)
elif config_attr != previous:
for attr in ('name', 'category', 'usage', 'summary', 'description'):
if getattr(config_attr, attr) != getattr(previous, attr):
lines.append(' modified %s (%s) => %s' % (config_name, attr, getattr(config_attr, attr)))
for config_name in set(previous_attr.keys()).difference(new_attr.keys()):
lines.append(' removing config option => %s' % config_name)
else:
added_items = set(new_attr.items()).difference(previous_attr.items())
removed_items = set(previous_attr.items()).difference(new_attr.items())
for added_item in added_items:
lines.append(' adding %s => %s' % added_item)
for removed_item in removed_items:
lines.append(' removing %s => %s' % removed_item)
lines.append('\n')
return '\n'.join(lines)
def is_important(option):
"""
Indicates if a configuration option of particularly common importance or not.
:param str option: tor configuration option to check
:returns: **bool** that's **True** if this is an important option and
**False** otherwise
"""
return option.lower() in _config()['manual.important']
def download_man_page(path = None, file_handle = None, url = GITWEB_MANUAL_URL, timeout = 20):
"""
Downloads tor's latest man page from `gitweb.torproject.org
`_. This method is
both slow and unreliable - please see the warnings on
:func:`~stem.manual.Manual.from_remote`.
:param str path: path to save tor's man page to
:param file file_handle: file handler to save tor's man page to
:param str url: url to download tor's asciidoc manual from
:param int timeout: seconds to wait before timing out the request
:raises: **IOError** if unable to retrieve the manual
"""
if not path and not file_handle:
raise ValueError("Either the path or file_handle we're saving to must be provided")
elif not stem.util.system.is_available('a2x'):
raise IOError('We require a2x from asciidoc to provide a man page')
dirpath = tempfile.mkdtemp()
asciidoc_path = os.path.join(dirpath, 'tor.1.txt')
manual_path = os.path.join(dirpath, 'tor.1')
try:
try:
with open(asciidoc_path, 'wb') as asciidoc_file:
request = urllib.urlopen(url, timeout = timeout)
shutil.copyfileobj(request, asciidoc_file)
except:
exc, stacktrace = sys.exc_info()[1:3]
message = "Unable to download tor's manual from %s to %s: %s" % (url, asciidoc_path, exc)
raise stem.DownloadFailed(url, exc, stacktrace, message)
try:
stem.util.system.call('a2x -f manpage %s' % asciidoc_path)
if not os.path.exists(manual_path):
raise OSError('no man page was generated')
except stem.util.system.CallError as exc:
raise IOError("Unable to run '%s': %s" % (exc.command, exc.stderr))
if path:
try:
path_dir = os.path.dirname(path)
if not os.path.exists(path_dir):
os.makedirs(path_dir)
shutil.copyfile(manual_path, path)
except OSError as exc:
raise IOError(exc)
if file_handle:
with open(manual_path, 'rb') as manual_file:
shutil.copyfileobj(manual_file, file_handle)
file_handle.flush()
finally:
shutil.rmtree(dirpath)
class Manual(object):
"""
Parsed tor man page. Tor makes no guarantees about its man page format so
this may not always be compatible. If not you can use the cached manual
information stored with Stem.
This does not include every bit of information from the tor manual. For
instance, I've excluded the 'THE CONFIGURATION FILE FORMAT' section. If
there's a part you'd find useful then `file an issue
`_ and we can
add it.
:var str name: brief description of the tor command
:var str synopsis: brief tor command usage
:var str description: general description of what tor does
:var collections.OrderedDict commandline_options: mapping of commandline arguments to their descripton
:var collections.OrderedDict signals: mapping of signals tor accepts to their description
:var collections.OrderedDict files: mapping of file paths to their description
:var collections.OrderedDict config_options: :class:`~stem.manual.ConfigOption` tuples for tor configuration options
:var str man_commit: latest tor commit editing the man page when this
information was cached
:var str stem_commit: stem commit to cache this manual information
"""
def __init__(self, name, synopsis, description, commandline_options, signals, files, config_options):
self.name = name
self.synopsis = synopsis
self.description = description
self.commandline_options = OrderedDict(commandline_options)
self.signals = OrderedDict(signals)
self.files = OrderedDict(files)
self.config_options = OrderedDict(config_options)
self.man_commit = None
self.stem_commit = None
self.schema = None
@staticmethod
def from_cache(path = None):
"""
Provides manual information cached with Stem. Unlike
:func:`~stem.manual.Manual.from_man` and
:func:`~stem.manual.Manual.from_remote` this doesn't have any system
requirements, and is faster too. Only drawback is that this manual
content is only as up to date as the Stem release we're using.
.. versionchanged:: 1.6.0
Added support for sqlite cache. Support for
:class:`~stem.util.conf.Config` caches will be dropped in Stem 2.x.
:param str path: cached manual content to read, if not provided this uses
the bundled manual information
:returns: :class:`~stem.manual.Manual` with our bundled manual information
:raises:
* **ImportError** if cache is sqlite and the sqlite3 module is
unavailable
* **IOError** if a **path** was provided and we were unable to read
it or the schema is out of date
"""
# TODO: drop _from_config_cache() with stem 2.x
if path is None:
path = CACHE_PATH
if path is not None and path.endswith('.sqlite'):
return Manual._from_sqlite_cache(path)
else:
return Manual._from_config_cache(path)
@staticmethod
def _from_sqlite_cache(path):
if not stem.prereq.is_sqlite_available():
raise ImportError('Reading a sqlite cache requires the sqlite3 module')
import sqlite3
if not os.path.exists(path):
raise IOError("%s doesn't exist" % path)
with sqlite3.connect(path) as conn:
try:
schema = conn.execute('SELECT version FROM schema').fetchone()[0]
if schema != SCHEMA_VERSION:
raise SchemaMismatch("Stem's current manual schema version is %s, but %s was version %s" % (SCHEMA_VERSION, path, schema), schema, (SCHEMA_VERSION,))
name, synopsis, description, man_commit, stem_commit = conn.execute('SELECT name, synopsis, description, man_commit, stem_commit FROM metadata').fetchone()
except sqlite3.OperationalError as exc:
raise IOError('Failed to read database metadata from %s: %s' % (path, exc))
commandline = dict(conn.execute('SELECT name, description FROM commandline').fetchall())
signals = dict(conn.execute('SELECT name, description FROM signals').fetchall())
files = dict(conn.execute('SELECT name, description FROM files').fetchall())
config_options = OrderedDict()
for entry in conn.execute('SELECT name, category, usage, summary, description FROM torrc ORDER BY position').fetchall():
option, category, usage, summary, option_description = entry
config_options[option] = ConfigOption(option, category, usage, summary, option_description)
manual = Manual(name, synopsis, description, commandline, signals, files, config_options)
manual.man_commit = man_commit
manual.stem_commit = stem_commit
manual.schema = schema
return manual
@staticmethod
def _from_config_cache(path):
conf = stem.util.conf.Config()
conf.load(path, commenting = False)
config_options = OrderedDict()
for key in conf.keys():
if key.startswith('config_options.'):
key = key.split('.')[1]
if key not in config_options:
config_options[key] = ConfigOption(
conf.get('config_options.%s.name' % key, ''),
conf.get('config_options.%s.category' % key, ''),
conf.get('config_options.%s.usage' % key, ''),
conf.get('config_options.%s.summary' % key, ''),
conf.get('config_options.%s.description' % key, '')
)
manual = Manual(
conf.get('name', ''),
conf.get('synopsis', ''),
conf.get('description', ''),
conf.get('commandline_options', OrderedDict()),
conf.get('signals', OrderedDict()),
conf.get('files', OrderedDict()),
config_options,
)
manual.man_commit = conf.get('man_commit', None)
manual.stem_commit = conf.get('stem_commit', None)
return manual
@staticmethod
def from_man(man_path = 'tor'):
"""
Reads and parses a given man page.
On OSX the man command doesn't have an '--encoding' argument so its results
may not quite match other platforms. For instance, it normalizes long
dashes into '--'.
:param str man_path: path argument for 'man', for example you might want
'/path/to/tor/doc/tor.1' to read from tor's git repository
:returns: :class:`~stem.manual.Manual` for the system's man page
:raises: **IOError** if unable to retrieve the manual
"""
man_cmd = 'man %s -P cat %s' % ('--encoding=ascii' if HAS_ENCODING_ARG else '', man_path)
try:
man_output = stem.util.system.call(man_cmd, env = {'MANWIDTH': '10000000'})
except OSError as exc:
raise IOError("Unable to run '%s': %s" % (man_cmd, exc))
categories, config_options = _get_categories(man_output), OrderedDict()
for category_header, category_enum in CATEGORY_SECTIONS.items():
_add_config_options(config_options, category_enum, categories.get(category_header, []))
for category in categories:
if category.endswith(' OPTIONS') and category not in CATEGORY_SECTIONS and category not in ('COMMAND-LINE OPTIONS', 'NON-PERSISTENT OPTIONS'):
_add_config_options(config_options, Category.UNKNOWN, categories.get(category, []))
return Manual(
_join_lines(categories.get('NAME', [])),
_join_lines(categories.get('SYNOPSIS', [])),
_join_lines(categories.get('DESCRIPTION', [])),
_get_indented_descriptions(categories.get('COMMAND-LINE OPTIONS', [])),
_get_indented_descriptions(categories.get('SIGNALS', [])),
_get_indented_descriptions(categories.get('FILES', [])),
config_options,
)
@staticmethod
def from_remote(timeout = 60):
"""
Reads and parses the latest tor man page `from gitweb.torproject.org
`_. Note that
while convenient, this reliance on GitWeb means you should alway call with
a fallback, such as...
::
try:
manual = stem.manual.from_remote()
except IOError:
manual = stem.manual.from_cache()
In addition to our GitWeb dependency this requires 'a2x' which is part of
`asciidoc `_ and... isn't quick.
Personally this takes ~7.41s, breaking down for me as follows...
* 1.67s to download tor.1.txt
* 5.57s to convert the asciidoc to a man page
* 0.17s for stem to read and parse the manual
:param int timeout: seconds to wait before timing out the request
:returns: latest :class:`~stem.manual.Manual` available for tor
:raises: **IOError** if unable to retrieve the manual
"""
with tempfile.NamedTemporaryFile() as tmp:
download_man_page(file_handle = tmp, timeout = timeout)
return Manual.from_man(tmp.name)
def save(self, path):
"""
Persists the manual content to a given location.
.. versionchanged:: 1.6.0
Added support for sqlite cache. Support for
:class:`~stem.util.conf.Config` caches will be dropped in Stem 2.x.
:param str path: path to save our manual content to
:raises:
* **ImportError** if saving as sqlite and the sqlite3 module is
unavailable
* **IOError** if unsuccessful
"""
# TODO: drop _save_as_config() with stem 2.x
if path.endswith('.sqlite'):
return self._save_as_sqlite(path)
else:
return self._save_as_config(path)
def _save_as_sqlite(self, path):
if not stem.prereq.is_sqlite_available():
raise ImportError('Saving a sqlite cache requires the sqlite3 module')
import sqlite3
tmp_path = path + '.new'
if os.path.exists(tmp_path):
os.remove(tmp_path)
with sqlite3.connect(tmp_path) as conn:
for cmd in SCHEMA:
conn.execute(cmd)
conn.execute('INSERT INTO metadata(name, synopsis, description, man_commit, stem_commit) VALUES (?,?,?,?,?)', (self.name, self.synopsis, self.description, self.man_commit, self.stem_commit))
for k, v in self.commandline_options.items():
conn.execute('INSERT INTO commandline(name, description) VALUES (?,?)', (k, v))
for k, v in self.signals.items():
conn.execute('INSERT INTO signals(name, description) VALUES (?,?)', (k, v))
for k, v in self.files.items():
conn.execute('INSERT INTO files(name, description) VALUES (?,?)', (k, v))
for i, v in enumerate(self.config_options.values()):
conn.execute('INSERT INTO torrc(key, name, category, usage, summary, description, position) VALUES (?,?,?,?,?,?,?)', (v.name.upper(), v.name, v.category, v.usage, v.summary, v.description, i))
if os.path.exists(path):
os.remove(path)
os.rename(tmp_path, path)
def _save_as_config(self, path):
conf = stem.util.conf.Config()
conf.set('name', self.name)
conf.set('synopsis', self.synopsis)
conf.set('description', self.description)
if self.man_commit:
conf.set('man_commit', self.man_commit)
if self.stem_commit:
conf.set('stem_commit', self.stem_commit)
for k, v in self.commandline_options.items():
conf.set('commandline_options', '%s => %s' % (k, v), overwrite = False)
for k, v in self.signals.items():
conf.set('signals', '%s => %s' % (k, v), overwrite = False)
for k, v in self.files.items():
conf.set('files', '%s => %s' % (k, v), overwrite = False)
for k, v in self.config_options.items():
conf.set('config_options.%s.category' % k, v.category)
conf.set('config_options.%s.name' % k, v.name)
conf.set('config_options.%s.usage' % k, v.usage)
conf.set('config_options.%s.summary' % k, v.summary)
conf.set('config_options.%s.description' % k, v.description)
conf.save(path)
def __hash__(self):
return stem.util._hash_attr(self, 'name', 'synopsis', 'description', 'commandline_options', 'signals', 'files', 'config_options', cache = True)
def __eq__(self, other):
return hash(self) == hash(other) if isinstance(other, Manual) else False
def __ne__(self, other):
return not self == other
def _get_categories(content):
"""
The man page is headers followed by an indented section. First pass gets
the mapping of category titles to their lines.
"""
# skip header and footer lines
if content and 'TOR(1)' in content[0]:
content = content[1:]
if content and content[-1].startswith('Tor'):
content = content[:-1]
categories = OrderedDict()
category, lines = None, []
for line in content:
# replace non-ascii characters
#
# \u2019 - smart single quote
# \u2014 - extra long dash
# \xb7 - centered dot
char_for = chr if stem.prereq.is_python_3() else unichr
line = line.replace(char_for(0x2019), "'").replace(char_for(0x2014), '-').replace(char_for(0xb7), '*')
if line and not line.startswith(' '):
if category:
if lines and lines[-1] == '':
lines = lines[:-1] # sections end with an extra empty line
categories[category] = lines
category, lines = line.strip(), []
else:
if line.startswith(' '):
line = line[7:] # contents of a section have a seven space indentation
lines.append(line)
if category:
categories[category] = lines
return categories
def _get_indented_descriptions(lines):
"""
Parses the commandline argument and signal sections. These are options
followed by an indented description. For example...
::
-f FILE
Specify a new configuration file to contain further Tor configuration
options OR pass - to make Tor read its configuration from standard
input. (Default: /usr/local/etc/tor/torrc, or $HOME/.torrc if that file
is not found)
There can be additional paragraphs not related to any particular argument but
ignoring those.
"""
options, last_arg = OrderedDict(), None
for line in lines:
if line == ' Note':
last_arg = None # manual has several indented 'Note' blocks
elif line and not line.startswith(' '):
options[line], last_arg = [], line
elif last_arg and line.startswith(' '):
options[last_arg].append(line[4:])
return dict([(arg, ' '.join(desc_lines)) for arg, desc_lines in options.items() if desc_lines])
def _add_config_options(config_options, category, lines):
"""
Parses a section of tor configuration options. These have usage information,
followed by an indented description. For instance...
::
ConnLimit NUM
The minimum number of file descriptors that must be available to the
Tor process before it will start. Tor will ask the OS for as many file
descriptors as the OS will allow (you can find this by "ulimit -H -n").
If this number is less than ConnLimit, then Tor will refuse to start.
You probably don't need to adjust this. It has no effect on Windows
since that platform lacks getrlimit(). (Default: 1000)
"""
def add_option(title, description):
if 'PER INSTANCE OPTIONS' in title:
return # skip, unfortunately amid the options
if ', ' in title:
# Line actually had multiple options with the same description. For
# example...
#
# AlternateBridgeAuthority [nickname], AlternateDirAuthority [nickname]
for subtitle in title.split(', '):
add_option(subtitle, description)
else:
name, usage = title.split(' ', 1) if ' ' in title else (title, '')
summary = _config().get('manual.summary.%s' % name.lower(), '')
config_options[name] = ConfigOption(name, category, usage, summary, _join_lines(description).strip())
# Remove the section's description by finding the sentence the section
# ends with.
end_indices = [i for (i, line) in enumerate(lines) if ('The following options' in line or 'PER SERVICE OPTIONS' in line)]
if end_indices:
lines = lines[max(end_indices):] # trim to the description paragrah
lines = lines[lines.index(''):] # drop the paragraph
last_title, description = None, []
for line in lines:
if line and not line.startswith(' '):
if last_title:
add_option(last_title, description)
last_title, description = line, []
else:
if line.startswith(' '):
line = line[4:]
description.append(line)
if last_title:
add_option(last_title, description)
def _join_lines(lines):
"""
Simple join, except we want empty lines to still provide a newline.
"""
result = []
for line in lines:
if not line:
if result and result[-1] != '\n':
result.append('\n')
else:
result.append(line + '\n')
return ''.join(result).strip()
stem-1.8.0/stem/util/ 0000775 0001750 0001750 00000000000 13602232262 015135 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/stem/util/test_tools.py 0000664 0001750 0001750 00000050107 13566051145 017721 0 ustar atagar atagar 0000000 0000000 # Copyright 2015-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Helper functions for testing.
Our **stylistic_issues**, **pyflakes_issues**, and **type_check_issues**
respect a 'exclude_paths' in our test config, excluding any absolute paths
matching those regexes. Issue strings can start or end with an asterisk
to match just against the prefix or suffix. For instance...
::
exclude_paths .*/stem/test/data/.*
.. versionadded:: 1.2.0
::
TimedTestRunner - test runner that tracks test runtimes
test_runtimes - provides runtime of tests excuted through TimedTestRunners
clean_orphaned_pyc - delete *.pyc files without corresponding *.py
is_pyflakes_available - checks if pyflakes is available
is_pycodestyle_available - checks if pycodestyle is available
pyflakes_issues - static checks for problems via pyflakes
stylistic_issues - checks for PEP8 and other stylistic issues
"""
import collections
import linecache
import multiprocessing
import os
import re
import threading
import time
import traceback
import unittest
import stem.prereq
import stem.util.conf
import stem.util.enum
import stem.util.system
CONFIG = stem.util.conf.config_dict('test', {
'pep8.ignore': [], # TODO: drop with stem 2.x, legacy alias for pycodestyle.ignore
'pycodestyle.ignore': [],
'pyflakes.ignore': [],
'exclude_paths': [],
})
TEST_RUNTIMES = {}
ASYNC_TESTS = {}
AsyncStatus = stem.util.enum.UppercaseEnum('PENDING', 'RUNNING', 'FINISHED')
AsyncResult = collections.namedtuple('AsyncResult', 'type msg')
# TODO: Providing a copy of SkipTest that works with python 2.6. This will be
# dropped when we remove python 2.6 support.
if stem.prereq._is_python_26():
class SkipTest(Exception):
'Notes that the test was skipped.'
else:
SkipTest = unittest.case.SkipTest
def assert_equal(expected, actual, msg = None):
"""
Function form of a TestCase's assertEqual.
.. versionadded:: 1.6.0
:param object expected: expected value
:param object actual: actual value
:param str msg: message if assertion fails
:raises: **AssertionError** if values aren't equal
"""
if expected != actual:
raise AssertionError("Expected '%s' but was '%s'" % (expected, actual) if msg is None else msg)
def assert_in(expected, actual, msg = None):
"""
Asserts that a given value is within this content.
.. versionadded:: 1.6.0
:param object expected: expected value
:param object actual: actual value
:param str msg: message if assertion fails
:raises: **AssertionError** if the expected value isn't in the actual
"""
if expected not in actual:
raise AssertionError("Expected '%s' to be within '%s'" % (expected, actual) if msg is None else msg)
def skip(msg):
"""
Function form of a TestCase's skipTest.
.. versionadded:: 1.6.0
:param str msg: reason test is being skipped
:raises: **unittest.case.SkipTest** for this reason
"""
raise SkipTest(msg)
def asynchronous(func):
test = stem.util.test_tools.AsyncTest(func)
ASYNC_TESTS[test.name] = test
return test.method
class AsyncTest(object):
"""
Test that's run asychronously. These are functions (no self reference)
performed like the following...
::
class MyTest(unittest.TestCase):
@staticmethod
def run_tests():
MyTest.test_addition = stem.util.test_tools.AsyncTest(MyTest.test_addition).method
@staticmethod
def test_addition():
if 1 + 1 != 2:
raise AssertionError('tisk, tisk')
MyTest.run()
.. versionadded:: 1.6.0
"""
def __init__(self, runner, args = None, threaded = False):
self.name = '%s.%s' % (runner.__module__, runner.__name__)
self._runner = runner
self._runner_args = args
self._threaded = threaded
self.method = lambda test: self.result(test) # method that can be mixed into TestCases
self._process = None
self._process_pipe = None
self._process_lock = threading.RLock()
self._result = None
self._status = AsyncStatus.PENDING
def run(self, *runner_args, **kwargs):
if stem.prereq._is_python_26():
return # not supported under python 2.6
def _wrapper(conn, runner, args):
os.nice(12)
try:
runner(*args) if args else runner()
conn.send(AsyncResult('success', None))
except AssertionError as exc:
conn.send(AsyncResult('failure', str(exc)))
except SkipTest as exc:
conn.send(AsyncResult('skipped', str(exc)))
except:
conn.send(AsyncResult('error', traceback.format_exc()))
finally:
conn.close()
with self._process_lock:
if self._status == AsyncStatus.PENDING:
if runner_args:
self._runner_args = runner_args
if 'threaded' in kwargs:
self._threaded = kwargs['threaded']
self._process_pipe, child_pipe = multiprocessing.Pipe()
if self._threaded:
self._process = threading.Thread(
target = _wrapper,
args = (child_pipe, self._runner, self._runner_args),
name = 'Background test of %s' % self.name,
)
self._process.setDaemon(True)
else:
self._process = multiprocessing.Process(target = _wrapper, args = (child_pipe, self._runner, self._runner_args))
self._process.start()
self._status = AsyncStatus.RUNNING
def pid(self):
with self._process_lock:
return self._process.pid if (self._process and not self._threaded) else None
def join(self):
self.result(None)
def result(self, test):
if stem.prereq._is_python_26():
return # not supported under python 2.6
with self._process_lock:
if self._status == AsyncStatus.PENDING:
self.run()
if self._status == AsyncStatus.RUNNING:
self._result = self._process_pipe.recv()
self._process.join()
self._status = AsyncStatus.FINISHED
if test and self._result.type == 'failure':
test.fail(self._result.msg)
elif test and self._result.type == 'error':
test.fail(self._result.msg)
elif test and self._result.type == 'skipped':
test.skipTest(self._result.msg)
class Issue(collections.namedtuple('Issue', ['line_number', 'message', 'line'])):
"""
Issue encountered by pyflakes or pycodestyle.
:var int line_number: line number the issue occured on
:var str message: description of the issue
:var str line: content of the line the issue is about
"""
class TimedTestRunner(unittest.TextTestRunner):
"""
Test runner that tracks the runtime of individual tests. When tests are run
with this their runtimes are made available through
:func:`stem.util.test_tools.test_runtimes`.
.. versionadded:: 1.6.0
"""
def run(self, test):
for t in test._tests:
original_type = type(t)
class _TestWrapper(original_type):
def run(self, result = None):
start_time = time.time()
result = super(type(self), self).run(result)
TEST_RUNTIMES[self.id()] = time.time() - start_time
return result
# TODO: remove and drop unnecessary 'returns' when dropping python 2.6
# support
def skipTest(self, message):
if not stem.prereq._is_python_26():
return super(original_type, self).skipTest(message)
# TODO: remove when dropping python 2.6 support
def assertItemsEqual(self, expected, actual):
if stem.prereq._is_python_26():
self.assertEqual(set(expected), set(actual))
else:
return super(original_type, self).assertItemsEqual(expected, actual)
def assertRaisesWith(self, exc_type, exc_msg, func, *args, **kwargs):
"""
Asserts the given invokation raises the expected excepiton. This is
similar to unittest's assertRaises and assertRaisesRegexp, but checks
for an exact match.
This method is **not** being vended to external users and may be
changed without notice. If you want this method to be part of our
vended API then please let us know.
"""
return self.assertRaisesRegexp(exc_type, '^%s$' % re.escape(exc_msg), func, *args, **kwargs)
def assertRaisesRegexp(self, exc_type, exc_msg, func, *args, **kwargs):
if stem.prereq._is_python_26():
try:
func(*args, **kwargs)
self.fail('Expected a %s to be raised but nothing was' % exc_type)
except exc_type as exc:
self.assertTrue(re.search(exc_msg, str(exc), re.MULTILINE))
else:
return super(original_type, self).assertRaisesRegexp(exc_type, exc_msg, func, *args, **kwargs)
def id(self):
return '%s.%s.%s' % (original_type.__module__, original_type.__name__, self._testMethodName)
def __str__(self):
return '%s (%s.%s)' % (self._testMethodName, original_type.__module__, original_type.__name__)
t.__class__ = _TestWrapper
return super(TimedTestRunner, self).run(test)
def test_runtimes():
"""
Provides the runtimes of tests executed through TimedTestRunners.
:returns: **dict** of fully qualified test names to floats for the runtime in
seconds
.. versionadded:: 1.6.0
"""
return dict(TEST_RUNTIMES)
def clean_orphaned_pyc(paths):
"""
Deletes any file with a \\*.pyc extention without a corresponding \\*.py. This
helps to address a common gotcha when deleting python files...
* You delete module 'foo.py' and run the tests to ensure that you haven't
broken anything. They pass, however there *are* still some 'import foo'
statements that still work because the bytecode (foo.pyc) is still around.
* You push your change.
* Another developer clones our repository and is confused because we have a
bunch of ImportErrors.
:param list paths: paths to search for orphaned pyc files
:returns: list of absolute paths that were deleted
"""
orphaned_pyc = []
for path in paths:
for pyc_path in stem.util.system.files_with_suffix(path, '.pyc'):
py_path = pyc_path[:-1]
# If we're running python 3 then the *.pyc files are no longer bundled
# with the *.py. Rather, they're in a __pycache__ directory.
pycache = '%s__pycache__%s' % (os.path.sep, os.path.sep)
if pycache in pyc_path:
directory, pycache_filename = pyc_path.split(pycache, 1)
if not pycache_filename.endswith('.pyc'):
continue # should look like 'test_tools.cpython-32.pyc'
py_path = os.path.join(directory, pycache_filename.split('.')[0] + '.py')
if not os.path.exists(py_path):
orphaned_pyc.append(pyc_path)
os.remove(pyc_path)
return orphaned_pyc
def is_pyflakes_available():
"""
Checks if pyflakes is availalbe.
:returns: **True** if we can use pyflakes and **False** otherwise
"""
return _module_exists('pyflakes.api') and _module_exists('pyflakes.reporter')
def is_pycodestyle_available():
"""
Checks if pycodestyle is availalbe.
:returns: **True** if we can use pycodestyle and **False** otherwise
"""
if _module_exists('pycodestyle'):
import pycodestyle
elif _module_exists('pep8'):
import pep8 as pycodestyle
else:
return False
return hasattr(pycodestyle, 'BaseReport')
def stylistic_issues(paths, check_newlines = False, check_exception_keyword = False, prefer_single_quotes = False):
"""
Checks for stylistic issues that are an issue according to the parts of PEP8
we conform to. You can suppress pycodestyle issues by making a 'test'
configuration that sets 'pycodestyle.ignore'.
For example, with a 'test/settings.cfg' of...
::
# pycodestyle compliance issues that we're ignoreing...
#
# * E111 and E121 four space indentations
# * E501 line is over 79 characters
pycodestyle.ignore E111
pycodestyle.ignore E121
pycodestyle.ignore E501
pycodestyle.ignore run_tests.py => E402: import stem.util.enum
... you can then run tests with...
::
import stem.util.conf
test_config = stem.util.conf.get_config('test')
test_config.load('test/settings.cfg')
issues = stylistic_issues('my_project')
.. versionchanged:: 1.3.0
Renamed from get_stylistic_issues() to stylistic_issues(). The old name
still works as an alias, but will be dropped in Stem version 2.0.0.
.. versionchanged:: 1.4.0
Changing tuples in return value to be namedtuple instances, and adding the
line that had the issue.
.. versionchanged:: 1.4.0
Added the prefer_single_quotes option.
.. versionchanged:: 1.6.0
Changed 'pycodestyle.ignore' code snippets to only need to match against
the prefix.
:param list paths: paths to search for stylistic issues
:param bool check_newlines: check that we have standard newlines (\\n), not
windows (\\r\\n) nor classic mac (\\r)
:param bool check_exception_keyword: checks that we're using 'as' for
exceptions rather than a comma
:param bool prefer_single_quotes: standardize on using single rather than
double quotes for strings, when reasonable
:returns: dict of paths list of :class:`stem.util.test_tools.Issue` instances
"""
issues = {}
ignore_rules = []
ignore_for_file = []
ignore_all_for_files = []
for rule in CONFIG['pycodestyle.ignore'] + CONFIG['pep8.ignore']:
if '=>' in rule:
path, rule_entry = rule.split('=>', 1)
if ':' in rule_entry:
rule, code = rule_entry.split(':', 1)
ignore_for_file.append((path.strip(), rule.strip(), code.strip()))
elif rule_entry.strip() == '*':
ignore_all_for_files.append(path.strip())
else:
ignore_rules.append(rule)
def is_ignored(path, rule, code):
for ignored_path, ignored_rule, ignored_code in ignore_for_file:
if path.endswith(ignored_path) and ignored_rule == rule and code.strip().startswith(ignored_code):
return True
for ignored_path in ignore_all_for_files:
if path.endswith(ignored_path):
return True
return False
if is_pycodestyle_available():
if _module_exists('pep8'):
import pep8 as pycodestyle
else:
import pycodestyle
class StyleReport(pycodestyle.BaseReport):
def init_file(self, filename, lines, expected, line_offset):
super(StyleReport, self).init_file(filename, lines, expected, line_offset)
if not check_newlines and not check_exception_keyword and not prefer_single_quotes:
return
is_block_comment = False
for ignored_path in ignore_all_for_files:
if filename.endswith(ignored_path):
return
for index, line in enumerate(lines):
content = line.split('#', 1)[0].strip()
if check_newlines and '\r' in line:
issues.setdefault(filename, []).append(Issue(index + 1, 'contains a windows newline', line))
if not content:
continue # blank line
if '"""' in content:
is_block_comment = not is_block_comment
if check_exception_keyword and content.startswith('except') and content.endswith(', exc:'):
# Python 2.6 - 2.7 supports two forms for exceptions...
#
# except ValueError, exc:
# except ValueError as exc:
#
# The former is the old method and no longer supported in python 3
# going forward.
# TODO: This check only works if the exception variable is called
# 'exc'. We should generalize this via a regex so other names work
# too.
issues.setdefault(filename, []).append(Issue(index + 1, "except clause should use 'as', not comma", line))
if prefer_single_quotes and not is_block_comment:
if '"' in content and "'" not in content and '"""' not in content and not content.endswith('\\'):
# Checking if the line already has any single quotes since that
# usually means double quotes are preferable for the content (for
# instance "I'm hungry"). Also checking for '\' at the end since
# that can indicate a multi-line string.
issues.setdefault(filename, []).append(Issue(index + 1, 'use single rather than double quotes', line))
def error(self, line_number, offset, text, check):
code = super(StyleReport, self).error(line_number, offset, text, check)
if code:
line = linecache.getline(self.filename, line_number)
if not is_ignored(self.filename, code, line):
issues.setdefault(self.filename, []).append(Issue(line_number, text, line))
style_checker = pycodestyle.StyleGuide(ignore = ignore_rules, reporter = StyleReport)
style_checker.check_files(list(_python_files(paths)))
return issues
def pyflakes_issues(paths):
"""
Performs static checks via pyflakes. False positives can be ignored via
'pyflakes.ignore' entries in our 'test' config. For instance...
::
pyflakes.ignore stem/util/test_tools.py => 'pyflakes' imported but unused
pyflakes.ignore stem/util/test_tools.py => 'pycodestyle' imported but unused
.. versionchanged:: 1.3.0
Renamed from get_pyflakes_issues() to pyflakes_issues(). The old name
still works as an alias, but will be dropped in Stem version 2.0.0.
.. versionchanged:: 1.4.0
Changing tuples in return value to be namedtuple instances, and adding the
line that had the issue.
.. versionchanged:: 1.5.0
Support matching against prefix or suffix issue strings.
:param list paths: paths to search for problems
:returns: dict of paths list of :class:`stem.util.test_tools.Issue` instances
"""
issues = {}
if is_pyflakes_available():
import pyflakes.api
import pyflakes.reporter
class Reporter(pyflakes.reporter.Reporter):
def __init__(self):
self._ignored_issues = {}
for line in CONFIG['pyflakes.ignore']:
path, issue = line.split('=>')
self._ignored_issues.setdefault(path.strip(), []).append(issue.strip())
def unexpectedError(self, filename, msg):
self._register_issue(filename, None, msg, None)
def syntaxError(self, filename, msg, lineno, offset, text):
self._register_issue(filename, lineno, msg, text)
def flake(self, msg):
self._register_issue(msg.filename, msg.lineno, msg.message % msg.message_args, None)
def _is_ignored(self, path, issue):
# Paths in pyflakes_ignore are relative, so we need to check to see if our
# path ends with any of them.
for ignored_path, ignored_issues in self._ignored_issues.items():
if path.endswith(ignored_path):
if issue in ignored_issues:
return True
for prefix in [i[:1] for i in ignored_issues if i.endswith('*')]:
if issue.startswith(prefix):
return True
for suffix in [i[1:] for i in ignored_issues if i.startswith('*')]:
if issue.endswith(suffix):
return True
return False
def _register_issue(self, path, line_number, issue, line):
if not self._is_ignored(path, issue):
if path and line_number and not line:
line = linecache.getline(path, line_number).strip()
issues.setdefault(path, []).append(Issue(line_number, issue, line))
reporter = Reporter()
for path in _python_files(paths):
pyflakes.api.checkPath(path, reporter)
return issues
def _module_exists(module_name):
"""
Checks if a module exists.
:param str module_name: module to check existance of
:returns: **True** if module exists and **False** otherwise
"""
try:
__import__(module_name)
return True
except ImportError:
return False
def _python_files(paths):
for path in paths:
for file_path in stem.util.system.files_with_suffix(path, '.py'):
skip = False
for exclude_path in CONFIG['exclude_paths']:
if re.match(exclude_path, file_path):
skip = True
break
if not skip:
yield file_path
# TODO: drop with stem 2.x
# We renamed our methods to drop a redundant 'get_*' prefix, so alias the old
# names for backward compatability, and account for pep8 being renamed to
# pycodestyle.
get_stylistic_issues = stylistic_issues
get_pyflakes_issues = pyflakes_issues
is_pep8_available = is_pycodestyle_available
stem-1.8.0/stem/util/system.py 0000664 0001750 0001750 00000123712 13501272761 017047 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Helper functions for working with the underlying system. These are mostly os
dependent, only working on linux, osx, and bsd. In almost all cases they're
best-effort, providing **None** if the lookup fails.
.. versionchanged:: 1.3.0
Dropped the get_* prefix from several function names. The old names still
work, but are deprecated aliases.
.. versionchanged:: 1.5.0
Added the **SYSTEM_CALL_TIME** global, which tracks total time spent making
system commands.
**Module Overview:**
::
is_windows - checks if we're running on windows
is_mac - checks if we're running on a mac
is_gentoo - checks if we're running on gentoo
is_slackware - checks if we're running on slackware
is_bsd - checks if we're running on the bsd family of operating systems
is_available - determines if a command is available on this system
is_running - determines if a given process is running
size_of - provides the memory usage of an object
call - runs the given system command and provides back the results
name_by_pid - gets the name for a process by the given pid
pid_by_name - gets the pid for a process by the given name
pid_by_port - gets the pid for a process listening to a given port
pid_by_open_file - gets the pid for the process with an open file
pids_by_user - provides processes owned by a user
cwd - provides the current working directory for a given process
user - provides the user a process is running under
start_time - provides the unix timestamp when the process started
tail - provides lines from the end of a file
bsd_jail_id - provides the BSD jail id a given process is running within
bsd_jail_path - provides the path of the given BSD jail
is_tarfile - checks if the given path is a tarball
expand_path - expands relative paths and ~ entries
files_with_suffix - provides files with the given suffix
get_process_name - provides our process' name
set_process_name - changes our process' name
.. data:: Status (enum)
State of a subprocess.
.. versionadded:: 1.6.0
==================== ===========
Status Description
==================== ===========
PENDING not yet started
RUNNING currently being performed
DONE completed successfully
FAILED failed with an exception
==================== ===========
"""
import collections
import ctypes
import ctypes.util
import itertools
import mimetypes
import multiprocessing
import os
import platform
import re
import subprocess
import sys
import tarfile
import threading
import time
import stem.prereq
import stem.util
import stem.util.enum
import stem.util.proc
import stem.util.str_tools
from stem import UNDEFINED
from stem.util import log
State = stem.util.enum.UppercaseEnum(
'PENDING',
'RUNNING',
'DONE',
'FAILED',
)
SIZE_RECURSES = {
tuple: iter,
list: iter,
collections.deque: iter,
dict: lambda d: itertools.chain.from_iterable(d.items()),
set: iter,
frozenset: iter,
}
# Mapping of commands to if they're available or not.
CMD_AVAILABLE_CACHE = {}
# An incomplete listing of commands provided by the shell. Expand this as
# needed. Some noteworthy things about shell commands...
#
# * They're not in the path so is_available() will fail.
# * subprocess.Popen() without the 'shell = True' argument will fail with...
# OSError: [Errno 2] No such file or directory
SHELL_COMMANDS = ['ulimit']
IS_RUNNING_PS_LINUX = 'ps -A co command'
IS_RUNNING_PS_BSD = 'ps -ao ucomm='
GET_NAME_BY_PID_PS = 'ps -p %s -o comm'
GET_PID_BY_NAME_PGREP = 'pgrep -x %s'
GET_PID_BY_NAME_PIDOF = 'pidof %s'
GET_PID_BY_NAME_PS_LINUX = 'ps -o pid -C %s'
GET_PID_BY_NAME_PS_BSD = 'ps axc'
GET_PID_BY_NAME_LSOF = 'lsof -tc %s'
GET_PID_BY_PORT_NETSTAT = 'netstat -npltu'
GET_PID_BY_PORT_SOCKSTAT = 'sockstat -4l -P tcp -p %s'
GET_PID_BY_PORT_LSOF = 'lsof -wnP -iTCP -sTCP:LISTEN'
GET_PID_BY_FILE_LSOF = 'lsof -tw %s'
GET_PIDS_BY_USER_LINUX = 'ps -o pid -u %s'
GET_PIDS_BY_USER_BSD = 'ps -o pid -U %s'
GET_CWD_PWDX = 'pwdx %s'
GET_CWD_LSOF = 'lsof -a -p %s -d cwd -Fn'
GET_BSD_JAIL_ID_PS = 'ps -p %s -o jid'
GET_BSD_JAIL_PATH = 'jls -j %s'
BLOCK_SIZE = 1024
# flag for setting the process name, found in '/usr/include/linux/prctl.h'
PR_SET_NAME = 15
argc_t = ctypes.POINTER(ctypes.c_char_p)
# The following can fail with pypy...
# AttributeError: No symbol Py_GetArgcArgv found in library
try:
Py_GetArgcArgv = ctypes.pythonapi.Py_GetArgcArgv
Py_GetArgcArgv.restype = None
Py_GetArgcArgv.argtypes = [
ctypes.POINTER(ctypes.c_int),
ctypes.POINTER(argc_t),
]
except:
Py_GetArgcArgv = None
# This is both a cache for get_process_name() and tracks what we've changed our
# process name to.
_PROCESS_NAME = None
# Length of our original process name.
#
# The original author our process renaming is based on did a memset for 256,
# while Jake did it for the original process name length (capped at 1608). I'm
# not sure of the reasons for either of these limits, but setting it to
# anything higher than our original name length should be pointless, so opting
# for Jake's limit.
_MAX_NAME_LENGTH = -1
# Tracks total time spent shelling out to other commands like 'ps' and
# 'netstat', so we can account for it as part of our cpu time along with
# os.times().
SYSTEM_CALL_TIME = 0.0
SYSTEM_CALL_TIME_LOCK = threading.RLock()
class CallError(OSError):
"""
Error response when making a system call. This is an **OSError** subclass
with additional information about the process. Depending on the nature of the
error not all of these attributes will be available.
:var str msg: exception string
:var str command: command that was ran
:var int exit_status: exit code of the process
:var float runtime: time the command took to run
:var str stdout: stdout of the process
:var str stderr: stderr of the process
"""
def __init__(self, msg, command, exit_status, runtime, stdout, stderr):
self.msg = msg
self.command = command
self.exit_status = exit_status
self.runtime = runtime
self.stdout = stdout
self.stderr = stderr
def __str__(self):
return self.msg
class CallTimeoutError(CallError):
"""
Error response when making a system call that has timed out.
.. versionadded:: 1.6.0
:var float timeout: time we waited
"""
def __init__(self, msg, command, exit_status, runtime, stdout, stderr, timeout):
super(CallTimeoutError, self).__init__(msg, command, exit_status, runtime, stdout, stderr)
self.timeout = timeout
class DaemonTask(object):
"""
Invokes the given function in a subprocess, returning the value.
.. versionadded:: 1.6.0
:var function runner: function to be invoked by the subprocess
:var tuple args: arguments to provide to the subprocess
:var int priority: subprocess nice priority
:var stem.util.system.State status: state of the subprocess
:var float runtime: seconds subprocess took to complete
:var object result: return value of subprocess if successful
:var exception error: exception raised by subprocess if it failed
"""
def __init__(self, runner, args = None, priority = 15, start = False):
self.runner = runner
self.args = args
self.priority = priority
self.status = State.PENDING
self.runtime = None
self.result = None
self.error = None
self._process = None
self._pipe = None
if start:
self.run()
def run(self):
"""
Invokes the task if it hasn't already been started. If it has this is a
no-op.
"""
if self.status == State.PENDING:
self._pipe, child_pipe = multiprocessing.Pipe()
self._process = multiprocessing.Process(target = DaemonTask._run_wrapper, args = (child_pipe, self.priority, self.runner, self.args))
self._process.start()
self.status = State.RUNNING
def join(self):
"""
Provides the result of the daemon task. If still running this blocks until
the task is completed.
:returns: response of the function we ran
:raises: exception raised by the function if it failed with one
"""
if self.status == State.PENDING:
self.run()
if self.status == State.RUNNING:
self._process.join()
response = self._pipe.recv()
self.status = response[0]
self.runtime = response[1]
if self.status == State.DONE:
self.result = response[2]
elif self.status == State.FAILED:
self.error = response[2]
if self.status == State.DONE:
return self.result
elif self.status == State.FAILED:
raise self.error
else:
raise RuntimeError('BUG: unexpected status from daemon task, %s' % self.status)
@staticmethod
def _run_wrapper(conn, priority, runner, args):
start_time = time.time()
os.nice(priority)
try:
result = runner(*args) if args else runner()
conn.send((State.DONE, time.time() - start_time, result))
except Exception as exc:
conn.send((State.FAILED, time.time() - start_time, exc))
finally:
conn.close()
def is_windows():
"""
Checks if we are running on Windows.
:returns: **bool** to indicate if we're on Windows
"""
return platform.system() == 'Windows'
def is_mac():
"""
Checks if we are running on Mac OSX.
:returns: **bool** to indicate if we're on a Mac
"""
return platform.system() == 'Darwin'
def is_gentoo():
"""
Checks if we're running on Gentoo.
:returns: **bool** to indicate if we're on Gentoo
"""
return os.path.exists('/etc/gentoo-release')
def is_slackware():
"""
Checks if we are running on a Slackware system.
:returns: **bool** to indicate if we're on a Slackware system
"""
return os.path.exists('/etc/slackware-version')
def is_bsd():
"""
Checks if we are within the BSD family of operating systems. This currently
recognizes Macs, FreeBSD, and OpenBSD but may be expanded later.
:returns: **bool** to indicate if we're on a BSD OS
"""
return platform.system() in ('Darwin', 'FreeBSD', 'OpenBSD', 'NetBSD')
def is_available(command, cached=True):
"""
Checks the current PATH to see if a command is available or not. If more
than one command is present (for instance "ls -a | grep foo") then this
just checks the first.
Note that shell (like cd and ulimit) aren't in the PATH so this lookup will
try to assume that it's available. This only happends for recognized shell
commands (those in SHELL_COMMANDS).
:param str command: command to search for
:param bool cached: makes use of available cached results if **True**
:returns: **True** if an executable we can use by that name exists in the
PATH, **False** otherwise
"""
if ' ' in command:
command = command.split(' ')[0]
if command in SHELL_COMMANDS:
return True # we can't actually look it up, so hope the shell really provides it...
elif cached and command in CMD_AVAILABLE_CACHE:
return CMD_AVAILABLE_CACHE[command]
elif 'PATH' not in os.environ:
return False # lacking a path will cause find_executable() to internally fail
cmd_exists = False
for path in os.environ['PATH'].split(os.pathsep):
cmd_path = os.path.join(path, command)
if is_windows():
cmd_path += '.exe'
if os.path.exists(cmd_path) and os.access(cmd_path, os.X_OK):
cmd_exists = True
break
CMD_AVAILABLE_CACHE[command] = cmd_exists
return cmd_exists
def is_running(command):
"""
Checks for if a process with a given name or pid is running.
.. versionchanged:: 1.6.0
Added support for list and pid arguments.
:param str,list,int command: process name if a str, multiple process names if
a list, or pid if an int to be checked
:returns: **True** if the process is running, **False** if it's not among ps
results, and **None** if ps can't be queried
"""
if isinstance(command, int):
try:
os.kill(command, 0)
return True
except OSError:
return False
# Linux and the BSD families have different variants of ps. Guess based on
# the is_bsd() check which to try first, then fall back to the other.
#
# Linux
# -A - Select all processes.
# -co command - Shows just the base command.
#
# Mac / BSD
# -a - Display information about other users' processes as well as
# our own.
# -o ucomm= - Shows just the ucomm attribute ("name to be used for
# accounting")
if is_available('ps'):
if is_bsd():
primary_resolver = IS_RUNNING_PS_BSD
secondary_resolver = IS_RUNNING_PS_LINUX
else:
primary_resolver = IS_RUNNING_PS_LINUX
secondary_resolver = IS_RUNNING_PS_BSD
command_listing = call(primary_resolver, None)
if not command_listing:
command_listing = call(secondary_resolver, None)
if command_listing:
command_listing = [c.strip() for c in command_listing]
if stem.util._is_str(command):
command = [command]
for cmd in command:
if cmd in command_listing:
return True
return False
return None
def size_of(obj, exclude = None):
"""
Provides the `approximate memory usage of an object
`_. This can recurse tuples,
lists, deques, dicts, and sets. To teach this function to inspect additional
object types expand SIZE_RECURSES...
::
stem.util.system.SIZE_RECURSES[SomeClass] = SomeClass.get_elements
.. versionadded:: 1.6.0
:param object obj: object to provide the size of
:param set exclude: object ids to exclude from size estimation
:returns: **int** with the size of the object in bytes
:raises: **NotImplementedError** if using PyPy
"""
if stem.prereq.is_pypy():
raise NotImplementedError('PyPy does not implement sys.getsizeof()')
if exclude is None:
exclude = set()
elif id(obj) in exclude:
return 0
try:
size = sys.getsizeof(obj)
except TypeError:
size = sys.getsizeof(0) # estimate if object lacks a __sizeof__
exclude.add(id(obj))
if type(obj) in SIZE_RECURSES:
for entry in SIZE_RECURSES[type(obj)](obj):
size += size_of(entry, exclude)
return size
def name_by_pid(pid):
"""
Attempts to determine the name a given process is running under (not
including arguments). This uses...
::
1. Information from /proc
2. ps -p -o command
:param int pid: process id of the process to be queried
:returns: **str** with the process name, **None** if it can't be determined
"""
process_name = None
if stem.util.proc.is_available():
try:
process_name = stem.util.proc.stats(pid, stem.util.proc.Stat.COMMAND)[0]
except IOError:
pass
# attempts to resolve using ps, failing if:
# - system's ps variant doesn't handle these flags (none known at the moment)
#
# example output:
# atagar@morrigan:~$ ps -p 5767 -o comm
# COMMAND
# vim
if not process_name:
try:
results = call(GET_NAME_BY_PID_PS % pid)
except OSError:
results = None
if results and len(results) == 2 and results[0] == 'COMMAND':
process_name = results[1].strip()
return process_name
def pid_by_name(process_name, multiple = False):
"""
Attempts to determine the process id for a running process, using...
::
1. pgrep -x
2. pidof
3. ps -o pid -C (linux)
ps axc | egrep " $" (bsd)
4. lsof -tc
5. tasklist | str .exe
:param str process_name: process name for which to fetch the pid
:param bool multiple: provides a list of all pids if **True**, otherwise
results with multiple processes are discarded
:returns:
Response depends upon the 'multiple' argument as follows...
* if **False** then this provides an **int** with the process id or **None** if it can't be determined
* if **True** then this provides a **list** of all **int** process ids, and an empty list if it can't be determined
"""
# attempts to resolve using pgrep, failing if:
# - we're running on bsd (command unavailable)
#
# example output:
# atagar@morrigan:~$ pgrep -x vim
# 3283
# 3392
if is_available('pgrep'):
results = call(GET_PID_BY_NAME_PGREP % process_name, None)
if results:
try:
pids = list(map(int, results))
if multiple:
return pids
elif len(pids) == 1:
return pids[0]
except ValueError:
pass
# attempts to resolve using pidof, failing if:
# - we're running on bsd (command unavailable)
#
# example output:
# atagar@morrigan:~$ pidof vim
# 3392 3283
if is_available('pidof'):
results = call(GET_PID_BY_NAME_PIDOF % process_name, None)
if results and len(results) == 1:
try:
pids = list(map(int, results[0].split()))
if multiple:
return pids
elif len(pids) == 1:
return pids[0]
except ValueError:
pass
# attempts to resolve using ps, failing if:
# - system's ps variant doesn't handle these flags (none known at the moment)
#
# example output:
# atagar@morrigan:~/Desktop/stem$ ps -o pid -C vim
# PID
# 3283
# 3392
#
# atagar$ ps axc
# PID TT STAT TIME COMMAND
# 1 ?? Ss 9:00.22 launchd
# 10 ?? Ss 0:09.97 kextd
# 11 ?? Ss 5:47.36 DirectoryService
# 12 ?? Ss 3:01.44 notifyd
if is_available('ps'):
if not is_bsd():
# linux variant of ps
results = call(GET_PID_BY_NAME_PS_LINUX % process_name, None)
if results:
try:
pids = list(map(int, results[1:]))
if multiple:
return pids
elif len(pids) == 1:
return pids[0]
except ValueError:
pass
if is_bsd():
# bsd variant of ps
results = call(GET_PID_BY_NAME_PS_BSD, None)
if results:
# filters results to those with our process name
results = [r.split()[0] for r in results if r.endswith(' %s' % process_name)]
try:
pids = list(map(int, results))
if multiple:
return pids
elif len(pids) == 1:
return pids[0]
except ValueError:
pass
# resolves using lsof which works on both Linux and BSD, only failing if:
# - lsof is unavailable (not included by default on OpenBSD)
# - the process being run as a different user due to permissions
# - the process doesn't have any open files to be reported by lsof?
#
# flags:
# t - only show pids
# c - restrict results to that command
#
# example output:
# atagar@morrigan:~$ lsof -t -c vim
# 2470
# 2561
if is_available('lsof'):
results = call(GET_PID_BY_NAME_LSOF % process_name, None)
if results:
try:
pids = list(map(int, results))
if multiple:
return pids
elif len(pids) == 1:
return pids[0]
except ValueError:
pass
if is_available('tasklist') and is_windows():
if not process_name.endswith('.exe'):
process_name = process_name + '.exe'
process_ids = []
results = stem.util.system.call('tasklist', None)
if results:
tasklist_regex = re.compile('^\\s*%s\\s+(?P[0-9]*)' % process_name)
for line in results:
match = tasklist_regex.search(line)
if match:
process_ids.append(int(match.group('pid')))
if multiple:
return process_ids
elif len(process_ids) > 0:
return process_ids[0]
log.debug("failed to resolve a pid for '%s'" % process_name)
return [] if multiple else None
def pid_by_port(port):
"""
Attempts to determine the process id for a process with the given port,
using...
::
1. netstat -npltu | grep 127.0.0.1:
2. sockstat -4l -P tcp -p
3. lsof -wnP -iTCP -sTCP:LISTEN | grep ":"
Most queries limit results to listening TCP connections. This function likely
won't work on Mac OSX.
:param int port: port where the process we're looking for is listening
:returns: **int** with the process id, **None** if it can't be determined
"""
# attempts to resolve using netstat, failing if:
# - netstat doesn't accept these flags (Linux only)
# - the process being run as a different user due to permissions
#
# flags:
# n - numeric (disables hostname lookups)
# p - program (include pids)
# l - listening (include listening sockets)
# tu - show tcp and udp sockets, and nothing else
#
# example output:
# atagar@morrigan:~$ netstat -npltu
# Active Internet connections (only servers)
# Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
# tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN -
# tcp 0 0 127.0.0.1:9051 0.0.0.0:* LISTEN 1641/tor
# tcp6 0 0 ::1:631 :::* LISTEN -
# udp 0 0 0.0.0.0:5353 0.0.0.0:* -
# udp6 0 0 fe80::7ae4:ff:fe2f::123 :::* -
if is_available('netstat'):
results = call(GET_PID_BY_PORT_NETSTAT, None)
if results:
# filters to results with our port
results = [r for r in results if '127.0.0.1:%s' % port in r]
if len(results) == 1 and len(results[0].split()) == 7:
results = results[0].split()[6] # process field (ex. "7184/tor")
pid = results[:results.find('/')]
if pid.isdigit():
return int(pid)
# attempts to resolve using sockstat, failing if:
# - sockstat doesn't accept the -4 flag (BSD only)
# - sockstat isn't available (encountered with OSX 10.5.8)
# - there are multiple instances using the same port on different addresses
#
# flags:
# 4 - only show IPv4 sockets
# l - listening sockets
# P tcp - only show tcp connections
# p - only includes results if the local or foreign port match this
#
# example output:
# # sockstat -4 | grep tor
# _tor tor 4397 7 tcp4 51.64.7.84:9050 *:*
# _tor tor 4397 8 udp4 51.64.7.84:53 *:*
# _tor tor 4397 12 tcp4 51.64.7.84:54011 80.3.121.7:9001
# _tor tor 4397 15 tcp4 51.64.7.84:59374 7.42.1.102:9001
# _tor tor 4397 20 tcp4 51.64.7.84:51946 32.83.7.104:443
if is_available('sockstat'):
results = call(GET_PID_BY_PORT_SOCKSTAT % port, None)
if results:
# filters to results where this is the local port
results = [r for r in results if (len(r.split()) == 7 and (':%s' % port) in r.split()[5])]
if len(results) == 1:
pid = results[0].split()[2]
if pid.isdigit():
return int(pid)
# resolves using lsof which works on both Linux and BSD, only failing if:
# - lsof is unavailable (not included by default on OpenBSD)
# - lsof doesn't provide the port ip/port, nor accept the -i and -s args
# (encountered with OSX 10.5.8)
# - the process being run as a different user due to permissions
# - there are multiple instances using the same port on different addresses
#
# flags:
# w - disables warning messages
# n - numeric addresses (disables hostname lookups)
# P - numeric ports (disables replacement of ports with their protocol)
# iTCP - only show tcp connections
# sTCP:LISTEN - listening sockets
#
# example output:
# atagar@morrigan:~$ lsof -wnP -iTCP -sTCP:LISTEN
# COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
# tor 1745 atagar 6u IPv4 14229 0t0 TCP 127.0.0.1:9051 (LISTEN)
if is_available('lsof'):
results = call(GET_PID_BY_PORT_LSOF, None)
if results:
# filters to results with our port
results = [r for r in results if (len(r.split()) == 10 and (':%s' % port) in r.split()[8])]
if len(results) == 1:
pid = results[0].split()[1]
if pid.isdigit():
return int(pid)
return None # all queries failed
def pid_by_open_file(path):
"""
Attempts to determine the process id for a process with the given open file,
using...
::
lsof -w
:param str path: location of the socket file to query against
:returns: **int** with the process id, **None** if it can't be determined
"""
# resolves using lsof which works on both Linux and BSD, only failing if:
# - lsof is unavailable (not included by default on OpenBSD)
# - the file can't be read due to permissions
#
# flags:
# t - only show pids
# w - disables warning messages
#
# example output:
# atagar@morrigan:~$ lsof -tw /tmp/foo
# 4762
if is_available('lsof'):
results = call(GET_PID_BY_FILE_LSOF % path, [])
if len(results) == 1:
pid = results[0].strip()
if pid.isdigit():
return int(pid)
return None # all queries failed
def pids_by_user(user):
"""
Provides processes owned by a given user.
.. versionadded:: 1.5.0
:param str user: user to look up processes for
:returns: **list** with the process ids, **None** if it can't be determined
"""
# example output:
# atagar@odin:~$ ps -o pid -u avahi
# PID
# 914
# 915
if is_available('ps'):
if is_bsd():
results = call(GET_PIDS_BY_USER_BSD % user, None)
else:
results = call(GET_PIDS_BY_USER_LINUX % user, None)
if results:
try:
return list(map(int, results[1:]))
except ValueError:
pass
return None
def cwd(pid):
"""
Provides the working directory of the given process.
:param int pid: process id of the process to be queried
:returns: **str** with the absolute path for the process' present working
directory, **None** if it can't be determined
"""
# try fetching via the proc contents if it's available
if stem.util.proc.is_available():
try:
return stem.util.proc.cwd(pid)
except IOError:
pass
# Fall back to a pwdx query. This isn't available on BSD.
logging_prefix = 'cwd(%s):' % pid
if is_available('pwdx'):
# pwdx results are of the form:
# 3799: /home/atagar
# 5839: No such process
results = call(GET_CWD_PWDX % pid, None)
if not results:
log.debug("%s pwdx didn't return any results" % logging_prefix)
elif results[0].endswith('No such process'):
log.debug('%s pwdx processes reported for this pid' % logging_prefix)
elif len(results) != 1 or results[0].count(' ') != 1 or not results[0].startswith('%s: ' % pid):
log.debug('%s we got unexpected output from pwdx: %s' % (logging_prefix, results))
else:
return results[0].split(' ', 1)[1].strip()
# Use lsof as the final fallback. This is available on both Linux and is the
# only lookup method here that works for BSD...
# https://trac.torproject.org/projects/tor/ticket/4236
#
# flags:
# a - presents the intersection of the following arguments
# p - limits results to this pid
# d cwd - limits results to just the cwd rather than all open files
# Fn - short listing in a single column, with just the pid and cwd
#
# example output:
# ~$ lsof -a -p 75717 -d cwd -Fn
# p75717
# n/Users/atagar/tor/src/or
if is_available('lsof'):
results = call(GET_CWD_LSOF % pid, [])
if len(results) >= 2 and results[-1].startswith('n/'):
lsof_result = results[-1][1:].strip()
# If we lack read permissions for the cwd then it returns...
# p2683
# n/proc/2683/cwd (readlink: Permission denied)
if ' ' not in lsof_result:
return lsof_result
else:
log.debug('%s we got unexpected output from lsof: %s' % (logging_prefix, results))
return None # all queries failed
def user(pid):
"""
Provides the user a process is running under.
:param int pid: process id of the process to be queried
:returns: **str** with the username a process is running under, **None** if
it can't be determined
"""
if not isinstance(pid, int) or pid < 0:
return None
if stem.util.proc.is_available():
try:
import pwd # only available on unix platforms
uid = stem.util.proc.uid(pid)
if uid and uid.isdigit():
return pwd.getpwuid(int(uid)).pw_name
except:
pass
if is_available('ps'):
results = call('ps -o user %s' % pid, [])
if len(results) >= 2:
return results[1].strip()
return None
def start_time(pid):
"""
Provides the unix timestamp when the given process started.
:param int pid: process id of the process to be queried
:returns: **float** for the unix timestamp when the process began, **None**
if it can't be determined
"""
if not isinstance(pid, int) or pid < 0:
return None
if stem.util.proc.is_available():
try:
return float(stem.util.proc.stats(pid, stem.util.proc.Stat.START_TIME)[0])
except IOError:
pass
try:
ps_results = call('ps -p %s -o etime' % pid, [])
if len(ps_results) >= 2:
etime = ps_results[1].strip()
return time.time() - stem.util.str_tools.parse_short_time_label(etime)
except:
pass
return None
def tail(target, lines = None):
"""
Provides lines of a file starting with the end. For instance,
'tail -n 50 /tmp/my_log' could be done with...
::
reversed(list(tail('/tmp/my_log', 50)))
:param str,file target: path or file object to read from
:param int lines: number of lines to read
:returns: **generator** that reads lines, starting with the end
:raises: **IOError** if unable to read the file
"""
if isinstance(target, str):
with open(target, 'rb') as target_file:
for line in tail(target_file, lines):
yield line
return
# based on snippet from...
# https://stackoverflow.com/questions/136168/get-last-n-lines-of-a-file-with-python-similar-to-tail
target.seek(0, 2) # go to the end of the file
block_end_byte = target.tell()
block_number = -1
content = b''
while (lines is None or lines > 0) and block_end_byte > 0:
if (block_end_byte - BLOCK_SIZE > 0):
# read the last block we haven't yet read
target.seek(block_number * BLOCK_SIZE, 2)
content, completed_lines = (target.read(BLOCK_SIZE) + content).split(b'\n', 1)
else:
# reached the start of the file, just read what's left
target.seek(0, 0)
completed_lines = target.read(block_end_byte) + content
for line in reversed(completed_lines.splitlines()):
if lines is None or lines > 0:
if lines is not None:
lines -= 1
yield stem.util.str_tools._to_unicode(line)
block_end_byte -= BLOCK_SIZE
block_number -= 1
def bsd_jail_id(pid):
"""
Gets the jail id for a process. These seem to only exist for FreeBSD (this
style for jails does not exist on Linux, OSX, or OpenBSD).
:param int pid: process id of the jail id to be queried
:returns: **int** for the jail id, zero if this can't be determined
"""
# Output when called from a FreeBSD jail or when Tor isn't jailed:
# JID
# 0
#
# Otherwise it's something like:
# JID
# 1
ps_output = call(GET_BSD_JAIL_ID_PS % pid, [])
if len(ps_output) == 2 and len(ps_output[1].split()) == 1:
jid = ps_output[1].strip()
if jid.isdigit():
return int(jid)
os_name = platform.system()
if os_name == 'FreeBSD':
log.warn('Unable to get the jail id for process %s.' % pid)
else:
log.debug('bsd_jail_id(%s): jail ids do not exist on %s' % (pid, os_name))
return 0
def bsd_jail_path(jid):
"""
Provides the path of the given FreeBSD jail.
:param int jid: jail id to be queried
:returns: **str** of the path prefix, **None** if this can't be determined
"""
if jid != 0:
# Output should be something like:
# JID IP Address Hostname Path
# 1 10.0.0.2 tor-jail /usr/jails/tor-jail
jls_output = call(GET_BSD_JAIL_PATH % jid, [])
if len(jls_output) == 2 and len(jls_output[1].split()) == 4:
return jls_output[1].split()[3]
return None
def is_tarfile(path):
"""
Returns if the path belongs to a tarfile or not.
.. versionadded:: 1.2.0
:param str path: path to be checked
:returns: **True** if the path belongs to a tarball, **False** otherwise
"""
# Checking if it's a tar file may fail due to permissions so failing back
# to the mime type...
#
# IOError: [Errno 13] Permission denied: '/vmlinuz.old'
#
# With python 3 insuffient permissions raises an AttributeError instead...
#
# http://bugs.python.org/issue17059
try:
return tarfile.is_tarfile(path)
except (IOError, AttributeError):
return mimetypes.guess_type(path)[0] == 'application/x-tar'
def expand_path(path, cwd = None):
"""
Provides an absolute path, expanding tildes with the user's home and
appending a current working directory if the path was relative.
:param str path: path to be expanded
:param str cwd: current working directory to expand relative paths with, our
process' if this is **None**
:returns: **str** of the path expanded to be an absolute path, never with an
ending slash
"""
if is_windows():
relative_path = path.replace('/', '\\').rstrip('\\')
else:
relative_path = path.rstrip('/')
if not relative_path or os.path.isabs(relative_path):
# empty or already absolute - nothing to do
pass
elif relative_path.startswith('~'):
# prefixed with a ~ or ~user entry
relative_path = os.path.expanduser(relative_path)
else:
# relative path, expand with the cwd
if not cwd:
cwd = os.getcwd()
# we'll be dealing with both "my/path/" and "./my/path" entries, so
# cropping the later
if relative_path.startswith('./') or relative_path.startswith('.\\'):
relative_path = relative_path[2:]
elif relative_path == '.':
relative_path = ''
if relative_path == '':
relative_path = cwd
else:
relative_path = os.path.join(cwd, relative_path)
return relative_path
def files_with_suffix(base_path, suffix):
"""
Iterates over files in a given directory, providing filenames with a certain
suffix.
.. versionadded:: 1.2.0
:param str base_path: directory to be iterated over
:param str suffix: filename suffix to look for
:returns: iterator that yields the absolute path for files with the given suffix
"""
if os.path.isfile(base_path):
if base_path.endswith(suffix):
yield base_path
else:
for root, _, files in os.walk(base_path):
for filename in files:
if filename.endswith(suffix):
yield os.path.join(root, filename)
def call(command, default = UNDEFINED, ignore_exit_status = False, timeout = None, cwd = None, env = None):
"""
call(command, default = UNDEFINED, ignore_exit_status = False)
Issues a command in a subprocess, blocking until completion and returning the
results. This is not actually ran in a shell so pipes and other shell syntax
are not permitted.
.. versionchanged:: 1.5.0
Providing additional information upon failure by raising a CallError. This
is a subclass of OSError, providing backward compatibility.
.. versionchanged:: 1.5.0
Added env argument.
.. versionchanged:: 1.6.0
Added timeout and cwd arguments.
:param str,list command: command to be issued
:param object default: response if the query fails
:param bool ignore_exit_status: reports failure if our command's exit status
was non-zero
:param float timeout: maximum seconds to wait, blocks indefinitely if
**None**
:param dict env: environment variables
:returns: **list** with the lines of output from the command
:raises:
* **CallError** if this fails and no default was provided
* **CallTimeoutError** if the timeout is reached without a default
"""
# TODO: in stem 2.x return a struct with stdout, stderr, and runtime instead
global SYSTEM_CALL_TIME
if isinstance(command, str):
command_list = command.split(' ')
else:
command_list = list(map(str, command))
exit_status, runtime, stdout, stderr = None, None, None, None
start_time = time.time()
try:
is_shell_command = command_list[0] in SHELL_COMMANDS
process = subprocess.Popen(command_list, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = is_shell_command, cwd = cwd, env = env)
if timeout:
while process.poll() is None:
if time.time() - start_time > timeout:
raise CallTimeoutError("Process didn't finish after %0.1f seconds" % timeout, ' '.join(command_list), None, timeout, '', '', timeout)
time.sleep(0.001)
stdout, stderr = process.communicate()
stdout, stderr = stdout.strip(), stderr.strip()
runtime = time.time() - start_time
log.debug('System call: %s (runtime: %0.2f)' % (command, runtime))
if log.is_tracing():
trace_prefix = 'Received from system (%s)' % command
if stdout and stderr:
log.trace(trace_prefix + ', stdout:\n%s\nstderr:\n%s' % (stdout, stderr))
elif stdout:
log.trace(trace_prefix + ', stdout:\n%s' % stdout)
elif stderr:
log.trace(trace_prefix + ', stderr:\n%s' % stderr)
exit_status = process.poll()
if not ignore_exit_status and exit_status != 0:
raise OSError('%s returned exit status %i' % (command, exit_status))
if stdout:
return stdout.decode('utf-8', 'replace').splitlines()
else:
return []
except CallTimeoutError:
log.debug('System call (timeout): %s (after %0.4fs)' % (command, timeout))
if default != UNDEFINED:
return default
else:
raise
except OSError as exc:
log.debug('System call (failed): %s (error: %s)' % (command, exc))
if default != UNDEFINED:
return default
else:
raise CallError(str(exc), ' '.join(command_list), exit_status, runtime, stdout, stderr)
finally:
with SYSTEM_CALL_TIME_LOCK:
SYSTEM_CALL_TIME += time.time() - start_time
def get_process_name():
"""
Provides the present name of our process.
:returns: **str** with the present name of our process
"""
global _PROCESS_NAME, _MAX_NAME_LENGTH
if _PROCESS_NAME is None:
# Example output...
#
# COMMAND
# python run_tests.py --unit
ps_output = call('ps -p %i -o args' % os.getpid(), [])
if len(ps_output) == 2 and ps_output[0] in ('COMMAND', 'ARGS'):
_PROCESS_NAME = ps_output[1]
else:
# Falling back on using ctypes to get our argv. Unfortunately the simple
# method for getting this...
#
# ' '.join(['python'] + sys.argv)
#
# ... doesn't do the trick since this will miss interpreter arguments.
#
# python -W ignore::DeprecationWarning my_script.py
args, argc = [], argc_t()
for i in range(100):
# The ending index can be either None or raise a ValueError when
# accessed...
#
# ValueError: NULL pointer access
try:
if argc[i] is None:
break
except ValueError:
break
args.append(str(argc[i]))
_PROCESS_NAME = ' '.join(args)
_MAX_NAME_LENGTH = len(_PROCESS_NAME)
return _PROCESS_NAME
def set_process_name(process_name):
"""
Renames our current process from "python " to a custom name. This is
best-effort, not necessarily working on all platforms.
:param str process_name: new name for our process
:raises: **IOError** if the process cannot be renamed
"""
# This is mostly based on...
#
# http://www.rhinocerus.net/forum/lang-python/569677-setting-program-name-like-0-perl.html#post2272369
#
# ... and an adaptation by Jake...
#
# https://github.com/ioerror/chameleon
#
# A cleaner implementation is available at...
#
# https://github.com/cream/libs/blob/b38970e2a6f6d2620724c828808235be0445b799/cream/util/procname.py
#
# but I'm not quite clear on their implementation, and it only does targeted
# argument replacement (ie, replace argv[0], argv[1], etc but with a string
# the same size).
_set_argv(process_name)
if platform.system() == 'Linux':
_set_prctl_name(process_name)
elif platform.system() in ('Darwin', 'FreeBSD', 'OpenBSD'):
_set_proc_title(process_name)
def _set_argv(process_name):
"""
Overwrites our argv in a similar fashion to how it's done in C with:
strcpy(argv[0], 'new_name');
"""
if Py_GetArgcArgv is None:
return
global _PROCESS_NAME
# both gets the current process name and initializes _MAX_NAME_LENGTH
current_name = get_process_name()
argv, argc = ctypes.c_int(0), argc_t()
Py_GetArgcArgv(argv, ctypes.pointer(argc))
if len(process_name) > _MAX_NAME_LENGTH:
raise IOError("Can't rename process to something longer than our initial name (this would overwrite memory used for the env)")
# space we need to clear
zero_size = max(len(current_name), len(process_name))
ctypes.memset(argc.contents, 0, zero_size + 1) # null terminate the string's end
process_name_encoded = process_name.encode('utf8')
ctypes.memmove(argc.contents, process_name_encoded, len(process_name))
_PROCESS_NAME = process_name
def _set_prctl_name(process_name):
"""
Sets the prctl name, which is used by top and killall. This appears to be
Linux specific and has the max of 15 characters.
This is from...
http://stackoverflow.com/questions/564695/is-there-a-way-to-change-effective-process-name-in-python/923034#923034
"""
libc = ctypes.CDLL(ctypes.util.find_library('c'))
name_buffer = ctypes.create_string_buffer(len(process_name) + 1)
name_buffer.value = stem.util.str_tools._to_bytes(process_name)
libc.prctl(PR_SET_NAME, ctypes.byref(name_buffer), 0, 0, 0)
def _set_proc_title(process_name):
"""
BSD specific calls (should be compataible with both FreeBSD and OpenBSD:
http://fxr.watson.org/fxr/source/gen/setproctitle.c?v=FREEBSD-LIBC
http://www.rootr.net/man/man/setproctitle/3
"""
libc = ctypes.CDLL(ctypes.util.find_library('c'))
name_buffer = ctypes.create_string_buffer(len(process_name) + 1)
name_buffer.value = process_name.encode()
try:
libc.setproctitle(ctypes.byref(name_buffer))
except AttributeError:
# Possible issue (seen on OSX):
# AttributeError: dlsym(0x7fff6a41d1e0, setproctitle): symbol not found
pass
# TODO: drop with stem 2.x
# We renamed our methods to drop a redundant 'get_*' prefix, so alias the old
# names for backward compatability.
get_name_by_pid = name_by_pid
get_pid_by_name = pid_by_name
get_pid_by_port = pid_by_port
get_pid_by_open_file = pid_by_open_file
get_cwd = cwd
get_user = user
get_start_time = start_time
get_bsd_jail_id = bsd_jail_id
get_bsd_jail_path = bsd_jail_path
stem-1.8.0/stem/util/conf.py 0000664 0001750 0001750 00000061055 13501272761 016451 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Handlers for text configuration files. Configurations are simple string to
string mappings, with the configuration files using the following rules...
* the key/value is separated by a space
* anything after a '#' is ignored as a comment
* excess whitespace is trimmed
* empty lines are ignored
* multi-line values can be defined by following the key with lines starting
with a '|'
For instance...
::
# This is my sample config
user.name Galen
user.password yabba1234 # here's an inline comment
user.notes takes a fancy to pepperjack cheese
blankEntry.example
msg.greeting
|Multi-line message exclaiming of the
|wonder and awe that is pepperjack!
... would be loaded as...
::
config = {
'user.name': 'Galen',
'user.password': 'yabba1234',
'user.notes': 'takes a fancy to pepperjack cheese',
'blankEntry.example': '',
'msg.greeting': 'Multi-line message exclaiming of the\\nwonder and awe that is pepperjack!',
}
Configurations are managed via the :class:`~stem.util.conf.Config` class. The
:class:`~stem.util.conf.Config` can be be used directly with its
:func:`~stem.util.conf.Config.get` and :func:`~stem.util.conf.Config.set`
methods, but usually modules will want a local dictionary with just the
configurations that it cares about.
To do this use the :func:`~stem.util.conf.config_dict` function. For example...
::
import getpass
from stem.util import conf, connection
def config_validator(key, value):
if key == 'timeout':
# require at least a one second timeout
return max(1, value)
elif key == 'endpoint':
if not connection.is_valid_ipv4_address(value):
raise ValueError("'%s' isn't a valid IPv4 address" % value)
elif key == 'port':
if not connection.is_valid_port(value):
raise ValueError("'%s' isn't a valid port" % value)
elif key == 'retries':
# negative retries really don't make sense
return max(0, value)
CONFIG = conf.config_dict('ssh_login', {
'username': getpass.getuser(),
'password': '',
'timeout': 10,
'endpoint': '263.12.8.0',
'port': 22,
'reconnect': False,
'retries': 3,
}, config_validator)
There's several things going on here so lets take it step by step...
* The :func:`~stem.util.conf.config_dict` provides a dictionary that's bound
to a given configuration. If the "ssh_proxy_config" configuration changes
then so will the contents of CONFIG.
* The dictionary we're passing to :func:`~stem.util.conf.config_dict` provides
two important pieces of information: default values and their types. See the
Config's :func:`~stem.util.conf.Config.get` method for how these type
inferences work.
* The config_validator is a hook we're adding to make sure CONFIG only gets
values we think are valid. In this case it ensures that our timeout value
is at least one second, and rejects endpoints or ports that are invalid.
Now lets say our user has the following configuration file...
::
username waddle_doo
password jabberwocky
timeout -15
port 9000000
retries lots
reconnect true
logging debug
... and we load it as follows...
::
>>> from stem.util import conf
>>> our_config = conf.get_config('ssh_login')
>>> our_config.load('/home/atagar/user_config')
>>> print CONFIG # doctest: +SKIP
{
"username": "waddle_doo",
"password": "jabberwocky",
"timeout": 1,
"endpoint": "263.12.8.0",
"port": 22,
"reconnect": True,
"retries": 3,
}
Here's an expanation of what happened...
* the username, password, and reconnect attributes took the values in the
configuration file
* the 'config_validator' we added earlier allows for a minimum timeout of one
and rejected the invalid port (with a log message)
* we weren't able to convert the retries' "lots" value to an integer so it kept
its default value and logged a warning
* the user didn't supply an endpoint so that remained unchanged
* our CONFIG didn't have a 'logging' attribute so it was ignored
**Module Overview:**
::
config_dict - provides a dictionary that's kept in sync with our config
get_config - singleton for getting configurations
uses_settings - provides an annotation for functions that use configurations
parse_enum_csv - helper funcion for parsing confguration entries for enums
Config - Custom configuration
|- load - reads a configuration file
|- save - writes the current configuration to a file
|- clear - empties our loaded configuration contents
|- add_listener - notifies the given listener when an update occurs
|- clear_listeners - removes any attached listeners
|- keys - provides keys in the loaded configuration
|- set - sets the given key/value pair
|- unused_keys - provides keys that have never been requested
|- get - provides the value for a given key, with type inference
+- get_value - provides the value for a given key as a string
"""
import inspect
import os
import threading
import stem.prereq
from stem.util import log
try:
# added in python 2.7
from collections import OrderedDict
except ImportError:
from stem.util.ordereddict import OrderedDict
CONFS = {} # mapping of identifier to singleton instances of configs
class _SyncListener(object):
def __init__(self, config_dict, interceptor):
self.config_dict = config_dict
self.interceptor = interceptor
def update(self, config, key):
if key in self.config_dict:
new_value = config.get(key, self.config_dict[key])
if new_value == self.config_dict[key]:
return # no change
if self.interceptor:
interceptor_value = self.interceptor(key, new_value)
if interceptor_value:
new_value = interceptor_value
self.config_dict[key] = new_value
def config_dict(handle, conf_mappings, handler = None):
"""
Makes a dictionary that stays synchronized with a configuration.
This takes a dictionary of 'config_key => default_value' mappings and
changes the values to reflect our current configuration. This will leave
the previous values alone if...
* we don't have a value for that config_key
* we can't convert our value to be the same type as the default_value
If a handler is provided then this is called just prior to assigning new
values to the config_dict. The handler function is expected to accept the
(key, value) for the new values and return what we should actually insert
into the dictionary. If this returns None then the value is updated as
normal.
For more information about how we convert types see our
:func:`~stem.util.conf.Config.get` method.
**The dictionary you get from this is manged by the Config class and should
be treated as being read-only.**
:param str handle: unique identifier for a config instance
:param dict conf_mappings: config key/value mappings used as our defaults
:param functor handler: function referred to prior to assigning values
"""
selected_config = get_config(handle)
selected_config.add_listener(_SyncListener(conf_mappings, handler).update)
return conf_mappings
def get_config(handle):
"""
Singleton constructor for configuration file instances. If a configuration
already exists for the handle then it's returned. Otherwise a fresh instance
is constructed.
:param str handle: unique identifier used to access this config instance
"""
if handle not in CONFS:
CONFS[handle] = Config()
return CONFS[handle]
def uses_settings(handle, path, lazy_load = True):
"""
Provides a function that can be used as a decorator for other functions that
require settings to be loaded. Functions with this decorator will be provided
with the configuration as its 'config' keyword argument.
.. versionchanged:: 1.3.0
Omits the 'config' argument if the funcion we're decorating doesn't accept
it.
::
uses_settings = stem.util.conf.uses_settings('my_app', '/path/to/settings.cfg')
@uses_settings
def my_function(config):
print 'hello %s!' % config.get('username', '')
:param str handle: hande for the configuration
:param str path: path where the configuration should be loaded from
:param bool lazy_load: loads the configuration file when the decorator is
used if true, otherwise it's loaded right away
:returns: **function** that can be used as a decorator to provide the
configuration
:raises: **IOError** if we fail to read the configuration file, if
**lazy_load** is true then this arises when we use the decorator
"""
config = get_config(handle)
if not lazy_load and not config._settings_loaded:
config.load(path)
config._settings_loaded = True
def decorator(func):
def wrapped(*args, **kwargs):
if lazy_load and not config._settings_loaded:
config.load(path)
config._settings_loaded = True
if 'config' in inspect.getargspec(func).args:
return func(*args, config = config, **kwargs)
else:
return func(*args, **kwargs)
return wrapped
return decorator
def parse_enum(key, value, enumeration):
"""
Provides the enumeration value for a given key. This is a case insensitive
lookup and raises an exception if the enum key doesn't exist.
:param str key: configuration key being looked up
:param str value: value to be parsed
:param stem.util.enum.Enum enumeration: enumeration the values should be in
:returns: enumeration value
:raises: **ValueError** if the **value** isn't among the enumeration keys
"""
return parse_enum_csv(key, value, enumeration, 1)[0]
def parse_enum_csv(key, value, enumeration, count = None):
"""
Parses a given value as being a comma separated listing of enumeration keys,
returning the corresponding enumeration values. This is intended to be a
helper for config handlers. The checks this does are case insensitive.
The **count** attribute can be used to make assertions based on the number of
values. This can be...
* None to indicate that there's no restrictions.
* An int to indicate that we should have this many values.
* An (int, int) tuple to indicate the range that values can be in. This range
is inclusive and either can be None to indicate the lack of a lower or
upper bound.
:param str key: configuration key being looked up
:param str value: value to be parsed
:param stem.util.enum.Enum enumeration: enumeration the values should be in
:param int,tuple count: validates that we have this many items
:returns: list with the enumeration values
:raises: **ValueError** if the count assertion fails or the **value** entries
don't match the enumeration keys
"""
values = [val.upper().strip() for val in value.split(',')]
if values == ['']:
return []
if count is None:
pass # no count validateion checks to do
elif isinstance(count, int):
if len(values) != count:
raise ValueError("Config entry '%s' is expected to be %i comma separated values, got '%s'" % (key, count, value))
elif isinstance(count, tuple) and len(count) == 2:
minimum, maximum = count
if minimum is not None and len(values) < minimum:
raise ValueError("Config entry '%s' must have at least %i comma separated values, got '%s'" % (key, minimum, value))
if maximum is not None and len(values) > maximum:
raise ValueError("Config entry '%s' can have at most %i comma separated values, got '%s'" % (key, maximum, value))
else:
raise ValueError("The count must be None, an int, or two value tuple. Got '%s' (%s)'" % (count, type(count)))
result = []
enum_keys = [k.upper() for k in list(enumeration.keys())]
enum_values = list(enumeration)
for val in values:
if val in enum_keys:
result.append(enum_values[enum_keys.index(val)])
else:
raise ValueError("The '%s' entry of config entry '%s' wasn't in the enumeration (expected %s)" % (val, key, ', '.join(enum_keys)))
return result
class Config(object):
"""
Handler for easily working with custom configurations, providing persistence
to and from files. All operations are thread safe.
**Example usage:**
User has a file at '/home/atagar/myConfig' with...
::
destination.ip 1.2.3.4
destination.port blarg
startup.run export PATH=$PATH:~/bin
startup.run alias l=ls
And they have a script with...
::
from stem.util import conf
# Configuration values we'll use in this file. These are mappings of
# configuration keys to the default values we'll use if the user doesn't
# have something different in their config file (or it doesn't match this
# type).
ssh_config = conf.config_dict('ssh_login', {
'login.user': 'atagar',
'login.password': 'pepperjack_is_awesome!',
'destination.ip': '127.0.0.1',
'destination.port': 22,
'startup.run': [],
})
# Makes an empty config instance with the handle of 'ssh_login'. This is
# a singleton so other classes can fetch this same configuration from
# this handle.
user_config = conf.get_config('ssh_login')
# Loads the user's configuration file, warning if this fails.
try:
user_config.load("/home/atagar/myConfig")
except IOError as exc:
print "Unable to load the user's config: %s" % exc
# This replace the contents of ssh_config with the values from the user's
# config file if...
#
# * the key is present in the config file
# * we're able to convert the configuration file's value to the same type
# as what's in the mapping (see the Config.get() method for how these
# type inferences work)
#
# For instance in this case...
#
# * the login values are left alone because they aren't in the user's
# config file
#
# * the 'destination.port' is also left with the value of 22 because we
# can't turn "blarg" into an integer
#
# The other values are replaced, so ssh_config now becomes...
#
# {'login.user': 'atagar',
# 'login.password': 'pepperjack_is_awesome!',
# 'destination.ip': '1.2.3.4',
# 'destination.port': 22,
# 'startup.run': ['export PATH=$PATH:~/bin', 'alias l=ls']}
#
# Information for what values fail to load and why are reported to
# 'stem.util.log'.
.. versionchanged:: 1.7.0
Class can now be used as a dictionary.
"""
def __init__(self):
self._path = None # location we last loaded from or saved to
self._contents = OrderedDict() # configuration key/value pairs
self._listeners = [] # functors to be notified of config changes
# used for accessing _contents
self._contents_lock = threading.RLock()
# keys that have been requested (used to provide unused config contents)
self._requested_keys = set()
# flag to support lazy loading in uses_settings()
self._settings_loaded = False
def load(self, path = None, commenting = True):
"""
Reads in the contents of the given path, adding its configuration values
to our current contents. If the path is a directory then this loads each
of the files, recursively.
.. versionchanged:: 1.3.0
Added support for directories.
.. versionchanged:: 1.3.0
Added the **commenting** argument.
.. versionchanged:: 1.6.0
Avoid loading vim swap files.
:param str path: file or directory path to be loaded, this uses the last
loaded path if not provided
:param bool commenting: ignore line content after a '#' if **True**, read
otherwise
:raises:
* **IOError** if we fail to read the file (it doesn't exist, insufficient
permissions, etc)
* **ValueError** if no path was provided and we've never been provided one
"""
if path:
self._path = path
elif not self._path:
raise ValueError('Unable to load configuration: no path provided')
if os.path.isdir(self._path):
for root, dirnames, filenames in os.walk(self._path):
for filename in filenames:
if filename.endswith('.swp'):
continue # vim swap file
self.load(os.path.join(root, filename))
return
with open(self._path, 'r') as config_file:
read_contents = config_file.readlines()
with self._contents_lock:
while read_contents:
line = read_contents.pop(0)
# strips any commenting or excess whitespace
comment_start = line.find('#') if commenting else -1
if comment_start != -1:
line = line[:comment_start]
line = line.strip()
# parse the key/value pair
if line:
if ' ' in line:
key, value = line.split(' ', 1)
self.set(key, value.strip(), False)
else:
# this might be a multi-line entry, try processing it as such
multiline_buffer = []
while read_contents and read_contents[0].lstrip().startswith('|'):
content = read_contents.pop(0).lstrip()[1:] # removes '\s+|' prefix
content = content.rstrip('\n') # trailing newline
multiline_buffer.append(content)
if multiline_buffer:
self.set(line, '\n'.join(multiline_buffer), False)
else:
self.set(line, '', False) # default to a key => '' mapping
def save(self, path = None):
"""
Saves configuration contents to disk. If a path is provided then it
replaces the configuration location that we track.
:param str path: location to be saved to
:raises:
* **IOError** if we fail to save the file (insufficient permissions, etc)
* **ValueError** if no path was provided and we've never been provided one
"""
if path:
self._path = path
elif not self._path:
raise ValueError('Unable to save configuration: no path provided')
with self._contents_lock:
if not os.path.exists(os.path.dirname(self._path)):
os.makedirs(os.path.dirname(self._path))
with open(self._path, 'w') as output_file:
for entry_key in self.keys():
for entry_value in self.get_value(entry_key, multiple = True):
# check for multi line entries
if '\n' in entry_value:
entry_value = '\n|' + entry_value.replace('\n', '\n|')
output_file.write('%s %s\n' % (entry_key, entry_value))
def clear(self):
"""
Drops the configuration contents and reverts back to a blank, unloaded
state.
"""
with self._contents_lock:
self._contents.clear()
self._requested_keys = set()
def add_listener(self, listener, backfill = True):
"""
Registers the function to be notified of configuration updates. Listeners
are expected to be functors which accept (config, key).
:param functor listener: function to be notified when our configuration is changed
:param bool backfill: calls the function with our current values if **True**
"""
with self._contents_lock:
self._listeners.append(listener)
if backfill:
for key in self.keys():
listener(self, key)
def clear_listeners(self):
"""
Removes all attached listeners.
"""
self._listeners = []
def keys(self):
"""
Provides all keys in the currently loaded configuration.
:returns: **list** if strings for the configuration keys we've loaded
"""
return list(self._contents.keys())
def unused_keys(self):
"""
Provides the configuration keys that have never been provided to a caller
via :func:`~stem.util.conf.config_dict` or the
:func:`~stem.util.conf.Config.get` and
:func:`~stem.util.conf.Config.get_value` methods.
:returns: **set** of configuration keys we've loaded but have never been requested
"""
return set(self.keys()).difference(self._requested_keys)
def set(self, key, value, overwrite = True):
"""
Appends the given key/value configuration mapping, behaving the same as if
we'd loaded this from a configuration file.
.. versionchanged:: 1.5.0
Allow removal of values by overwriting with a **None** value.
:param str key: key for the configuration mapping
:param str,list value: value we're setting the mapping to
:param bool overwrite: replaces the previous value if **True**, otherwise
the values are appended
"""
with self._contents_lock:
unicode_type = str if stem.prereq.is_python_3() else unicode
if value is None:
if overwrite and key in self._contents:
del self._contents[key]
else:
pass # no value so this is a no-op
elif isinstance(value, (bytes, unicode_type)):
if not overwrite and key in self._contents:
self._contents[key].append(value)
else:
self._contents[key] = [value]
for listener in self._listeners:
listener(self, key)
elif isinstance(value, (list, tuple)):
if not overwrite and key in self._contents:
self._contents[key] += value
else:
self._contents[key] = value
for listener in self._listeners:
listener(self, key)
else:
raise ValueError("Config.set() only accepts str (bytes or unicode), list, or tuple. Provided value was a '%s'" % type(value))
def get(self, key, default = None):
"""
Fetches the given configuration, using the key and default value to
determine the type it should be. Recognized inferences are:
* **default is a boolean => boolean**
* values are case insensitive
* provides the default if the value isn't "true" or "false"
* **default is an integer => int**
* provides the default if the value can't be converted to an int
* **default is a float => float**
* provides the default if the value can't be converted to a float
* **default is a list => list**
* string contents for all configuration values with this key
* **default is a tuple => tuple**
* string contents for all configuration values with this key
* **default is a dictionary => dict**
* values without "=>" in them are ignored
* values are split into key/value pairs on "=>" with extra whitespace
stripped
:param str key: config setting to be fetched
:param default object: value provided if no such key exists or fails to be converted
:returns: given configuration value with its type inferred with the above rules
"""
is_multivalue = isinstance(default, (list, tuple, dict))
val = self.get_value(key, default, is_multivalue)
if val == default:
return val # don't try to infer undefined values
if isinstance(default, bool):
if val.lower() == 'true':
val = True
elif val.lower() == 'false':
val = False
else:
log.debug("Config entry '%s' is expected to be a boolean, defaulting to '%s'" % (key, str(default)))
val = default
elif isinstance(default, int):
try:
val = int(val)
except ValueError:
log.debug("Config entry '%s' is expected to be an integer, defaulting to '%i'" % (key, default))
val = default
elif isinstance(default, float):
try:
val = float(val)
except ValueError:
log.debug("Config entry '%s' is expected to be a float, defaulting to '%f'" % (key, default))
val = default
elif isinstance(default, list):
val = list(val) # make a shallow copy
elif isinstance(default, tuple):
val = tuple(val)
elif isinstance(default, dict):
val_map = OrderedDict()
for entry in val:
if '=>' in entry:
entry_key, entry_val = entry.split('=>', 1)
val_map[entry_key.strip()] = entry_val.strip()
else:
log.debug('Ignoring invalid %s config entry (expected a mapping, but "%s" was missing "=>")' % (key, entry))
val = val_map
return val
def get_value(self, key, default = None, multiple = False):
"""
This provides the current value associated with a given key.
:param str key: config setting to be fetched
:param object default: value provided if no such key exists
:param bool multiple: provides back a list of all values if **True**,
otherwise this returns the last loaded configuration value
:returns: **str** or **list** of string configuration values associated
with the given key, providing the default if no such key exists
"""
with self._contents_lock:
if key in self._contents:
self._requested_keys.add(key)
if multiple:
return self._contents[key]
else:
return self._contents[key][-1]
else:
message_id = 'stem.util.conf.missing_config_key_%s' % key
log.log_once(message_id, log.TRACE, "config entry '%s' not found, defaulting to '%s'" % (key, default))
return default
def __getitem__(self, key):
with self._contents_lock:
return self._contents[key]
stem-1.8.0/stem/util/term.py 0000664 0001750 0001750 00000011246 13501272761 016470 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Utilities for working with the terminal.
**Module Overview:**
::
encoding - provides the ANSI escape sequence for a terminal attribute
format - wrap text with ANSI for the given colors or attributes
.. data:: Color (enum)
.. data:: BgColor (enum)
Foreground or background terminal colors.
=========== ===========
Color Description
=========== ===========
**BLACK** black color
**BLUE** blue color
**CYAN** cyan color
**GREEN** green color
**MAGENTA** magenta color
**RED** red color
**WHITE** white color
**YELLOW** yellow color
=========== ===========
.. data:: Attr (enum)
Terminal text attributes.
.. versionchanged:: 1.5.0
Added the LINES attribute.
=================== ===========
Attr Description
=================== ===========
**BOLD** heavy typeface
**HIGHLIGHT** inverted foreground and background
**UNDERLINE** underlined text
**READLINE_ESCAPE** wrap encodings in `RL_PROMPT_START_IGNORE and RL_PROMPT_END_IGNORE sequences `_
**LINES** formats lines individually
=================== ===========
"""
import stem.util.enum
import stem.util.str_tools
TERM_COLORS = ('BLACK', 'RED', 'GREEN', 'YELLOW', 'BLUE', 'MAGENTA', 'CYAN', 'WHITE')
# DISABLE_COLOR_SUPPORT is *not* being vended to Stem users. This is likely to
# go away if I can think of a more graceful method for color toggling.
DISABLE_COLOR_SUPPORT = False
Color = stem.util.enum.Enum(*TERM_COLORS)
BgColor = stem.util.enum.Enum(*['BG_' + color for color in TERM_COLORS])
Attr = stem.util.enum.Enum('BOLD', 'UNDERLINE', 'HIGHLIGHT', 'READLINE_ESCAPE', 'LINES')
# mappings of terminal attribute enums to their ANSI escape encoding
FG_ENCODING = dict([(list(Color)[i], str(30 + i)) for i in range(8)])
BG_ENCODING = dict([(list(BgColor)[i], str(40 + i)) for i in range(8)])
ATTR_ENCODING = {Attr.BOLD: '1', Attr.UNDERLINE: '4', Attr.HIGHLIGHT: '7'}
CSI = '\x1B[%sm'
RESET = CSI % '0'
def encoding(*attrs):
"""
Provides the ANSI escape sequence for these terminal color or attributes.
.. versionadded:: 1.5.0
:param list attr: :data:`~stem.util.terminal.Color`,
:data:`~stem.util.terminal.BgColor`, or :data:`~stem.util.terminal.Attr` to
provide an ecoding for
:returns: **str** of the ANSI escape sequence, **None** no attributes are
recognized
"""
term_encodings = []
for attr in attrs:
# TODO: Account for an earlier misspelled attribute. This should be dropped
# in Stem. 2.0.x.
if attr == 'HILIGHT':
attr = 'HIGHLIGHT'
attr = stem.util.str_tools._to_camel_case(attr)
term_encoding = FG_ENCODING.get(attr, None)
term_encoding = BG_ENCODING.get(attr, term_encoding)
term_encoding = ATTR_ENCODING.get(attr, term_encoding)
if term_encoding:
term_encodings.append(term_encoding)
if term_encodings:
return CSI % ';'.join(term_encodings)
def format(msg, *attr):
"""
Simple terminal text formatting using `ANSI escape sequences
`_.
The following are some toolkits providing similar capabilities:
* `django.utils.termcolors `_
* `termcolor `_
* `colorama `_
.. versionchanged:: 1.6.0
Normalized return value to be unicode to better support python 2/3
compatibility.
:param str msg: string to be formatted
:param str attr: text attributes, this can be :data:`~stem.util.term.Color`,
:data:`~stem.util.term.BgColor`, or :data:`~stem.util.term.Attr` enums
and are case insensitive (so strings like 'red' are fine)
:returns: **unicode** wrapped with ANSI escape encodings, starting with the given
attributes and ending with a reset
"""
msg = stem.util.str_tools._to_unicode(msg)
if DISABLE_COLOR_SUPPORT:
return msg
if Attr.LINES in attr:
attr = list(attr)
attr.remove(Attr.LINES)
lines = [format(line, *attr) for line in msg.split('\n')]
return '\n'.join(lines)
# if we have reset sequences in the message then apply our attributes
# after each of them
if RESET in msg:
return ''.join([format(comp, *attr) for comp in msg.split(RESET)])
prefix, suffix = encoding(*attr), RESET
if prefix:
if Attr.READLINE_ESCAPE in attr:
prefix = '\001%s\002' % prefix
suffix = '\001%s\002' % suffix
return prefix + msg + suffix
else:
return msg
stem-1.8.0/stem/util/ordereddict.py 0000664 0001750 0001750 00000007567 13501272761 020024 0 ustar atagar atagar 0000000 0000000 # Drop in replacement for python 2.7's OrderedDict, from...
# https://pypi.org/project/ordereddict/
#
# Stem users should *not* rely upon this module. It will be removed when we
# drop support for python 2.6 and below.
# Copyright (c) 2009 Raymond Hettinger
#
# Permission is hereby granted, free of charge, to any person
# obtaining a copy of this software and associated documentation files
# (the "Software"), to deal in the Software without restriction,
# including without limitation the rights to use, copy, modify, merge,
# publish, distribute, sublicense, and/or sell copies of the Software,
# and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
#
# The above copyright notice and this permission notice shall be
# included in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
# OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
from UserDict import DictMixin
class OrderedDict(dict, DictMixin):
def __init__(self, *args, **kwds):
if len(args) > 1:
raise TypeError('expected at most 1 arguments, got %d' % len(args))
try:
self.__end
except AttributeError:
self.clear()
self.update(*args, **kwds)
def clear(self):
self.__end = end = []
end += [None, end, end] # sentinel node for doubly linked list
self.__map = {} # key --> [key, prev, next]
dict.clear(self)
def __setitem__(self, key, value):
if key not in self:
end = self.__end
curr = end[1]
curr[2] = end[1] = self.__map[key] = [key, curr, end]
dict.__setitem__(self, key, value)
def __delitem__(self, key):
dict.__delitem__(self, key)
key, prev, next = self.__map.pop(key)
prev[2] = next
next[1] = prev
def __iter__(self):
end = self.__end
curr = end[2]
while curr is not end:
yield curr[0]
curr = curr[2]
def __reversed__(self):
end = self.__end
curr = end[1]
while curr is not end:
yield curr[0]
curr = curr[1]
def popitem(self, last=True):
if not self:
raise KeyError('dictionary is empty')
if last:
key = reversed(self).next()
else:
key = iter(self).next()
value = self.pop(key)
return key, value
def __reduce__(self):
items = [[k, self[k]] for k in self]
tmp = self.__map, self.__end
del self.__map, self.__end
inst_dict = vars(self).copy()
self.__map, self.__end = tmp
if inst_dict:
return (self.__class__, (items,), inst_dict)
return self.__class__, (items,)
def keys(self):
return list(self)
setdefault = DictMixin.setdefault
update = DictMixin.update
pop = DictMixin.pop
values = DictMixin.values
items = DictMixin.items
iterkeys = DictMixin.iterkeys
itervalues = DictMixin.itervalues
iteritems = DictMixin.iteritems
def __repr__(self):
if not self:
return '%s()' % (self.__class__.__name__,)
return '%s(%r)' % (self.__class__.__name__, self.items())
def copy(self):
return self.__class__(self)
@classmethod
def fromkeys(cls, iterable, value=None):
d = cls()
for key in iterable:
d[key] = value
return d
def __eq__(self, other):
if isinstance(other, OrderedDict):
if len(self) != len(other):
return False
for p, q in zip(self.items(), other.items()):
if p != q:
return False
return True
return dict.__eq__(self, other)
def __ne__(self, other):
return not self == other
stem-1.8.0/stem/util/proc.py 0000664 0001750 0001750 00000042432 13501272761 016465 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Helper functions for querying process and system information from the /proc
contents. Fetching information this way provides huge performance benefits
over lookups via system utilities (ps, netstat, etc). For instance, resolving
connections this way cuts the runtime by around 90% verses the alternatives.
These functions may not work on all platforms (only Linux?).
The method for reading these files (and a little code) are borrowed from
`psutil `_, which was written by Jay Loden,
Dave Daeschler, Giampaolo Rodola' and is under the BSD license.
**These functions are not being vended to stem users. They may change in the
future, use them at your own risk.**
.. versionchanged:: 1.3.0
Dropped the get_* prefix from several function names. The old names still
work, but are deprecated aliases.
**Module Overview:**
::
is_available - checks if proc utilities can be used on this system
system_start_time - unix timestamp for when the system started
physical_memory - memory available on this system
cwd - provides the current working directory for a process
uid - provides the user id a process is running under
memory_usage - provides the memory usage of a process
stats - queries statistics about a process
file_descriptors_used - number of file descriptors used by a process
connections - provides the connections made by a process
.. data:: Stat (enum)
Types of data available via the :func:`~stem.util.proc.stats` function.
============== ===========
Stat Description
============== ===========
**COMMAND** command name under which the process is running
**CPU_UTIME** total user time spent on the process
**CPU_STIME** total system time spent on the process
**START_TIME** when this process began, in unix time
============== ===========
"""
import base64
import os
import platform
import socket
import sys
import time
import stem.prereq
import stem.util.connection
import stem.util.enum
import stem.util.str_tools
from stem.util import log
try:
# unavailable on windows (#19823)
import pwd
IS_PWD_AVAILABLE = True
except ImportError:
IS_PWD_AVAILABLE = False
if stem.prereq._is_lru_cache_available():
from functools import lru_cache
else:
from stem.util.lru_cache import lru_cache
# os.sysconf is only defined on unix
try:
CLOCK_TICKS = os.sysconf(os.sysconf_names['SC_CLK_TCK'])
except AttributeError:
CLOCK_TICKS = None
IS_LITTLE_ENDIAN = sys.byteorder == 'little'
ENCODED_ADDR = {} # cache of encoded ips to their decoded version
Stat = stem.util.enum.Enum(
('COMMAND', 'command'), ('CPU_UTIME', 'utime'),
('CPU_STIME', 'stime'), ('START_TIME', 'start time')
)
@lru_cache()
def is_available():
"""
Checks if proc information is available on this platform.
:returns: **True** if proc contents exist on this platform, **False** otherwise
"""
if platform.system() != 'Linux':
return False
else:
# list of process independent proc paths we use
proc_paths = ('/proc/stat', '/proc/meminfo', '/proc/net/tcp', '/proc/net/udp')
for path in proc_paths:
if not os.path.exists(path):
return False
return True
@lru_cache()
def system_start_time():
"""
Provides the unix time (seconds since epoch) when the system started.
:returns: **float** for the unix time of when the system started
:raises: **IOError** if it can't be determined
"""
start_time, parameter = time.time(), 'system start time'
btime_line = _get_line('/proc/stat', 'btime', parameter)
try:
result = float(btime_line.strip().split()[1])
_log_runtime(parameter, '/proc/stat[btime]', start_time)
return result
except:
exc = IOError('unable to parse the /proc/stat btime entry: %s' % btime_line)
_log_failure(parameter, exc)
raise exc
@lru_cache()
def physical_memory():
"""
Provides the total physical memory on the system in bytes.
:returns: **int** for the bytes of physical memory this system has
:raises: **IOError** if it can't be determined
"""
start_time, parameter = time.time(), 'system physical memory'
mem_total_line = _get_line('/proc/meminfo', 'MemTotal:', parameter)
try:
result = int(mem_total_line.split()[1]) * 1024
_log_runtime(parameter, '/proc/meminfo[MemTotal]', start_time)
return result
except:
exc = IOError('unable to parse the /proc/meminfo MemTotal entry: %s' % mem_total_line)
_log_failure(parameter, exc)
raise exc
def cwd(pid):
"""
Provides the current working directory for the given process.
:param int pid: process id of the process to be queried
:returns: **str** with the path of the working directory for the process
:raises: **IOError** if it can't be determined
"""
start_time, parameter = time.time(), 'cwd'
proc_cwd_link = '/proc/%s/cwd' % pid
if pid == 0:
cwd = ''
else:
try:
cwd = os.readlink(proc_cwd_link)
except OSError:
exc = IOError('unable to read %s' % proc_cwd_link)
_log_failure(parameter, exc)
raise exc
_log_runtime(parameter, proc_cwd_link, start_time)
return cwd
def uid(pid):
"""
Provides the user ID the given process is running under.
:param int pid: process id of the process to be queried
:returns: **int** with the user id for the owner of the process
:raises: **IOError** if it can't be determined
"""
start_time, parameter = time.time(), 'uid'
status_path = '/proc/%s/status' % pid
uid_line = _get_line(status_path, 'Uid:', parameter)
try:
result = int(uid_line.split()[1])
_log_runtime(parameter, '%s[Uid]' % status_path, start_time)
return result
except:
exc = IOError('unable to parse the %s Uid entry: %s' % (status_path, uid_line))
_log_failure(parameter, exc)
raise exc
def memory_usage(pid):
"""
Provides the memory usage in bytes for the given process.
:param int pid: process id of the process to be queried
:returns: **tuple** of two ints with the memory usage of the process, of the
form **(resident_size, virtual_size)**
:raises: **IOError** if it can't be determined
"""
# checks if this is the kernel process
if pid == 0:
return (0, 0)
start_time, parameter = time.time(), 'memory usage'
status_path = '/proc/%s/status' % pid
mem_lines = _get_lines(status_path, ('VmRSS:', 'VmSize:'), parameter)
try:
residentSize = int(mem_lines['VmRSS:'].split()[1]) * 1024
virtualSize = int(mem_lines['VmSize:'].split()[1]) * 1024
_log_runtime(parameter, '%s[VmRSS|VmSize]' % status_path, start_time)
return (residentSize, virtualSize)
except:
exc = IOError('unable to parse the %s VmRSS and VmSize entries: %s' % (status_path, ', '.join(mem_lines)))
_log_failure(parameter, exc)
raise exc
def stats(pid, *stat_types):
"""
Provides process specific information. See the :data:`~stem.util.proc.Stat`
enum for valid options.
:param int pid: process id of the process to be queried
:param Stat stat_types: information to be provided back
:returns: **tuple** with all of the requested statistics as strings
:raises: **IOError** if it can't be determined
"""
if CLOCK_TICKS is None:
raise IOError('Unable to look up SC_CLK_TCK')
start_time, parameter = time.time(), 'process %s' % ', '.join(stat_types)
# the stat file contains a single line, of the form...
# 8438 (tor) S 8407 8438 8407 34818 8438 4202496...
stat_path = '/proc/%s/stat' % pid
stat_line = _get_line(stat_path, str(pid), parameter)
# breaks line into component values
stat_comp = []
cmd_start, cmd_end = stat_line.find('('), stat_line.find(')')
if cmd_start != -1 and cmd_end != -1:
stat_comp.append(stat_line[:cmd_start])
stat_comp.append(stat_line[cmd_start + 1:cmd_end])
stat_comp += stat_line[cmd_end + 1:].split()
if len(stat_comp) < 44 and _is_float(stat_comp[13], stat_comp[14], stat_comp[21]):
exc = IOError('stat file had an unexpected format: %s' % stat_path)
_log_failure(parameter, exc)
raise exc
results = []
for stat_type in stat_types:
if stat_type == Stat.COMMAND:
if pid == 0:
results.append('sched')
else:
results.append(stat_comp[1])
elif stat_type == Stat.CPU_UTIME:
if pid == 0:
results.append('0')
else:
results.append(str(float(stat_comp[13]) / CLOCK_TICKS))
elif stat_type == Stat.CPU_STIME:
if pid == 0:
results.append('0')
else:
results.append(str(float(stat_comp[14]) / CLOCK_TICKS))
elif stat_type == Stat.START_TIME:
if pid == 0:
return system_start_time()
else:
# According to documentation, starttime is in field 21 and the unit is
# jiffies (clock ticks). We divide it for clock ticks, then add the
# uptime to get the seconds since the epoch.
p_start_time = float(stat_comp[21]) / CLOCK_TICKS
results.append(str(p_start_time + system_start_time()))
_log_runtime(parameter, stat_path, start_time)
return tuple(results)
def file_descriptors_used(pid):
"""
Provides the number of file descriptors currently being used by a process.
.. versionadded:: 1.3.0
:param int pid: process id of the process to be queried
:returns: **int** of the number of file descriptors used
:raises: **IOError** if it can't be determined
"""
try:
pid = int(pid)
if pid < 0:
raise IOError("Process pids can't be negative: %s" % pid)
except (ValueError, TypeError):
raise IOError('Process pid was non-numeric: %s' % pid)
try:
return len(os.listdir('/proc/%i/fd' % pid))
except Exception as exc:
raise IOError('Unable to check number of file descriptors used: %s' % exc)
def connections(pid = None, user = None):
"""
Queries connections from the proc contents. This matches netstat, lsof, and
friends but is much faster. If no **pid** or **user** are provided this
provides all present connections.
:param int pid: pid to provide connections for
:param str user: username to look up connections for
:returns: **list** of :class:`~stem.util.connection.Connection` instances
:raises: **IOError** if it can't be determined
"""
start_time, conn = time.time(), []
if pid:
parameter = 'connections for pid %s' % pid
try:
pid = int(pid)
if pid < 0:
raise IOError("Process pids can't be negative: %s" % pid)
except (ValueError, TypeError):
raise IOError('Process pid was non-numeric: %s' % pid)
elif user:
parameter = 'connections for user %s' % user
else:
parameter = 'all connections'
try:
if not IS_PWD_AVAILABLE:
raise IOError("This requires python's pwd module, which is unavailable on Windows.")
inodes = _inodes_for_sockets(pid) if pid else set()
process_uid = stem.util.str_tools._to_bytes(str(pwd.getpwnam(user).pw_uid)) if user else None
for proc_file_path in ('/proc/net/tcp', '/proc/net/tcp6', '/proc/net/udp', '/proc/net/udp6'):
if proc_file_path.endswith('6') and not os.path.exists(proc_file_path):
continue # ipv6 proc contents are optional
protocol = proc_file_path[10:].rstrip('6') # 'tcp' or 'udp'
is_ipv6 = proc_file_path.endswith('6')
try:
with open(proc_file_path, 'rb') as proc_file:
proc_file.readline() # skip the first line
for line in proc_file:
_, l_dst, r_dst, status, _, _, _, uid, _, inode = line.split()[:10]
if inodes and inode not in inodes:
continue
elif process_uid and uid != process_uid:
continue
elif protocol == 'tcp' and status != b'01':
continue # skip tcp connections that aren't yet established
div = l_dst.find(b':')
l_addr = _unpack_addr(l_dst[:div])
l_port = int(l_dst[div + 1:], 16)
div = r_dst.find(b':')
r_addr = _unpack_addr(r_dst[:div])
r_port = int(r_dst[div + 1:], 16)
if r_addr == '0.0.0.0' or r_addr == '0000:0000:0000:0000:0000:0000':
continue # no address
elif l_port == 0 or r_port == 0:
continue # no port
conn.append(stem.util.connection.Connection(l_addr, l_port, r_addr, r_port, protocol, is_ipv6))
except IOError as exc:
raise IOError("unable to read '%s': %s" % (proc_file_path, exc))
except Exception as exc:
raise IOError("unable to parse '%s': %s" % (proc_file_path, exc))
_log_runtime(parameter, '/proc/net/[tcp|udp]', start_time)
return conn
except IOError as exc:
_log_failure(parameter, exc)
raise
def _inodes_for_sockets(pid):
"""
Provides inodes in use by a process for its sockets.
:param int pid: process id of the process to be queried
:returns: **set** with inodes for its sockets
:raises: **IOError** if it can't be determined
"""
inodes = set()
try:
fd_contents = os.listdir('/proc/%s/fd' % pid)
except OSError as exc:
raise IOError('Unable to read our file descriptors: %s' % exc)
for fd in fd_contents:
fd_path = '/proc/%s/fd/%s' % (pid, fd)
try:
# File descriptor link, such as 'socket:[30899]'
fd_name = os.readlink(fd_path)
if fd_name.startswith('socket:['):
inodes.add(stem.util.str_tools._to_bytes(fd_name[8:-1]))
except OSError as exc:
if not os.path.exists(fd_path):
continue # descriptors may shift while we're in the middle of iterating over them
# most likely couldn't be read due to permissions
raise IOError('unable to determine file descriptor destination (%s): %s' % (exc, fd_path))
return inodes
def _unpack_addr(addr):
"""
Translates an address entry in the /proc/net/* contents to a human readable
form (`reference `_,
for instance:
::
"0500000A" -> "10.0.0.5"
"F804012A4A5190010000000002000000" -> "2a01:4f8:190:514a::2"
:param str addr: proc address entry to be decoded
:returns: **str** of the decoded address
"""
if addr not in ENCODED_ADDR:
if len(addr) == 8:
# IPv4 address
decoded = base64.b16decode(addr)[::-1] if IS_LITTLE_ENDIAN else base64.b16decode(addr)
ENCODED_ADDR[addr] = socket.inet_ntop(socket.AF_INET, decoded)
else:
# IPv6 address
if IS_LITTLE_ENDIAN:
# Group into eight characters, then invert in pairs...
#
# https://trac.torproject.org/projects/tor/ticket/18079#comment:24
inverted = []
for i in range(4):
grouping = addr[8 * i:8 * (i + 1)]
inverted += [grouping[2 * i:2 * (i + 1)] for i in range(4)][::-1]
encoded = b''.join(inverted)
else:
encoded = addr
ENCODED_ADDR[addr] = stem.util.connection.expand_ipv6_address(socket.inet_ntop(socket.AF_INET6, base64.b16decode(encoded)))
return ENCODED_ADDR[addr]
def _is_float(*value):
try:
for v in value:
float(v)
return True
except ValueError:
return False
def _get_line(file_path, line_prefix, parameter):
return _get_lines(file_path, (line_prefix, ), parameter)[line_prefix]
def _get_lines(file_path, line_prefixes, parameter):
"""
Fetches lines with the given prefixes from a file. This only provides back
the first instance of each prefix.
:param str file_path: path of the file to read
:param tuple line_prefixes: string prefixes of the lines to return
:param str parameter: description of the proc attribute being fetch
:returns: mapping of prefixes to the matching line
:raises: **IOError** if unable to read the file or can't find all of the prefixes
"""
try:
remaining_prefixes = list(line_prefixes)
proc_file, results = open(file_path), {}
for line in proc_file:
if not remaining_prefixes:
break # found everything we're looking for
for prefix in remaining_prefixes:
if line.startswith(prefix):
results[prefix] = line
remaining_prefixes.remove(prefix)
break
proc_file.close()
if remaining_prefixes:
if len(remaining_prefixes) == 1:
msg = '%s did not contain a %s entry' % (file_path, remaining_prefixes[0])
else:
msg = '%s did not contain %s entries' % (file_path, ', '.join(remaining_prefixes))
raise IOError(msg)
else:
return results
except IOError as exc:
_log_failure(parameter, exc)
raise
def _log_runtime(parameter, proc_location, start_time):
"""
Logs a message indicating a successful proc query.
:param str parameter: description of the proc attribute being fetch
:param str proc_location: proc files we were querying
:param int start_time: unix time for when this query was started
"""
runtime = time.time() - start_time
log.debug('proc call (%s): %s (runtime: %0.4f)' % (parameter, proc_location, runtime))
def _log_failure(parameter, exc):
"""
Logs a message indicating that the proc query failed.
:param str parameter: description of the proc attribute being fetch
:param Exception exc: exception that we're raising
"""
log.debug('proc call failed (%s): %s' % (parameter, exc))
# TODO: drop with stem 2.x
# We renamed our methods to drop a redundant 'get_*' prefix, so alias the old
# names for backward compatability.
get_system_start_time = system_start_time
get_physical_memory = physical_memory
get_cwd = cwd
get_uid = uid
get_memory_usage = memory_usage
get_stats = stats
get_connections = connections
stem-1.8.0/stem/util/connection.py 0000664 0001750 0001750 00000061506 13546245571 017674 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Connection and networking based utility functions.
**Module Overview:**
::
download - download from a given url
get_connections - quieries the connections belonging to a given process
system_resolvers - provides connection resolution methods that are likely to be available
port_usage - brief description of the common usage for a port
is_valid_ipv4_address - checks if a string is a valid IPv4 address
is_valid_ipv6_address - checks if a string is a valid IPv6 address
is_valid_port - checks if something is a valid representation for a port
is_private_address - checks if an IPv4 address belongs to a private range or not
address_to_int - provides an integer representation of an IP address
expand_ipv6_address - provides an IPv6 address with its collapsed portions expanded
get_mask_ipv4 - provides the mask representation for a given number of bits
get_mask_ipv6 - provides the IPv6 mask representation for a given number of bits
.. data:: Resolver (enum)
Method for resolving a process' connections.
.. versionadded:: 1.1.0
.. versionchanged:: 1.4.0
Added **NETSTAT_WINDOWS**.
.. versionchanged:: 1.6.0
Added **BSD_FSTAT**.
.. deprecated:: 1.6.0
The SOCKSTAT connection resolver is proving to be unreliable
(:trac:`23057`), and will be dropped in the 2.0.0 release unless fixed.
==================== ===========
Resolver Description
==================== ===========
**PROC** /proc contents
**NETSTAT** netstat
**NETSTAT_WINDOWS** netstat command under Windows
**SS** ss command
**LSOF** lsof command
**SOCKSTAT** sockstat command under \\*nix
**BSD_SOCKSTAT** sockstat command under FreeBSD
**BSD_PROCSTAT** procstat command under FreeBSD
**BSD_FSTAT** fstat command under OpenBSD
==================== ===========
"""
import collections
import os
import platform
import re
import socket
import sys
import time
import stem
import stem.util
import stem.util.proc
import stem.util.system
from stem.util import conf, enum, log, str_tools
try:
# account for urllib's change between python 2.x and 3.x
import urllib.request as urllib
except ImportError:
import urllib2 as urllib
# Connection resolution is risky to log about since it's highly likely to
# contain sensitive information. That said, it's also difficult to get right in
# a platform independent fashion. To opt into the logging requried to
# troubleshoot connection resolution set the following...
LOG_CONNECTION_RESOLUTION = False
Resolver = enum.Enum(
('PROC', 'proc'),
('NETSTAT', 'netstat'),
('NETSTAT_WINDOWS', 'netstat (windows)'),
('SS', 'ss'),
('LSOF', 'lsof'),
('SOCKSTAT', 'sockstat'),
('BSD_SOCKSTAT', 'sockstat (bsd)'),
('BSD_PROCSTAT', 'procstat (bsd)'),
('BSD_FSTAT', 'fstat (bsd)')
)
FULL_IPv4_MASK = '255.255.255.255'
FULL_IPv6_MASK = 'FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF'
PORT_USES = None # port number => description
RESOLVER_COMMAND = {
Resolver.PROC: '',
# -n = prevents dns lookups, -p = include process, -W = don't crop addresses (needed for ipv6)
Resolver.NETSTAT: 'netstat -npW',
# -a = show all TCP/UDP connections, -n = numeric addresses and ports, -o = include pid
Resolver.NETSTAT_WINDOWS: 'netstat -ano',
# -n = numeric ports, -p = include process, -t = tcp sockets, -u = udp sockets
Resolver.SS: 'ss -nptu',
# -n = prevent dns lookups, -P = show port numbers (not names), -i = ip only, -w = no warnings
# (lsof provides a '-p ' but oddly in practice it seems to be ~11-28% slower)
Resolver.LSOF: 'lsof -wnPi',
Resolver.SOCKSTAT: 'sockstat',
# -4 = IPv4, -c = connected sockets
Resolver.BSD_SOCKSTAT: 'sockstat -4c',
# -f = process pid
Resolver.BSD_PROCSTAT: 'procstat -f {pid}',
# -p = process pid
Resolver.BSD_FSTAT: 'fstat -p {pid}',
}
RESOLVER_FILTER = {
Resolver.PROC: '',
# tcp 0 586 192.168.0.1:44284 38.229.79.2:443 ESTABLISHED 15843/tor
Resolver.NETSTAT: '^{protocol}\\s+.*\\s+{local}\\s+{remote}\\s+ESTABLISHED\\s+{pid}/{name}\\s*$',
# tcp 586 192.168.0.1:44284 38.229.79.2:443 ESTABLISHED 15843
Resolver.NETSTAT_WINDOWS: '^\\s*{protocol}\\s+{local}\\s+{remote}\\s+ESTABLISHED\\s+{pid}\\s*$',
# tcp ESTAB 0 0 192.168.0.20:44415 38.229.79.2:443 users:(("tor",15843,9))
Resolver.SS: '^{protocol}\\s+ESTAB\\s+.*\\s+{local}\\s+{remote}\\s+users:\\(\\("{name}",(?:pid=)?{pid},(?:fd=)?[0-9]+\\)\\)$',
# tor 3873 atagar 45u IPv4 40994 0t0 TCP 10.243.55.20:45724->194.154.227.109:9001 (ESTABLISHED)
Resolver.LSOF: '^{name}\\s+{pid}\\s+.*\\s+{protocol}\\s+{local}->{remote} \\(ESTABLISHED\\)$',
# atagar tor 15843 tcp4 192.168.0.20:44092 68.169.35.102:443 ESTABLISHED
Resolver.SOCKSTAT: '^\\S+\\s+{name}\\s+{pid}\\s+{protocol}4\\s+{local}\\s+{remote}\\s+ESTABLISHED$',
# _tor tor 4397 12 tcp4 172.27.72.202:54011 127.0.0.1:9001
Resolver.BSD_SOCKSTAT: '^\\S+\\s+{name}\\s+{pid}\\s+\\S+\\s+{protocol}4\\s+{local}\\s+{remote}$',
# 3561 tor 4 s - rw---n-- 2 0 TCP 10.0.0.2:9050 10.0.0.1:22370
Resolver.BSD_PROCSTAT: '^\\s*{pid}\\s+{name}\\s+.*\\s+{protocol}\\s+{local}\\s+{remote}$',
# _tor tor 15843 20* internet stream tcp 0x0 192.168.1.100:36174 --> 4.3.2.1:443
Resolver.BSD_FSTAT: '^\\S+\\s+{name}\\s+{pid}\\s+.*\\s+{protocol}\\s+\\S+\\s+{local}\\s+[-<]-[->]\\s+{remote}$',
}
class Connection(collections.namedtuple('Connection', ['local_address', 'local_port', 'remote_address', 'remote_port', 'protocol', 'is_ipv6'])):
"""
Network connection information.
.. versionchanged:: 1.5.0
Added the **is_ipv6** attribute.
:var str local_address: ip address the connection originates from
:var int local_port: port the connection originates from
:var str remote_address: destionation ip address
:var int remote_port: destination port
:var str protocol: protocol of the connection ('tcp', 'udp', etc)
:var bool is_ipv6: addresses are ipv6 if true, and ipv4 otherwise
"""
def download(url, timeout = None, retries = None):
"""
Download from the given url.
.. versionadded:: 1.8.0
:param str url: uncompressed url to download from
:param int timeout: timeout when connection becomes idle, no timeout applied
if **None**
:param int retires: maximum attempts to impose
:returns: **bytes** content of the given url
:raises:
* :class:`~stem.DownloadTimeout` if our request timed out
* :class:`~stem.DownloadFailed` if our request fails
"""
if retries is None:
retries = 0
start_time = time.time()
try:
return urllib.urlopen(url, timeout = timeout).read()
except socket.timeout as exc:
raise stem.DownloadTimeout(url, exc, sys.exc_info()[2], timeout)
except:
exc, stacktrace = sys.exc_info()[1:3]
if timeout is not None:
timeout -= time.time() - start_time
if retries > 0 and (timeout is None or timeout > 0):
log.debug('Failed to download from %s (%i retries remaining): %s' % (url, retries, exc))
return download(url, timeout, retries - 1)
else:
log.debug('Failed to download from %s: %s' % (url, exc))
raise stem.DownloadFailed(url, exc, stacktrace)
def get_connections(resolver = None, process_pid = None, process_name = None):
"""
Retrieves a list of the current connections for a given process. This
provides a list of :class:`~stem.util.connection.Connection`. Note that
addresses may be IPv4 *or* IPv6 depending on what the platform supports.
.. versionadded:: 1.1.0
.. versionchanged:: 1.5.0
Made our resolver argument optional.
.. versionchanged:: 1.5.0
IPv6 support when resolving via proc, netstat, lsof, or ss.
:param Resolver resolver: method of connection resolution to use, if not
provided then one is picked from among those that should likely be
available for the system
:param int process_pid: pid of the process to retrieve
:param str process_name: name of the process to retrieve
:returns: **list** of :class:`~stem.util.connection.Connection` instances
:raises:
* **ValueError** if neither a process_pid nor process_name is provided
* **IOError** if no connections are available or resolution fails
(generally they're indistinguishable). The common causes are the
command being unavailable or permissions.
"""
if not resolver:
available_resolvers = system_resolvers()
if available_resolvers:
resolver = available_resolvers[0]
else:
raise IOError('Unable to determine a connection resolver')
if not process_pid and not process_name:
raise ValueError('You must provide a pid or process name to provide connections for')
def _log(msg):
if LOG_CONNECTION_RESOLUTION:
log.debug(msg)
_log('=' * 80)
_log('Querying connections for resolver: %s, pid: %s, name: %s' % (resolver, process_pid, process_name))
if isinstance(process_pid, str):
try:
process_pid = int(process_pid)
except ValueError:
raise ValueError('Process pid was non-numeric: %s' % process_pid)
if process_pid is None:
all_pids = stem.util.system.pid_by_name(process_name, True)
if len(all_pids) == 0:
if resolver in (Resolver.NETSTAT_WINDOWS, Resolver.PROC, Resolver.BSD_PROCSTAT):
raise IOError("Unable to determine the pid of '%s'. %s requires the pid to provide the connections." % (process_name, resolver))
elif len(all_pids) == 1:
process_pid = all_pids[0]
else:
if resolver in (Resolver.NETSTAT_WINDOWS, Resolver.PROC, Resolver.BSD_PROCSTAT):
raise IOError("There's multiple processes named '%s'. %s requires a single pid to provide the connections." % (process_name, resolver))
if resolver == Resolver.PROC:
return stem.util.proc.connections(pid = process_pid)
resolver_command = RESOLVER_COMMAND[resolver].format(pid = process_pid)
try:
results = stem.util.system.call(resolver_command)
except OSError as exc:
raise IOError("Unable to query '%s': %s" % (resolver_command, exc))
resolver_regex_str = RESOLVER_FILTER[resolver].format(
protocol = '(?P\\S+)',
local = '(?P[\\[\\]0-9a-f.:]+)',
remote = '(?P[\\[\\]0-9a-f.:]+)',
pid = process_pid if process_pid else '[0-9]*',
name = process_name if process_name else '\\S*',
)
_log('Resolver regex: %s' % resolver_regex_str)
_log('Resolver results:\n%s' % '\n'.join(results))
connections = []
resolver_regex = re.compile(resolver_regex_str)
def _parse_address_str(addr_type, addr_str, line):
addr, port = addr_str.rsplit(':', 1)
if not is_valid_ipv4_address(addr) and not is_valid_ipv6_address(addr, allow_brackets = True):
_log('Invalid %s address (%s): %s' % (addr_type, addr, line))
return None, None
elif not is_valid_port(port):
_log('Invalid %s port (%s): %s' % (addr_type, port, line))
return None, None
else:
_log('Valid %s:%s: %s' % (addr, port, line))
return addr.lstrip('[').rstrip(']'), int(port)
for line in results:
match = resolver_regex.match(line)
if match:
attr = match.groupdict()
local_addr, local_port = _parse_address_str('local', attr['local'], line)
remote_addr, remote_port = _parse_address_str('remote', attr['remote'], line)
if not (local_addr and local_port and remote_addr and remote_port):
continue # missing or malformed field
protocol = attr['protocol'].lower()
if protocol == 'tcp6':
protocol = 'tcp'
if protocol not in ('tcp', 'udp'):
_log('Unrecognized protocol (%s): %s' % (protocol, line))
continue
conn = Connection(local_addr, local_port, remote_addr, remote_port, protocol, is_valid_ipv6_address(local_addr))
connections.append(conn)
_log(str(conn))
_log('%i connections found' % len(connections))
if not connections:
raise IOError('No results found using: %s' % resolver_command)
return connections
def system_resolvers(system = None):
"""
Provides the types of connection resolvers likely to be available on this platform.
.. versionadded:: 1.1.0
.. versionchanged:: 1.3.0
Renamed from get_system_resolvers() to system_resolvers(). The old name
still works as an alias, but will be dropped in Stem version 2.0.0.
:param str system: system to get resolvers for, this is determined by
platform.system() if not provided
:returns: **list** of :data:`~stem.util.connection.Resolver` instances available on this platform
"""
if system is None:
if stem.util.system.is_gentoo():
system = 'Gentoo'
else:
system = platform.system()
if system == 'Windows':
resolvers = [Resolver.NETSTAT_WINDOWS]
elif system == 'Darwin':
resolvers = [Resolver.LSOF]
elif system == 'OpenBSD':
resolvers = [Resolver.BSD_FSTAT]
elif system == 'FreeBSD':
# Netstat is available, but lacks a '-p' equivalent so we can't associate
# the results to processes. The platform also has a ss command, but it
# belongs to a spreadsheet application.
resolvers = [Resolver.BSD_SOCKSTAT, Resolver.BSD_PROCSTAT, Resolver.LSOF]
else:
# Sockstat isn't available by default on ubuntu.
resolvers = [Resolver.NETSTAT, Resolver.SOCKSTAT, Resolver.LSOF, Resolver.SS]
# remove any that aren't in the user's PATH
resolvers = [r for r in resolvers if stem.util.system.is_available(RESOLVER_COMMAND[r])]
# proc resolution, by far, outperforms the others so defaults to this is able
if stem.util.proc.is_available() and os.access('/proc/net/tcp', os.R_OK) and os.access('/proc/net/udp', os.R_OK):
resolvers = [Resolver.PROC] + resolvers
return resolvers
def port_usage(port):
"""
Provides the common use of a given port. For example, 'HTTP' for port 80 or
'SSH' for 22.
.. versionadded:: 1.2.0
:param int port: port number to look up
:returns: **str** with a description for the port, **None** if none is known
"""
global PORT_USES
if PORT_USES is None:
config = conf.Config()
config_path = os.path.join(os.path.dirname(__file__), 'ports.cfg')
try:
config.load(config_path)
port_uses = {}
for key, value in config.get('port', {}).items():
if key.isdigit():
port_uses[int(key)] = value
elif '-' in key:
min_port, max_port = key.split('-', 1)
for port_entry in range(int(min_port), int(max_port) + 1):
port_uses[port_entry] = value
else:
raise ValueError("'%s' is an invalid key" % key)
PORT_USES = port_uses
except Exception as exc:
log.warn("BUG: stem failed to load its internal port descriptions from '%s': %s" % (config_path, exc))
if not PORT_USES:
return None
if isinstance(port, str) and port.isdigit():
port = int(port)
return PORT_USES.get(port)
def is_valid_ipv4_address(address):
"""
Checks if a string is a valid IPv4 address.
:param str address: string to be checked
:returns: **True** if input is a valid IPv4 address, **False** otherwise
"""
if isinstance(address, bytes):
address = str_tools._to_unicode(address)
elif not stem.util._is_str(address):
return False
# checks if theres four period separated values
if address.count('.') != 3:
return False
# checks that each value in the octet are decimal values between 0-255
for entry in address.split('.'):
if not entry.isdigit() or int(entry) < 0 or int(entry) > 255:
return False
elif entry[0] == '0' and len(entry) > 1:
return False # leading zeros, for instance in '1.2.3.001'
return True
def is_valid_ipv6_address(address, allow_brackets = False):
"""
Checks if a string is a valid IPv6 address.
:param str address: string to be checked
:param bool allow_brackets: ignore brackets which form '[address]'
:returns: **True** if input is a valid IPv6 address, **False** otherwise
"""
if isinstance(address, bytes):
address = str_tools._to_unicode(address)
elif not stem.util._is_str(address):
return False
if allow_brackets:
if address.startswith('[') and address.endswith(']'):
address = address[1:-1]
if address.count('.') == 3:
# Likely an ipv4-mapped portion. Check that its vaild, then replace with a
# filler.
ipv4_start = address.rfind(':', 0, address.find('.')) + 1
ipv4_end = address.find(':', ipv4_start + 1)
if ipv4_end == -1:
ipv4_end = None # don't crop the last character
if not is_valid_ipv4_address(address[ipv4_start:ipv4_end]):
return False
addr_comp = [address[:ipv4_start - 1] if ipv4_start != 0 else None, 'ff:ff', address[ipv4_end + 1:] if ipv4_end else None]
address = ':'.join(filter(None, addr_comp))
# addresses are made up of eight colon separated groups of four hex digits
# with leading zeros being optional
# https://en.wikipedia.org/wiki/IPv6#Address_format
colon_count = address.count(':')
if colon_count > 7:
return False # too many groups
elif colon_count != 7 and '::' not in address:
return False # not enough groups and none are collapsed
elif address.count('::') > 1 or ':::' in address:
return False # multiple groupings of zeros can't be collapsed
for entry in address.split(':'):
if not re.match('^[0-9a-fA-f]{0,4}$', entry):
return False
return True
def is_valid_port(entry, allow_zero = False):
"""
Checks if a string or int is a valid port number.
:param list,str,int entry: string, integer or list to be checked
:param bool allow_zero: accept port number of zero (reserved by definition)
:returns: **True** if input is an integer and within the valid port range, **False** otherwise
"""
try:
value = int(entry)
if str(value) != str(entry):
return False # invalid leading char, e.g. space or zero
elif allow_zero and value == 0:
return True
else:
return value > 0 and value < 65536
except TypeError:
if isinstance(entry, (tuple, list)):
for port in entry:
if not is_valid_port(port, allow_zero):
return False
return True
else:
return False
except ValueError:
return False
def is_private_address(address):
"""
Checks if the IPv4 address is in a range belonging to the local network or
loopback. These include:
* Private ranges: 10.*, 172.16.* - 172.31.*, 192.168.*
* Loopback: 127.*
.. versionadded:: 1.1.0
:param str address: string to be checked
:returns: **True** if input is in a private range, **False** otherwise
:raises: **ValueError** if the address isn't a valid IPv4 address
"""
if not is_valid_ipv4_address(address):
raise ValueError("'%s' isn't a valid IPv4 address" % address)
# checks for any of the simple wildcard ranges
if address.startswith('10.') or address.startswith('192.168.') or address.startswith('127.'):
return True
# checks for the 172.16.* - 172.31.* range
if address.startswith('172.'):
second_octet = int(address.split('.')[1])
if second_octet >= 16 and second_octet <= 31:
return True
return False
def address_to_int(address):
"""
Provides an integer representation of a IPv4 or IPv6 address that can be used
for sorting.
.. versionadded:: 1.5.0
:param str address: IPv4 or IPv6 address
:returns: **int** representation of the address
"""
# TODO: Could be neat to also use this for serialization if we also had an
# int_to_address() function.
return int(_address_to_binary(address), 2)
def expand_ipv6_address(address):
"""
Expands abbreviated IPv6 addresses to their full colon separated hex format.
For instance...
::
>>> expand_ipv6_address('2001:db8::ff00:42:8329')
'2001:0db8:0000:0000:0000:ff00:0042:8329'
>>> expand_ipv6_address('::')
'0000:0000:0000:0000:0000:0000:0000:0000'
>>> expand_ipv6_address('::ffff:5.9.158.75')
'0000:0000:0000:0000:0000:ffff:0509:9e4b'
:param str address: IPv6 address to be expanded
:raises: **ValueError** if the address can't be expanded due to being malformed
"""
if not is_valid_ipv6_address(address):
raise ValueError("'%s' isn't a valid IPv6 address" % address)
# expand ipv4-mapped portions of addresses
if address.count('.') == 3:
ipv4_start = address.rfind(':', 0, address.find('.')) + 1
ipv4_end = address.find(':', ipv4_start + 1)
if ipv4_end == -1:
ipv4_end = None # don't crop the last character
# Converts ipv4 address to its hex ipv6 representation. For instance...
#
# '5.9.158.75' => '0509:9e4b'
ipv4_bin = _address_to_binary(address[ipv4_start:ipv4_end])
groupings = [ipv4_bin[16 * i:16 * (i + 1)] for i in range(2)]
ipv6_snippet = ':'.join(['%04x' % int(group, 2) for group in groupings])
addr_comp = [address[:ipv4_start - 1] if ipv4_start != 0 else None, ipv6_snippet, address[ipv4_end + 1:] if ipv4_end else None]
address = ':'.join(filter(None, addr_comp))
# expands collapsed groupings, there can only be a single '::' in a valid
# address
if '::' in address:
missing_groups = 7 - address.count(':')
address = address.replace('::', '::' + ':' * missing_groups)
# inserts missing zeros
for index in range(8):
start = index * 5
end = address.index(':', start) if index != 7 else len(address)
missing_zeros = 4 - (end - start)
if missing_zeros > 0:
address = address[:start] + '0' * missing_zeros + address[start:]
return address
def get_mask_ipv4(bits):
"""
Provides the IPv4 mask for a given number of bits, in the dotted-quad format.
:param int bits: number of bits to be converted
:returns: **str** with the subnet mask representation for this many bits
:raises: **ValueError** if given a number of bits outside the range of 0-32
"""
if bits > 32 or bits < 0:
raise ValueError('A mask can only be 0-32 bits, got %i' % bits)
elif bits == 32:
return FULL_IPv4_MASK
# get the binary representation of the mask
mask_bin = _get_binary(2 ** bits - 1, 32)[::-1]
# breaks it into eight character groupings
octets = [mask_bin[8 * i:8 * (i + 1)] for i in range(4)]
# converts each octet into its integer value
return '.'.join([str(int(octet, 2)) for octet in octets])
def get_mask_ipv6(bits):
"""
Provides the IPv6 mask for a given number of bits, in the hex colon-delimited
format.
:param int bits: number of bits to be converted
:returns: **str** with the subnet mask representation for this many bits
:raises: **ValueError** if given a number of bits outside the range of 0-128
"""
if bits > 128 or bits < 0:
raise ValueError('A mask can only be 0-128 bits, got %i' % bits)
elif bits == 128:
return FULL_IPv6_MASK
# get the binary representation of the mask
mask_bin = _get_binary(2 ** bits - 1, 128)[::-1]
# breaks it into sixteen character groupings
groupings = [mask_bin[16 * i:16 * (i + 1)] for i in range(8)]
# converts each group into its hex value
return ':'.join(['%04x' % int(group, 2) for group in groupings]).upper()
def _get_masked_bits(mask):
"""
Provides the number of bits that an IPv4 subnet mask represents. Note that
not all masks can be represented by a bit count.
:param str mask: mask to be converted
:returns: **int** with the number of bits represented by the mask
:raises: **ValueError** if the mask is invalid or can't be converted
"""
if not is_valid_ipv4_address(mask):
raise ValueError("'%s' is an invalid subnet mask" % mask)
# converts octets to binary representation
mask_bin = _address_to_binary(mask)
mask_match = re.match('^(1*)(0*)$', mask_bin)
if mask_match:
return 32 - len(mask_match.groups()[1])
else:
raise ValueError('Unable to convert mask to a bit count: %s' % mask)
def _get_binary(value, bits):
"""
Provides the given value as a binary string, padded with zeros to the given
number of bits.
:param int value: value to be converted
:param int bits: number of bits to pad to
"""
# http://www.daniweb.com/code/snippet216539.html
return ''.join([str((value >> y) & 1) for y in range(bits - 1, -1, -1)])
# TODO: In stem 2.x we should consider unifying this with
# stem.client.datatype's _unpack_ipv4_address() and _unpack_ipv6_address().
def _address_to_binary(address):
"""
Provides the binary value for an IPv4 or IPv6 address.
:returns: **str** with the binary representation of this address
:raises: **ValueError** if address is neither an IPv4 nor IPv6 address
"""
if is_valid_ipv4_address(address):
return ''.join([_get_binary(int(octet), 8) for octet in address.split('.')])
elif is_valid_ipv6_address(address):
address = expand_ipv6_address(address)
return ''.join([_get_binary(int(grouping, 16), 16) for grouping in address.split(':')])
else:
raise ValueError("'%s' is neither an IPv4 or IPv6 address" % address)
# TODO: drop with stem 2.x
# We renamed our methods to drop a redundant 'get_*' prefix, so alias the old
# names for backward compatability.
get_system_resolvers = system_resolvers
stem-1.8.0/stem/util/lru_cache.py 0000664 0001750 0001750 00000016315 13412531020 017433 0 ustar atagar atagar 0000000 0000000 # Drop in replace for python 3.2's collections.lru_cache, from...
# http://code.activestate.com/recipes/578078-py26-and-py30-backport-of-python-33s-lru-cache/
#
# ... which is under the MIT license. Stem users should *not* rely upon this
# module. It will be removed when we drop support for python 3.2 and below.
"""
Memoization decorator that caches a function's return value. If later called
with the same arguments then the cached value is returned rather than
reevaluated.
This is a a python 2.x port of `functools.lru_cache
`_. If
using python 3.2 or later you should use that instead.
"""
from collections import namedtuple
from functools import update_wrapper
from threading import RLock
_CacheInfo = namedtuple('CacheInfo', ['hits', 'misses', 'maxsize', 'currsize'])
class _HashedSeq(list):
__slots__ = 'hashvalue'
def __init__(self, tup, hash=hash):
self[:] = tup
self.hashvalue = hash(tup)
def __hash__(self):
return self.hashvalue
def _make_key(args, kwds, typed,
kwd_mark = (object(),),
fasttypes = set([int, str, frozenset, type(None)]),
sorted=sorted, tuple=tuple, type=type, len=len):
'Make a cache key from optionally typed positional and keyword arguments'
key = args
if kwds:
sorted_items = sorted(kwds.items())
key += kwd_mark
for item in sorted_items:
key += item
if typed:
key += tuple(type(v) for v in args)
if kwds:
key += tuple(type(v) for k, v in sorted_items)
elif len(key) == 1 and type(key[0]) in fasttypes:
return key[0]
return _HashedSeq(key)
def lru_cache(maxsize=100, typed=False):
"""Least-recently-used cache decorator.
If *maxsize* is set to None, the LRU features are disabled and the cache
can grow without bound.
If *typed* is True, arguments of different types will be cached separately.
For example, f(3.0) and f(3) will be treated as distinct calls with
distinct results.
Arguments to the cached function must be hashable.
View the cache statistics named tuple (hits, misses, maxsize, currsize) with
f.cache_info(). Clear the cache and statistics with f.cache_clear().
Access the underlying function with f.__wrapped__.
See: http://en.wikipedia.org/wiki/Cache_algorithms#Least_Recently_Used
"""
# Users should only access the lru_cache through its public API:
# cache_info, cache_clear, and f.__wrapped__
# The internals of the lru_cache are encapsulated for thread safety and
# to allow the implementation to change (including a possible C version).
def decorating_function(user_function):
cache = dict()
stats = [0, 0] # make statistics updateable non-locally
HITS, MISSES = 0, 1 # names for the stats fields
make_key = _make_key
cache_get = cache.get # bound method to lookup key or return None
_len = len # localize the global len() function
lock = RLock() # because linkedlist updates aren't threadsafe
root = [] # root of the circular doubly linked list
root[:] = [root, root, None, None] # initialize by pointing to self
nonlocal_root = [root] # make updateable non-locally
PREV, NEXT, KEY, RESULT = 0, 1, 2, 3 # names for the link fields
if maxsize == 0:
def wrapper(*args, **kwds):
# no caching, just do a statistics update after a successful call
result = user_function(*args, **kwds)
stats[MISSES] += 1
return result
elif maxsize is None:
def wrapper(*args, **kwds):
# simple caching without ordering or size limit
key = make_key(args, kwds, typed)
result = cache_get(key, root) # root used here as a unique not-found sentinel
if result is not root:
stats[HITS] += 1
return result
result = user_function(*args, **kwds)
cache[key] = result
stats[MISSES] += 1
return result
else:
def wrapper(*args, **kwds):
# size limited caching that tracks accesses by recency
key = make_key(args, kwds, typed) if kwds or typed else args
with lock:
link = cache_get(key)
if link is not None:
# record recent use of the key by moving it to the front of the list
root, = nonlocal_root
link_prev, link_next, key, result = link
link_prev[NEXT] = link_next
link_next[PREV] = link_prev
last = root[PREV]
last[NEXT] = root[PREV] = link
link[PREV] = last
link[NEXT] = root
stats[HITS] += 1
return result
result = user_function(*args, **kwds)
with lock:
root, = nonlocal_root
if key in cache:
# getting here means that this same key was added to the
# cache while the lock was released. since the link
# update is already done, we need only return the
# computed result and update the count of misses.
pass
elif _len(cache) >= maxsize:
# use the old root to store the new key and result
oldroot = root
oldroot[KEY] = key
oldroot[RESULT] = result
# empty the oldest link and make it the new root
root = nonlocal_root[0] = oldroot[NEXT]
oldkey = root[KEY]
root[KEY] = root[RESULT] = None
# now update the cache dictionary for the new links
del cache[oldkey]
cache[key] = oldroot
else:
# put result in a new link at the front of the list
last = root[PREV]
link = [last, root, key, result]
last[NEXT] = root[PREV] = cache[key] = link
stats[MISSES] += 1
return result
def cache_info():
"""Report cache statistics"""
with lock:
return _CacheInfo(stats[HITS], stats[MISSES], maxsize, len(cache))
def cache_clear():
"""Clear the cache and cache statistics"""
with lock:
cache.clear()
root = nonlocal_root[0]
root[:] = [root, root, None, None]
stats[:] = [0, 0]
wrapper.__wrapped__ = user_function
wrapper.cache_info = cache_info
wrapper.cache_clear = cache_clear
return update_wrapper(wrapper, user_function)
return decorating_function
stem-1.8.0/stem/util/log.py 0000664 0001750 0001750 00000016654 13501272761 016312 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Functions to aid library logging. The default logging
:data:`~stem.util.log.Runlevel` is usually NOTICE and above.
**Stem users are more than welcome to listen for stem events, but these
functions are not being vended to our users. They may change in the future, use
them at your own risk.**
**Module Overview:**
::
get_logger - provides the stem's Logger instance
logging_level - converts a runlevel to its logging number
escape - escapes special characters in a message in preparation for logging
log - logs a message at the given runlevel
log_once - logs a message, deduplicating if it has already been logged
trace - logs a message at the TRACE runlevel
debug - logs a message at the DEBUG runlevel
info - logs a message at the INFO runlevel
notice - logs a message at the NOTICE runlevel
warn - logs a message at the WARN runlevel
error - logs a message at the ERROR runlevel
LogBuffer - Buffers logged events so they can be iterated over.
|- is_empty - checks if there's events in our buffer
+- __iter__ - iterates over and removes the buffered events
log_to_stdout - reports further logged events to stdout
.. data:: Runlevel (enum)
Enumeration for logging runlevels.
========== ===========
Runlevel Description
========== ===========
**ERROR** critical issue occurred, the user needs to be notified
**WARN** non-critical issue occurred that the user should be aware of
**NOTICE** information that is helpful to the user
**INFO** high level library activity
**DEBUG** low level library activity
**TRACE** request/reply logging
========== ===========
"""
import logging
import stem.prereq
import stem.util.enum
import stem.util.str_tools
# Logging runlevels. These are *very* commonly used so including shorter
# aliases (so they can be referenced as log.DEBUG, log.WARN, etc).
Runlevel = stem.util.enum.UppercaseEnum('TRACE', 'DEBUG', 'INFO', 'NOTICE', 'WARN', 'ERROR')
TRACE, DEBUG, INFO, NOTICE, WARN, ERR = list(Runlevel)
# mapping of runlevels to the logger module's values, TRACE and DEBUG aren't
# built into the module
LOG_VALUES = {
Runlevel.TRACE: logging.DEBUG - 5,
Runlevel.DEBUG: logging.DEBUG,
Runlevel.INFO: logging.INFO,
Runlevel.NOTICE: logging.INFO + 5,
Runlevel.WARN: logging.WARN,
Runlevel.ERROR: logging.ERROR,
}
logging.addLevelName(LOG_VALUES[TRACE], 'TRACE')
logging.addLevelName(LOG_VALUES[NOTICE], 'NOTICE')
LOGGER = logging.getLogger('stem')
LOGGER.setLevel(LOG_VALUES[TRACE])
FORMATTER = logging.Formatter(
fmt = '%(asctime)s [%(levelname)s] %(message)s',
datefmt = '%m/%d/%Y %H:%M:%S',
)
# There's some messages that we don't want to log more than once. This set has
# the messages IDs that we've logged which fall into this category.
DEDUPLICATION_MESSAGE_IDS = set()
# Adds a default nullhandler for the stem logger, suppressing the 'No handlers
# could be found for logger "stem"' warning as per...
# http://docs.python.org/release/3.1.3/library/logging.html#configuring-logging-for-a-library
class _NullHandler(logging.Handler):
def __init__(self):
logging.Handler.__init__(self, level = logging.FATAL + 5) # disable logging
def emit(self, record):
pass
if not LOGGER.handlers:
LOGGER.addHandler(_NullHandler())
def get_logger():
"""
Provides the stem logger.
:returns: **logging.Logger** for stem
"""
return LOGGER
def logging_level(runlevel):
"""
Translates a runlevel into the value expected by the logging module.
:param stem.util.log.Runlevel runlevel: runlevel to be returned, no logging if **None**
"""
if runlevel:
return LOG_VALUES[runlevel]
else:
return logging.FATAL + 5
def is_tracing():
"""
Checks if we're logging at the trace runlevel.
.. versionadded:: 1.6.0
:returns: **True** if we're logging at the trace runlevel and **False** otherwise
"""
for handler in get_logger().handlers:
if handler.level <= logging_level(TRACE):
return True
return False
def escape(message):
"""
Escapes specific sequences for logging (newlines, tabs, carriage returns). If
the input is **bytes** then this converts it to **unicode** under python 3.x.
:param str message: string to be escaped
:returns: str that is escaped
"""
if stem.prereq.is_python_3():
message = stem.util.str_tools._to_unicode(message)
for pattern, replacement in (('\n', '\\n'), ('\r', '\\r'), ('\t', '\\t')):
message = message.replace(pattern, replacement)
return message
def log(runlevel, message):
"""
Logs a message at the given runlevel.
:param stem.util.log.Runlevel runlevel: runlevel to log the message at, logging is skipped if **None**
:param str message: message to be logged
"""
if runlevel:
LOGGER.log(LOG_VALUES[runlevel], message)
def log_once(message_id, runlevel, message):
"""
Logs a message at the given runlevel. If a message with this ID has already
been logged then this is a no-op.
:param str message_id: unique message identifier to deduplicate on
:param stem.util.log.Runlevel runlevel: runlevel to log the message at, logging is skipped if **None**
:param str message: message to be logged
:returns: **True** if we log the message, **False** otherwise
"""
if not runlevel or message_id in DEDUPLICATION_MESSAGE_IDS:
return False
else:
DEDUPLICATION_MESSAGE_IDS.add(message_id)
log(runlevel, message)
# shorter aliases for logging at a runlevel
def trace(message):
log(Runlevel.TRACE, message)
def debug(message):
log(Runlevel.DEBUG, message)
def info(message):
log(Runlevel.INFO, message)
def notice(message):
log(Runlevel.NOTICE, message)
def warn(message):
log(Runlevel.WARN, message)
def error(message):
log(Runlevel.ERROR, message)
class LogBuffer(logging.Handler):
"""
Basic log handler that listens for stem events and stores them so they can be
read later. Log entries are cleared as they are read.
.. versionchanged:: 1.4.0
Added the yield_records argument.
.. deprecated:: 1.8.0
This will be dropped in Stem 2.x. Use python's logging.BufferingHandler instead.
"""
def __init__(self, runlevel, yield_records = False):
# TODO: At least in python 2.6 logging.Handler has a bug in that it doesn't
# extend object, causing our super() call to fail. When we drop python 2.6
# support we should switch back to using super() instead.
#
# super(LogBuffer, self).__init__(level = logging_level(runlevel))
logging.Handler.__init__(self, level = logging_level(runlevel))
self.formatter = FORMATTER
self._buffer = []
self._yield_records = yield_records
def is_empty(self):
return not bool(self._buffer)
def __iter__(self):
while self._buffer:
record = self._buffer.pop(0)
yield record if self._yield_records else self.formatter.format(record)
def emit(self, record):
self._buffer.append(record)
class _StdoutLogger(logging.Handler):
def __init__(self, runlevel):
logging.Handler.__init__(self, level = logging_level(runlevel))
self.formatter = logging.Formatter(
fmt = '%(asctime)s [%(levelname)s] %(message)s',
datefmt = '%m/%d/%Y %H:%M:%S')
def emit(self, record):
print(self.formatter.format(record))
def log_to_stdout(runlevel):
"""
Logs further events to stdout.
:param stem.util.log.Runlevel runlevel: minimum runlevel a message needs to be to be logged
"""
get_logger().addHandler(_StdoutLogger(runlevel))
stem-1.8.0/stem/util/ports.cfg 0000664 0001750 0001750 00000014010 13157571677 017006 0 ustar atagar atagar 0000000 0000000 ################################################################################
#
# Common usages for port . This is based on...
#
# https://secure.wikimedia.org/wikipedia/en/wiki/List_of_TCP_and_UDP_port numbers
# http://isc.sans.edu/services.html
#
################################################################################
port 1 => TCPMUX
port 2 => CompressNET
port 3 => CompressNET
port 5 => RJE
port 7 => Echo
port 9 => Discard
port 11 => SYSTAT
port 13 => Daytime
port 15 => netstat
port 17 => QOTD
port 18 => MSP
port 19 => CHARGEN
port 20 => FTP
port 21 => FTP
port 22 => SSH
port 23 => Telnet
port 24 => Priv-mail
port 25 => SMTP
port 34 => RF
port 35 => Printer
port 37 => TIME
port 39 => RLP
port 41 => Graphics
port 42 => WINS
port 43 => WHOIS
port 47 => NI FTP
port 49 => TACACS
port 50 => Remote Mail
port 51 => IMP
port 52 => XNS
port 53 => DNS
port 54 => XNS
port 55 => ISI-GL
port 56 => RAP
port 57 => MTP
port 58 => XNS
port 67 => BOOTP
port 68 => BOOTP
port 69 => TFTP
port 70 => Gopher
port 79 => Finger
port 80 => HTTP
port 81 => HTTP Alternate
port 82 => Torpark
port 83 => MIT ML
port 88 => Kerberos
port 90 => dnsix
port 99 => WIP
port 101 => NIC
port 102 => ISO-TSAP
port 104 => ACR/NEMA
port 105 => CCSO
port 107 => Telnet
port 108 => SNA
port 109 => POP2
port 110 => POP3
port 111 => ONC RPC
port 113 => ident
port 115 => SFTP
port 117 => UUCP
port 118 => SQL
port 119 => NNTP
port 123 => NTP
port 135 => DCE
port 137 => NetBIOS
port 138 => NetBIOS
port 139 => NetBIOS
port 143 => IMAP
port 152 => BFTP
port 153 => SGMP
port 156 => SQL
port 158 => DMSP
port 161 => SNMP
port 162 => SNMPTRAP
port 170 => Print-srv
port 177 => XDMCP
port 179 => BGP
port 194 => IRC
port 199 => SMUX
port 201 => AppleTalk
port 209 => QMTP
port 210 => ANSI
port 213 => IPX
port 218 => MPP
port 220 => IMAP
port 256 => 2DEV
port 259 => ESRO
port 264 => BGMP
port 308 => Novastor
port 311 => OSX Admin
port 318 => PKIX TSP
port 319 => PTP
port 320 => PTP
port 323 => IMMP
port 350 => MATIP
port 351 => MATIP
port 366 => ODMR
port 369 => Rpc2port ap
port 370 => codaauth2
port 371 => ClearCase
port 383 => HP Alarm Mgr
port 384 => ARNS
port 387 => AURP
port 389 => LDAP
port 401 => UPS
port 402 => Altiris
port 427 => SLP
port 443 => HTTPS
port 444 => SNPP
port 445 => SMB
port 464 => Kerberos (kpasswd)
port 465 => SMTP
port 475 => tcpnethaspsrv
port 497 => Retrospect
port 500 => ISAKMP
port 501 => STMF
port 502 => Modbus
port 504 => Citadel
port 510 => FirstClass
port 512 => Rexec
port 513 => rlogin
port 514 => rsh
port 515 => LPD
port 517 => Talk
port 518 => NTalk
port 520 => efs
port 524 => NCP
port 530 => RPC
port 531 => AIM/IRC
port 532 => netnews
port 533 => netwall
port 540 => UUCP
port 542 => commerce
port 543 => Kerberos (klogin)
port 544 => Kerberos (kshell)
port 545 => OSISoft PI
port 546 => DHCPv6
port 547 => DHCPv6
port 548 => AFP
port 550 => new-who
port 554 => RTSP
port 556 => RFS
port 560 => rmonitor
port 561 => monitor
port 563 => NNTPS
port 587 => SMTP
port 591 => FileMaker
port 593 => HTTP RPC
port 604 => TUNNEL
port 623 => ASF-RMCP
port 631 => CUPS
port 635 => RLZ DBase
port 636 => LDAPS
port 639 => MSDP
port 641 => Support oft
port 646 => LDP
port 647 => DHCP
port 648 => RRP
port 651 => IEEE-MMS
port 652 => DTCP
port 653 => Support oft
port 654 => MMS/MMP
port 657 => RMC
port 660 => OSX Admin
port 665 => sun-dr
port 666 => Doom
port 674 => ACAP
port 691 => MS Exchange
port 692 => Hyperwave-ISP
port 694 => Linux-HA
port 695 => IEEE-MMS-SSL
port 698 => OLSR
port 699 => Access Network
port 700 => EPP
port 701 => LMP
port 702 => IRIS
port 706 => SILC
port 711 => MPLS
port 712 => TBRPF
port 720 => SMQP
port 749 => Kerberos (admin)
port 750 => rfile
port 751 => pump
port 752 => qrh
port 753 => rrh
port 754 => tell send
port 760 => ns
port 782 => Conserver
port 783 => spamd
port 829 => CMP
port 843 => Flash
port 847 => DHCP
port 860 => iSCSI
port 873 => rsync
port 888 => CDDB
port 901 => SWAT
port 902-904 => VMware
port 911 => NCA
port 953 => DNS RNDC
port 981 => SofaWare Firewall
port 989 => FTPS
port 990 => FTPS
port 991 => NAS
port 992 => Telnets
port 993 => IMAPS
port 994 => IRCS
port 995 => POP3S
port 999 => ScimoreDB
port 1001 => JtoMB
port 1002 => cogbot
port 1080 => SOCKS
port 1085 => WebObjects
port 1109 => KPOP
port 1169 => Tripwire
port 1194 => OpenVPN
port 1214 => Kazaa
port 1220 => QuickTime
port 1234 => VLC
port 1241 => Nessus
port 1270 => SCOM
port 1293 => IPSec
port 1433 => MSSQL
port 1434 => MSSQL
port 1500 => NetGuard
port 1503 => MSN
port 1512 => WINS
port 1521 => Oracle
port 1526 => Oracle
port 1533 => Sametime
port 1666 => Perforce
port 1677 => GroupWise
port 1723 => PPTP
port 1725 => Steam
port 1863 => MSNP
port 2049 => NFS
port 2082 => Infowave
port 2083 => radsec
port 2086 => GNUnet
port 2087 => ELI
port 2095 => NBX SER
port 2096 => NBX DIR
port 2102-2104 => Zephyr
port 2401 => CVS
port 2525 => SMTP
port 2710 => BitTorrent
port 3074 => XBox LIVE
port 3101 => BlackBerry
port 3128 => SQUID
port 3306 => MySQL
port 3389 => WBT
port 3690 => SVN
port 3723 => Battle.net
port 3724 => WoW
port 4321 => RWHOIS
port 4643 => Virtuozzo
port 4662 => eMule
port 5003 => FileMaker
port 5050 => Yahoo IM
port 5060 => SIP
port 5061 => SIP
port 5190 => AIM/ICQ
port 5222 => Jabber
port 5223 => Jabber
port 5228 => Android Market
port 5269 => Jabber
port 5298 => Jabber
port 5432 => PostgreSQL
port 5500 => VNC
port 5556 => Freeciv
port 5666 => NRPE
port 5667 => NSCA
port 5800 => VNC
port 5900 => VNC
port 6346 => gnutella
port 6347 => gnutella
port 6660-6669 => IRC
port 6679 => IRC
port 6697 => IRC
port 6881-6999 => BitTorrent
port 8000 => iRDMI
port 8008 => HTTP Alternate
port 8010 => XMPP
port 8074 => Gadu-Gadu
port 8080 => HTTP Proxy
port 8087 => SPP
port 8088 => Radan HTTP
port 8118 => Privoxy
port 8123 => Polipo
port 8332-8333 => Bitcoin
port 8443 => PCsync HTTPS
port 8888 => NewsEDGE
port 9030 => Tor
port 9050 => Tor
port 9051 => Tor
port 9418 => Git
port 9999 => distinct
port 10000 => Webmin
port 19294 => Google Voice
port 19638 => Ensim
port 23399 => Skype
port 30301 => BitTorrent
port 33434 => traceroute
port 50002 => Electrum Bitcoin SSL
stem-1.8.0/stem/util/ed25519.py 0000664 0001750 0001750 00000017211 13566051145 016517 0 ustar atagar atagar 0000000 0000000 # The following is copied from...
#
# https://github.com/pyca/ed25519
#
# This is under the CC0 license. For more information please see...
#
# https://github.com/pyca/cryptography/issues/5068
# ed25519.py - Optimized version of the reference implementation of Ed25519
#
# Written in 2011? by Daniel J. Bernstein
# 2013 by Donald Stufft
# 2013 by Alex Gaynor
# 2013 by Greg Price
#
# To the extent possible under law, the author(s) have dedicated all copyright
# and related and neighboring rights to this software to the public domain
# worldwide. This software is distributed without any warranty.
#
# You should have received a copy of the CC0 Public Domain Dedication along
# with this software. If not, see
# .
"""
NB: This code is not safe for use with secret keys or secret data.
The only safe use of this code is for verifying signatures on public messages.
Functions for computing the public key of a secret key and for signing
a message are included, namely publickey_unsafe and signature_unsafe,
for testing purposes only.
The root of the problem is that Python's long-integer arithmetic is
not designed for use in cryptography. Specifically, it may take more
or less time to execute an operation depending on the values of the
inputs, and its memory access patterns may also depend on the inputs.
This opens it to timing and cache side-channel attacks which can
disclose data to an attacker. We rely on Python's long-integer
arithmetic, so we cannot handle secrets without risking their disclosure.
"""
import hashlib
import operator
import sys
__version__ = "1.0.dev0"
# Useful for very coarse version differentiation.
PY3 = sys.version_info[0] == 3
if PY3:
indexbytes = operator.getitem
intlist2bytes = bytes
int2byte = operator.methodcaller("to_bytes", 1, "big")
else:
int2byte = chr
range = xrange
def indexbytes(buf, i):
return ord(buf[i])
def intlist2bytes(l):
return b"".join(chr(c) for c in l)
b = 256
q = 2 ** 255 - 19
l = 2 ** 252 + 27742317777372353535851937790883648493
def H(m):
return hashlib.sha512(m).digest()
def pow2(x, p):
"""== pow(x, 2**p, q)"""
while p > 0:
x = x * x % q
p -= 1
return x
def inv(z):
"""$= z^{-1} \mod q$, for z != 0"""
# Adapted from curve25519_athlon.c in djb's Curve25519.
z2 = z * z % q # 2
z9 = pow2(z2, 2) * z % q # 9
z11 = z9 * z2 % q # 11
z2_5_0 = (z11 * z11) % q * z9 % q # 31 == 2^5 - 2^0
z2_10_0 = pow2(z2_5_0, 5) * z2_5_0 % q # 2^10 - 2^0
z2_20_0 = pow2(z2_10_0, 10) * z2_10_0 % q # ...
z2_40_0 = pow2(z2_20_0, 20) * z2_20_0 % q
z2_50_0 = pow2(z2_40_0, 10) * z2_10_0 % q
z2_100_0 = pow2(z2_50_0, 50) * z2_50_0 % q
z2_200_0 = pow2(z2_100_0, 100) * z2_100_0 % q
z2_250_0 = pow2(z2_200_0, 50) * z2_50_0 % q # 2^250 - 2^0
return pow2(z2_250_0, 5) * z11 % q # 2^255 - 2^5 + 11 = q - 2
d = -121665 * inv(121666) % q
I = pow(2, (q - 1) // 4, q)
def xrecover(y):
xx = (y * y - 1) * inv(d * y * y + 1)
x = pow(xx, (q + 3) // 8, q)
if (x * x - xx) % q != 0:
x = (x * I) % q
if x % 2 != 0:
x = q-x
return x
By = 4 * inv(5)
Bx = xrecover(By)
B = (Bx % q, By % q, 1, (Bx * By) % q)
ident = (0, 1, 1, 0)
def edwards_add(P, Q):
# This is formula sequence 'addition-add-2008-hwcd-3' from
# http://www.hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html
(x1, y1, z1, t1) = P
(x2, y2, z2, t2) = Q
a = (y1-x1)*(y2-x2) % q
b = (y1+x1)*(y2+x2) % q
c = t1*2*d*t2 % q
dd = z1*2*z2 % q
e = b - a
f = dd - c
g = dd + c
h = b + a
x3 = e*f
y3 = g*h
t3 = e*h
z3 = f*g
return (x3 % q, y3 % q, z3 % q, t3 % q)
def edwards_double(P):
# This is formula sequence 'dbl-2008-hwcd' from
# http://www.hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html
(x1, y1, z1, t1) = P
a = x1*x1 % q
b = y1*y1 % q
c = 2*z1*z1 % q
# dd = -a
e = ((x1+y1)*(x1+y1) - a - b) % q
g = -a + b # dd + b
f = g - c
h = -a - b # dd - b
x3 = e*f
y3 = g*h
t3 = e*h
z3 = f*g
return (x3 % q, y3 % q, z3 % q, t3 % q)
def scalarmult(P, e):
if e == 0:
return ident
Q = scalarmult(P, e // 2)
Q = edwards_double(Q)
if e & 1:
Q = edwards_add(Q, P)
return Q
# Bpow[i] == scalarmult(B, 2**i)
Bpow = []
def make_Bpow():
P = B
for i in range(253):
Bpow.append(P)
P = edwards_double(P)
make_Bpow()
def scalarmult_B(e):
"""
Implements scalarmult(B, e) more efficiently.
"""
# scalarmult(B, l) is the identity
e = e % l
P = ident
for i in range(253):
if e & 1:
P = edwards_add(P, Bpow[i])
e = e // 2
assert e == 0, e
return P
def encodeint(y):
bits = [(y >> i) & 1 for i in range(b)]
return b''.join([
int2byte(sum([bits[i * 8 + j] << j for j in range(8)]))
for i in range(b//8)
])
def encodepoint(P):
(x, y, z, t) = P
zi = inv(z)
x = (x * zi) % q
y = (y * zi) % q
bits = [(y >> i) & 1 for i in range(b - 1)] + [x & 1]
return b''.join([
int2byte(sum([bits[i * 8 + j] << j for j in range(8)]))
for i in range(b // 8)
])
def bit(h, i):
return (indexbytes(h, i // 8) >> (i % 8)) & 1
def publickey_unsafe(sk):
"""
Not safe to use with secret keys or secret data.
See module docstring. This function should be used for testing only.
"""
h = H(sk)
a = 2 ** (b - 2) + sum(2 ** i * bit(h, i) for i in range(3, b - 2))
A = scalarmult_B(a)
return encodepoint(A)
def Hint(m):
h = H(m)
return sum(2 ** i * bit(h, i) for i in range(2 * b))
def signature_unsafe(m, sk, pk):
"""
Not safe to use with secret keys or secret data.
See module docstring. This function should be used for testing only.
"""
h = H(sk)
a = 2 ** (b - 2) + sum(2 ** i * bit(h, i) for i in range(3, b - 2))
r = Hint(
intlist2bytes([indexbytes(h, j) for j in range(b // 8, b // 4)]) + m
)
R = scalarmult_B(r)
S = (r + Hint(encodepoint(R) + pk + m) * a) % l
return encodepoint(R) + encodeint(S)
def isoncurve(P):
(x, y, z, t) = P
return (z % q != 0 and
x*y % q == z*t % q and
(y*y - x*x - z*z - d*t*t) % q == 0)
def decodeint(s):
return sum(2 ** i * bit(s, i) for i in range(0, b))
def decodepoint(s):
y = sum(2 ** i * bit(s, i) for i in range(0, b - 1))
x = xrecover(y)
if x & 1 != bit(s, b-1):
x = q - x
P = (x, y, 1, (x*y) % q)
if not isoncurve(P):
raise ValueError("decoding point that is not on curve")
return P
class SignatureMismatch(Exception):
pass
def checkvalid(s, m, pk):
"""
Not safe to use when any argument is secret.
See module docstring. This function should be used only for
verifying public signatures of public messages.
"""
if len(s) != b // 4:
raise ValueError("signature length is wrong")
if len(pk) != b // 8:
raise ValueError("public-key length is wrong")
R = decodepoint(s[:b // 8])
A = decodepoint(pk)
S = decodeint(s[b // 8:b // 4])
h = Hint(encodepoint(R) + pk + m)
(x1, y1, z1, t1) = P = scalarmult_B(S)
(x2, y2, z2, t2) = Q = edwards_add(R, scalarmult(A, h))
if (not isoncurve(P) or not isoncurve(Q) or
(x1*z2 - x2*z1) % q != 0 or (y1*z2 - y2*z1) % q != 0):
raise SignatureMismatch("signature does not pass verification")
stem-1.8.0/stem/util/__init__.py 0000664 0001750 0001750 00000012470 13565322274 017265 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Utility functions used by the stem library.
"""
import datetime
import stem.prereq
__all__ = [
'conf',
'connection',
'enum',
'log',
'lru_cache',
'ordereddict',
'proc',
'str_tools',
'system',
'term',
'test_tools',
'tor_tools',
'datetime_to_unix',
]
# Beginning with Stem 1.7 we take attribute types into account when hashing
# and checking equality. That is to say, if two Stem classes' attributes are
# the same but use different types we no longer consider them to be equal.
# For example...
#
# s1 = Schedule(classes = ['Math', 'Art', 'PE'])
# s2 = Schedule(classes = ('Math', 'Art', 'PE'))
#
# Prior to Stem 1.7 s1 and s2 would be equal, but afterward unless Stem's
# construcotr normalizes the types they won't.
#
# This change in behavior is the right thing to do but carries some risk, so
# we provide the following constant to revert to legacy behavior. If you find
# yourself using it them please let me know (https://www.atagar.com/contact/)
# since this flag will go away in the future.
HASH_TYPES = True
def _hash_value(val):
if not HASH_TYPES:
my_hash = 0
else:
# TODO: I hate doing this but until Python 2.x support is dropped we
# can't readily be strict about bytes vs unicode for attributes. This
# is because test assertions often use strings, and normalizing this
# would require wrapping most with to_unicode() calls.
#
# This hack will go away when we drop Python 2.x support.
if _is_str(val):
my_hash = hash('str')
else:
# Hashing common builtins (ints, bools, etc) provide consistant values but many others vary their value on interpreter invokation.
my_hash = hash(str(type(val)))
if isinstance(val, (tuple, list)):
for v in val:
my_hash = (my_hash * 1024) + hash(v)
elif isinstance(val, dict):
for k in sorted(val.keys()):
my_hash = (my_hash * 2048) + (hash(k) * 1024) + hash(val[k])
else:
my_hash += hash(val)
return my_hash
def _is_str(val):
"""
Check if a value is a string. This will be removed when we no longer provide
backward compatibility for the Python 2.x series.
:param object val: value to be checked
:returns: **True** if the value is some form of string (unicode or bytes),
and **False** otherwise
"""
if stem.prereq.is_python_3():
return isinstance(val, (bytes, str))
else:
return isinstance(val, (bytes, unicode))
def _is_int(val):
"""
Check if a value is an integer. This will be removed when we no longer
provide backward compatibility for the Python 2.x series.
:param object val: value to be checked
:returns: **True** if the value is some form of integer (int or long),
and **False** otherwise
"""
if stem.prereq.is_python_3():
return isinstance(val, int)
else:
return isinstance(val, (int, long))
def datetime_to_unix(timestamp):
"""
Converts a utc datetime object to a unix timestamp.
.. versionadded:: 1.5.0
:param datetime timestamp: timestamp to be converted
:returns: **float** for the unix timestamp of the given datetime object
"""
if stem.prereq._is_python_26():
delta = (timestamp - datetime.datetime(1970, 1, 1))
return delta.days * 86400 + delta.seconds
else:
return (timestamp - datetime.datetime(1970, 1, 1)).total_seconds()
def _pubkey_bytes(key):
"""
Normalizes X25509 and ED25519 keys into their public key bytes.
"""
if _is_str(key):
return key
if not stem.prereq.is_crypto_available():
raise ImportError('Key normalization requires the cryptography module')
elif not stem.prereq.is_crypto_available(ed25519 = True):
raise ImportError('Key normalization requires the cryptography ed25519 support')
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey
if isinstance(key, (X25519PrivateKey, Ed25519PrivateKey)):
return key.public_key().public_bytes(
encoding = serialization.Encoding.Raw,
format = serialization.PublicFormat.Raw,
)
elif isinstance(key, (X25519PublicKey, Ed25519PublicKey)):
return key.public_bytes(
encoding = serialization.Encoding.Raw,
format = serialization.PublicFormat.Raw,
)
else:
raise ValueError('Key must be a string or cryptographic public/private key (was %s)' % type(key).__name__)
def _hash_attr(obj, *attributes, **kwargs):
"""
Provide a hash value for the given set of attributes.
:param Object obj: object to be hashed
:param list attributes: attribute names to take into account
:param bool cache: persists hash in a '_cached_hash' object attribute
:param class parent: include parent's hash value
"""
is_cached = kwargs.get('cache', False)
parent_class = kwargs.get('parent', None)
cached_hash = getattr(obj, '_cached_hash', None)
if is_cached and cached_hash is not None:
return cached_hash
my_hash = parent_class.__hash__(obj) if parent_class else 0
my_hash = my_hash * 1024 + hash(str(type(obj)))
for attr in attributes:
val = getattr(obj, attr)
my_hash = my_hash * 1024 + _hash_value(val)
if is_cached:
setattr(obj, '_cached_hash', my_hash)
return my_hash
stem-1.8.0/stem/util/tor_tools.py 0000664 0001750 0001750 00000012161 13546245571 017552 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Miscellaneous utility functions for working with tor.
.. versionadded:: 1.2.0
**Module Overview:**
::
is_valid_fingerprint - checks if a string is a valid tor relay fingerprint
is_valid_nickname - checks if a string is a valid tor relay nickname
is_valid_circuit_id - checks if a string is a valid tor circuit id
is_valid_stream_id - checks if a string is a valid tor stream id
is_valid_connection_id - checks if a string is a valid tor connection id
is_valid_hidden_service_address - checks if a string is a valid hidden service address
is_hex_digits - checks if a string is only made up of hex digits
"""
import re
import stem.util.str_tools
# The control-spec defines the following as...
#
# Fingerprint = "$" 40*HEXDIG
# NicknameChar = "a"-"z" / "A"-"Z" / "0" - "9"
# Nickname = 1*19 NicknameChar
#
# CircuitID = 1*16 IDChar
# IDChar = ALPHA / DIGIT
#
# HEXDIG is defined in RFC 5234 as being uppercase and used in RFC 5987 as
# case insensitive. Tor doesn't define this in the spec so flipping a coin
# and going with case insensitive.
NICKNAME_PATTERN = re.compile('^[a-zA-Z0-9]{1,19}$')
CIRC_ID_PATTERN = re.compile('^[a-zA-Z0-9]{1,16}$')
# Hidden service addresses are sixteen or fifty six base32 characters.
HS_V2_ADDRESS_PATTERN = re.compile('^[a-z2-7]{16}$')
HS_V3_ADDRESS_PATTERN = re.compile('^[a-z2-7]{56}$')
def is_valid_fingerprint(entry, check_prefix = False):
"""
Checks if a string is a properly formatted relay fingerprint. This checks for
a '$' prefix if check_prefix is true, otherwise this only validates the hex
digits.
:param str entry: string to be checked
:param bool check_prefix: checks for a '$' prefix
:returns: **True** if the string could be a relay fingerprint, **False** otherwise
"""
if isinstance(entry, bytes):
entry = stem.util.str_tools._to_unicode(entry)
try:
if check_prefix:
if not entry or entry[0] != '$':
return False
entry = entry[1:]
return is_hex_digits(entry, 40)
except TypeError:
return False
def is_valid_nickname(entry):
"""
Checks if a string is a valid format for being a nickname.
:param str entry: string to be checked
:returns: **True** if the string could be a nickname, **False** otherwise
"""
if isinstance(entry, bytes):
entry = stem.util.str_tools._to_unicode(entry)
try:
return bool(NICKNAME_PATTERN.match(entry))
except TypeError:
return False
def is_valid_circuit_id(entry):
"""
Checks if a string is a valid format for being a circuit identifier.
:returns: **True** if the string could be a circuit id, **False** otherwise
"""
if isinstance(entry, bytes):
entry = stem.util.str_tools._to_unicode(entry)
try:
return bool(CIRC_ID_PATTERN.match(entry))
except TypeError:
return False
def is_valid_stream_id(entry):
"""
Checks if a string is a valid format for being a stream identifier.
Currently, this is just an alias to :func:`~stem.util.tor_tools.is_valid_circuit_id`.
:returns: **True** if the string could be a stream id, **False** otherwise
"""
return is_valid_circuit_id(entry)
def is_valid_connection_id(entry):
"""
Checks if a string is a valid format for being a connection identifier.
Currently, this is just an alias to :func:`~stem.util.tor_tools.is_valid_circuit_id`.
:returns: **True** if the string could be a connection id, **False** otherwise
"""
return is_valid_circuit_id(entry)
def is_valid_hidden_service_address(entry, version = None):
"""
Checks if a string is a valid format for being a hidden service address (not
including the '.onion' suffix).
.. versionchanged:: 1.8.0
Added the **version** argument, and responds with **True** if a version 3
hidden service address rather than just version 2 addresses.
:param int,list version: versions to check for, if unspecified either v2 or v3
hidden service address will provide **True**
:returns: **True** if the string could be a hidden service address, **False**
otherwise
"""
if isinstance(entry, bytes):
entry = stem.util.str_tools._to_unicode(entry)
if version is None:
version = (2, 3)
elif isinstance(version, int):
version = [version]
elif not isinstance(version, (list, tuple)):
raise ValueError('Hidden service version must be an integer or list, not a %s' % type(version).__name__)
try:
if 2 in version and bool(HS_V2_ADDRESS_PATTERN.match(entry)):
return True
if 3 in version and bool(HS_V3_ADDRESS_PATTERN.match(entry)):
return True
return False
except TypeError:
return False
def is_hex_digits(entry, count):
"""
Checks if a string is the given number of hex digits. Digits represented by
letters are case insensitive.
:param str entry: string to be checked
:param int count: number of hex digits to be checked for
:returns: **True** if the given number of hex digits, **False** otherwise
"""
try:
if len(entry) != count:
return False
int(entry, 16) # attempt to convert it as hex
return True
except (ValueError, TypeError):
return False
stem-1.8.0/stem/util/enum.py 0000664 0001750 0001750 00000010414 13501272761 016461 0 ustar atagar atagar 0000000 0000000 # Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Basic enumeration, providing ordered types for collections. These can be
constructed as simple type listings...
::
>>> from stem.util import enum
>>> insects = enum.Enum('ANT', 'WASP', 'LADYBUG', 'FIREFLY')
>>> insects.ANT
'Ant'
>>> tuple(insects)
('Ant', 'Wasp', 'Ladybug', 'Firefly')
... or with overwritten string counterparts...
::
>>> from stem.util import enum
>>> pets = enum.Enum(('DOG', 'Skippy'), 'CAT', ('FISH', 'Nemo'))
>>> pets.DOG
'Skippy'
>>> pets.CAT
'Cat'
**Module Overview:**
::
UppercaseEnum - Provides an enum instance with capitalized values
Enum - Provides a basic, ordered enumeration
|- keys - string representation of our enum keys
|- index_of - index of an enum value
|- next - provides the enum after a given enum value
|- previous - provides the enum before a given value
|- __getitem__ - provides the value for an enum key
+- __iter__ - iterator over our enum keys
"""
import stem.util
def UppercaseEnum(*args):
"""
Provides an :class:`~stem.util.enum.Enum` instance where the values are
identical to the keys. Since the keys are uppercase by convention this means
the values are too. For instance...
::
>>> from stem.util import enum
>>> runlevels = enum.UppercaseEnum('DEBUG', 'INFO', 'NOTICE', 'WARN', 'ERROR')
>>> runlevels.DEBUG
'DEBUG'
:param list args: enum keys to initialize with
:returns: :class:`~stem.util.enum.Enum` instance with the given keys
"""
return Enum(*[(v, v) for v in args])
class Enum(object):
"""
Basic enumeration.
"""
def __init__(self, *args):
from stem.util.str_tools import _to_camel_case
# ordered listings of our keys and values
keys, values = [], []
for entry in args:
if stem.util._is_str(entry):
key, val = entry, _to_camel_case(entry)
elif isinstance(entry, tuple) and len(entry) == 2:
key, val = entry
else:
raise ValueError('Unrecognized input: %s' % args)
keys.append(key)
values.append(val)
setattr(self, key, val)
self._keys = tuple(keys)
self._values = tuple(values)
def keys(self):
"""
Provides an ordered listing of the enumeration keys in this set.
:returns: **list** with our enum keys
"""
return list(self._keys)
def index_of(self, value):
"""
Provides the index of the given value in the collection.
:param str value: entry to be looked up
:returns: **int** index of the given entry
:raises: **ValueError** if no such element exists
"""
return self._values.index(value)
def next(self, value):
"""
Provides the next enumeration after the given value.
:param str value: enumeration for which to get the next entry
:returns: enum value following the given entry
:raises: **ValueError** if no such element exists
"""
if value not in self._values:
raise ValueError('No such enumeration exists: %s (options: %s)' % (value, ', '.join(self._values)))
next_index = (self._values.index(value) + 1) % len(self._values)
return self._values[next_index]
def previous(self, value):
"""
Provides the previous enumeration before the given value.
:param str value: enumeration for which to get the previous entry
:returns: enum value proceeding the given entry
:raises: **ValueError** if no such element exists
"""
if value not in self._values:
raise ValueError('No such enumeration exists: %s (options: %s)' % (value, ', '.join(self._values)))
prev_index = (self._values.index(value) - 1) % len(self._values)
return self._values[prev_index]
def __getitem__(self, item):
"""
Provides the values for the given key.
:param str item: key to be looked up
:returns: **str** with the value for the given key
:raises: **ValueError** if the key doesn't exist
"""
if item in vars(self):
return getattr(self, item)
else:
keys = ', '.join(self.keys())
raise ValueError("'%s' isn't among our enumeration keys, which includes: %s" % (item, keys))
def __iter__(self):
"""
Provides an ordered listing of the enums in this set.
"""
for entry in self._values:
yield entry
stem-1.8.0/stem/util/str_tools.py 0000664 0001750 0001750 00000041533 13564354230 017554 0 ustar atagar atagar 0000000 0000000 # Copyright 2012-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Toolkit for various string activity.
.. versionchanged:: 1.3.0
Dropped the get_* prefix from several function names. The old names still
work, but are deprecated aliases.
**Module Overview:**
::
crop - shortens string to a given length
size_label - human readable label for a number of bytes
time_label - human readable label for a number of seconds
time_labels - human readable labels for each time unit
short_time_label - condensed time label output
parse_short_time_label - seconds represented by a short time label
"""
import base64
import codecs
import datetime
import re
import sys
import stem.prereq
import stem.util
import stem.util.enum
# label conversion tuples of the form...
# (bits / bytes / seconds, short label, long label)
SIZE_UNITS_BITS = (
(140737488355328.0, ' Pb', ' Petabit'),
(137438953472.0, ' Tb', ' Terabit'),
(134217728.0, ' Gb', ' Gigabit'),
(131072.0, ' Mb', ' Megabit'),
(128.0, ' Kb', ' Kilobit'),
(0.125, ' b', ' Bit'),
)
SIZE_UNITS_BYTES = (
(1125899906842624.0, ' PB', ' Petabyte'),
(1099511627776.0, ' TB', ' Terabyte'),
(1073741824.0, ' GB', ' Gigabyte'),
(1048576.0, ' MB', ' Megabyte'),
(1024.0, ' KB', ' Kilobyte'),
(1.0, ' B', ' Byte'),
)
TIME_UNITS = (
(86400.0, 'd', ' day'),
(3600.0, 'h', ' hour'),
(60.0, 'm', ' minute'),
(1.0, 's', ' second'),
)
_timestamp_re = re.compile(r'(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})')
if stem.prereq.is_python_3():
def _to_bytes_impl(msg):
if isinstance(msg, str):
return codecs.latin_1_encode(msg, 'replace')[0]
else:
return msg
def _to_unicode_impl(msg):
if msg is not None and not isinstance(msg, str):
return msg.decode('utf-8', 'replace')
else:
return msg
else:
def _to_bytes_impl(msg):
if msg is not None and isinstance(msg, unicode):
return codecs.latin_1_encode(msg, 'replace')[0]
else:
return msg
def _to_unicode_impl(msg):
if msg is not None and not isinstance(msg, unicode):
return msg.decode('utf-8', 'replace')
else:
return msg
def _to_bytes(msg):
"""
Provides the ASCII bytes for the given string. This is purely to provide
python 3 compatability, normalizing the unicode/ASCII change in the version
bump. For an explanation of this see...
http://python3porting.com/problems.html#nicer-solutions
:param str,unicode msg: string to be converted
:returns: ASCII bytes for string
"""
return _to_bytes_impl(msg)
def _to_unicode(msg):
"""
Provides the unicode string for the given ASCII bytes. This is purely to
provide python 3 compatability, normalizing the unicode/ASCII change in the
version bump.
:param str,unicode msg: string to be converted
:returns: unicode conversion
"""
return _to_unicode_impl(msg)
def _decode_b64(msg):
"""
Base64 decode, without padding concerns.
"""
missing_padding = len(msg) % 4
padding_chr = b'=' if isinstance(msg, bytes) else '='
return base64.b64decode(msg + padding_chr * missing_padding)
def _to_int(msg):
"""
Serializes a string to a number.
:param str msg: string to be serialized
:returns: **int** representation of the string
"""
if stem.prereq.is_python_3() and isinstance(msg, bytes):
# iterating over bytes in python3 provides ints rather than characters
return sum([pow(256, (len(msg) - i - 1)) * c for (i, c) in enumerate(msg)])
else:
return sum([pow(256, (len(msg) - i - 1)) * ord(c) for (i, c) in enumerate(msg)])
def _to_camel_case(label, divider = '_', joiner = ' '):
"""
Converts the given string to camel case, ie:
::
>>> _to_camel_case('I_LIKE_PEPPERJACK!')
'I Like Pepperjack!'
:param str label: input string to be converted
:param str divider: word boundary
:param str joiner: replacement for word boundaries
:returns: camel cased string
"""
words = []
for entry in label.split(divider):
if len(entry) == 0:
words.append('')
elif len(entry) == 1:
words.append(entry.upper())
else:
words.append(entry[0].upper() + entry[1:].lower())
return joiner.join(words)
def _split_by_length(msg, size):
"""
Splits a string into a list of strings up to the given size.
::
>>> _split_by_length('hello', 2)
['he', 'll', 'o']
:param str msg: string to split
:param int size: number of characters to chunk into
:returns: **list** with chunked string components
"""
return [msg[i:i + size] for i in range(0, len(msg), size)]
# This needs to be defined after _to_camel_case() to avoid a circular
# dependency with the enum module.
Ending = stem.util.enum.Enum('ELLIPSE', 'HYPHEN')
def crop(msg, size, min_word_length = 4, min_crop = 0, ending = Ending.ELLIPSE, get_remainder = False):
"""
Shortens a string to a given length.
If we crop content then a given ending is included (counting itself toward
the size limitation). This crops on word breaks so we only include a word if
we can display at least **min_word_length** characters of it.
If there isn't room for even a truncated single word (or one word plus the
ellipse if including those) then this provides an empty string.
If a cropped string ends with a comma or period then it's stripped (unless
we're providing the remainder back). For example...
>>> crop('This is a looooong message', 17)
'This is a looo...'
>>> crop('This is a looooong message', 12)
'This is a...'
>>> crop('This is a looooong message', 3)
''
The whole point of this method is to provide human friendly croppings, and as
such details of how this works might change in the future. Callers should not
rely on the details of how this crops.
.. versionadded:: 1.3.0
:param str msg: text to be processed
:param int size: space available for text
:param int min_word_length: minimum characters before which a word is
dropped, requires whole word if **None**
:param int min_crop: minimum characters that must be dropped if a word is
cropped
:param Ending ending: type of ending used when truncating, no special
truncation is used if **None**
:param bool get_remainder: returns a tuple with the second part being the
cropped portion of the message
:returns: **str** of the text truncated to the given length
"""
# checks if there's room for the whole message
if len(msg) <= size:
return (msg, '') if get_remainder else msg
if size < 0:
raise ValueError("Crop size can't be negative (received %i)" % size)
elif min_word_length and min_word_length < 0:
raise ValueError("Crop's min_word_length can't be negative (received %i)" % min_word_length)
elif min_crop < 0:
raise ValueError("Crop's min_crop can't be negative (received %i)" % min_crop)
# since we're cropping, the effective space available is less with an
# ellipse, and cropping words requires an extra space for hyphens
if ending == Ending.ELLIPSE:
if size < 3:
return ('', msg) if get_remainder else ''
size -= 3
elif min_word_length and ending == Ending.HYPHEN:
min_word_length += 1
if min_word_length is None:
min_word_length = sys.maxsize
# checks if there isn't the minimum space needed to include anything
last_wordbreak = msg.rfind(' ', 0, size + 1)
if last_wordbreak == -1:
# we're splitting the first word
if size < min_word_length:
return ('', msg) if get_remainder else ''
include_crop = True
else:
last_wordbreak = len(msg[:last_wordbreak].rstrip()) # drops extra ending whitespaces
include_crop = size - last_wordbreak - 1 >= min_word_length
# if there's a max crop size then make sure we're cropping at least that many characters
if include_crop and min_crop:
next_wordbreak = msg.find(' ', size)
if next_wordbreak == -1:
next_wordbreak = len(msg)
include_crop = next_wordbreak - size + 1 >= min_crop
if include_crop:
return_msg, remainder = msg[:size], msg[size:]
if ending == Ending.HYPHEN:
remainder = return_msg[-1] + remainder
return_msg = return_msg[:-1].rstrip() + '-'
else:
return_msg, remainder = msg[:last_wordbreak], msg[last_wordbreak:]
# if this is ending with a comma or period then strip it off
if not get_remainder and return_msg and return_msg[-1] in (',', '.'):
return_msg = return_msg[:-1]
if ending == Ending.ELLIPSE:
return_msg = return_msg.rstrip() + '...'
return (return_msg, remainder) if get_remainder else return_msg
def size_label(byte_count, decimal = 0, is_long = False, is_bytes = True, round = False):
"""
Converts a number of bytes into a human readable label in its most
significant units. For instance, 7500 bytes would return "7 KB". If the
is_long option is used this expands unit labels to be the properly pluralized
full word (for instance 'Kilobytes' rather than 'KB'). Units go up through
petabytes.
::
>>> size_label(2000000)
'1 MB'
>>> size_label(1050, 2)
'1.02 KB'
>>> size_label(1050, 3, True)
'1.025 Kilobytes'
.. versionchanged:: 1.6.0
Added round argument.
:param int byte_count: number of bytes to be converted
:param int decimal: number of decimal digits to be included
:param bool is_long: expands units label
:param bool is_bytes: provides units in bytes if **True**, bits otherwise
:param bool round: rounds normally if **True**, otherwise rounds down
:returns: **str** with human readable representation of the size
"""
if is_bytes:
return _get_label(SIZE_UNITS_BYTES, byte_count, decimal, is_long, round)
else:
return _get_label(SIZE_UNITS_BITS, byte_count, decimal, is_long, round)
def time_label(seconds, decimal = 0, is_long = False):
"""
Converts seconds into a time label truncated to its most significant units.
For instance, 7500 seconds would return "2h". Units go up through days.
This defaults to presenting single character labels, but if the is_long
option is used this expands labels to be the full word (space included and
properly pluralized). For instance, "4h" would be "4 hours" and "1m" would
become "1 minute".
::
>>> time_label(10000)
'2h'
>>> time_label(61, 1, True)
'1.0 minute'
>>> time_label(61, 2, True)
'1.01 minutes'
:param int seconds: number of seconds to be converted
:param int decimal: number of decimal digits to be included
:param bool is_long: expands units label
:returns: **str** with human readable representation of the time
"""
return _get_label(TIME_UNITS, seconds, decimal, is_long)
def time_labels(seconds, is_long = False):
"""
Provides a list of label conversions for each time unit, starting with its
most significant units on down. Any counts that evaluate to zero are omitted.
For example...
::
>>> time_labels(400)
['6m', '40s']
>>> time_labels(3640, True)
['1 hour', '40 seconds']
:param int seconds: number of seconds to be converted
:param bool is_long: expands units label
:returns: **list** of strings with human readable representations of the time
"""
time_labels = []
for count_per_unit, _, _ in TIME_UNITS:
if abs(seconds) >= count_per_unit:
time_labels.append(_get_label(TIME_UNITS, seconds, 0, is_long))
seconds %= count_per_unit
return time_labels
def short_time_label(seconds):
"""
Provides a time in the following format:
[[dd-]hh:]mm:ss
::
>>> short_time_label(111)
'01:51'
>>> short_time_label(544100)
'6-07:08:20'
:param int seconds: number of seconds to be converted
:returns: **str** with the short representation for the time
:raises: **ValueError** if the input is negative
"""
if seconds < 0:
raise ValueError("Input needs to be a non-negative integer, got '%i'" % seconds)
time_comp = {}
for amount, _, label in TIME_UNITS:
count = int(seconds / amount)
seconds %= amount
time_comp[label.strip()] = count
label = '%02i:%02i' % (time_comp['minute'], time_comp['second'])
if time_comp['day']:
label = '%i-%02i:%s' % (time_comp['day'], time_comp['hour'], label)
elif time_comp['hour']:
label = '%02i:%s' % (time_comp['hour'], label)
return label
def parse_short_time_label(label):
"""
Provides the number of seconds corresponding to the formatting used for the
cputime and etime fields of ps:
[[dd-]hh:]mm:ss or mm:ss.ss
::
>>> parse_short_time_label('01:51')
111
>>> parse_short_time_label('6-07:08:20')
544100
:param str label: time entry to be parsed
:returns: **int** with the number of seconds represented by the label
:raises: **ValueError** if input is malformed
"""
days, hours, minutes, seconds = '0', '0', '0', '0'
if '-' in label:
days, label = label.split('-', 1)
time_comp = label.split(':')
if len(time_comp) == 3:
hours, minutes, seconds = time_comp
elif len(time_comp) == 2:
minutes, seconds = time_comp
else:
raise ValueError("Invalid time format, we expected '[[dd-]hh:]mm:ss' or 'mm:ss.ss': %s" % label)
try:
time_sum = int(float(seconds))
time_sum += int(minutes) * 60
time_sum += int(hours) * 3600
time_sum += int(days) * 86400
return time_sum
except ValueError:
raise ValueError('Non-numeric value in time entry: %s' % label)
def _parse_timestamp(entry):
"""
Parses the date and time that in format like like...
::
2012-11-08 16:48:41
:param str entry: timestamp to be parsed
:returns: **datetime** for the time represented by the timestamp
:raises: **ValueError** if the timestamp is malformed
"""
if not stem.util._is_str(entry):
raise ValueError('parse_timestamp() input must be a str, got a %s' % type(entry))
try:
time = [int(x) for x in _timestamp_re.match(entry).groups()]
except AttributeError:
raise ValueError('Expected timestamp in format YYYY-MM-DD HH:MM:ss but got ' + entry)
return datetime.datetime(time[0], time[1], time[2], time[3], time[4], time[5])
def _parse_iso_timestamp(entry):
"""
Parses the ISO 8601 standard that provides for timestamps like...
::
2012-11-08T16:48:41.420251
:param str entry: timestamp to be parsed
:returns: **datetime** for the time represented by the timestamp
:raises: **ValueError** if the timestamp is malformed
"""
if not stem.util._is_str(entry):
raise ValueError('parse_iso_timestamp() input must be a str, got a %s' % type(entry))
# based after suggestions from...
# http://stackoverflow.com/questions/127803/how-to-parse-iso-formatted-date-in-python
if '.' in entry:
timestamp_str, microseconds = entry.split('.')
else:
timestamp_str, microseconds = entry, '000000'
if len(microseconds) != 6 or not microseconds.isdigit():
raise ValueError("timestamp's microseconds should be six digits")
if len(timestamp_str) > 10 and timestamp_str[10] == 'T':
timestamp_str = timestamp_str[:10] + ' ' + timestamp_str[11:]
else:
raise ValueError("timestamp didn't contain delimeter 'T' between date and time")
timestamp = _parse_timestamp(timestamp_str)
return timestamp + datetime.timedelta(microseconds = int(microseconds))
def _get_label(units, count, decimal, is_long, round = False):
"""
Provides label corresponding to units of the highest significance in the
provided set. This rounds down (ie, integer truncation after visible units).
:param tuple units: type of units to be used for conversion, containing
(count_per_unit, short_label, long_label)
:param int count: number of base units being converted
:param int decimal: decimal precision of label
:param bool is_long: uses the long label if **True**, short label otherwise
:param bool round: rounds normally if **True**, otherwise rounds down
"""
# formatted string for the requested number of digits
label_format = '%%.%if' % decimal
if count < 0:
label_format = '-' + label_format
count = abs(count)
elif count == 0:
units_label = units[-1][2] + 's' if is_long else units[-1][1]
return '%s%s' % (label_format % count, units_label)
for count_per_unit, short_label, long_label in units:
if count >= count_per_unit:
if not round:
# Rounding down with a '%f' is a little clunky. Reducing the count so
# it'll divide evenly as the rounded down value.
count -= count % (count_per_unit / (10 ** decimal))
count_label = label_format % (count / count_per_unit)
if is_long:
# Pluralize if any of the visible units make it greater than one. For
# instance 1.0003 is plural but 1.000 isn't.
if decimal > 0:
is_plural = count > count_per_unit
else:
is_plural = count >= count_per_unit * 2
return count_label + long_label + ('s' if is_plural else '')
else:
return count_label + short_label
# TODO: drop with stem 2.x
# We renamed our methods to drop a redundant 'get_*' prefix, so alias the old
# names for backward compatability.
get_size_label = size_label
get_time_label = time_label
get_time_labels = time_labels
get_short_time_label = short_time_label
stem-1.8.0/requirements.txt 0000664 0001750 0001750 00000000053 13501272761 016500 0 ustar atagar atagar 0000000 0000000 mock
pyflakes
pycodestyle
tox
cryptography
stem-1.8.0/MANIFEST.in 0000664 0001750 0001750 00000000633 13602232262 014750 0 ustar atagar atagar 0000000 0000000 include cache_fallback_directories.py
include cache_manual.py
include LICENSE
include README.md
include MANIFEST.in
include requirements.txt
include run_tests.py
include tox.ini
graft docs
graft test
global-exclude __pycache__
global-exclude *.orig
global-exclude *.pyc
global-exclude *.swp
global-exclude *.swo
global-exclude .tox
global-exclude *~
recursive-exclude test/data *
recursive-exclude docs/_build * stem-1.8.0/run_tests.py 0000775 0001750 0001750 00000033351 13526063314 015625 0 ustar atagar atagar 0000000 0000000 #!/usr/bin/env python
# Copyright 2011-2019, Damian Johnson and The Tor Project
# See LICENSE for licensing information
"""
Runs unit and integration tests. For usage information run this with '--help'.
"""
import errno
import importlib
import logging
import multiprocessing
import os
import signal
import sys
import threading
import time
import traceback
import unittest
try:
from StringIO import StringIO
except ImportError:
from io import StringIO
import stem.prereq
import stem.util.conf
import stem.util.log
import stem.util.system
import stem.util.test_tools
import stem.version
import test
import test.arguments
import test.output
import test.runner
import test.task
from test.output import STATUS, SUCCESS, ERROR, NO_NL, STDERR, println
CONFIG = stem.util.conf.config_dict('test', {
'integ.test_directory': './test/data',
'test.unit_tests': '',
'test.integ_tests': '',
})
MOCK_UNAVAILABLE_MSG = """\
To run stem's tests you'll need mock...
https://pypi.org/project/mock/
"""
MOCK_OUT_OF_DATE_MSG = """\
To run stem's tests you'll need mock. You have version %s, but you need
version 0.8.0 or later...
https://pypi.org/project/mock/
"""
NEW_CAPABILITIES_FOUND = """\
Your version of Tor has capabilities stem currently isn't taking advantage of.
If you're running the latest version of stem then please file a ticket on:
https://trac.torproject.org/projects/tor/wiki/doc/stem/bugs
New capabilities are:
"""
def log_traceback(sig, frame):
"""
Dump the stacktraces of all threads on stderr.
"""
# Attempt to get the name of our signal. Unfortunately the signal module
# doesn't provide a reverse mapping, so we need to get this ourselves
# from the attributes.
signal_name = str(sig)
for attr_name, value in signal.__dict__.items():
if attr_name.startswith('SIG') and value == sig:
signal_name = attr_name
break
lines = [
'', # initial NL so we start on our own line
'=' * 80,
'Signal %s received by thread %s in process %i' % (signal_name, threading.current_thread().name, os.getpid()),
]
for thread_name, stacktrace in test.output.thread_stacktraces().items():
lines.append('-' * 80)
lines.append('%s thread stacktrace' % thread_name)
lines.append('')
lines.append(stacktrace)
lines.append('=' * 80)
println('\n'.join(lines), STDERR)
# propagate the signal to any multiprocessing children
for p in multiprocessing.active_children():
try:
os.kill(p.pid, sig)
except OSError as exc:
if exc.errno == errno.ESRCH:
pass # already exited, no such process
else:
raise exc
if sig == signal.SIGABRT:
# we need to use os._exit() to abort every thread in the interpreter,
# rather than raise a SystemExit exception that can be caught
os._exit(-1)
def get_unit_tests(module_prefixes = None):
"""
Provides the classes for our unit tests.
:param list module_prefixes: only provide the test if the module starts with
any of these substrings
:returns: an **iterator** for our unit tests
"""
return _get_tests(CONFIG['test.unit_tests'].splitlines(), module_prefixes)
def get_integ_tests(module_prefixes = None):
"""
Provides the classes for our integration tests.
:param list module_prefixes: only provide the test if the module starts with
any of these substrings
:returns: an **iterator** for our integration tests
"""
return _get_tests(CONFIG['test.integ_tests'].splitlines(), module_prefixes)
def _get_tests(modules, module_prefixes):
for import_name in modules:
if not module_prefixes:
yield import_name
else:
cropped_name = test.arguments.crop_module_name(import_name)
cropped_name = cropped_name.rsplit('.', 1)[0] # exclude the class name
for prefix in module_prefixes:
if cropped_name.startswith(prefix):
yield import_name
break
elif prefix.startswith(cropped_name):
# single test for this module
test_name = prefix.rsplit('.', 1)[1]
yield '%s.%s' % (import_name, test_name)
break
def main():
start_time = time.time()
try:
stem.prereq.check_requirements()
except ImportError as exc:
println('%s\n' % exc)
sys.exit(1)
signal.signal(signal.SIGABRT, log_traceback)
signal.signal(signal.SIGUSR1, log_traceback)
test_config = stem.util.conf.get_config('test')
test_config.load(os.path.join(test.STEM_BASE, 'test', 'settings.cfg'))
if 'STEM_TEST_CONFIG' in os.environ:
test_config.load(os.environ['STEM_TEST_CONFIG'])
try:
args = test.arguments.parse(sys.argv[1:])
test.task.TOR_VERSION.args = (args.tor_path,)
test.output.SUPPRESS_STDOUT = args.quiet
except ValueError as exc:
println(str(exc))
sys.exit(1)
if args.print_help:
println(test.arguments.get_help())
sys.exit()
elif not args.run_unit and not args.run_integ:
println('Nothing to run (for usage provide --help)\n')
sys.exit()
if not stem.prereq.is_mock_available():
try:
import mock
println(MOCK_OUT_OF_DATE_MSG % mock.__version__)
except ImportError:
println(MOCK_UNAVAILABLE_MSG)
if stem.util.system.is_available('pip'):
println("You can get it by running 'sudo pip install mock'.")
elif stem.util.system.is_available('apt-get'):
println("You can get it by running 'sudo apt-get install python-mock'.")
sys.exit(1)
test.task.run(
'INITIALISING',
test.task.STEM_VERSION,
test.task.TOR_VERSION if args.run_integ else None,
test.task.PYTHON_VERSION,
test.task.PLATFORM_VERSION,
test.task.CRYPTO_VERSION,
test.task.MOCK_VERSION,
test.task.PYFLAKES_VERSION,
test.task.PYCODESTYLE_VERSION,
test.task.CLEAN_PYC,
test.task.UNUSED_TESTS,
test.task.IMPORT_TESTS,
test.task.REMOVE_TOR_DATA_DIR if args.run_integ else None,
test.task.PYFLAKES_TASK if not args.specific_test else None,
test.task.PYCODESTYLE_TASK if not args.specific_test else None,
)
# Test logging. If '--log-file' is provided we log to that location,
# otherwise we buffer messages and log to stdout after its test completes.
logging_buffer = None
if args.logging_runlevel:
if args.logging_path:
handler = logging.FileHandler(args.logging_path, mode = 'w')
handler.setLevel(stem.util.log.logging_level(args.logging_runlevel))
handler.setFormatter(stem.util.log.FORMATTER)
else:
handler = logging_buffer = stem.util.log.LogBuffer(args.logging_runlevel)
stem.util.log.get_logger().addHandler(handler)
# filters for how testing output is displayed
error_tracker = test.output.ErrorTracker()
output_filters = (
error_tracker.get_filter(),
test.output.runtimes,
test.output.strip_module,
test.output.align_results,
test.output.colorize,
)
# Number of tests that we have skipped. This is only available with python
# 2.7 or later because before that test results didn't have a 'skipped'
# attribute.
skipped_tests = 0
if args.run_integ:
default_test_dir = stem.util.system.expand_path(CONFIG['integ.test_directory'], test.STEM_BASE)
async_args = test.AsyncTestArgs(default_test_dir, args.tor_path)
for module_str in stem.util.test_tools.ASYNC_TESTS:
module = importlib.import_module(module_str.rsplit('.', 1)[0])
test_classes = [v for k, v in module.__dict__.items() if k.startswith('Test')]
if len(test_classes) != 1:
print('BUG: Detected multiple tests for %s: %s' % (module_str, ', '.join(test_classes)))
sys.exit(1)
test_classes[0].run_tests(async_args)
if args.run_unit:
test.output.print_divider('UNIT TESTS', True)
error_tracker.set_category('UNIT TEST')
for test_class in get_unit_tests(args.specific_test):
run_result = _run_test(args, test_class, output_filters)
test.output.print_logging(logging_buffer)
skipped_tests += len(getattr(run_result, 'skipped', []))
println()
if args.run_integ:
test.output.print_divider('INTEGRATION TESTS', True)
integ_runner = test.runner.get_runner()
for target in args.run_targets:
error_tracker.set_category(target)
try:
integ_runner.start(target, args.attribute_targets, args.tor_path)
println('Running tests...\n', STATUS)
for test_class in get_integ_tests(args.specific_test):
run_result = _run_test(args, test_class, output_filters)
test.output.print_logging(logging_buffer)
skipped_tests += len(getattr(run_result, 'skipped', []))
if not integ_runner.assert_tor_is_running():
# our tor process died
error_tracker.register_error()
break
except KeyboardInterrupt:
println(' aborted starting tor: keyboard interrupt\n', ERROR)
break
except ValueError as exc:
println(str(exc), ERROR) # can arise if there's bad settings.cfg data
break
except OSError:
error_tracker.register_error()
finally:
println()
integ_runner.stop()
println()
# We should have joined on all threads. If not then that indicates a
# leak that could both likely be a bug and disrupt further targets.
active_threads = threading.enumerate()
if len(active_threads) > 1:
println('Threads lingering after test run:', ERROR)
for lingering_thread in active_threads:
println(' %s' % lingering_thread, ERROR)
break
static_check_issues = {}
for task in (test.task.PYFLAKES_TASK, test.task.PYCODESTYLE_TASK):
if not task.is_available and task.unavailable_msg:
println(task.unavailable_msg, ERROR)
else:
task.join() # no-op if these haven't been run
if task.result:
for path, issues in task.result.items():
for issue in issues:
static_check_issues.setdefault(path, []).append(issue)
_print_static_issues(static_check_issues)
if error_tracker.has_errors_occured():
println('TESTING FAILED (%i seconds)' % (time.time() - start_time), ERROR, STDERR)
for line in error_tracker:
println(' %s' % line, ERROR, STDERR)
error_modules = error_tracker.get_modules()
if len(error_modules) < 10 and not args.specific_test:
println('\nYou can re-run just these tests with:\n', ERROR, STDERR)
for module in error_modules:
println(' %s --test %s' % (' '.join(sys.argv), test.arguments.crop_module_name(module)), ERROR, STDERR)
else:
if skipped_tests > 0:
println('%i TESTS WERE SKIPPED' % skipped_tests, STATUS)
println('TESTING PASSED (%i seconds)\n' % (time.time() - start_time), SUCCESS)
new_capabilities = test.get_new_capabilities()
if new_capabilities:
println(NEW_CAPABILITIES_FOUND, ERROR)
for capability_type, msg in sorted(new_capabilities, key = lambda x: x[1]):
println(' [%s] %s' % (capability_type, msg), ERROR)
sys.exit(1 if error_tracker.has_errors_occured() else 0)
def _print_static_issues(static_check_issues):
if static_check_issues:
println('STATIC CHECKS', STATUS)
for file_path in static_check_issues:
println('* %s' % file_path, STATUS)
# Make a dict of line numbers to its issues. This is so we can both sort
# by the line number and clear any duplicate messages.
line_to_issues = {}
for issue in static_check_issues[file_path]:
line_to_issues.setdefault(issue.line_number, set()).add((issue.message, issue.line))
for line_number in sorted(line_to_issues.keys()):
for msg, line in line_to_issues[line_number]:
line_count = '%-4s' % line_number
content = ' | %s' % line.strip() if line.strip() else ''
println(' line %s - %-40s%s' % (line_count, msg, content))
println()
def _run_test(args, test_class, output_filters):
# When logging to a file we don't have stdout's test delimiters to correlate
# logs with the test that generated them.
if args.logging_path:
stem.util.log.notice('Beginning test %s' % test_class)
start_time = time.time()
# Test classes look like...
#
# test.unit.util.conf.TestConf.test_parse_enum_csv
#
# We want to strip the 'test.unit.' or 'test.integ.' prefix since it's
# redundant. We also want to drop the test class name. The individual test
# name at the end it optional (only present if we used the '--test'
# argument).
label_comp = test_class.split('.')[2:]
del label_comp[-1 if label_comp[-1][0].isupper() else -2]
test_label = ' %-52s' % ('.'.join(label_comp) + '...')
if args.verbose:
test.output.print_divider(test_class)
else:
println(test_label, STATUS, NO_NL)
try:
suite = unittest.TestLoader().loadTestsFromName(test_class)
except AttributeError:
if args.specific_test:
# should only come up if user provided '--test' for something that doesn't exist
println(' no such test', ERROR)
return None
else:
raise
except Exception as exc:
println(' failed', ERROR)
traceback.print_exc(exc)
return None
test_results = StringIO()
run_result = stem.util.test_tools.TimedTestRunner(test_results, verbosity = 2).run(suite)
if args.verbose:
println(test.output.apply_filters(test_results.getvalue(), *output_filters))
elif not run_result.failures and not run_result.errors:
println(' success (%0.2fs)' % (time.time() - start_time), SUCCESS)
else:
if args.quiet:
println(test_label, STATUS, NO_NL, STDERR)
println(' failed (%0.2fs)' % (time.time() - start_time), ERROR, STDERR)
println(test.output.apply_filters(test_results.getvalue(), *output_filters), STDERR)
else:
println(' failed (%0.2fs)' % (time.time() - start_time), ERROR)
println(test.output.apply_filters(test_results.getvalue(), *output_filters), NO_NL)
if args.logging_path:
stem.util.log.notice('Finished test %s' % test_class)
return run_result
if __name__ == '__main__':
main()
stem-1.8.0/LICENSE 0000664 0001750 0001750 00000016743 13157571677 014255 0 ustar atagar atagar 0000000 0000000 GNU LESSER GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
This version of the GNU Lesser General Public License incorporates
the terms and conditions of version 3 of the GNU General Public
License, supplemented by the additional permissions listed below.
0. Additional Definitions.
As used herein, "this License" refers to version 3 of the GNU Lesser
General Public License, and the "GNU GPL" refers to version 3 of the GNU
General Public License.
"The Library" refers to a covered work governed by this License,
other than an Application or a Combined Work as defined below.
An "Application" is any work that makes use of an interface provided
by the Library, but which is not otherwise based on the Library.
Defining a subclass of a class defined by the Library is deemed a mode
of using an interface provided by the Library.
A "Combined Work" is a work produced by combining or linking an
Application with the Library. The particular version of the Library
with which the Combined Work was made is also called the "Linked
Version".
The "Minimal Corresponding Source" for a Combined Work means the
Corresponding Source for the Combined Work, excluding any source code
for portions of the Combined Work that, considered in isolation, are
based on the Application, and not on the Linked Version.
The "Corresponding Application Code" for a Combined Work means the
object code and/or source code for the Application, including any data
and utility programs needed for reproducing the Combined Work from the
Application, but excluding the System Libraries of the Combined Work.
1. Exception to Section 3 of the GNU GPL.
You may convey a covered work under sections 3 and 4 of this License
without being bound by section 3 of the GNU GPL.
2. Conveying Modified Versions.
If you modify a copy of the Library, and, in your modifications, a
facility refers to a function or data to be supplied by an Application
that uses the facility (other than as an argument passed when the
facility is invoked), then you may convey a copy of the modified
version:
a) under this License, provided that you make a good faith effort to
ensure that, in the event an Application does not supply the
function or data, the facility still operates, and performs
whatever part of its purpose remains meaningful, or
b) under the GNU GPL, with none of the additional permissions of
this License applicable to that copy.
3. Object Code Incorporating Material from Library Header Files.
The object code form of an Application may incorporate material from
a header file that is part of the Library. You may convey such object
code under terms of your choice, provided that, if the incorporated
material is not limited to numerical parameters, data structure
layouts and accessors, or small macros, inline functions and templates
(ten or fewer lines in length), you do both of the following:
a) Give prominent notice with each copy of the object code that the
Library is used in it and that the Library and its use are
covered by this License.
b) Accompany the object code with a copy of the GNU GPL and this license
document.
4. Combined Works.
You may convey a Combined Work under terms of your choice that,
taken together, effectively do not restrict modification of the
portions of the Library contained in the Combined Work and reverse
engineering for debugging such modifications, if you also do each of
the following:
a) Give prominent notice with each copy of the Combined Work that
the Library is used in it and that the Library and its use are
covered by this License.
b) Accompany the Combined Work with a copy of the GNU GPL and this license
document.
c) For a Combined Work that displays copyright notices during
execution, include the copyright notice for the Library among
these notices, as well as a reference directing the user to the
copies of the GNU GPL and this license document.
d) Do one of the following:
0) Convey the Minimal Corresponding Source under the terms of this
License, and the Corresponding Application Code in a form
suitable for, and under terms that permit, the user to
recombine or relink the Application with a modified version of
the Linked Version to produce a modified Combined Work, in the
manner specified by section 6 of the GNU GPL for conveying
Corresponding Source.
1) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (a) uses at run time
a copy of the Library already present on the user's computer
system, and (b) will operate properly with a modified version
of the Library that is interface-compatible with the Linked
Version.
e) Provide Installation Information, but only if you would otherwise
be required to provide such information under section 6 of the
GNU GPL, and only to the extent that such information is
necessary to install and execute a modified version of the
Combined Work produced by recombining or relinking the
Application with a modified version of the Linked Version. (If
you use option 4d0, the Installation Information must accompany
the Minimal Corresponding Source and Corresponding Application
Code. If you use option 4d1, you must provide the Installation
Information in the manner specified by section 6 of the GNU GPL
for conveying Corresponding Source.)
5. Combined Libraries.
You may place library facilities that are a work based on the
Library side by side in a single library together with other library
facilities that are not Applications and are not covered by this
License, and convey such a combined library under terms of your
choice, if you do both of the following:
a) Accompany the combined library with a copy of the same work based
on the Library, uncombined with any other library facilities,
conveyed under the terms of this License.
b) Give prominent notice with the combined library that part of it
is a work based on the Library, and explaining where to find the
accompanying uncombined form of the same work.
6. Revised Versions of the GNU Lesser General Public License.
The Free Software Foundation may publish revised and/or new versions
of the GNU Lesser General Public License from time to time. Such new
versions will be similar in spirit to the present version, but may
differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the
Library as you received it specifies that a certain numbered version
of the GNU Lesser General Public License "or any later version"
applies to it, you have the option of following the terms and
conditions either of that published version or of any later version
published by the Free Software Foundation. If the Library as you
received it does not specify a version number of the GNU Lesser
General Public License, you may choose any version of the GNU Lesser
General Public License ever published by the Free Software Foundation.
If the Library as you received it specifies that a proxy can decide
whether future versions of the GNU Lesser General Public License shall
apply, that proxy's public statement of acceptance of any version is
permanent authorization for you to choose that version for the
Library.
stem-1.8.0/tox.ini 0000664 0001750 0001750 00000000362 13501272761 014532 0 ustar atagar atagar 0000000 0000000 [tox]
skip_missing_interpreters = True
envlist = py26,py27,py32,py33,py34,py35,py36,py37,jython,pypy
skipsdist = True
[testenv]
commands =
pip install -e .
python run_tests.py {posargs:-a}
rm -rf stem.egg-info
deps =
-rrequirements.txt
stem-1.8.0/docs/ 0000775 0001750 0001750 00000000000 13602232262 014140 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/tutorials.rst 0000664 0001750 0001750 00000013305 13157571677 016747 0 ustar atagar atagar 0000000 0000000 Tutorial
========
.. Image Sources:
* The Little Relay That Could - train.png
Source: https://openclipart.org/detail/140185/tren-train-by-antroares
Author: Antroares
License: Public Domain
Alternate: https://openclipart.org/detail/1128/train-roadsign-by-ryanlerch
* To Russia With Love - soviet.png
Source: https://openclipart.org/detail/146017/flag-of-the-soviet-union-by-marxist-leninist
Author: Unknown
License: Public Domain (not a subject of copyright according the Russian civil code)
Alternate: https://openclipart.org/detail/85555/communist-sabbatarian-ribbon-by-rones-85555
* Tortoise and the Hare - tortoise.png
Source: https://openclipart.org/detail/27911/green-tortoise-%28cartoon%29-by-arking-27911
Author: arking
License: Public Domain
* Over the River and Through the Wood - riding_hood.png
Source: https://openclipart.org/detail/163771/little-red-riding-hood-by-tzunghaor
Author: tzunghaor
License: Public Domain
* Mirror Mirror On The Wall - mirror.png
Source: https://openclipart.org/detail/152155/mirror-frame-by-gsagri04
Author: Unknown (gsagri04?)
License: Public Domain
Alternate: https://openclipart.org/detail/174179/miroir-rectangulaire-by-defaz36-174179
* East of the Sun & West of the Moon - windrose.png
Source: https://commons.wikimedia.org/wiki/File:Compass_card_%28sl%29.svg
Author: Andrejj
License: CC0 (https://creativecommons.org/publicdomain/zero/1.0/deed.en)
* Mad Hatter - mad_hatter.png
Source: http://www.krepcio.com/vitreosity/archives/MadHatter-ALL-illus600.jpg
Author: John Tenniel
License: Public Doman
Augmented: Colored by me, and used the card from...
https://openclipart.org/detail/1892/mad-hatter-with-label-on-hat-by-nayrhcrel
* Double Double Toil and Trouble - cauldron.png
Source: https://openclipart.org/detail/174099/cauldron-by-jarda-174099
Author: Unknown (jarda?)
License: Public Domain
Getting started with any new library can be daunting, so let's get our feet wet
by jumping straight in with some tutorials...
.. list-table::
:widths: 1 10
:header-rows: 0
* - .. image:: /_static/section/tutorials/train.png
:target: tutorials/the_little_relay_that_could.html
- .. image:: /_static/label/the_little_relay_that_could.png
:target: tutorials/the_little_relay_that_could.html
Basics for talking with Tor. This will step you through configuring Tor
and writing your first script to talk with it.
* - .. image:: /_static/section/tutorials/soviet.png
:target: tutorials/to_russia_with_love.html
- .. image:: /_static/label/to_russia_with_love.png
:target: tutorials/to_russia_with_love.html
Rather than talking to Tor, we'll now talk **through** it. In this
tutorial we'll programmatically start Tor then use it to read a site
through mother Russia!
* - .. image:: /_static/section/tutorials/tortoise.png
:target: tutorials/tortoise_and_the_hare.html
- .. image:: /_static/label/tortoise_and_the_hare.png
:target: tutorials/tortoise_and_the_hare.html
As Tor runs it generates a variety of **events** that controllers can
subscribe to be notified of. In this tutorial we'll do just that,
writing a curses application that graphs the bandwidth usage of Tor.
* - .. image:: /_static/section/tutorials/riding_hood.png
:target: tutorials/over_the_river.html
- .. image:: /_static/label/over_the_river.png
:target: tutorials/over_the_river.html
`Hidden services
`_ are a way
of providing a service that isn't easily trackable. As a dissident, for
instance, this could let you safely publish a blog without getting your
door kicked down. Here we'll walk you through an example.
* - .. image:: /_static/section/tutorials/mirror.png
:target: tutorials/mirror_mirror_on_the_wall.html
- .. image:: /_static/label/mirror_mirror_on_the_wall.png
:target: tutorials/mirror_mirror_on_the_wall.html
Getting and acting upon information about relays in the Tor network.
Relay information is provided through documents called **descriptors**.
This walks you through both where to get them and a small script to tell
you the fastest Tor exits.
* - .. image:: /_static/section/tutorials/windrose.png
:target: tutorials/east_of_the_sun.html
- .. image:: /_static/label/east_of_the_sun.png
:target: tutorials/east_of_the_sun.html
Stem provides several utility modules frequently useful for Tor
controller applications. Here we introduce some of them.
* - .. image:: /_static/section/tutorials/mad_hatter.png
:target: tutorials/down_the_rabbit_hole.html
- .. image:: /_static/label/down_the_rabbit_hole.png
:target: tutorials/down_the_rabbit_hole.html
Interactive interpreter for Tor that provides you with direct access to
Tor's `control interface
`_
via either python or direct requests. This is an easy way of
experimenting with Stem and learning what Tor can do.
* - .. image:: /_static/section/tutorials/cauldron.png
:target: tutorials/double_double_toil_and_trouble.html
- .. image:: /_static/label/double_double_toil_and_trouble.png
:target: tutorials/double_double_toil_and_trouble.html
Sometimes it's easiest to learn a library by seeing how it's used in the
wild. This is a directory of scripts and applications that use Stem.
stem-1.8.0/docs/roles.py 0000664 0001750 0001750 00000005220 13412531020 015626 0 ustar atagar atagar 0000000 0000000 import re
from docutils.utils import unescape
from docutils.nodes import reference
from docutils.parsers.rst.roles import set_classes
def role_trac(name, rawtext, text, lineno, inliner, options={}, content=[]):
"""
Aliases :trac:`1234` to 'https://trac.torproject.org/1234'.
:param name: the role name used in the document
:param rawtext: the entire markup snippet, with role
:param text: the text marked with the role
:param lineno: the line number where rawtext appears in the input
:param inliner: the inliner instance that called us
:param options: directive options for customization
:param content: the directive content for customization
"""
# checking if the number is valid
try:
ticket_num = int(text)
if ticket_num <= 0:
raise ValueError
except ValueError:
msg = inliner.reporter.error('Invalid trac ticket: %s' % text, line=lineno)
prb = inliner.problematic(rawtext, rawtext, msg)
return ([prb], [msg])
app = inliner.document.settings.env.app
link_text = 'ticket %s' % unescape(str(ticket_num))
return (
[make_link_node(rawtext, app, 'trac_url', link_text, str(ticket_num), options)],
[],
)
def role_spec(name, rawtext, text, lineno, inliner, options={}, content=[]):
"""
Aliases :spec:`25b0d43` to 'https://gitweb.torproject.org/torspec.git/commit/?id=25b0d43'.
"""
# checking if the input is a valid short commit id
if not re.match('^[0-9a-f]{7}$', text):
msg = inliner.reporter.error('Spec tag expects a short commit id (seven hex characters): %s' % text, line=lineno)
prb = inliner.problematic(rawtext, rawtext, msg)
return ([prb], [msg])
app = inliner.document.settings.env.app
return (
[make_link_node(rawtext, app, 'spec_url', 'spec', text, options)],
[],
)
def make_link_node(rawtext, app, url_type, link_text, slug, options):
"""
Creates a link to a trac ticket.
:param rawtext: text being replaced with link node
:param app: sphinx application context
:param url_type: base for our url
:param link_text: text for the link
:param slug: ID of the thing to link to
:param options: options dictionary passed to role func
"""
base_url = getattr(app.config, url_type, None)
if not base_url:
raise ValueError("'%s' isn't set in our config" % url_type)
ref = base_url.format(slug = slug)
set_classes(options)
return reference(rawtext, link_text, refuri = ref, **options)
def setup(app):
"""
Installs the plugin.
:param app: sphinx application context
"""
app.add_role('trac', role_trac)
app.add_config_value('trac_url', None, 'env')
app.add_role('spec', role_spec)
app.add_config_value('spec_url', None, 'env')
stem-1.8.0/docs/_static/ 0000775 0001750 0001750 00000000000 13602232262 015566 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/_static/favicon.png 0000664 0001750 0001750 00000001744 13157571677 017754 0 ustar atagar atagar 0000000 0000000 ‰PNG
IHDR szzô sRGB ®Î é bKGD ÿ ÿ ÿ ½§“ pHYs ¬ ¬!¼UW tIMEÝ4å…‡~ dIDATXÃÅ×_ˆ”UÇñÏóθFæ¿MA7´?”T® DYÁFi%ÎŽ’uHÑEÚ_uw#£ì¢.jí¢‚ºÉ‹ 5ŒC((rwK,3Œ\Ý÷t±“ÍŽ»9»îæ¹z_Ιó|ßçù=¿s¦`’GÖîÔªÏ^?8?Ù ‰e‘¼g£©ç Khq¢‰(™Ù ÁË8¨àøD×öye5´¸ÝÊQ÷9†Ù‘ìTvÿY2µÜ)ŸO<@2y$›µ)Œ¸fƒk„‹ìðëhÛÆ
°Ôja:¸Ð—z 6ÿˆY‘y
'²V¦Vó,Ó«g¸Šã’‚Ìá,¹'çÃÓs›dÑç ܬLˆ¡¬ý˜6Xn›þsÏÀ2G‚Çqnð‰ }֛혧°KèÎ’$\YýØ™sS÷ÿýŽÚ±Î"]u©üoÝ áüáû|ÐÖ,”óSžðº?N¯kÓ¤ÙRE½¶úax"k_J¾RÊ”m÷EC› QpÒê,wk>àQoø«áv®«k/EîS%W7´ÃϦg^•›–W¬Kð3 "9Šãˆ,ó@%X¹7ód‹Š—†œwŒ†6¬µ3ó1})¹oÔ_m4#Ú}”…›Ò|÷ªøv¼Z.֙˂êÓ1,ñ˜éÃÄ›v§¤;Ul>WK¯÷YÃÄÙäRì¯1— bªîÄnõÁ×j6ÅrWÈôËõâ+Žà0š‘Wß/«È¦z11¨³&xÉͶá:ICÏô›%cÓ@x±úØ„þ,¹«Æ#'ÚR²æ´ØÊÖEø ×Wáa)Qò®±µá<]ÁV,ÆQœÔ®"óB„.}Õ#¶ISð¸Å SÅžÆ }äó»·HN(ØeÐ’ §p¹‡”Üá$0Sh©
¹7qŠßÇPŸ¦’ )ÌHÚ”¬‰Ð)‘ìLay5cÿ´òJÛu7~¦m´)D³þÄ3Y²8…µØ—Ø ”±°f³Ž¼Óúqшãb+0GØ“‡}‰§…ãÁs5ÁO&ž kð† 2nÃ! öKöG¸[²§ð]ðl*ºJ§-“óÇ¢ìíh··®,Mêg¬NxæÕ/Y(êît
ô÷Äi€…‘F¿TN.ÀÐm·…ó0W Šg”àȇÚ,ÏÏ@ªöù$fàoý| 8€ IEND®B`‚ stem-1.8.0/docs/_static/resources/ 0000775 0001750 0001750 00000000000 13602232262 017600 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/_static/resources/exit_map_alt.png 0000664 0001750 0001750 00000030713 13157571677 023005 0 ustar atagar atagar 0000000 0000000 ‰PNG
IHDR € € Ã>aË sRGB ®Î é bKGD ÿ ÿ ÿ ½§“ pHYs šœ tIMEÞ æ† tEXtComment Created with GIMPW IDATxÚíwœåýÇß3³}¯÷;8zïH“ H €hÔDÅüŒŠ °‹†X#Š ¨€bÈ`T@¥) p´kÀõ^¶·™y~,¬œ9àá{¯yÁíîÍÌÎóy¾½HBÁ:mI>óNo2´ä›ÛµkûöíÀív#Ë26›áÇc·Û[ôƒÝ¹s'7näšk®9ÃŽ•ºwïÎsÏ=ÇìÙ³9÷ÜséÖëÖ‹€â—¤ë:>Ÿ¯EÜ{AA·ß~ûp¼Ô·o_’’’HKK£gÏžÜrË-tèÐMÓ¨¯¯§²²’œœ B¡7Ýt‹/Æï÷ãr¹p»Ý”––²oß>
q¹\„B!
ðûý‡å8ÅÅÅèºÎ¾}ûp¹\ø|>òòò"Ÿ¯««cûöí PÜn7 ‡ââbB¡ ¹¹¹´k×îŒÐ¤iÕÕÕäææ²~ýzæÏŸÕjå³Ï>cüøñ|ýõ×Üyç|öÙg,_¾ ›ÍFyy9cÇŽå_ÿúO=õåååüáÀçóa4yùå—1
®3uêTêëë™1cS¦LáwÞaîܹ(ŠÂìÙ³ùñÇ ÉÉÉá‘G ÁårqÕUW
…¸üòËyüñÇ™9s&>Ÿ |`0ÈâÅ‹1 g ÐTWWÇÎ;Ù°a%%% Œ =Y–¹òÊ+¹æškøᇠˆŠŠ"333²ûú÷ïÏ /¼ÀÙgŸMïÞ½Y»v-N§“””E‰œ? òÜsÏ1tèPú÷ïÕjeøðáÔÔÔ`2™°Ûíx< FŽ É Aƒxÿý÷1˜ÍfzôèÁ‹/¾HVV;wî¤gÏžLœ81ÂÎ(ÇA’$ѹsg.¹ä Š‹‹q»ÝH’áV«MÓBD^ˆ‰‰‰üÿ®»îâÕW_eÛ¶mL›6Á5L&ùË_xýõ× Œ ;¿ß 9—$I!HOO租~bݺuÈrxï!"×Yµj
v† ©ªÚ`QV+Ÿþ9f³I’P%ò¯Ùl& FíàEèÕ«•••x<žÃZ àü#“'OføðᨪŠÛí °°›ÍÆSO=Enn.çž{.º®‡ ,G®Ó§O -Zá*§‚‹¥E`ÇŽ ,_¾œõë×sï½÷rÇ w0hÐ ZµjÅÂ… )--¥ €… ’““Ø1c˜}z ˜S6á BJ ÚádÉ|Æ
8ÕHHN¶2qâÄþ¯ªj$ R Ñi{Ðd«)“>/þ¦ÿ7/t]D¢ƒ¿F¡P›ÍFš\$ \{ÆaïÝ–ß:öYÁ’$QXXÎìÙ ¨uçb°hoˆ³"$ý NÙ…•%ŒFï Š¢Ð·oWÚ¶É`ì9·“¿ìRV~bFQtBÁ Bÿmƒà7+
*¹ï¾§•”!IŽz'Ï>s? õ—²ì‹7n•¥…X¬vÌ61±q€t -ªÊJP$‰´´8®»îÊFé 6›…ë¯ É`Á¥WÑ»]?vîÚÇØ d~ ¿W]-q ÉØJ3;#ZyÝ.Š÷æðy€,I˜Í¦_=l6+ 7^ÿ€—žÿ¯sr€ÿÄê/v±vÝdYF–e„ÔVWPYV‚z
${ž B „ TåÁ]U‡„LÊ°Z-,[ö sæ|È߯¿‚‹/½]»ó™0ñ|Š•Ÿv5s _ÌíS¦QYY‰ÑhD’$>/UeŸŽÓ -1e@@
•lç.|‡&´Fݯ®ë<ó̸œ ¾^1ŸÑçŸC]u5²"SZZÅ óogwùÎn}éU™påµlËÊŠè š¦Q_S…³®öô @KLuÒÐðj^jJˈ•b‘‘‘ˆ_UÕdYbÞ¼ÿrÎïòêk3AŠ
JY¿a+}úöÀQï"!!†.ƒð}$Ø“—ù7nùû½äåïiPìᨫÁãrüöÐ"Ù¿¦ãw¸ H’ôó„þ?8€Õjáµ×?`Èà~Ü{ÿÍ€Ä'‹WPWï`̘ópÕ;éÔ¹-_³Ž¿N Ã_‹‚XKc;\Ã
7Þ‚×çmP/P[U‰×í<€I>¯‡Š¢BüNw£¹“$Iäç ™2õÐ5ž™9›±cFЧO8tß¾b„.P™g5Š9ìÐ…N¼=‘³b/àéYÏ5à’$QW]E08€£%]× ø}^ü^Oøðy ühšzØ¿ ø}ÔV– µÈ’$‰oWÿÀÃÓoÍË矯bÊ“0YÌ„‚!rs÷‘”OÖö F?‚?mC˜^TM×èšÒ—üÜ\n×!úˆ£¶†S1½ò¤ø> ng=ªBÛ ”9ðð¬\F1( &¬v;öè˜rWèz£µýÈj ¯Ž ÚP[[OBB,Š¢àõxÙ¹#NÛe·Ñºµ›];v’K¾¡ ²øt¡#;íTVTѦMfƒóû½ ‚~ &‹5BSCHŠƒAAQ g ©!*ËJÐÔÐ!^µƒw:jHG
…ðû<8jkHNË@6ð{<ÈG¨»; ÐuÙlBQdòó‹iß®5(
ÿýï2®úËÅH’„Óé&#=…µë6Ó¶m:ß³çPÝ# àõy{ͪòÒÿe² lQ±ÄÆÅ#µ Ôó !®ú: uÕH’ÌѺTu]£¼¸ Å`<ââÿšö¯†4$IÂãñÍò/Wsþès5"++›¤¤‚AÙ áõzÁø‹):F£éè..I蚎«¾g]5V{4ѱqX¬¶ß¾ i*•å%8êjö/þ±‘$ˇ$q
)Š‚@§¼¼ŠÎ]ÚQRRA}½“”ôtV|õ=={u¦°°”´´$6oÎBü‚K!!ÇHLˆ?¶ï IȲBÀ祺¼ŒÊÒb4Mûí@×4ªËË TjÝ$ ¥±;^U#G(¢ÿ <0}q±Ñøý~ W䌊¢K]—ËÍÞ=%ÈAkƒÅwêˆN5“’’Ü$ß"ðS^´€ÿäµµiVPSYN0àorGґΦë:3Ûòå—_7€‹ÉddÏÞBV¬øžÔÔ$ ›~ÜÌ€Aƒ¨ªªYF:ùùEDEÙð©–ÈâëBçóÜy¼õÈlTµév‚ªò’’Ó±œ„ÆWÍƪ+Ëñ ä49‘¤(
ùyÙ”——QZúóQPPD«V1L½ûQ<^ Õ5u¬^ýºêÅåò€¦!tAm]=U… â)‘s~¸éUþñÄ=têØñT²¦`i5•åx=îþ¬š¥6ÐëvQW]yRíb£ÑtKQBê n¼åî¼ã*¶nÝM—.í7ö÷Ì}ó#l6 ËW|ÇÎok¸¼ßõxC.¾*ü€›¦^ÍEcÇ4ëwR RÒ[¡Œ§. „T• ´<ϘK¸Y\Ë9–aÄÍÜy󨫫¢¦¦$¦†Ø²m7¥ûê9¯ãE˜“ ¦½Ä„?]NŸÞ½ 4ówB`‰%!)åÔ€ß祪´¸EÙº
¯úÞà ×LF[F1/öuB²Š×륦¶–` t!0)fttìQ6’“’"zʼn1™uZ·ëtž_“+Õ¥-nñÃbVÐVi‹$ɬ
¬ç‡Ð&úza6›ÉHOÿU…òKeª+ÊHNouê)¿¯Å&QêèŒ5ýt9‡p°CÝÙ"3ü$IÂïóœšV€ó8=ÍM&ÉÄ@ã P¬–¢Ó2ƒ7’$ãrÔŸ 4¥
ª*-™:ÑRtXWÁ‡ åFieÛ, h*;= ¢Ÿd·æ‘ ÛÕí ¤È)È-8 Bè'æY6Ùµðƈ22[CYìVs°Èº:ï÷
´P ˆµ)šJÉÒB„Ý®-ã¡Jý Rª—ñ°ûQÜÂCWCgÎ6j´ƒáV´a–Ù èf³ù”î,Öd '`+(ÈÒôO‰¾½Ÿ[GÃ!œ”je”h¥ìÐv±=´ƒïCk)W+°ÉVžŠ~œX9† h\~ÿãO>…Ýn'-5•5ëÖÓ½[¢££ÙüÓî¼ýV:wêÔô @§ škÑ
’
zY¡íê…i%Ôjµxñâ.üp蜺 —p¡#ЄJ• ¢£ƒ€®†Î¼ ÷
”ö^| M×¹ù¦‘e‰^~™?^2žßŸ7œÔ”< o3)gÊé €r¹T+#KÝÁþE| ZƒGó6æà Á€E2+Å¥ØbÌE–±œo I@ŽZû¿zâUÄÄDïo\-c2™°X,œsΰHsɪêjBÁŠ"“š’Š¦k8œNYÆére·×h=Éh6b ǯHH¨¨Ìt?Ëûþ¨Ñ~.¼ˆUbé¢t"QN$^Ž%FŠÁ(±bÅ(±K6Œ±JVl’•$9‰9™VJ6Ɇ*Bøű™V=ºw;lâF|\ V«•·çÍ' Ò¥sg¾ÿ£G¤Oï^Üsÿƒthß ÇC‡öí¹ç®)‡4:¼ ˆŽ?ŠкŸ‚ ÷cÌñ¾‚L%“‰Ö üÑr1ñrü~ @Š ø9˜s4Ädx·ùÄñ%\ü¯¬ I’ÈËËç‡g»3 Y–IMMካ®fÅK±˜Í$$Ä3ãáé]oÜâ -*ê„)–M I’Ž:S÷—”¯ía©ÿ ‚»¢ïäûݨhEðˆlûd8uEaý? Óå"9)œhâõù0›ÍÄÇÅa6™Ž*¦’vêXnG=Á€Ÿ@àø=WåzåZ±J,÷ÛïÂ+Z¢·N:ç‚ؘ‚Á Å%%ÄÆÆñññÇ8/H`±ÙNhÍ1ó!e…{©¯Æëq£5Ø¥‡sôÚ)mP0´¸ÅW…`(ˆ¦…¿PHeܘ ÉÈÈà“ÅK0¸Ü.Ze¤“‘ž ÉGlü‚J|>ª+ËZ6 ?E{rš<£Õ"…“0 ºs¿•ßBö¼$áóúxgáûd¶nÍÒÏ>gã¦Í Ë>û”í;w²àÝ…¼³ð=žŸõ4?nÚ„Ëí!7/Ÿ’ÒÒ£ÚÕ>·›ª²’âY=ê„¿ÏCuyó tKh—Ö]ŽFqJ>:zËá
FŒF#º®
…"@’$ŒF#^¯›ÍF(B’$Ìf3BèÇâ&˜ÌVR2Z· „ º¬´Ùn&QN MIEG°!ôcË
Öˆp;¹ãgæ~B„ÛÑ †È°¨SLýþÀ1îd‰ ßGeiqË@yIa³ºúSädZÉá±këCP¤ScôZ3Êžp"Ÿ÷äÀU_ Òœˆ–£i«´`{ ÍØif&sXýÃQWÛl¢°q ŸÇÕì扂®†. Th•¸t÷éµáÿÇëÁ€Ÿ`3
Ån ü>ï i€ £ÓÍÐ ‰½†½–3ô³ŽqÒ øOˆI¢£ó;Sx(C±^B©^öÛßõ’„Åb9âgš«+™ÜøávÖŸï”@/Å1ÀØŸ®²[ÍþÍ ²ªŠ§Ÿ}îˆ;\
uš ’ԤœÉdÆlnxè&‡ ନþtµu=ä}³ÙŒÉtâ[¸›ŒFJJJ›4H#Ë2›6mæ¥Ù¯ qÒø¯¦Û Çæ<¢Ã:RiŽ| EQ˜9ëŸ8 õ‡|…n"¥Òû|Æ¿ø;™({4Sïxช6Ì&²,£ª*«¿ß Y³Ù î' >Ÿ£ÑÈ7«VóßO3ï9ø¼>4M# FØ·¯ÕjÁçó£ëz8]L’dŸÏ‡“É97ÀÀh•‘HȲŒÅbAÓ4‚Á@Ã-I¡7yÚýàu;šü¢²,óÑÒ¡S{†
zT.åM›6±zÕ
T5ˆ, œÁ`yóß¡°¸ˆaC‡òä̧™rÇm\|ÑE„T•×Þ˜ÃÖmYØl6f<ô uõõ<öäS¸=nnºåvòòóéÛ§7ÿwÝ$ {ò_hªÆÃÞ¦éüãÑÇxøûÉÌlÍ /ÍÆårQZVÊ÷ÞKBBóO?Ũ‘¿'''‡×ÿ3›ó/ G(¨Ò½[7:wìÄÇŸ,¦SÇŽx¼ Ìf3Ý»wcìøK˜|ã
\~Ù ùü‹e 1’/–,æó/—QZZÆ? žN}}=º¦Gvø¶mYLøÓeŒ9’PèîcA³”ÜóЛZÿs»Ý¤¦%p˜9Î(Š‚Ùl! r]MÓQÕ &c,` *øIÆqHPE=ŠÔ¸ ƒÖZ‘ž–ÆàA°XÂ7’›ŸOAA!u'[¶mã¦oÀd4
…¿4
¿ÏÏm·ÜÌÄk¯ã‘ MYY[·e±fÝ:¦Þ~Û²²ØðãF–|ò155µŒüýÚf¶aë¶môìÞ Œ¹ðx½^ÊË+°˜Íüeâ5Ü{÷4Î~îáB¹y”ð# 9Ì?]×9ë¬ó¸à‚‹
;wnáõןáÚk¯=¤ ;œšc4˜)>D¢q,UÁÿâÓòio›à(BÒ"œÃÖ#¤ˆ /-+cäˆáû‡K†ýÿû@TMeôÈß“’œÌ¼ïàñzø¿ë&ñîû KݯëÊ›6‡ã&UUØ£¢Ð4¶m3#qEQÐ4ígÑ'IŒ9‚ žÁçK>Áz³Ð`lžžGä)a…¥yü^ÅÅÙTWSUUDUUee{ˆ‹³6P’~©ì&¦»É °]ƒRÿ z1 íO Õâ h++Ërƒ¹ÂI‰‰þýêëá® 5µÌyóm ¬È¹= Œ# ¯—û>ö#Ï;«'þ…·çÏçÜs† …èÔ±#éé¼÷ÁGDGGc2™Ø»¯€!ƒ!IB‘„ƒAÁïó3uÊôëÛ‡GŸx£ÑØÀÚB`Š99 0˜›g^ž¢(„P
Ð$ñW.É:݆åawR§À*w õ.4á=j´rõjÖnØÀúõøü‹e |þå2 ùÇÃ<ûâ‹ôì?€Û¦LeÜØ øÝÙCX·~÷<ð .—‹óGdÔïG™ÙšÄÄD&]ýW:wî„®ëDEÙ™÷æ,úäf=÷âÚë®g_AA’$a¶X›Çu¤|€`ÀGyqQ“Ú¿û
ö°bå**
cŒFúÓŸÊBa$d[ŽÏ¾ I†y½c?DçØ\Ô³YQðûý(Š‚ÉdŠT ™L&ª*«HLJŒÜƒÁ` ¾¾žø¸8TM O˜g"¼³z”’$a2™¨®©!>..Ò
Õb±„KÀýaSÑh4`2™#׶X,áºÁ`ÄÌ5[¬$¥e4‹3îˆ:€Élmr?€“&L˜ð«¦ÚÏJ›‚2²D1@mi:¿ŽB‘[“PP0HJ$kXG ¡ê!Ñ4ÿAúÅÈ{~?±q±
îAUUbbb ”ú&ò n m &:ºAÕ´ïAPHÝïkÙov{½¿àz )©Íæ‰m”(ËÍ—4*À!|ûíFú舮” úmlŒ¡‹éçþÂûÖ„Ö±9´…=Ú^ º“VJ:Œgq‘y fÉL@4ž[ ÎÉt,Ž§ãQ¢‚Ôô6ÍÚkøˆg–$ [t ^§NBË7I›ÕŠÏ "FêBÖOà©m°£kôúViȨ¤0ÈÞà-&³_˶›H‘“[t_€ƒ ÑÔ¼B‚–ÕjÇãt4™J’$,V3QQ¶FY ‰1œÕ¯/Få- yòAºŽ¨kð¾M²ÑÏØ¿ÐQé@Šœ„Y2S¯×³CÛEVps=oó…÷FMc¢õÊc®:qÀ—ð¸ Ä%&| ˜-Œ&S“MËòûƒÜwﳘL³0t]çëåóhÝÊŠ¬ñûŠ0KfĽ‰Œ„3FɈ„„††_(Ô
™æ¼¬Ð¦9ïck(‹§b % ‚-› œ€&€¬(˜Í6ÔPÓĤ-ÿzj*CüU Ë2N§‹+Öšš„? ##kÖQYYI«VÑ4
‰XéP;YAÁ.ÙèaèΗ Ÿò kó}ïò¦o ‰r·ÛonÑM"ôƒ¡Ì˜1cF£Ä€ÝŽËY×$A]}-ù{w‘””D(:ì¡ë:K–|Êåßsí5—Ñ¥S;**k0*f”ÒLÞÿèCœz-gõë×èëþÁ|>fÙÌ·ïYZOk¹ƒL Ñ2ç
ÑqqÍÚxë¨ÎœÖºí‰aK3g¾F(¨2ÿíYŒù;
‹Êð‚ ½°#± 6†µÏæEE\4þÏ„B¡#ú)‚ An´þ Fݦ¹îcMh †Ü&!l^p Å@BJz³*>^¯éÓŸeô¨a¼øÒãDÇD±s{6IÉ ´j•BBr †ö•dýÒ‡1Àö†Ÿ3†ÝÙÙ²•‚ël×0Ò| S ÷à'fô›$I(ŠrT‡ÔÌË1µŠu9ꨫªBVŽ5íÝ—Ï·k—2`@ÿ¯û|~æÎýˆ;n›Äè .Àí¬dõê èر
ݺv ° §ÛÛéãåÛ¿§SJO$ ê½5¬¯[Êkóž#>6®¨—)Ð
SûG ÂÉTûíL±ßÖ¼²VQp¹,Yú1 ¯›Æö…DEGc³G‚É“ï>9Jà/):6 ‹ÕNEIa“ÞÌÆÛ¹z⥌ õ;j*‹ùö» 7ö÷˜Ì& õNÊÊ*IMO¦Sç6”©oÑ…Þ¨zˆhK é¢óÞ^È´©· ±_¡ŽNGCž‰y’¿×ß³žù«õJRä”fñH’Äž½y¼ûÁ\ÆŒ¹ÄÄÄF‚Ff÷îlÞ}wC† >yVÀaoÎ`@èRy E&?¯€ûｉ`0ȪÕëÑ(LfšªR]S‡ªkXÌ&²³÷“bD×Ed#õÊÄ+¯Î`êÔ[u½ q™å>±,á3ÿ—LrÜÀ²ø%hhM‹ÅʽÓo£Cûö,X0ïbXtI‡±‚$*+«8°'™™áŠ)¿ZQŽE‘-' á;—›l‡ÔÖ†SÏ¢bÒ™?ïmƉÉj§º¢‚ʪºtnÑ` ¸¤œªÊZ’2ì¸ö9°[ÃI FÅH»ø.|õõJ.=êˆI– ^áã¨{ø!´‰mÁí<ï}™iö;ŽÊeÜXJMMcæÌ—ÓGA¢¼¼·»ò08 ?> “IÝL•{5AµŽVq—PãYO¢ýì«ò OkSEeY¦¼¼Š®];àq”a³Z‰KLf׎]äæí£GÏ.Ìá0qFF* ¯V™Ix®ˆ ¯ ô˜¶ü´yÊQLk¯´ãJëŸ$‰yÞwš-]‘
hšNEEÅ‘£ºº„U«–ãõz1…ƒû- Ù "Ù·SP3ŸhsVåœGŒ¥Û‰·~±m1›ÎOª:Š"³yËNþxÉhÜŽZŠ‹Ë:l ¨*¯&7o š¦…ÓíDZýÞ¨˜øýG²ÐÑ™j»L¥5eZ9ÿö¾ÞlŠ Ùl£uë®dfv‹ Q㯈ZARû½’Wo;‹U¹#ØvF%îä@’$¬6{“ô4ÕuVRÈÉÙK·n غm7N§› Ý;¦R[]OyE5™ÓÙµ+ §ÓMiiUƒ(™„L•§” ½º¡iÚ VÉÂ[±¯ ½ °,°³Ô´µÁ`²²}TV"?rTUíC×/®4U¢ë jâZïà §³µxÃ;}I”¹óÉW(‚Ç!<’u€’’pº<ÄÄD±eË.Æ A öÕ{¼^ÒÒ’ðû””Tàr¹)ØSJ›˜†QÁÝå?qñøç%ÿ8[PéjèÌtû}•‰†‚ IDAT<æþ79ng˜i(ÑRt“)„n·“_|â°ûÅï÷Ó£G×C¹búÿ¾“5DHÕ×m;1Öž-Ã
°XmÈŠrÔ]Âm6»wç“““ß@«p» ,^üôbÍÚÍtíÚþÀ6¸F«ªjˆ‹!/¯ˆ‹Î‰' úÈ.ÏâÒ ã0ïÏ®9j.„`‚ír> |L¶šÃ λy-öešÆʱGÙ™4éºÃÎ ’$é×%IF3äa¶ªhºŽ¨œÐä‹ß$ Àd2ã?Ê^¯—>}º1tè;Âétñ oóÖœQPPÂ[oÌÓÏ<ŒËíA–edY"RqÔ;é˜Ô]‚UÕEòV^¸åñ㪢M’y8ê&ÖObyàkæzçq«ýƦ‰
A0hdŒàí·>aüÕ`Q4Üéèå=Z– òÐR3(Ú—ƒtê„¢(|þÅW|óÍ÷‡Ê=MeÐÙ—ñÖÜ™œuVO šþÓ¦ü윽 @ù saæ
hBÃpñéÞ×xæÙÇIMM=®r1
óÍ#y$ê! v=Ê#®'°IVþf»¶YLÃ_ó‰ôíÛ…¾íÎæ»ylÿ>…Þ=¤– $ˆM Ïn¤YØ®m>~oùaÓ¥Â!`3 }³Eœ Ç[o/ÂíöPPXFή}$;áôÖRàÞ?¡’ùï¼F‡ö šd¬[@˜l¿ -¾…Üç|¯ð1ÉöW,XÐÐŽåQ[ëäûï75º ®¼¼
¯g()µ±ú“'iÓÚÕKh’rüâ©ÉÆÆU•ïŸ{üH=ÔÉÎÉ¡ªªšÜül²³sPU+Dß®ýé֧ɩ‰tïÖ
EQš|º—†Æ}®‡xÏû!Hpžé\þõ gáÝn§]ç8ÏBÊÈHå“_aÝŠl>_°…¡SøÇC/ý¬³øýÈKË@( ª¼¤YƬ (ä8XFžˆ†VÉÊ,÷ <éy:òÚóÜl¿‘>†^ûíè#s=«ÕÆÿÝôg¦L¹õˆVdYfëÖÝü´y'ÿžýO²¶å2ó†åäkëÙ¸}ãÏK••(ññÈÇY1Ô脃©²²’²²²ý_ÎQf3e¥%”•–a2™(((Àn·Eª`$I¢º¦†²²r’’#‹èr¹ÈËßCJr2EÅÅø|>bbb,òEõAŠŠKPÕöãÈ "Äpó9 2¤R¯¢P+"WÍg¡÷øßc{h%z NáÂ-<èèX0%Û1H
áÍ`4Y¼ä† H(¤6ø.EQ(-àþÀãö1ç')*.§U«¶oÍ'ÖÕ™'f>FT²‰.]º`Ž=y" 0yòdªªªX¸p!QQQ‘÷zõêI·.]˜ùäãÌ|æ9&]{5[eD”¿O>]Âœ¹o±ü‹¥x½ááÒ›Úµÿw=ù»wrómwйs'n»yò1Ët Àõ7Læ’K.bâ•W w
áe—º›eÁ¯øÈ÷ åjyDÚÉ’LŒ CŒM´MŠ’Lg¥Sl·-Gc±ZùÛâÎ;oŽø6šÅV¬XÃW_åÙ§ `è°¸.ŠŠË …T|N•ùÓ·mŠ'§f5Qy|²ä¿ÄÅ ¿7ð˜ùfDOçw¦³1Kf¼ÂK©VÆ.u7+«yÍ=‡h9ºq‰?^ΪU?²ní"†; -¤²-+‡˜è(B¡ ½úuÀÖуQ1Ñ;uÝôátîØ…ªªª“gX,®½öZ yä/^ ÀŠ+˜0aÛ·oÇ Ã“?Æ…œO¯ Ýùbùrt]PPP€Á`Äl2ñÕ×ßPïpàv»6—#fwvÅ%%ìܵ‹óÎ=—¾}zGädvv‹—.%1!U
Ñ«g
‹()-åÁ{ïÙ" MÓ™ûÖÛtîԉܼ<®½ú¯|øÑ"ÊÊ+¸ã¶[(((dçîÝŒsa£2Štt"@¥ ·ØoàNû-€D±VÂn-›<5ŸÝZÕZ5fÉü«éç’$±k× êëœ|÷Ý kädï!;g/ç @ß>ÝYÿÃÒ:Ù¨- 8#¦
Wô¸«¯œÄG‹ßoÀOh,àŠ+®`õêÕìÞ½›•+W2iÒ¤H+”˜˜6oÙŠÁl¥ ´‚ÿ»˜ñãÆЫgt¡SX\Ì /Ïæ’ñ1dð ðâëá’ípJ·ÌÛï,ÄåtRQQÉ#?‰ò…3e¢øfåjÎ~. ±ôó/ˆ‰á•¿ÆÊÕßFLRÇCaQãÇeÓO?QYUÅàÁƒøiëVt]GÓuâãºôê@ʹK¸q qr,CC¸ÖúWžˆú'/Å>{ÄÚ³ÙÄÒ¥+yòñ» ‰U«Öãõù¹hÜï‰OˆÃáp±go™Òi×5™¢º\dIAÕUm©(åñ|¹ìË“ èÙ³'ãÇçæ›oÆápбcÇ;V…ØØX,V+K–.¥O¿þ$¥gÒ¥[عióÒÓ3°X‘ st ö˜Xbâpº½$&&rÙå—óà}÷ðî¼·°í¸ØXâãhÛ&“Üü|F Ɉó†³+ë'Î~îþ¦J‚ØØXn¾ñF^þ÷«—ðèÐ>œ[°{w6?nÜDß¾}Žßч@GGEEC;b¢©¢(lþi]»´'½u¶þ´
“ÉH¿³z#I5Õµ„T}ûJ0›Môëß•²Ð^äý9A»¸®,xõ½“ ¿ßÛíæ™gžaåÊ•E4÷ƒËš%I"))‰uëÖ…E‡Í†Á`¤c—®lÙº•˜„dZµí9¯ÑhDQ¢¢¢X³f
Ñq‰¤¥¥³u붻Ô`0 É2’$ËÆM›INN&¤ªìÝ·Y ×þçäærýM“™vçídffb4†;~ÿmÒµ<ôÏG"ÌN4)ŠÂ¦M;¸âÏ㨫.¡ Œß3Œ€×Kn^N§›Ä„8úõíNAa)Žz7µÁÒ ×äètÖ¬^â——Ç+¯¼Â‚ HMMeÚ´iŒ3†ÜÜ\Þ|óM¾úê+>ýôSV¬XÁŠ+¸á†p»Ý\tÑEÌ™3‡úúzÒÓÓéÝ»7ƒæÉ'ŸDQ–.]Ê÷ßÏ’%KˆŠŠâ /¤]»¶üaÜxüiòF£_ÚµëØðÃüßu×òÉ’% úÝ9<ñ¯™H’Ć ~dåªUøýöí+à†É·àt8øÇ£¡jç …Ãá7†
žø
!Y–¨(¯¢]ûVlËÊæ‚ó‡¡Ý¬Y³‰ä¤xÚwjÉ}0
èº@…,Š¤`3GQ]]}ò A!UU¥¢iòþü¿# õÕ•xÜ® Àd2Ð5
Å`ÀçóEpû¶eߺdMd ´ßZ˜õü‹ücú‡”l7¹CÉj;Ä ´XÌ<úÈ˼ýæÓì+(aÈà¾TTTápºéÙ£3B¶ee£i*™3X»~3wÜú/þÞçZø~Š‰ÿ¬zŒœªmÇìï8¡
ù7GGQ”_UÀˆ‘¸ÄÌfKªªâõz##]UU â@¿@ nrᦺŽ$ËÌyëmî¼ën®ÿÛ¤H¿¦ÐŽf/éºN›¶lÚ¼=< M–(..§mÛV —#tAQQ9B
K1L \šTÈFŽËÙuÊ ½•d‰Ä´ ÌËÿ|Ðy]Ó4.;†»§N!!>¾É\Ê‹
«ÕQ‚·àáN§&Ìf²¬0~ü(žž5‡þý{°rÕúŸ—V’(¯¨¦mÛVX,f
‹Ê(/¯$9&£A½`…³˜‹'Œ;ÉÑÀ*7e’ÒZQS^F pll[AzZÓŽe3™Í$§·Šü%è÷…iI`4™HOoÍSO½Ð J–%$Iç§-;©¨¨¥Gx²³÷0`` êë˜LFE¦²²ššÚzâÉ@ðs¬eOý ùÛݧ € 9½Žºj\õõ ¼‰å’$ OL|Bƒ×cñ;À¶m›¹ð H’DBBwÜ9ƒ¥Kæ²hÑ2dYfÀ þDÙmTUÕRPPJFF
»vía`â4¡b6Xù±x%ýÇwbÈà!-#x2(P]Y†ºHÓ‰"!£‘äôÖžXYY~Ø{”$‰ŠŠJ&N¼‚»¦^HøýA. ?’üüB>ûb%~õŸïetÛ+B°dûëÉ^û÷É µ4r9ëqÕ× unâ1Ùï±ñ Øš¡oßí·ÝJ}}9:…åt¹))ªàÛ•›‘y9º¬²WßÊ wßÊŸÿôçHw²Ó v¥×íÂïõàóºº8îÞºBµ’,c·Gc¶Z±GE7k¯¤ââbÖ®]ƒÓé@U54†&lõ›À/-àóਫ%€$Ezú5æïÖìcâ1š,‡$¥ LŸ}öÕÕÕ
f ¦¤¤p饗 öóÏ=÷ W]u©©©Ç ’O?ý”sÏ=—Þ½{Ÿ^J`c3I’°Ú£±ÚÃáØP0ˆ×ãB
†Ð´ðü!~¡:Ê2Š"c2™±GÇ UéûèÑ£ÉÌÌäÝwߥOŸ>TWWóØcýO h PSSi'ÛXJKKcÖ¬Y´oßþ¸€8CÇM~¿_ :TìÞ½;ò{ii©PUUlÚ´IlܸQÔÖÖŠï¾ûN„B!Q__/< ÈÊÊC‡Ÿ}ö™Ð4Á9KJJDnn®Ø±c‡Bˆœœ ±xñbáõz…BŒ5J|ñÅB×u±råJ±mÛ6!„ëÖ7n>ŸOÔÕՉ͛7‹`0ø?ï]æ 5™èÙ¸q#6l`ÆŒƒAE!77—o¼«ÕJvv6;wîdÈ!deeÑ£GòóóéÑ£GÿÀòåË8p sæÌáùçŸ'//ììl’““9rdıäóù¸à‚ 6l .d×®]!¸çž{"&óúõëµÿ²áÌÒ5 9Njkkq:‘×®¸â
æÎË„ X´hF£‘Þ½{ ‘eƒÁpHj×\@ZZS¦L!%%…»îº‹ôôtZ·7¦®¬ü¹”|Ê”)ÔÕÕ¡ª*%%%Œ1»ÝNqq1~¿ŸN:^:Àɤ#Fн{wÎ;着’˜˜È Aƒ˜4iÒéç8Ý©¶¶–‚‚öîÝËe—]vúùNwš>}:_}õkÖ¬9==§»)z´±3:ÀoÌ z´ôÿµ$†c†œ*¯ IEND®B`‚ stem-1.8.0/docs/_static/example/ 0000775 0001750 0001750 00000000000 13602232262 017221 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/_static/example/get_hidden_service_descriptor.py 0000664 0001750 0001750 00000000417 13412531020 025636 0 ustar atagar atagar 0000000 0000000 from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
# descriptor of duck-duck-go's hidden service (http://3g2upl4pq6kufc4m.onion)
print(controller.get_hidden_service_descriptor('3g2upl4pq6kufc4m'))
stem-1.8.0/docs/_static/example/descriptor_from_tor_control_socket.py 0000664 0001750 0001750 00000000356 13412531020 026765 0 ustar atagar atagar 0000000 0000000 from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
for desc in controller.get_network_statuses():
print("found relay %s (%s)" % (desc.nickname, desc.fingerprint))
stem-1.8.0/docs/_static/example/utilities.py 0000664 0001750 0001750 00000001732 13412531020 021602 0 ustar atagar atagar 0000000 0000000 import sys
from stem.util.connection import get_connections, system_resolvers
from stem.util.system import pid_by_name
resolvers = system_resolvers()
if not resolvers:
print("Stem doesn't support any connection resolvers on our platform.")
sys.exit(1)
picked_resolver = resolvers[0] # lets just opt for the first
print("Our platform supports connection resolution via: %s (picked %s)" % (', '.join(resolvers), picked_resolver))
tor_pids = pid_by_name('tor', multiple = True)
if not tor_pids:
print("Unable to get tor's pid. Is it running?")
sys.exit(1)
elif len(tor_pids) > 1:
print("You're running %i instances of tor, picking the one with pid %i" % (len(tor_pids), tor_pids[0]))
else:
print("Tor is running with pid %i" % tor_pids[0])
print("\nConnections:\n")
for conn in get_connections(picked_resolver, process_pid = tor_pids[0], process_name = 'tor'):
print(" %s:%s => %s:%s" % (conn.local_address, conn.local_port, conn.remote_address, conn.remote_port))
stem-1.8.0/docs/_static/example/descriptor_from_tor_data_directory.py 0000664 0001750 0001750 00000000251 13412531020 026724 0 ustar atagar atagar 0000000 0000000 from stem.descriptor import parse_file
for desc in parse_file('/home/atagar/.tor/cached-consensus'):
print('found relay %s (%s)' % (desc.nickname, desc.fingerprint))
stem-1.8.0/docs/_static/example/broken_listener.py 0000664 0001750 0001750 00000000517 13567611373 023001 0 ustar atagar atagar 0000000 0000000 import time
from stem.control import EventType, Controller
def broken_handler(event):
print('start of broken_handler')
raise ValueError('boom')
print('end of broken_handler')
with Controller.from_port() as controller:
controller.authenticate()
controller.add_event_listener(broken_handler, EventType.BW)
time.sleep(2)
stem-1.8.0/docs/_static/example/benchmark_server_descriptor_stem.py 0000664 0001750 0001750 00000001362 13412531020 026374 0 ustar atagar atagar 0000000 0000000 import time
import stem.descriptor
def measure_average_advertised_bandwidth(path):
start_time = time.time()
total_bw, count = 0, 0
for desc in stem.descriptor.parse_file(path):
total_bw += min(desc.average_bandwidth, desc.burst_bandwidth, desc.observed_bandwidth)
count += 1
runtime = time.time() - start_time
print("Finished measure_average_advertised_bandwidth('%s')" % path)
print(' Total time: %i seconds' % runtime)
print(' Processed server descriptors: %i' % count)
print(' Average advertised bandwidth: %i' % (total_bw / count))
print(' Time per server descriptor: %0.5f seconds' % (runtime / count))
print('')
if __name__ == '__main__':
measure_average_advertised_bandwidth('server-descriptors-2015-11.tar')
stem-1.8.0/docs/_static/example/introduction_points.py 0000664 0001750 0001750 00000000636 13412531020 023706 0 ustar atagar atagar 0000000 0000000 from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
desc = controller.get_hidden_service_descriptor('3g2upl4pq6kufc4m')
print("DuckDuckGo's introduction points are...\n")
for introduction_point in desc.introduction_points():
print(' %s:%s => %s' % (introduction_point.address, introduction_point.port, introduction_point.identifier))
stem-1.8.0/docs/_static/example/exit_used.py 0000664 0001750 0001750 00000002116 13412531020 021555 0 ustar atagar atagar 0000000 0000000 import functools
from stem import StreamStatus
from stem.control import EventType, Controller
def main():
print("Tracking requests for tor exits. Press 'enter' to end.")
print("")
with Controller.from_port() as controller:
controller.authenticate()
stream_listener = functools.partial(stream_event, controller)
controller.add_event_listener(stream_listener, EventType.STREAM)
raw_input() # wait for user to press enter
def stream_event(controller, event):
if event.status == StreamStatus.SUCCEEDED and event.circ_id:
circ = controller.get_circuit(event.circ_id)
exit_fingerprint = circ.path[-1][0]
exit_relay = controller.get_network_status(exit_fingerprint)
print("Exit relay for our connection to %s" % (event.target))
print(" address: %s:%i" % (exit_relay.address, exit_relay.or_port))
print(" fingerprint: %s" % exit_relay.fingerprint)
print(" nickname: %s" % exit_relay.nickname)
print(" locale: %s" % controller.get_info("ip-to-country/%s" % exit_relay.address, 'unknown'))
print("")
if __name__ == '__main__':
main()
stem-1.8.0/docs/_static/example/descriptor_from_orport.py 0000664 0001750 0001750 00000000677 13501272761 024421 0 ustar atagar atagar 0000000 0000000 import stem.descriptor.remote
# Unlike the above example, this one downloads specifically through the
# ORPort of moria1 (long time tor directory authority).
try:
consensus = stem.descriptor.remote.get_consensus(
endpoints = (stem.ORPort('128.31.0.34', 9101),)
)
for desc in consensus:
print("found relay %s (%s)" % (desc.nickname, desc.fingerprint))
except Exception as exc:
print("Unable to retrieve the consensus: %s" % exc)
stem-1.8.0/docs/_static/example/event_listening.py 0000664 0001750 0001750 00000012246 13412531020 022766 0 ustar atagar atagar 0000000 0000000 import curses
import functools
from stem.control import EventType, Controller
from stem.util import str_tools
# colors that curses can handle
COLOR_LIST = {
"red": curses.COLOR_RED,
"green": curses.COLOR_GREEN,
"yellow": curses.COLOR_YELLOW,
"blue": curses.COLOR_BLUE,
"cyan": curses.COLOR_CYAN,
"magenta": curses.COLOR_MAGENTA,
"black": curses.COLOR_BLACK,
"white": curses.COLOR_WHITE,
}
GRAPH_WIDTH = 40
GRAPH_HEIGHT = 8
DOWNLOAD_COLOR = "green"
UPLOAD_COLOR = "blue"
def main():
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
try:
# This makes curses initialize and call draw_bandwidth_graph() with a
# reference to the screen, followed by additional arguments (in this
# case just the controller).
curses.wrapper(draw_bandwidth_graph, controller)
except KeyboardInterrupt:
pass # the user hit ctrl+c
def draw_bandwidth_graph(stdscr, controller):
window = Window(stdscr)
# (downloaded, uploaded) tuples for the last 40 seconds
bandwidth_rates = [(0, 0)] * GRAPH_WIDTH
# Making a partial that wraps the window and bandwidth_rates with a function
# for Tor to call when it gets a BW event. This causes the 'window' and
# 'bandwidth_rates' to be provided as the first two arguments whenever
# 'bw_event_handler()' is called.
bw_event_handler = functools.partial(_handle_bandwidth_event, window, bandwidth_rates)
# Registering this listener with Tor. Tor reports a BW event each second.
controller.add_event_listener(bw_event_handler, EventType.BW)
# Pause the main thread until the user hits any key... and no, don't you dare
# ask where the 'any' key is. :P
stdscr.getch()
def _handle_bandwidth_event(window, bandwidth_rates, event):
# callback for when tor provides us with a BW event
bandwidth_rates.insert(0, (event.read, event.written))
bandwidth_rates = bandwidth_rates[:GRAPH_WIDTH] # truncate old values
_render_graph(window, bandwidth_rates)
def _render_graph(window, bandwidth_rates):
window.erase()
download_rates = [entry[0] for entry in bandwidth_rates]
upload_rates = [entry[1] for entry in bandwidth_rates]
# show the latest values at the top
label = "Downloaded (%s/s):" % str_tools.size_label(download_rates[0], 1)
window.addstr(0, 1, label, DOWNLOAD_COLOR, curses.A_BOLD)
label = "Uploaded (%s/s):" % str_tools.size_label(upload_rates[0], 1)
window.addstr(0, GRAPH_WIDTH + 7, label, UPLOAD_COLOR, curses.A_BOLD)
# draw the graph bounds in KB
max_download_rate = max(download_rates)
max_upload_rate = max(upload_rates)
window.addstr(1, 1, "%4i" % (max_download_rate / 1024), DOWNLOAD_COLOR)
window.addstr(GRAPH_HEIGHT, 1, " 0", DOWNLOAD_COLOR)
window.addstr(1, GRAPH_WIDTH + 7, "%4i" % (max_upload_rate / 1024), UPLOAD_COLOR)
window.addstr(GRAPH_HEIGHT, GRAPH_WIDTH + 7, " 0", UPLOAD_COLOR)
# draw the graph
for col in range(GRAPH_WIDTH):
col_height = GRAPH_HEIGHT * download_rates[col] / max(max_download_rate, 1)
for row in range(col_height):
window.addstr(GRAPH_HEIGHT - row, col + 6, " ", DOWNLOAD_COLOR, curses.A_STANDOUT)
col_height = GRAPH_HEIGHT * upload_rates[col] / max(max_upload_rate, 1)
for row in range(col_height):
window.addstr(GRAPH_HEIGHT - row, col + GRAPH_WIDTH + 12, " ", UPLOAD_COLOR, curses.A_STANDOUT)
window.refresh()
class Window(object):
"""
Simple wrapper for the curses standard screen object.
"""
def __init__(self, stdscr):
self._stdscr = stdscr
# Mappings of names to the curses color attribute. Initially these all
# reference black text, but if the terminal can handle color then
# they're set with that foreground color.
self._colors = dict([(color, 0) for color in COLOR_LIST])
# allows for background transparency
try:
curses.use_default_colors()
except curses.error:
pass
# makes the cursor invisible
try:
curses.curs_set(0)
except curses.error:
pass
# initializes colors if the terminal can handle them
try:
if curses.has_colors():
color_pair = 1
for name, foreground in COLOR_LIST.items():
background = -1 # allows for default (possibly transparent) background
curses.init_pair(color_pair, foreground, background)
self._colors[name] = curses.color_pair(color_pair)
color_pair += 1
except curses.error:
pass
def addstr(self, y, x, msg, color = None, attr = curses.A_NORMAL):
# Curses throws an error if we try to draw a message that spans out of the
# window's bounds (... seriously?), so doing our best to avoid that.
if color is not None:
if color not in self._colors:
recognized_colors = ", ".join(self._colors.keys())
raise ValueError("The '%s' color isn't recognized: %s" % (color, recognized_colors))
attr |= self._colors[color]
max_y, max_x = self._stdscr.getmaxyx()
if max_x > x and max_y > y:
try:
self._stdscr.addstr(y, x, msg[:max_x - x], attr)
except:
pass # maybe an edge case while resizing the window
def erase(self):
self._stdscr.erase()
def refresh(self):
self._stdscr.refresh()
if __name__ == '__main__':
main()
stem-1.8.0/docs/_static/example/hello_world.py 0000664 0001750 0001750 00000000551 13412531020 022077 0 ustar atagar atagar 0000000 0000000 from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate() # provide the password here if you set one
bytes_read = controller.get_info("traffic/read")
bytes_written = controller.get_info("traffic/written")
print("My Tor relay has read %s bytes and written %s." % (bytes_read, bytes_written))
stem-1.8.0/docs/_static/example/benchmark_stem.py 0000664 0001750 0001750 00000005657 13412531020 022563 0 ustar atagar atagar 0000000 0000000 import time
import stem.descriptor
def measure_average_advertised_bandwidth(path):
start_time = time.time()
total_bw, count = 0, 0
for desc in stem.descriptor.parse_file(path):
total_bw += min(desc.average_bandwidth, desc.burst_bandwidth, desc.observed_bandwidth)
count += 1
runtime = time.time() - start_time
print("Finished measure_average_advertised_bandwidth('%s')" % path)
print(' Total time: %i seconds' % runtime)
print(' Processed server descriptors: %i' % count)
print(' Average advertised bandwidth: %i' % (total_bw / count))
print(' Time per server descriptor: %0.5f seconds' % (runtime / count))
print('')
def measure_countries_v3_requests(path):
start_time = time.time()
countries, count = set(), 0
for desc in stem.descriptor.parse_file(path):
if desc.dir_v3_responses:
countries.update(desc.dir_v3_responses.keys())
count += 1
runtime = time.time() - start_time
print("Finished measure_countries_v3_requests('%s')" % path)
print(' Total time: %i seconds' % runtime)
print(' Processed extrainfo descriptors: %i' % count)
print(' Number of countries: %i' % len(countries))
print(' Time per extrainfo descriptor: %0.5f seconds' % (runtime / count))
print('')
def measure_average_relays_exit(path):
start_time = time.time()
total_relays, exits, consensuses = 0, 0, 0
for consensus in stem.descriptor.parse_file(path, document_handler = stem.descriptor.DocumentHandler.DOCUMENT):
for desc in consensus.routers.values():
if 'Exit' in desc.flags:
exits += 1
total_relays += 1
consensuses += 1
runtime = time.time() - start_time
print("Finished measure_average_relays_exit('%s')" % path)
print(' Total time: %i seconds' % runtime)
print(' Processed %i consensuses with %i router status entries' % (consensuses, total_relays))
print(' Total exits: %i (%0.2f%%)' % (exits, float(exits) / total_relays))
print(' Time per consensus: %0.5f seconds' % (runtime / consensuses))
print('')
def measure_fraction_relays_exit_80_microdescriptors(path):
start_time = time.time()
exits, count = 0, 0
for desc in stem.descriptor.parse_file(path):
if desc.exit_policy.can_exit_to(port = 80):
exits += 1
count += 1
runtime = time.time() - start_time
print("Finished measure_fraction_relays_exit_80_microdescriptors('%s')" % path)
print(' Total time: %i seconds' % runtime)
print(' Processed microdescriptors: %i' % count)
print(' Total exits to port 80: %i (%0.2f%%)' % (exits, float(exits) / count))
print(' Time per microdescriptor: %0.5f seconds' % (runtime / count))
print('')
measure_average_advertised_bandwidth('/home/atagar/Desktop/server-descriptors-2015-11.tar')
measure_countries_v3_requests('/home/atagar/Desktop/extra-infos-2015-11.tar')
measure_average_relays_exit('/home/atagar/Desktop/consensuses-2015-11.tar')
measure_fraction_relays_exit_80_microdescriptors('/home/atagar/Desktop/microdescs-2015-11.tar')
stem-1.8.0/docs/_static/example/client_usage_using_socksipy.py 0000664 0001750 0001750 00000001137 13412531020 025361 0 ustar atagar atagar 0000000 0000000 import socks # SocksiPy module
import socket
import urllib
SOCKS_PORT = 7000
# Set socks proxy and wrap the urllib module
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, '127.0.0.1', SOCKS_PORT)
socket.socket = socks.socksocket
# Perform DNS resolution through the socket
def getaddrinfo(*args):
return [(socket.AF_INET, socket.SOCK_STREAM, 6, '', (args[0], args[1]))]
socket.getaddrinfo = getaddrinfo
def query(url):
"""
Uses urllib to fetch a site using SocksiPy for Tor over the SOCKS_PORT.
"""
try:
return urllib.urlopen(url).read()
except:
return "Unable to reach %s" % url
stem-1.8.0/docs/_static/example/relay_connections.py 0000775 0001750 0001750 00000007636 13501272761 023336 0 ustar atagar atagar 0000000 0000000 import argparse
import collections
import time
import stem.connection
import stem.util.system
import stem.util.str_tools
from stem.control import Listener
from stem.util.connection import get_connections, port_usage, is_valid_ipv4_address
HEADER_LINE = " {version} uptime: {uptime} flags: {flags}\n"
DIV = '+%s+%s+%s+' % ('-' * 30, '-' * 6, '-' * 6)
COLUMN = '| %-28s | %4s | %4s |'
INBOUND_ORPORT = 'Inbound to our ORPort'
INBOUND_DIRPORT = 'Inbound to our DirPort'
INBOUND_CONTROLPORT = 'Inbound to our ControlPort'
OUTBOUND_ORPORT = 'Outbound to a relay'
OUTBOUND_EXIT = 'Outbound exit traffic'
OUTBOUND_UNKNOWN = 'Outbound uncategorized'
def main():
parser = argparse.ArgumentParser()
parser.add_argument("--ctrlport", help="default: 9051 or 9151")
parser.add_argument("--resolver", help="default: autodetected")
args = parser.parse_args()
control_port = int(args.ctrlport) if args.ctrlport else 'default'
controller = stem.connection.connect(control_port = ('127.0.0.1', control_port))
if not controller:
return
desc = controller.get_network_status(default = None)
pid = controller.get_pid()
print(HEADER_LINE.format(
version = str(controller.get_version()).split()[0],
uptime = stem.util.str_tools.short_time_label(time.time() - stem.util.system.start_time(pid)),
flags = ', '.join(desc.flags if desc else ['none']),
))
policy = controller.get_exit_policy()
relays = {} # address => [orports...]
for desc in controller.get_network_statuses():
relays.setdefault(desc.address, []).append(desc.or_port)
# categorize our connections
categories = collections.OrderedDict((
(INBOUND_ORPORT, []),
(INBOUND_DIRPORT, []),
(INBOUND_CONTROLPORT, []),
(OUTBOUND_ORPORT, []),
(OUTBOUND_EXIT, []),
(OUTBOUND_UNKNOWN, []),
))
exit_connections = {} # port => [connections]
for conn in get_connections(resolver = args.resolver, process_pid = pid):
if conn.protocol == 'udp':
continue
if conn.local_port in controller.get_ports(Listener.OR, []):
categories[INBOUND_ORPORT].append(conn)
elif conn.local_port in controller.get_ports(Listener.DIR, []):
categories[INBOUND_DIRPORT].append(conn)
elif conn.local_port in controller.get_ports(Listener.CONTROL, []):
categories[INBOUND_CONTROLPORT].append(conn)
elif conn.remote_port in relays.get(conn.remote_address, []):
categories[OUTBOUND_ORPORT].append(conn)
elif policy.can_exit_to(conn.remote_address, conn.remote_port):
categories[OUTBOUND_EXIT].append(conn)
exit_connections.setdefault(conn.remote_port, []).append(conn)
else:
categories[OUTBOUND_UNKNOWN].append(conn)
print(DIV)
print(COLUMN % ('Type', 'IPv4', 'IPv6'))
print(DIV)
total_ipv4, total_ipv6 = 0, 0
for label, connections in categories.items():
if len(connections) == 0:
continue
ipv4_count = len([conn for conn in connections if is_valid_ipv4_address(conn.remote_address)])
ipv6_count = len(connections) - ipv4_count
total_ipv4, total_ipv6 = total_ipv4 + ipv4_count, total_ipv6 + ipv6_count
print(COLUMN % (label, ipv4_count, ipv6_count))
print(DIV)
print(COLUMN % ('Total', total_ipv4, total_ipv6))
print(DIV)
print('')
if exit_connections:
print(DIV)
print(COLUMN % ('Exit Port', 'IPv4', 'IPv6'))
print(DIV)
total_ipv4, total_ipv6 = 0, 0
for port in sorted(exit_connections):
connections = exit_connections[port]
ipv4_count = len([conn for conn in connections if is_valid_ipv4_address(conn.remote_address)])
ipv6_count = len(connections) - ipv4_count
total_ipv4, total_ipv6 = total_ipv4 + ipv4_count, total_ipv6 + ipv6_count
usage = port_usage(port)
label = '%s (%s)' % (port, usage) if usage else port
print(COLUMN % (label, ipv4_count, ipv6_count))
print(DIV)
print(COLUMN % ('Total', total_ipv4, total_ipv6))
print(DIV)
print('')
if __name__ == '__main__':
main()
stem-1.8.0/docs/_static/example/persisting_a_consensus_with_parse_file.py 0000664 0001750 0001750 00000000500 13412531020 027572 0 ustar atagar atagar 0000000 0000000 from stem.descriptor import DocumentHandler, parse_file
consensus = next(parse_file(
'/tmp/descriptor_dump',
descriptor_type = 'network-status-consensus-3 1.0',
document_handler = DocumentHandler.DOCUMENT,
))
for fingerprint, relay in consensus.routers.items():
print("%s: %s" % (fingerprint, relay.nickname))
stem-1.8.0/docs/_static/example/collector_reading.py 0000664 0001750 0001750 00000000747 13601771224 023267 0 ustar atagar atagar 0000000 0000000 import datetime
import stem.descriptor.collector
yesterday = datetime.datetime.utcnow() - datetime.timedelta(days = 1)
# provide yesterday's exits
exits = {}
for desc in stem.descriptor.collector.get_server_descriptors(start = yesterday):
if desc.exit_policy.is_exiting_allowed():
exits[desc.fingerprint] = desc
print('%i relays published an exiting policy today...\n' % len(exits))
for fingerprint, desc in exits.items():
print(' %s (%s)' % (desc.nickname, fingerprint))
stem-1.8.0/docs/_static/example/running_hidden_service.py 0000664 0001750 0001750 00000002763 13412531020 024307 0 ustar atagar atagar 0000000 0000000 import os
import shutil
from stem.control import Controller
from flask import Flask
app = Flask(__name__)
@app.route('/')
def index():
return "Hi Grandma!
"
print(' * Connecting to tor')
with Controller.from_port() as controller:
controller.authenticate()
# All hidden services have a directory on disk. Lets put ours in tor's data
# directory.
hidden_service_dir = os.path.join(controller.get_conf('DataDirectory', '/tmp'), 'hello_world')
# Create a hidden service where visitors of port 80 get redirected to local
# port 5000 (this is where Flask runs by default).
print(" * Creating our hidden service in %s" % hidden_service_dir)
result = controller.create_hidden_service(hidden_service_dir, 80, target_port = 5000)
# The hostname is only available when we can read the hidden service
# directory. This requires us to be running with the same user as tor.
if result.hostname:
print(" * Our service is available at %s, press ctrl+c to quit" % result.hostname)
else:
print(" * Unable to determine our service's hostname, probably due to being unable to read the hidden service directory")
try:
app.run()
finally:
# Shut down the hidden service and clean it off disk. Note that you *don't*
# want to delete the hidden service directory if you'd like to have this
# same *.onion address in the future.
print(" * Shutting down our hidden service")
controller.remove_hidden_service(hidden_service_dir)
shutil.rmtree(hidden_service_dir)
stem-1.8.0/docs/_static/example/create_descriptor_content.py 0000664 0001750 0001750 00000000203 13412531020 025012 0 ustar atagar atagar 0000000 0000000 from stem.descriptor.server_descriptor import RelayDescriptor
print(RelayDescriptor.content({'router': 'demo 127.0.0.1 80 0 0'}))
stem-1.8.0/docs/_static/example/persisting_a_consensus.py 0000664 0001750 0001750 00000000510 13412531020 024347 0 ustar atagar atagar 0000000 0000000 from stem.descriptor import DocumentHandler
from stem.descriptor.remote import DescriptorDownloader
downloader = DescriptorDownloader()
consensus = downloader.get_consensus(document_handler = DocumentHandler.DOCUMENT).run()[0]
with open('/tmp/descriptor_dump', 'w') as descriptor_file:
descriptor_file.write(str(consensus))
stem-1.8.0/docs/_static/example/check_digests.py 0000664 0001750 0001750 00000003417 13501272761 022405 0 ustar atagar atagar 0000000 0000000 import sys
import stem.descriptor.remote
import stem.util.tor_tools
def download_descriptors(fingerprint):
"""
Downloads the descriptors we need to validate this relay. Downloads are
parallelized, providing the caller with a tuple of the form...
(router_status_entry, server_descriptor, extrainfo_descriptor)
"""
conensus_query = stem.descriptor.remote.get_consensus()
server_desc_query = stem.descriptor.remote.get_server_descriptors(fingerprint)
extrainfo_query = stem.descriptor.remote.get_extrainfo_descriptors(fingerprint)
router_status_entries = filter(lambda desc: desc.fingerprint == fingerprint, conensus_query.run())
if len(router_status_entries) != 1:
raise IOError("Unable to find relay '%s' in the consensus" % fingerprint)
return (
router_status_entries[0],
server_desc_query.run()[0],
extrainfo_query.run()[0],
)
if __name__ == '__main__':
fingerprint = raw_input("What relay fingerprint would you like to validate?\n")
print('') # blank line
if not stem.util.tor_tools.is_valid_fingerprint(fingerprint):
print("'%s' is not a valid relay fingerprint" % fingerprint)
sys.exit(1)
try:
router_status_entry, server_desc, extrainfo_desc = download_descriptors(fingerprint)
except Exception as exc:
print(exc)
sys.exit(1)
if router_status_entry.digest == server_desc.digest():
print("Server descriptor digest is correct")
else:
print("Server descriptor digest invalid, expected %s but is %s" % (router_status_entry.digest, server_desc.digest()))
if server_desc.extra_info_digest == extrainfo_desc.digest():
print("Extrainfo descriptor digest is correct")
else:
print("Extrainfo descriptor digest invalid, expected %s but is %s" % (server_desc.extra_info_digest, extrainfo_desc.digest()))
stem-1.8.0/docs/_static/example/queue_listener.py 0000664 0001750 0001750 00000000720 13567613056 022641 0 ustar atagar atagar 0000000 0000000 import queue
import time
from stem.control import EventType, Controller
with Controller.from_port() as controller:
controller.authenticate()
start_time = time.time()
event_queue = queue.Queue()
controller.add_event_listener(lambda event: event_queue.put(event), EventType.BW)
while time.time() - start_time < 2:
event = event_queue.get()
print('I got a BW event for %i bytes downloaded and %i bytes uploaded' % (event.read, event.written))
stem-1.8.0/docs/_static/example/benchmark_server_descriptor_zoossh.go 0000664 0001750 0001750 00000002411 13157571677 026756 0 ustar atagar atagar 0000000 0000000 package main
import (
"fmt"
"os"
"path/filepath"
"time"
"git.torproject.org/user/phw/zoossh.git"
)
var processedDescs int64 = 0
var totalBw uint64 = 0
func Min(a uint64, b uint64, c uint64) uint64 {
min := a
if b < min {
min = b
}
if c < min {
min = c
}
return min
}
func ProcessDescriptors(path string, info os.FileInfo, err error) error {
if _, err := os.Stat(path); err != nil {
return err
}
if info.IsDir() {
return nil
}
consensus, err := zoossh.ParseDescriptorFile(path)
if err != nil {
return err
}
if (processedDescs % 100) == 0 {
fmt.Printf(".")
}
for _, getDesc := range consensus.RouterDescriptors {
desc := getDesc()
totalBw += Min(desc.BandwidthAvg, desc.BandwidthBurst, desc.BandwidthObs)
processedDescs++
}
return nil
}
func main() {
before = time.Now()
filepath.Walk("server-descriptors-2015-11", ProcessDescriptors)
fmt.Println()
after = time.Now()
duration = after.Sub(before)
fmt.Println("Total time for descriptors:", duration)
fmt.Printf("Time per descriptor: %dns\n",
duration.Nanoseconds()/processedDescs)
fmt.Printf("Processed %d descriptors.\n", processedDescs)
fmt.Printf("Average advertised bandwidth: %d\n", totalBw/uint64(processedDescs))
}
stem-1.8.0/docs/_static/example/tor_descriptors.py 0000664 0001750 0001750 00000001463 13412531020 023015 0 ustar atagar atagar 0000000 0000000 import sys
import stem.descriptor.remote
from stem.util import str_tools
# provides a mapping of observed bandwidth to the relay nicknames
def get_bw_to_relay():
bw_to_relay = {}
try:
for desc in stem.descriptor.remote.get_server_descriptors().run():
if desc.exit_policy.is_exiting_allowed():
bw_to_relay.setdefault(desc.observed_bandwidth, []).append(desc.nickname)
except Exception as exc:
print("Unable to retrieve the server descriptors: %s" % exc)
return bw_to_relay
# prints the top fifteen relays
bw_to_relay = get_bw_to_relay()
count = 1
for bw_value in sorted(bw_to_relay.keys(), reverse = True):
for nickname in bw_to_relay[bw_value]:
print("%i. %s (%s/s)" % (count, nickname, str_tools.size_label(bw_value, 2)))
count += 1
if count > 15:
sys.exit()
stem-1.8.0/docs/_static/example/read_with_parse_file.py 0000664 0001750 0001750 00000000310 13412531020 023715 0 ustar atagar atagar 0000000 0000000 from stem.descriptor import parse_file
server_descriptors = parse_file('/tmp/descriptor_dump', descriptor_type = 'server-descriptor 1.0')
for relay in server_descriptors:
print(relay.fingerprint)
stem-1.8.0/docs/_static/example/collector_caching.py 0000664 0001750 0001750 00000001060 13526063314 023237 0 ustar atagar atagar 0000000 0000000 import datetime
import stem.descriptor
import stem.descriptor.collector
yesterday = datetime.datetime.utcnow() - datetime.timedelta(days = 1)
cache_dir = '~/descriptor_cache/server_desc_today'
collector = stem.descriptor.collector.CollecTor()
for f in collector.files('server-descriptor', start = yesterday):
f.download(cache_dir)
# then later...
for f in collector.files('server-descriptor', start = yesterday):
for desc in f.read(cache_dir):
if desc.exit_policy.is_exiting_allowed():
print(' %s (%s)' % (desc.nickname, desc.fingerprint))
stem-1.8.0/docs/_static/example/download_descriptor.py 0000664 0001750 0001750 00000010000 13501272761 023635 0 ustar atagar atagar 0000000 0000000 """
Simple script to dowload a descriptor from Tor's ORPort or DirPort.
"""
import collections
import getopt
import sys
import stem
import stem.descriptor.remote
import stem.util.connection
import stem.util.tor_tools
# By default downloading moria1's server descriptor from itself.
DEFAULT_ARGS = {
'descriptor_type': 'server',
'fingerprint': '9695DFC35FFEB861329B9F1AB04C46397020CE31',
'download_from': stem.DirPort('128.31.0.34', 9131),
'print_help': False,
}
VALID_TYPES = ('server', 'extrainfo', 'consensus')
HELP_TEXT = """\
Downloads a descriptor through Tor's ORPort or DirPort.
-t, --type TYPE descriptor type to download, options are:
%s
-f, --fingerprint FP relay to download the descriptor of
--orport ADDRESS:PORT ORPort to download from
--dirport ADDRESS:PORT DirPort to download from
-h, --help presents this help
""" % ', '.join(VALID_TYPES)
def parse(argv):
"""
Parses our arguments, providing a named tuple with their values.
:param list argv: input arguments to be parsed
:returns: a **named tuple** with our parsed arguments
:raises: **ValueError** if we got an invalid argument
"""
args = dict(DEFAULT_ARGS)
try:
recognized_args, unrecognized_args = getopt.getopt(argv, 't:f:h', ['type=', 'fingerprint=', 'orport=', 'dirport=', 'help'])
if unrecognized_args:
raise getopt.GetoptError("'%s' aren't recognized arguments" % "', '".join(unrecognized_args))
except Exception as exc:
raise ValueError('%s (for usage provide --help)' % exc)
for opt, arg in recognized_args:
if opt in ('-t', '--type'):
if arg not in VALID_TYPES:
raise ValueError("'%s' isn't a recognized decriptor type, options are: %s" % (arg, ', '.join(VALID_TYPES)))
args['descriptor_type'] = arg
elif opt in ('-f', '--fingerprint'):
if not stem.util.tor_tools.is_valid_fingerprint(arg):
raise ValueError("'%s' isn't a relay fingerprint" % arg)
args['fingerprint'] = arg
elif opt in ('--orport', '--dirport'):
if ':' not in arg:
raise ValueError("'%s' should be of the form 'address:port'" % arg)
address, port = arg.rsplit(':', 1)
if not stem.util.connection.is_valid_ipv4_address(address):
raise ValueError("'%s' isn't a valid IPv4 address" % address)
elif not stem.util.connection.is_valid_port(port):
raise ValueError("'%s' isn't a valid port number" % port)
endpoint_class = stem.ORPort if opt == '--orport' else stem.DirPort
args['download_from'] = endpoint_class(address, port)
elif opt in ('-h', '--help'):
args['print_help'] = True
# translates our args dict into a named tuple
Args = collections.namedtuple('Args', args.keys())
return Args(**args)
def main():
try:
args = parse(sys.argv[1:])
except ValueError as exc:
print(exc)
sys.exit(1)
if args.print_help:
print(HELP_TEXT)
sys.exit()
print('Downloading %s descriptor from %s:%s...\n' % (args.descriptor_type, args.download_from.address, args.download_from.port))
desc = None
if args.descriptor_type in ('server', 'extrainfo'):
if args.descriptor_type == 'server':
download_func = stem.descriptor.remote.get_server_descriptors
else:
download_func = stem.descriptor.remote.get_extrainfo_descriptors
desc = download_func(
fingerprints = [args.fingerprint],
endpoints = [args.download_from],
).run()[0]
elif args.descriptor_type == 'consensus':
for consensus_desc in stem.descriptor.remote.get_consensus(endpoints = [args.download_from]):
if consensus_desc.fingerprint == args.fingerprint:
desc = consensus_desc
break
if not desc:
print('Unable to find a descriptor for %s in the consensus' % args.fingerprint)
sys.exit(1)
else:
print("'%s' is not a recognized descriptor type, options are: %s" % (args.descriptor_type, ', '.join(VALID_TYPES)))
sys.exit(1)
print(desc)
if __name__ == '__main__':
main()
stem-1.8.0/docs/_static/example/custom_path_selection.py 0000664 0001750 0001750 00000004416 13501272761 024201 0 ustar atagar atagar 0000000 0000000 import StringIO
import time
import pycurl
import stem.control
# Static exit for us to make 2-hop circuits through. Picking aurora, a
# particularly beefy one...
#
# https://metrics.torproject.org/rs.html#details/379FB450010D17078B3766C2273303C358C3A442
EXIT_FINGERPRINT = '379FB450010D17078B3766C2273303C358C3A442'
SOCKS_PORT = 9050
CONNECTION_TIMEOUT = 30 # timeout before we give up on a circuit
def query(url):
"""
Uses pycurl to fetch a site using the proxy on the SOCKS_PORT.
"""
output = StringIO.StringIO()
query = pycurl.Curl()
query.setopt(pycurl.URL, url)
query.setopt(pycurl.PROXY, 'localhost')
query.setopt(pycurl.PROXYPORT, SOCKS_PORT)
query.setopt(pycurl.PROXYTYPE, pycurl.PROXYTYPE_SOCKS5_HOSTNAME)
query.setopt(pycurl.CONNECTTIMEOUT, CONNECTION_TIMEOUT)
query.setopt(pycurl.WRITEFUNCTION, output.write)
try:
query.perform()
return output.getvalue()
except pycurl.error as exc:
raise ValueError("Unable to reach %s (%s)" % (url, exc))
def scan(controller, path):
"""
Fetch check.torproject.org through the given path of relays, providing back
the time it took.
"""
circuit_id = controller.new_circuit(path, await_build = True)
def attach_stream(stream):
if stream.status == 'NEW':
controller.attach_stream(stream.id, circuit_id)
controller.add_event_listener(attach_stream, stem.control.EventType.STREAM)
try:
controller.set_conf('__LeaveStreamsUnattached', '1') # leave stream management to us
start_time = time.time()
check_page = query('https://check.torproject.org/')
if 'Congratulations. This browser is configured to use Tor.' not in check_page:
raise ValueError("Request didn't have the right content")
return time.time() - start_time
finally:
controller.remove_event_listener(attach_stream)
controller.reset_conf('__LeaveStreamsUnattached')
with stem.control.Controller.from_port() as controller:
controller.authenticate()
relay_fingerprints = [desc.fingerprint for desc in controller.get_network_statuses()]
for fingerprint in relay_fingerprints:
try:
time_taken = scan(controller, [fingerprint, EXIT_FINGERPRINT])
print('%s => %0.2f seconds' % (fingerprint, time_taken))
except Exception as exc:
print('%s => %s' % (fingerprint, exc))
stem-1.8.0/docs/_static/example/benchmark_metrics_lib.java 0000664 0001750 0001750 00000026315 13157571677 024426 0 ustar atagar atagar 0000000 0000000 /* Copyright 2016 The Tor Project
* See LICENSE for licensing information */
package org.torproject.descriptor;
import java.io.File;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Set;
import java.util.SortedMap;
public class MeasurePerformance {
/* Check if all necessary files are available and then measure
* performance of some more or less common use cases. */
public static void main(String[] args) {
if (!filesAvailable()) {
return;
}
/*measureListOutdatedRelays(null);
pause();*/
measureAverageAdvertisedBandwidth(new File(resDir, resPaths[0]));
pause();
measureAverageAdvertisedBandwidth(new File(resDir, resPaths[1]));
pause();
measureAverageAdvertisedBandwidth(new File(resDir, resPaths[2]));
pause();
/*measureFractionRelaysExit80ServerDescriptors(null);
pause();
measureSumOfWrittenAndReadBytes(null);
pause();*/
measureCountriesV3Requests(new File(resDir, resPaths[3]));
pause();
measureCountriesV3Requests(new File(resDir, resPaths[4]));
pause();
measureAverageRelaysExit(new File(resDir, resPaths[5]));
pause();
measureAverageRelaysExit(new File(resDir, resPaths[6]));
pause();
measureAverageRelaysExit(new File(resDir, resPaths[7]));
/*pause();
measureVotesByBandwidthAuthorities(null);
pause();
measureExtendedFamilies(null);
pause();*/
measureFractionRelaysExit80Microdescriptors(
new File(resDir, resPaths[8]));
measureFractionRelaysExit80Microdescriptors(
new File(resDir, resPaths[9]));
}
private static File resDir = new File("res");
private static String[] resPaths = new String[] {
"archive/relay-descriptors/server-descriptors/"
+ "server-descriptors-2015-11.tar.xz",
"archive/relay-descriptors/server-descriptors/"
+ "server-descriptors-2015-11.tar",
"archive/relay-descriptors/server-descriptors/"
+ "server-descriptors-2015-11",
"archive/relay-descriptors/extra-infos/extra-infos-2015-11.tar.xz",
"archive/relay-descriptors/extra-infos/extra-infos-2015-11.tar",
"archive/relay-descriptors/consensuses/consensuses-2015-11.tar.xz",
"archive/relay-descriptors/consensuses/consensuses-2015-11.tar",
"archive/relay-descriptors/consensuses/consensuses-2015-11",
"archive/relay-descriptors/microdescs/"
+ "microdescs-2015-11-micro.tar.xz",
"archive/relay-descriptors/microdescs/microdescs-2015-11-micro.tar"
};
private static boolean filesAvailable() {
if (!resDir.exists() || !resDir.isDirectory()) {
return false;
}
for (String resPath : resPaths) {
if (!(new File(resDir, resPath).exists())) {
System.err.println(resPath);
return false;
}
}
return true;
}
private static void pause() {
try {
Thread.sleep(15L * 1000L);
} catch (InterruptedException e) {
e.printStackTrace();
}
}
private static void measureListOutdatedRelays(File tarballFile) {
}
private static void measureAverageAdvertisedBandwidth(
File tarballFileOrDirectory) {
System.out.println("Starting measureAverageAdvertisedBandwidth");
long startedMillis = System.currentTimeMillis();
long sumAdvertisedBandwidth = 0, countedServerDescriptors = 0;
DescriptorReader descriptorReader =
DescriptorSourceFactory.createDescriptorReader();
descriptorReader.addTarball(tarballFileOrDirectory);
descriptorReader.addDirectory(tarballFileOrDirectory);
Iterator descriptorFiles =
descriptorReader.readDescriptors();
while (descriptorFiles.hasNext()) {
DescriptorFile descriptorFile = descriptorFiles.next();
for (Descriptor descriptor : descriptorFile.getDescriptors()) {
if (!(descriptor instanceof ServerDescriptor)) {
continue;
}
ServerDescriptor serverDescriptor = (ServerDescriptor) descriptor;
sumAdvertisedBandwidth += (long) Math.min(Math.min(
serverDescriptor.getBandwidthRate(),
serverDescriptor.getBandwidthBurst()),
serverDescriptor.getBandwidthObserved());
countedServerDescriptors++;
}
}
long endedMillis = System.currentTimeMillis();
System.out.println("Ending measureAverageAdvertisedBandwidth");
System.out.printf("Total time: %d millis%n",
endedMillis - startedMillis);
System.out.printf("Processed server descriptors: %d%n",
countedServerDescriptors);
System.out.printf("Average advertised bandwidth: %d%n",
sumAdvertisedBandwidth / countedServerDescriptors);
System.out.printf("Time per server descriptor: %.6f millis%n",
((double) (endedMillis - startedMillis))
/ ((double) countedServerDescriptors));
}
private static void measureFractionRelaysExit80ServerDescriptors(
File tarballFile) {
}
private static void measureSumOfWrittenAndReadBytes(File tarballFile) {
}
private static void measureCountriesV3Requests(File tarballFile) {
System.out.println("Starting measureCountriesV3Requests");
long startedMillis = System.currentTimeMillis();
Set countries = new HashSet<>();
long countedExtraInfoDescriptors = 0;
DescriptorReader descriptorReader =
DescriptorSourceFactory.createDescriptorReader();
descriptorReader.addTarball(tarballFile);
Iterator descriptorFiles =
descriptorReader.readDescriptors();
while (descriptorFiles.hasNext()) {
DescriptorFile descriptorFile = descriptorFiles.next();
for (Descriptor descriptor : descriptorFile.getDescriptors()) {
if (!(descriptor instanceof ExtraInfoDescriptor)) {
continue;
}
ExtraInfoDescriptor extraInfoDescriptor =
(ExtraInfoDescriptor) descriptor;
SortedMap dirreqV3Reqs =
extraInfoDescriptor.getDirreqV3Reqs();
if (dirreqV3Reqs != null) {
countries.addAll(dirreqV3Reqs.keySet());
}
countedExtraInfoDescriptors++;
}
}
long endedMillis = System.currentTimeMillis();
System.out.println("Ending measureCountriesV3Requests");
System.out.printf("Total time: %d millis%n",
endedMillis - startedMillis);
System.out.printf("Processed extra-info descriptors: %d%n",
countedExtraInfoDescriptors);
System.out.printf("Number of countries: %d%n",
countries.size());
System.out.printf("Time per extra-info descriptor: %.6f millis%n",
((double) (endedMillis - startedMillis))
/ ((double) countedExtraInfoDescriptors));
}
private static void measureAverageRelaysExit(
File tarballFileOrDirectory) {
System.out.println("Starting measureAverageRelaysExit");
long startedMillis = System.currentTimeMillis();
long totalRelaysWithExitFlag = 0L, totalRelays = 0L,
countedConsensuses = 0L;
DescriptorReader descriptorReader =
DescriptorSourceFactory.createDescriptorReader();
descriptorReader.addTarball(tarballFileOrDirectory);
descriptorReader.addDirectory(tarballFileOrDirectory);
Iterator descriptorFiles =
descriptorReader.readDescriptors();
while (descriptorFiles.hasNext()) {
DescriptorFile descriptorFile = descriptorFiles.next();
for (Descriptor descriptor : descriptorFile.getDescriptors()) {
if (!(descriptor instanceof RelayNetworkStatusConsensus)) {
continue;
}
RelayNetworkStatusConsensus consensus =
(RelayNetworkStatusConsensus) descriptor;
for (NetworkStatusEntry entry :
consensus.getStatusEntries().values()) {
if (entry.getFlags().contains("Exit")) {
totalRelaysWithExitFlag++;
}
totalRelays++;
}
countedConsensuses++;
}
}
long endedMillis = System.currentTimeMillis();
System.out.println("Ending measureAverageRelaysExit");
System.out.printf("Total time: %d millis%n",
endedMillis - startedMillis);
System.out.printf("Processed consensuses: %d%n", countedConsensuses);
System.out.printf("Total number of status entries: %d%n",
totalRelays);
System.out.printf("Total number of status entries with Exit flag: "
+ "%d%n", totalRelaysWithExitFlag);
System.out.printf("Average number of relays with Exit Flag: %.2f%n",
(double) totalRelaysWithExitFlag / (double) totalRelays);
System.out.printf("Time per consensus: %.6f millis%n",
((double) (endedMillis - startedMillis))
/ ((double) countedConsensuses));
}
private static void measureVotesByBandwidthAuthorities(
File tarballFile) {
}
private static void measureExtendedFamilies(File tarballFile) {
}
private static void measureFractionRelaysExit80Microdescriptors(
File tarballFile) {
System.out.println("Starting "
+ "measureFractionRelaysExit80Microdescriptors");
long startedMillis = System.currentTimeMillis();
long totalRelaysWithExitFlag = 0L, countedMicrodescriptors = 0L;
DescriptorReader descriptorReader =
DescriptorSourceFactory.createDescriptorReader();
descriptorReader.addTarball(tarballFile);
Iterator descriptorFiles =
descriptorReader.readDescriptors();
while (descriptorFiles.hasNext()) {
DescriptorFile descriptorFile = descriptorFiles.next();
for (Descriptor descriptor : descriptorFile.getDescriptors()) {
if (!(descriptor instanceof Microdescriptor)) {
continue;
}
countedMicrodescriptors++;
Microdescriptor microdescriptor =
(Microdescriptor) descriptor;
String defaultPolicy = microdescriptor.getDefaultPolicy();
if (defaultPolicy == null) {
continue;
}
boolean accept = "accept".equals(
microdescriptor.getDefaultPolicy());
for (String ports : microdescriptor.getPortList().split(",")) {
if (ports.contains("-")) {
String[] parts = ports.split("-");
int from = Integer.parseInt(parts[0]);
int to = Integer.parseInt(parts[1]);
if (from <= 80 && to >= 80) {
if (accept) {
totalRelaysWithExitFlag++;
}
} else if (to > 80) {
if (!accept) {
totalRelaysWithExitFlag++;
}
break;
}
} else if ("80".equals(ports)) {
if (accept) {
totalRelaysWithExitFlag++;
}
break;
}
}
}
}
long endedMillis = System.currentTimeMillis();
System.out.println("Ending "
+ "measureFractionRelaysExit80Microdescriptors");
System.out.printf("Total time: %d millis%n",
endedMillis - startedMillis);
System.out.printf("Processed microdescriptors: %d%n",
countedMicrodescriptors);
System.out.printf("Total number of microdescriptors that exit to 80: "
+ "%d%n", totalRelaysWithExitFlag);
System.out.printf("Average number of relays that exit to 80: %.2f%n",
(double) totalRelaysWithExitFlag
/ (double) countedMicrodescriptors);
System.out.printf("Time per microdescriptor: %.6f millis%n",
((double) (endedMillis - startedMillis))
/ ((double) countedMicrodescriptors));
}
}
stem-1.8.0/docs/_static/example/compare_flags.py 0000664 0001750 0001750 00000003353 13501272761 022407 0 ustar atagar atagar 0000000 0000000 import collections
import stem.descriptor
import stem.descriptor.remote
import stem.directory
# Query all authority votes asynchronously.
downloader = stem.descriptor.remote.DescriptorDownloader(
document_handler = stem.descriptor.DocumentHandler.DOCUMENT,
)
# An ordered dictionary ensures queries are finished in the order they were
# added.
queries = collections.OrderedDict()
for name, authority in stem.directory.Authority.from_cache().items():
if authority.v3ident is None:
continue # authority doesn't vote if it lacks a v3ident
queries[name] = downloader.get_vote(authority)
# Wait for the votes to finish being downloaded, this produces a dictionary of
# authority nicknames to their vote.
votes = dict((name, query.run()[0]) for (name, query) in queries.items())
# Get a superset of all the fingerprints in all the votes.
all_fingerprints = set()
for vote in votes.values():
all_fingerprints.update(vote.routers.keys())
# Finally, compare moria1's votes to maatuska's votes.
for fingerprint in all_fingerprints:
moria1_vote = votes['moria1'].routers.get(fingerprint)
maatuska_vote = votes['maatuska'].routers.get(fingerprint)
if not moria1_vote and not maatuska_vote:
print("both moria1 and maatuska haven't voted about %s" % fingerprint)
elif not moria1_vote:
print("moria1 hasn't voted about %s" % fingerprint)
elif not maatuska_vote:
print("maatuska hasn't voted about %s" % fingerprint)
elif 'Running' in moria1_vote.flags and 'Running' not in maatuska_vote.flags:
print("moria1 has the Running flag but maatuska doesn't: %s" % fingerprint)
elif 'Running' in maatuska_vote.flags and 'Running' not in moria1_vote.flags:
print("maatuska has the Running flag but moria1 doesn't: %s" % fingerprint)
stem-1.8.0/docs/_static/example/create_descriptor.py 0000664 0001750 0001750 00000000557 13412531020 023274 0 ustar atagar atagar 0000000 0000000 from stem.descriptor.server_descriptor import RelayDescriptor
# prints 'caerSidi (71.35.133.197:9001)'
desc = RelayDescriptor.create()
print("%s (%s:%s)" % (desc.nickname, desc.address, desc.or_port))
# prints 'demo (127.0.0.1:80)'
desc = RelayDescriptor.create({'router': 'demo 127.0.0.1 80 0 0'})
print("%s (%s:%s)" % (desc.nickname, desc.address, desc.or_port))
stem-1.8.0/docs/_static/example/slow_listener.py 0000664 0001750 0001750 00000000726 13567611417 022506 0 ustar atagar atagar 0000000 0000000 import time
from stem.control import EventType, Controller
with Controller.from_port() as controller:
def slow_handler(event):
age = time.time() - event.arrived_at
unprocessed_count = controller._event_queue.qsize()
print("processing a BW event that's %0.1f seconds old (%i more events are waiting)" % (age, unprocessed_count))
time.sleep(5)
controller.authenticate()
controller.add_event_listener(slow_handler, EventType.BW)
time.sleep(10)
stem-1.8.0/docs/_static/example/votes_by_bandwidth_authorities.py 0000664 0001750 0001750 00000001643 13501272761 026103 0 ustar atagar atagar 0000000 0000000 import stem.descriptor.remote
import stem.directory
# request votes from all the bandwidth authorities
queries = {}
downloader = stem.descriptor.remote.DescriptorDownloader()
for authority in stem.directory.Authority.from_cache().values():
queries[authority.nickname] = downloader.query(
'/tor/status-vote/current/authority',
endpoints = [(authority.address, authority.dir_port)],
)
for authority_name, query in queries.items():
try:
print("Getting %s's vote from %s:" % (authority_name, query.download_url))
measured, unmeasured = 0, 0
for desc in query.run():
if desc.measured:
measured += 1
else:
unmeasured += 1
if measured == 0:
print(' %s is not a bandwidth authority' % authority_name)
else:
print(' %i measured entries and %i unmeasured' % (measured, unmeasured))
except Exception as exc:
print(" failed to get the vote (%s)" % exc)
stem-1.8.0/docs/_static/example/fibonacci_threaded.py 0000664 0001750 0001750 00000000665 13412531020 023350 0 ustar atagar atagar 0000000 0000000 import threading
import time
def fibonacci(n):
if n < 2:
return n
else:
return fibonacci(n-2) + fibonacci(n-1)
# calculate fibonacci sequences four times in parallel
start_time, threads = time.time(), []
for i in range(4):
t = threading.Thread(target = fibonacci, args = (35,))
t.setDaemon(True)
t.start()
threads.append(t)
for t in threads:
t.join()
print('took %0.1f seconds' % (time.time() - start_time))
stem-1.8.0/docs/_static/example/ephemeral_hidden_services.py 0000664 0001750 0001750 00000001216 13412531020 024744 0 ustar atagar atagar 0000000 0000000 from stem.control import Controller
from flask import Flask
app = Flask(__name__)
@app.route('/')
def index():
return "Hi Grandma!
"
print(' * Connecting to tor')
with Controller.from_port() as controller:
controller.authenticate()
# Create a hidden service where visitors of port 80 get redirected to local
# port 5000 (this is where Flask runs by default).
response = controller.create_ephemeral_hidden_service({80: 5000}, await_publication = True)
print(" * Our service is available at %s.onion, press ctrl+c to quit" % response.service_id)
try:
app.run()
finally:
print(" * Shutting down our hidden service")
stem-1.8.0/docs/_static/example/load_test.py 0000664 0001750 0001750 00000001332 13412531020 021541 0 ustar atagar atagar 0000000 0000000 import os
import time
import stem.control
import stem.util.proc
import stem.util.str_tools
start_time = time.time()
samplings = []
last_sample = None
with stem.control.Controller.from_port() as controller:
controller.authenticate()
controller.add_event_listener(lambda *args: None, 'DEBUG')
while True:
utime, stime = stem.util.proc.stats(os.getpid(), stem.util.proc.Stat.CPU_UTIME, stem.util.proc.Stat.CPU_STIME)
total_cpu_time = float(utime) + float(stime)
if last_sample:
samplings.append(total_cpu_time - last_sample)
print '%0.1f%% (%s)' % (sum(samplings) / len(samplings) * 100, stem.util.str_tools.time_label(time.time() - start_time))
last_sample = total_cpu_time
time.sleep(1)
stem-1.8.0/docs/_static/example/reading_twitter.py 0000664 0001750 0001750 00000005033 13412531020 022760 0 ustar atagar atagar 0000000 0000000 import binascii
import hashlib
import hmac
import json
import socket
import time
import urllib
import urllib2
import socks # SockiPy module
import stem.process
SOCKS_PORT = 7000
TWITTER_API_URL = "https://api.twitter.com/1.1/statuses/user_timeline.json"
CONSUMER_KEY = ""
CONSUMER_SECRET = ""
ACCESS_TOKEN = ""
ACCESS_TOKEN_SECRET = ""
HEADER_AUTH_KEYS = ['oauth_consumer_key', 'oauth_nonce', 'oauth_signature',
'oauth_signature_method', 'oauth_timestamp', 'oauth_token', 'oauth_version']
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, '127.0.0.1', SOCKS_PORT)
socket.socket = socks.socksocket
def oauth_signature(key_dict):
fin_key = ""
for key in sorted(key_dict.keys()):
fin_key += key + "=" + key_dict[key] + "&"
fin_key = fin_key[:-1]
fin_key = 'GET' + "&" + urllib.quote(TWITTER_API_URL, '') + "&" + urllib.quote(fin_key, '')
key = urllib.quote(CONSUMER_SECRET, '') + "&" + urllib.quote(ACCESS_TOKEN_SECRET, '')
hashed = hmac.new(key, fin_key, hashlib.sha1)
fin_key = binascii.b2a_base64(hashed.digest())[:-1]
return urllib.quote(fin_key, '')
def poll_twitter_feed(user_id, tweet_count):
"""
Polls Twitter for the tweets from a given user.
"""
key_dict = {
'oauth_consumer_key': urllib.quote(CONSUMER_KEY, ''),
'oauth_nonce': urllib.quote(hashlib.md5(str(time.time())).hexdigest(), ''),
'oauth_signature_method': urllib.quote("HMAC-SHA1", ''),
'oauth_timestamp': urllib.quote(str(int(time.time())), ''),
'oauth_token': urllib.quote(ACCESS_TOKEN, ''),
'oauth_version': urllib.quote('1.0', ''),
}
url_values = {'screen_name': user_id, 'count': str(tweet_count), 'include_rts': '1'}
for key, value in url_values.items():
key_dict[key] = urllib.quote(value, '')
key_dict['oauth_signature'] = oauth_signature(key_dict)
header_auth = 'OAuth ' + ', '.join(['%s="%s"' % (key, key_dict[key]) for key in HEADER_AUTH_KEYS])
data = urllib.urlencode(url_values)
api_request = urllib2.Request(TWITTER_API_URL + "?" + data, headers = {'Authorization': header_auth})
try:
api_response = urllib2.urlopen(api_request).read()
except:
raise IOError("Unable to reach %s" % TWITTER_API_URL)
return json.loads(api_response)
tor_process = stem.process.launch_tor_with_config(
config = {
'SocksPort': str(SOCKS_PORT),
'ExitNodes': '{ru}',
},
)
try:
for index, tweet in enumerate(poll_twitter_feed('ioerror', 3)):
print("%i. %s" % (index + 1, tweet["created_at"]))
print(tweet["text"])
print("")
except IOError as exc:
print(exc)
finally:
tor_process.kill() # stops tor
stem-1.8.0/docs/_static/example/current_descriptors.py 0000664 0001750 0001750 00000000356 13501272761 023710 0 ustar atagar atagar 0000000 0000000 import stem.descriptor.remote
try:
for desc in stem.descriptor.remote.get_consensus():
print("found relay %s (%s)" % (desc.nickname, desc.fingerprint))
except Exception as exc:
print("Unable to retrieve the consensus: %s" % exc)
stem-1.8.0/docs/_static/example/list_circuits.py 0000664 0001750 0001750 00000001203 13412531020 022440 0 ustar atagar atagar 0000000 0000000 from stem import CircStatus
from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
for circ in sorted(controller.get_circuits()):
if circ.status != CircStatus.BUILT:
continue
print("")
print("Circuit %s (%s)" % (circ.id, circ.purpose))
for i, entry in enumerate(circ.path):
div = '+' if (i == len(circ.path) - 1) else '|'
fingerprint, nickname = entry
desc = controller.get_network_status(fingerprint, None)
address = desc.address if desc else 'unknown'
print(" %s- %s (%s, %s)" % (div, fingerprint, nickname, address))
stem-1.8.0/docs/_static/example/bandwidth_stats.py 0000664 0001750 0001750 00000000454 13501272761 022766 0 ustar atagar atagar 0000000 0000000 import stem.descriptor.remote
bandwidth_file = stem.descriptor.remote.get_bandwidth_file().run()[0]
for fingerprint, measurement in bandwidth_file.measurements.items():
print('Relay %s' % fingerprint)
for attr, value in measurement.items():
print(' %s = %s' % (attr, value))
print('')
stem-1.8.0/docs/_static/example/outdated_relays.py 0000664 0001750 0001750 00000001041 13412531020 022750 0 ustar atagar atagar 0000000 0000000 from stem.descriptor.remote import DescriptorDownloader
from stem.version import Version
downloader = DescriptorDownloader()
count, with_contact = 0, 0
print("Checking for outdated relays...")
print("")
for desc in downloader.get_server_descriptors():
if desc.tor_version < Version('0.2.3.0'):
count += 1
if desc.contact:
print(' %-15s %s' % (desc.tor_version, desc.contact.decode("utf-8", "replace")))
with_contact += 1
print("")
print("%i outdated relays found, %i had contact information" % (count, with_contact))
stem-1.8.0/docs/_static/example/benchmark_zoossh.go 0000664 0001750 0001750 00000004373 13157571677 023143 0 ustar atagar atagar 0000000 0000000 package main
import (
"fmt"
"log"
"os"
"path/filepath"
"time"
"git.torproject.org/user/phw/zoossh.git"
)
var processedCons int64 = 0
var processedDescs int64 = 0
var totalExits int64 = 0
var totalRelays int64 = 0
var totalBw uint64 = 0
func Min(a uint64, b uint64, c uint64) uint64 {
min := a
if b < min {
min = b
}
if c < min {
min = c
}
return min
}
func ProcessDescriptors(path string, info os.FileInfo, err error) error {
if _, err := os.Stat(path); err != nil {
return err
}
if info.IsDir() {
return nil
}
consensus, err := zoossh.ParseDescriptorFile(path)
if err != nil {
return err
}
if (processedDescs % 100) == 0 {
fmt.Printf(".")
}
for _, getDesc := range consensus.RouterDescriptors {
desc := getDesc()
totalBw += Min(desc.BandwidthAvg, desc.BandwidthBurst, desc.BandwidthObs)
processedDescs++
}
return nil
}
func ProcessConsensus(path string, info os.FileInfo, err error) error {
if _, err := os.Stat(path); err != nil {
return err
}
if info.IsDir() {
return nil
}
consensus, err := zoossh.ParseConsensusFile(path)
if err != nil {
return err
}
fmt.Printf(".")
for _, getStatus := range consensus.RouterStatuses {
status := getStatus()
totalRelays++
if status.Flags.Exit == true {
totalExits++
}
}
processedCons++
return nil
}
func main() {
if len(os.Args) != 3 {
log.Fatalf("Usage: %s CONSENSUS_ARCHIVE DESCRIPTOR_ARCHIVE", os.Args[0])
}
before := time.Now()
filepath.Walk(os.Args[1], ProcessConsensus)
fmt.Println()
after := time.Now()
duration := after.Sub(before)
fmt.Println("Total time for consensuses:", duration)
fmt.Printf("Time per consensus: %dms\n",
duration.Nanoseconds()/processedCons/int64(1000000))
fmt.Printf("Processed %d consensuses with %d router status entries.\n",
processedCons, totalRelays)
fmt.Printf("Total exits: %d\n", totalExits)
before = time.Now()
filepath.Walk(os.Args[2], ProcessDescriptors)
fmt.Println()
after = time.Now()
duration = after.Sub(before)
fmt.Println("Total time for descriptors:", duration)
fmt.Printf("Time per descriptor: %dns\n",
duration.Nanoseconds()/processedDescs)
fmt.Printf("Processed %d descriptors.\n", processedDescs)
fmt.Printf("Average advertised bandwidth: %d\n", totalBw/uint64(processedDescs))
}
stem-1.8.0/docs/_static/example/benchmark_server_descriptor_metrics_lib.java 0000664 0001750 0001750 00000003777 13157571677 030261 0 ustar atagar atagar 0000000 0000000 package org.torproject.descriptor;
import org.torproject.descriptor.Descriptor;
import org.torproject.descriptor.DescriptorReader;
import org.torproject.descriptor.DescriptorSourceFactory;
import org.torproject.descriptor.ServerDescriptor;
import java.io.File;
import java.util.Iterator;
public class MeasurePerformance {
public static void main(String[] args) {
measureAverageAdvertisedBandwidth(new File("server-descriptors-2015-11.tar"));
}
private static void measureAverageAdvertisedBandwidth(
File tarballFileOrDirectory) {
System.out.println("Starting measureAverageAdvertisedBandwidth");
final long startedMillis = System.currentTimeMillis();
long sumAdvertisedBandwidth = 0;
long countedServerDescriptors = 0;
DescriptorReader descriptorReader =
DescriptorSourceFactory.createDescriptorReader();
Iterator descriptors =
descriptorReader.readDescriptors(tarballFileOrDirectory).iterator();
while (descriptors.hasNext()) {
Descriptor descriptor = descriptors.next();
if (!(descriptor instanceof ServerDescriptor)) {
continue;
}
ServerDescriptor serverDescriptor = (ServerDescriptor) descriptor;
sumAdvertisedBandwidth += (long) Math.min(Math.min(
serverDescriptor.getBandwidthRate(),
serverDescriptor.getBandwidthBurst()),
serverDescriptor.getBandwidthObserved());
countedServerDescriptors++;
}
long endedMillis = System.currentTimeMillis();
System.out.println("Ending measureAverageAdvertisedBandwidth");
System.out.printf("Total time: %d millis%n",
endedMillis - startedMillis);
System.out.printf("Processed server descriptors: %d%n",
countedServerDescriptors);
System.out.printf("Average advertised bandwidth: %d%n",
sumAdvertisedBandwidth / countedServerDescriptors);
System.out.printf("Time per server descriptor: %.6f millis%n",
((double) (endedMillis - startedMillis))
/ ((double) countedServerDescriptors));
}
}
stem-1.8.0/docs/_static/example/client_usage_using_pycurl.py 0000664 0001750 0001750 00000002466 13412531020 025041 0 ustar atagar atagar 0000000 0000000 import io
import pycurl
import stem.process
from stem.util import term
SOCKS_PORT = 7000
def query(url):
"""
Uses pycurl to fetch a site using the proxy on the SOCKS_PORT.
"""
output = io.BytesIO()
query = pycurl.Curl()
query.setopt(pycurl.URL, url)
query.setopt(pycurl.PROXY, 'localhost')
query.setopt(pycurl.PROXYPORT, SOCKS_PORT)
query.setopt(pycurl.PROXYTYPE, pycurl.PROXYTYPE_SOCKS5_HOSTNAME)
query.setopt(pycurl.WRITEFUNCTION, output.write)
try:
query.perform()
return output.getvalue()
except pycurl.error as exc:
return "Unable to reach %s (%s)" % (url, exc)
# Start an instance of Tor configured to only exit through Russia. This prints
# Tor's bootstrap information as it starts. Note that this likely will not
# work if you have another Tor instance running.
def print_bootstrap_lines(line):
if "Bootstrapped " in line:
print(term.format(line, term.Color.BLUE))
print(term.format("Starting Tor:\n", term.Attr.BOLD))
tor_process = stem.process.launch_tor_with_config(
config = {
'SocksPort': str(SOCKS_PORT),
'ExitNodes': '{ru}',
},
init_msg_handler = print_bootstrap_lines,
)
print(term.format("\nChecking our endpoint:\n", term.Attr.BOLD))
print(term.format(query("https://www.atagar.com/echo.php"), term.Color.BLUE))
tor_process.kill() # stops tor
stem-1.8.0/docs/_static/example/saving_and_loading_descriptors.py 0000664 0001750 0001750 00000000346 13412531020 026016 0 ustar atagar atagar 0000000 0000000 import stem.descriptor.remote
server_descriptors = stem.descriptor.remote.get_server_descriptors().run()
with open('/tmp/descriptor_dump', 'wb') as descriptor_file:
descriptor_file.write(''.join(map(str, server_descriptors)))
stem-1.8.0/docs/_static/example/fibonacci_multiprocessing.py 0000664 0001750 0001750 00000000634 13412531020 025013 0 ustar atagar atagar 0000000 0000000 import stem.util.system
import time
def fibonacci(n):
if n < 2:
return n
else:
return fibonacci(n-2) + fibonacci(n-1)
# calculate fibonacci sequences four times in parallel
start_time, threads = time.time(), []
for i in range(4):
threads.append(stem.util.system.DaemonTask(fibonacci, (35,), start = True))
for t in threads:
t.join()
print('took %0.1f seconds' % (time.time() - start_time))
stem-1.8.0/docs/_static/example/resuming_ephemeral_hidden_service.py 0000664 0001750 0001750 00000001652 13412531020 026476 0 ustar atagar atagar 0000000 0000000 import os
from stem.control import Controller
key_path = os.path.expanduser('~/my_service_key')
with Controller.from_port() as controller:
controller.authenticate()
if not os.path.exists(key_path):
service = controller.create_ephemeral_hidden_service({80: 5000}, await_publication = True)
print("Started a new hidden service with the address of %s.onion" % service.service_id)
with open(key_path, 'w') as key_file:
key_file.write('%s:%s' % (service.private_key_type, service.private_key))
else:
with open(key_path) as key_file:
key_type, key_content = key_file.read().split(':', 1)
service = controller.create_ephemeral_hidden_service({80: 5000}, key_type = key_type, key_content = key_content, await_publication = True)
print("Resumed %s.onion" % service.service_id)
raw_input('press any key to shut the service down...')
controller.remove_ephemeral_hidden_service(service.service_id)
stem-1.8.0/docs/_static/example/manual_config_options.py 0000664 0001750 0001750 00000002303 13412531020 024137 0 ustar atagar atagar 0000000 0000000 from stem.manual import Manual
from stem.util import term
try:
print("Downloading tor's manual information, please wait...")
manual = Manual.from_remote()
print(" done\n")
except IOError as exc:
print(" unsuccessful (%s), using information provided with stem\n" % exc)
manual = Manual.from_cache() # fall back to our bundled manual information
print('Which tor configuration would you like to learn about? (press ctrl+c to quit)\n')
try:
while True:
requested_option = raw_input('> ').strip()
if requested_option:
if requested_option in manual.config_options:
option = manual.config_options[requested_option]
print(term.format('%s %s' % (option.name, option.usage), term.Color.GREEN, term.Attr.BOLD))
print(term.format(option.summary, term.Color.GREEN)) # brief description provided by stem
print(term.format('\nFull Description:\n', term.Color.GREEN, term.Attr.BOLD))
print(term.format(option.description + '\n', term.Color.GREEN))
else:
print(term.format("Sorry, we don't have any information about %s. Are you sure it's an option?" % requested_option, term.Color.RED))
except KeyboardInterrupt:
pass # user pressed ctrl+c
stem-1.8.0/docs/_static/example/validate_descriptor_content.py 0000664 0001750 0001750 00000000272 13412531020 025346 0 ustar atagar atagar 0000000 0000000 from stem.descriptor import parse_file
for desc in parse_file('/home/atagar/.tor/cached-consensus', validate = True):
print('found relay %s (%s)' % (desc.nickname, desc.fingerprint))
stem-1.8.0/docs/_static/example/words_with.py 0000664 0001750 0001750 00000002143 13412531020 021755 0 ustar atagar atagar 0000000 0000000 import itertools
import re
from stem.util import term
from stem.util.term import Attr, Color
def get_words_with(target, attr):
"""
Provides words with the given substring highlighted within it.
:param str target: substring to match against
:param tuple attr: terminal formatting to highlight the match with
:returns: **iterable** with words containing that substring
"""
word_matcher = re.compile('(.*)(%s)(.*)' % target, re.I)
with open('/etc/dictionaries-common/words') as dictionary_file:
for word in dictionary_file:
match = word_matcher.match(word)
if match:
yield ''.join((
match.group(1),
term.format(match.group(2), *attr),
match.group(3),
))
if __name__ == '__main__':
target = raw_input("What substring would you like to look for? We'll get words containing it: ")
attr = (Attr.BOLD, Color.YELLOW)
print("Words with '%s' include...\n" % term.format(target, *attr))
for words in itertools.izip_longest(*(get_words_with(target, attr),) * 4):
print('%-30s%-30s%-30s%-30s' % tuple([w if w else '' for w in words]))
stem-1.8.0/docs/_static/style.css 0000664 0001750 0001750 00000000357 13501272761 017453 0 ustar atagar atagar 0000000 0000000 div.literal-block-wrapper {
padding: 0;
}
span.caption-text {
float: right;
}
span.red {
color: red;
font-weight: bold;
}
span.green {
color: green;
font-weight: bold;
}
img {
max-width: none !important;
}
stem-1.8.0/docs/_static/words_with.png 0000664 0001750 0001750 00000133151 13340051401 020462 0 ustar atagar atagar 0000000 0000000 ‰PNG
IHDR Ë 6 —ìß bKGD ÿ ÿ ÿ ½§“ pHYs šœ tIMEá ,/øà· IDATxÚìwtUÅÖÀ·%¹é–= EšôÞ›ˆÊ "*`Gß{¢Ò*6TžÊG•"½HïD „$$¤„ôrËþþ¸¡“ä.H™ßZ{-H&söìÙgfŸ©:´ãôÚ
P …B¡P(
…âÖæ pØ ¬~r´ü¡NCšp` 00*[+
…B¡P(ns¬À7À àÐõËS€±Êž
…B¡P(Š;”©À¸â~©/æçáÀ(+îJôTéø, ‡¥n95™r÷Ô{ mÆ|Äì1˜•5Ðû·ä¹i 1:¬êT¡PÜéŒ-Š{õËp¬åhRæGét¸‡˜©TY¯i}‡âÐé©<®.ÿmÌèñ ¸Þ‘†ö$ô™M¼ôõ Fö¹©:ë ´ Kò Zºß±“w :ôïE}Ÿ«Ô«± mŸ Í“ *aR-
ÆríõÒHºýSÖÐS¾ß÷ÄYÓY3ª&.ªN
Å¥IQüÛª´`9 Ç‚çkظ§§êû
xgK8O qÃp;˜Å`¤ÊPžÝژɱMøï_õxäY/·¢Î:˜³‘Ýß´ÂXn8›³3ˆ^û_šzüƒ®Õäß,úm*½+ªƒÛ Æ«Z8!_ÂÂü‹õUU§
…‰ÅÁ—Œ0_Þº|Ãuœp¡ÓßNöÐüB F1“»+-‹
16
¤Ù«µñÉ>Èçß`»Õ¶°s| ^º’ºð g¬wšŸêp9€jn@ú*Ç8~lòÇ¿‚': 7ùºÀ*5{š~¬|ëþ#†ÐýN_Œ}n5u>tœ¹ŠÏÿÃ̧»òãþ³˜ÊצqtNªÖX¡ Q³:RgC0‘§ ¢P(n^Àü
ÐôjÁò®ºôB‡w¯P†¿ëG¹ =z ?6‹½3cYòK …Þ×åÍ)†‹|GÔã½EÿIIfvëXbóJÏ@çíA³ñÁ´íëE9_ Øld ÏaßûÑ,ýÓ‚ mù˜•£óˆ š»S.°(8°ÛHù-šO^>K^Eú6S¸êÓG¤‘i<2Ðo®C“'üñŸŸˆµOU ëGHˆ]AÑ;픿όG^ ÛÇ ã×¥…Ø—;Í^¯LÇ^ø™!ïXۦƲjyÁùQ¿Òôɱ—žÆðà¥v¦·‰¤ÑDç^Vcΰ¡‹-?¬Fë–f‹t)ˆÉä¯÷cX±¬àÒÑLce ™¿ïz§2£kÆnÌ@®9Èò"¸]KL@Öö¥¤^XíæÏÿ<ÉQ[]šûžÖÕ[Òv@SŽ}±•\ªR§ÿ8îkß
3XÓrìi¬]µ—|{Ñ#<Ñxð‹4n\ /W€<²O,fõG“8‘i¿R'×ú´ûïwÜ[²ÖbÞ·Û0´þŽÃ.|xzuÿ‘ÑÝ‹þ“ñ3óÇ¿ÏéBЙëRÿ¡±4kÙo!?aûĶ]ñ«ÑhÄD‡UÅËË =vò¶rð÷IlÙ‡U´Û§ärgm:—lC#Þ÷½Eï ©è‰ÎrŠøãyø‡ÕÂ\xœƒ_=Çê IØ]kУC ù+ ã¯W‘ À6-/ëàb%úÏü™)5¥f +Kì¦ yÿÅqÌÙy; ʆS_SþpîùÏa
UyvûI>.Fpë¯IpoϧÖ2ØÇ‘í{‘¼Wôˆ£êQÿ¿G8gJ·^?p²0 ?“´¿1éÙLÝ”ÆyÏp«Îÿþ„÷ŸéF-/ §·ÏçƒÆ0{[º#!ˆþ ÍcâýM òBÔ¿1õù§™²þŒÆp/ºýžÄòÀaTh³€”‹üÀ¥Þî{˜¯Â2騥t} C…N¼üßØ©9õªâa¬§øy@C-NE ½w#F~ô9o?Ö”
†\b$R 8~ñƒ_ FÏšÅøM¨ä
X2ˆÙ8™¾½Þc¾óÊ55ÿ)vÄ|B£¢ße.èHð¿Ö’}qVžN¬Ó›å‡v…(· MŠââqŽáUá»™O(<+HV »²‰²âVÅ‹Skѵ¾ãÏ ÙDnÍæôÙ¢?9“ˉYDmÍâØÆ<òlÚòÁÅLû ÃxàqoÊ ˆ^ŸE’Õ€w oêÔ1¯Ô:|:V¤M/Ï A'€Þ€{¡•B»ïöåÕ[Ø9ë,–ybó½L>R‡&þ@3>.:Üj{Q9Ä@îßy乺R•ùG
°z˜iöfy*º&7Ú|W— ñÂÏdáLœ
s- :|^—»‹ \š>ÚÒ8ìœÅ‰ƒ–â«×Y64™¨ÚÁƒÀ@=ñù$'
®U½iûY
ZU¿l¥«[
zv BïVŸ^m¯sm {#êßc9º5ªø%ùGØû¿Õ n=tô¨ûôôêÑ
Ë1NGEañ»‡ºƒ¾ _ûG]è¨=üSÚÝW /ÛIN ÛGrr! •±[ìW޼ǽåÀzdÿûa y"XÓö ¹›”s'4fFr*r'q‘;‰=|ܘCiüÒwtnßoc*é)Y¸µ¡ÙsßÓµ‘¿£. Tº§.>^îX’ÿ&%9· V4yö;º6ô»rMqqö)µ\u.Õ†z\ƒ›P1Гüøä›B®[‚Ø8l®5¹çáA˜ kÑ)àÖù5Æt¹öµõ Â;µ¦fü‡ êÖ™î_e™ùQ>ݲ”j;–àؓױ`/ÔêÛŽJ†sÛ
é Gm&ÅälglÓz4{òòˆafŸ†„‡‡ ^ ŸDqÉõ3¯êI÷þÏ2ßÒ‡I‹?¦›_Qôôül ÇVaó„ôè;’o³ûòÑƼæZ¤³7á;P/õs†öîFÏGó‹½ ï/žCï@£úÎDA|Cð1‚Þ=ˆšÕË᪓(~ö¢R-Úô\Bzñüðn—ý›§t¥C‡Îôô" ï,ú°5ñÐ÷ëùä‹^ Hïžç«ƒ–˦ =i5m1Óû¤óùN´lÞ’öýŸáý 6rÚ‚SËeK˜Ï€ºá„7ìì˜b²rVÞL?T(·c‹âãómᘒRço>ɇmÁàiÄÝl ôÝz<ÖÃ…:\X¾?ŸÜqÌݨ'trÏ2röד|ùnîNiùU ]„ò3˜ßá8{’ôԛ߈¡Ê–ÏÅ#7¶M'øàñ42¬ s3âébÂÿfn`ÍáX‚ …P7²äB]w—R\ËÆ8æncxã–WÄïj±²ÓmXÀ¦'ñG”+ WÞC÷î4¸ÏÄÆ…Fe²·ðê#¯Ð2_>9Ê%ƒÁú@ª?<î]ïÁ˜º‹Ã+æð׆¸uûœ¾÷Ʋíãw8tÞ@:ÜjßOU õŽ$”<_o=sˆ,ºáêQO“c¥ÇiÓÈ2³xÒ'$æƒkñ ÑàŽ ñYÿ éúrTv,œúe4¿®wŒÞê]ÍpÅãôx4z…>]C˜/X8ëgÒ,ŽüCÓøí™ '–1¨/Y[þï? ¹Äç]ê>EóšF(ØÈò×^äHº‰rýçóX¿P èËÖýß~>õ)öÎzœÍñ®„<²‡:•'¬_76ï[@†Òíc,\Út6†–fÃE)“8üåÓÄ?°Œ¾÷Dò׬×q}áÿh_± HÉố¯pÿªIü{U ã,æÓi“˜öýf¯aF~Ìz–¯\C&kXµ>†€ã‹xýÕæ̶‘ k<Ë¿ßS ¡CÅ9|oýn šºÆñÝêXÇû%¹œ>v„¬Êg±’Gâ±# þûêŠäG.âÇ_ÿ ØÎýÛ å_î,_Ÿƒ±ÊÃügHviň Ù O||%¯¾ÒœÏžØp~ô3?z5‹–®$“•¬;Y‹>;ž`P„;‹þÌÖPâB$!Ô ÐdDF®àØ <Ü“õ«á•v„Sy”I HcÇsY°5÷Š§™B æµ¾žl{º Ï~ ‹
Xu¨ƒÿõöE Ž.†ø™}¬[½ž©6`+ëËT“ÚÊ…õ,'#Ï‚‹¤âF¬T§7Õ
ÅíÆ`¸ ÇÍ|C‹O§§Ü¡ŒÞß„÷7ä]õy¬‡ã³Ùŧ,§^”–÷Zî¸D¦•"NÑGò¬E’o%+S æŠÈ( ßß‹:ÁÀá8fˆf{ÜÕe!ÿ¬ Ðáj°“•
¸0étø4öÀ Èž3ü(€ä?Î:‚ Þ”s×¢OÙÓ\cCÇ€…SÇ Q›{Ს…Ä-̸7¾`{ºý’瘼FÏ®÷àî%â‘Ïþù P Ÿ !+û¢O!íZ`2ÿZ^˜–T\Ýù‘r0à^ã^<¼ûÐgâr†O[Îã#:8vÑ{WÅl ,'‰Ür 02äÿxöƒ/èÞ¿\-د0Wêõë‚;ÇØôÙ òÊ24d³F8n€œXDtº
È'm×ZÇ’„J-ðw½š¯e‘¸eãJ¡
ñ¹x˜¾$û”©\ÅŸi³á…Ï
r
\ô¹dçFw :GdíšL—P: ŸÌ –öŒýr±[ߣïõ™¶ŸÙÄ‚Ýv›6£’É1Zóë vèšóDç
p¥z·ö&/çGò¯ëY… ûIÀ—Ê~ŽŠ0×lO ¢ùcÝ©óÁœÝÉoûì4iJÅb¦U
ö“€7•|´Î»ØÉ8~”,¿ÚyÓeP8¸´dpÓ@*„Aü^â ®]ŸËq«ÞŠœäÏIÅ/‘tVŽ}™%îcY—Ë– &2¬Mneš5ÐV®Éåuz;ø¡B¡øÇ
Ž•ký)áf>}•@þ5=
98ý4ûÚ |¤
][—m ½–|ä\¯nÐ]4²{ƒô1 6w#.€5>œ’‚3Ûqé¹8új1+çc8¹±µxÅÇÁ
³¡`+pä3hí ¸ùZ8›´C3^àMiÐ{[܃GÞn¶ú!qyÈã^ê×sˆÜ]Ê):Là
u’¬BAg(
ÂR²jÁ.Žm¥àiV€|’{œ¹GûÓ ]Oê4nB½~M¨×£ kß ÅžÄ‹ —äã¹”¯Y‹VÇ3ù+’ ä›”d¯«ù†N§; 4Hqn?7j™K´Ör•ìZlèu‰®6¸xå§NwÙà_ ë¾|…u_ý—úOÿĦO^ãÓßÐhòÑëiìv¹äYÖS¿3{ý ¾~¦Á?¦S¿ê¤ý1œ¹×÷~‰Í‚
úK|^Wö#÷ì6Çþ†2|'äÇn'V÷ ûÓ=t=ï~U•CÛRW_ŽÌƒ‡I³q~™×u (‚ à וh÷œý3éºæ÷?ΡÃøxÃë|°ì:=8‹¹â´r•ÞÒ9»Nom?T(ÿF ¿ h_âXSywÇtòYÖ}–ÂÞ¥é 9|õ±knÑÈc¨ .Eí‡ÑÓ±¬ô|„ÜÈ\² î)GÓ†FL>.ø^»>%6Øivp7bÌ*$0†ºãíRühHÔ {_å0›ã.
–2vå èP«¼t‚úù9t<–AÒ
ØÂ-¹VÇ̺·+~E‘‹Á¬Cw“mxñ(jHÏqL~w8Íüô—Œ8§¯}•y¯ŽdOb>…‰Ùñåc|þT#>|þI6 N¿(tÓa®;€*& e9—rd‚Ϋ)Í îˆ Èݳ”3…6rOí˜h„oÎ^Nì^ËñÝk‰:¼ŸÓÇŠÖäêÜñ)GÞá¬ÿøqæ<Ý—Õ‘piJÃæU.;ž*ƒ˜£Xûw!úê£0¤=îúË? zºU¨€Qç(‡ÁÍŒ +ÙÇ’èªõ¦Š¯ t ”kÑÙàÇo%ð²`@à‚Ox G@šzˆL«Fûh.WI:k´áE qsÚñáÿbOi§‘H6æMge6T +Ïu øçUŸžõ
dìßMÒ¹ˆÛvšÅ“~%³ù†µïÅàzi,ž»Óñ.\¬FA6xàqm£ÛyÇ×ó7¡tër~m¾Î· ÷7Гºs‰Nœk·&ïã`V}G¢êæé|2s é]Þ`ds31›¢Éw¢>yÇ×I(½º…–Z7RÀ¶ ðL÷0‚:Ì$¿ç&wöuj¹.4½d€{€W±{!®·NKoÇœï‡
…ⶢ½hXR
[\§-Ô,_ž+܉>aÃ-Üåªeúö<¬Ã\péZ“׶m7âc?Ã' ãHÐå@"k¶Ò¿…;]~kH—ëÒ§Äa Ò÷@3•H`÷~ŽaÔ¢ ì•2̘î:Íš]þô¹×—G¶EÐ#Ù€ °²kRjÑh¦s±%f• Ê{òðÚ:gð>{šé½9sÓlxž˜ôãdû@ß¼DLŒ¤ÌËRu~Tn×±íìÖˆo/§k¹ŠŽNýìRÖü¶Çñ¼¨¯Ø|¸ëÕ éø?i˜ G®Î _ Ǧveñ¡ p©Gë×¾ Ì-“¬ÓñäÚ¼ñ«l
ÉH<{åîxËIöÍy—jïý‡ÐûÞ¥Û¡X´9±(]!™GcëR S£é<5-Ž\»žöEüôƇ$E}ɶãÝi_³=½§®$#ÃŒ¿;Æáÿ-&ÃÆEs:Á4k µÓ
ø–÷¬œZ½ÚqJ‹ûh.Wi:—fCÑ—K
†NyŠ»V°ùÈi²u~Ôð½<3Y¶(²ÌÇ€¹µ{•`]Œ‰{GLfxù£¼?uÛEAˆ¾~2sNîâõoßÇ”6Ÿ—w^¢äŸÜL¤ýI†½;ŽÝ³·“áUª™Købù)M#ÝÖØLøöM–N[Âú·Yx›6£§ð˜Ï_Œ›´lg¾èyÇYwƒÁ=ø®ÓzN ù›¹ñ˜tÏifïOuLv9I kìOLøfË>XÍ/ o1ws<ÔnD †¡ó¥Ã»Sè‘´šÕ»£I·yS»KCüÉâtz¡sËu^±öîIÃ8x† k²+’¹”¯VÄŸ¯¯ëÓ²´cÎòC…Bq[ÑP„–V&¥ñÓðÓ 9nÃTÍ“:|¨ZÁNNlQG—Lê欎eá9d[Áµ’+ #Ɔè5æc)`ëÐC|31‰]KÓÙ3/‰ÝEkˆm…‚”QŸÆFH_•J"fZ=jbÏ3QlØRˆK-3žØ9»'— A®%ŸM á×ùÙœµ™ðÒ“ •Áº‘Gøߟֳ
#/‡•ÏÄsø„ <]°‘°Ïâˆnš
/Ž@¢X¾ú4Rp¥O_ÓôºÎ«)a&àG¶Ç\¹nÒ’NzJ.‚r1d çäš÷Y0ámŽ-
m§ØÿÑÃ,Y¼†¤´¿æVÈÛû>+× $×.~•ñõÕ‘’ƒè k {>|œÕö’eÀÇß‚ÄÍì˜=„ÕûÎ^ö,!'Mð*ï®ðÑ‹žgɆ„óAn©öÑ\®RtÖbCMW øVlÍ s–²aûnvÿµ†¯ 1ðóó]xjñÊ|0€-€noÍã÷ß¿á¥:{ø _gÞÙ}ÙÜvÞ>f½³)ïNÌ· ³ã*‘¢-~#F|Kt“·ùaé
–Ì OŸú~Ú/g±ŸaÙÓxhÆ)Úü÷'ÿöC½—òR»ž|éä¤m©ìÙ ±_3sk&X¢øqÆ&¬…øóx¾sõ±§²üéÜ?q5F}Éï+þà÷™½± ^Í–sG]èÝ0‚éõÖ<þØøÛ·¬âóÇ\ù}l?ÆmÎqn¹Î“Íæ7‡óñîʼðÕ"÷&^zAÉu×iYÚ1'ù¡B¡¸uôž·Šèõâ ¨]Ñÿu^^Ò{™ ÛX†v48ùYF©õ~„LŽ½W^šQQ"š»K¹ª®PÃ,*]Ðᶓ›iC§‰^: ´I,És¤¥û5ü½K˜¼)’·¨›xkHïÑ|ºÄäï”15Mw)¹ñ¢üP‰’»Zn©ûAõåýòW(åò8“î5Ìø¹)ilÚáäûôìVŽ½ É·ÙÕ02„G\4B>?’÷^ɾ-ú¹©6t:ª´kŒ Hß²’ô;îVBeŸêó>uhæ…¡|[Æ|2
û™¥êR(?T(Îá–
–u&áÔ–<|¸ ¬‹…Ä5©¬ùoQ7bÙWa!‡&þÍáM”7ã hÀ`±r62—Û5 ¹é6t†Î>-¨_Û ÄpdG,6õ^ÞAöÎ,hiÁ{‚Gã×øõÏ!YÙöåt·LQ~sÓ17aƱ ¼\|’Íÿ*G›g¸«Gù¡Bq÷Àz
…Bq½‰™ ºaT2w’„Œ¨ ?«>‡
…
–
…B¡P(Š;½sr ͘˜=&ó e Z>?Ï׿³Êu79¸Kž›ö£#T
bbÀ'kX;½ Êʆ
…j3Š›,ËÑöéÑ<Ù¡&g(å]‡ý{QßGÿÏZÇXž£^bdç [¨\zÊ÷ûž8k:kFÕ¼¾Ë n§¥Ê3ìAŠ$c~ǵ̥ºf;F½4’.A¦» ì¥ø†Á›º ;Ò¢ºgÙÕº…ßåkõk{˜³mèJõ‡¦³úX:V¤à Ç7̤OEÃ]ðV»Òàýhĺ’Þ>e¯Ó›Zï·cÿuÍÝùíßfÞš}îÖwkÓçfúóü‘‘êcö#éßÓÎóÒŸ‡>·ÉX@ÇÐ:¹7ù7‹~›JïŠFî$œS.^Õ 1øæÏÝÐ¥ØNÿăõÐ Éý| {w}Ñj/ûç7ã]¾}ÃXí)æ/Ã=>`P綴ï=Œ·¿]O¤“×õz4|‰Ÿw''‚ˆ…Äß1ª±w.‘¾}`-°‚%‹”½NoÕz¿Sû/Õç^o»z«µÏÚô¹™þ|+¿;¥hd'?3 1ºaº¤UÕat5"ygɳ«òæb!jVGêl&ãà!òîšb§u0
\
9w·U¹Ö²+߸Ý|ÃjKêèŽ1ýé,¬>žº2(¤õ].͆NL5<«ÌúcCöY; jñÎÁsö±°¢—O™ô)Ý °œŻÓç±|Óv¶-ÿ‚I?Ä@@(þšgÚËÐhö §RÈI!ýŸ>ŽXK{XZ¹œÒ9±]ÕèZÚÌRû8èÌTïû6 þŠ!»È6…gòýÃÁFîJ+—–>Nc]”“8«Ï½µúnú”ÅŸ•yä—xlyû™ÖÆ]Yß?'öZ|þZ)ñÖ¯n¿KNÁJé탸”«+÷6¨" zW¹ç?ÇÅràe©iºp»‘üý‰<= ‡të7Rfï*IŸ/=ütçóÒyÖ•>÷‘Ž-›IóöåõÿK±ÿ%ÏU3:ÒèÜ¥RºÒtØ
É•“òQïR¯^=©W¯®Tp)ÃzžÒfnŠHÆJyûáŽr_³û¤]ÏÉÈam¤œ¡([#™#’øi q/ú;—:¯ÉÉ—Åݽ/¹µIÒ×Êôу¤wŸÇäßK’D$R&66k–Ær™ïýPâÄ"»g='ƒút‘öí;IÏJÛJEö1úJhX=©× ·Ì<)’1¿ƒxsÓ”ìŸ"õê*=Ž’O÷ZD2•~ú¢[þ¤ûÜÓ"rL~?Hztî*÷¿ø«œ¹¸ì¥Š›Ü;-VlÇJM¢w’šÕˉ«ñh=WR
ÖÉÀ } ôü&QÄvX¾ ó€tï󄼿&]Äò—Œ
sÕ^—•ïªe7É E™"…{äóç ^†É[?FŠLåB0†Ês»Edç3Rµ¨uþýdY¾ÈáWj‹‰P®2Ü"vÕ²—Á7 ·¹JõG8[š,¾¾xèÎùª´› -’ó—Ì ÑSÚ¶í%Ãgm—Zž¥%^—}êHˆ‡^»>ZÚËÄæò[Jž4cûP IDATì|³áy¿Ô"šú‚2ú©r ýD„x\K–%M‰·žjhµ”Ë)ý—ÛU-¾¡©ÍÔÐÇi“„[*™"»dŠŒ~´¿tïÖK>ñ´¿ÏýÚƒ‚«ÕE“rJ2d~GO‡Ý«>-ÛEdÿ¸¢Àïš‚8½?µC¬‰ŸJ w£Ôxq¿HÁ
¨—€k%ÿô§Ò 1†Ž’"²ë…知óí"ß9óu[‡þN
–M5^”}b—#«ˆáº‚S“Ôxq¯ˆm“
vÔ©G«/%EbeÚ½nE¾ëär]o0XßXü°t·JÒÑòíàêâzQC•²Íš)¿ß_Nôç~nª%cŠdýÜÙáóe’|^“
d -ÏÒ¤Þlûhn7@\ª•ÿ%fÉÎ÷ÚK€¾lºjé œí?7#XÖÒ –¥\××9±]ÕàšÚÌ2ôq%ŠW{ù6U$gù£l(.&(Ã;XB wuQ\Lr½}îÕw—íÝÑfC©Ük¼L™8\šùé¯ÙGnv{X)u¶Ó–•D–݈9à>žl•È’ ! éŠÙÕ@Aj*yÅœÒ\˜°Ÿ|©ìgºh«oüô'Óò±ÙrIÚú
0áîæäIWIgåØ—Yâ>–u)±lùa"ÃÚ„à¦sBÞYXvІODc*˜nð³œDAÂ~𦒣.Üjv¤.1,_ { WzÛÉ8~”,¿ÚyÓeP8¸´dpÓ@*„Aü^â À\³=uˆæu§Î?KÎîä·}vš4¥¢7\»UoE
NòçÖ¤ë¼åÎB̯sØ¡kÎ+`À•êÝÚ˜¼œÿ Énn¹œ>ãÜû{VOnɶamöã .^²j®Õ‰z/úýš|~jR
2% <«VÆÓ‰¯êÍ´¡–g•EŸ’lxËÚÇX•a?Ì¡ÓÖaô~k ©e\c¬¥/¸™þã´÷AC{xóÊusÛUMm¦“ú8—Êmháogۗˈ·9×ç/ïã´r£b’kÕçæôÝ7‚Bâ–NfÜ_°=ýÆldû§ûÜR=Âz6ž ›‰
mž¢Uül&üg=AßOM/8—^ìµÐb³`C‡Þ ;·X“1KVðnëS|úTWšÝÛ†¾Ï}ÍñR,!gÿLú†sßàYì x7Ä»d4õÝuçÓØì`p1–y ‹N§‘2<ëF¡1»
; +ªmÁˆ …Öë»&?v;±º`"÷ghèzÞý*…6CÛR·A92 &ÍvAO])õuuqi6‚ à ¿~»[OýÎìõBëgúìB§~ÕIûcr/µÿM)—“}þï[æ p¡ûìox±±×%)u:=:˜3 ááá—H݇#Åî|=u7Ñ&:'éS’
o]ûäsxΆ¿¶”¤køšÔÒÜ|ÿq‚…5´‡7³\ÎkWÕf:©³Û±‹ó}þ²>N[ô~-1‰ÎIúü³}÷5ëóÏ¿ÿ˜¦¥,g&f
¤ýÈÖ$|¿„ƒ›¾fK¥!<fâllºö¯smºFÀÁ_áÃ_7°kï.¶lØMòÕ^Í‚l
ð Àãú¾î¤ m >à™îau˜I~Ï)Lîì[4x˜Nl:ÖEYŽôÓù5ç†zRwî Ñ¢ñYN.ö² À=ÀëšÎ.ˆÛE ¡th^þºŽ¯±&ïã`V}G¢êæé|2s é]Þ`ds31›¢ÉòŽ¯çoBéÖ!ä¼®:ß&Üßà"–¥.ÄJ¾Ì¾ Wèžw|-‘„Ò«[èõŸai;ÍâI¿’Ù| ÃÚ÷bp½4ÏÝIÖùg9¹\š ºø²—Å7
cò\«¦ŒÙܘ)›–ñJcÏó
ÆA´°}ø0‡/’È“g‹ý8.þ ,Þç5ÙÐIöÑò¬²èS’
…ÓícMçèÞƒÄä^[G«¥/p¶ÿhòy-i®³=,K¹®·wZ»ªÉÇ´·™Zú¸Ç ã·°#Ý@‹'»d¸9>_b]”!&¹Þ>÷Vë»Ë¢66Òs “ß N3¿kïìnjqMð%‰{KùÝž#bÙ&/‡¹”áYÚÊ¥}§´û&U¤p—L ÖWz?4Bžî ìÈGK]«ÉÈu"»åÓQ¤×ýCäÕoˆ¥¬ëž !2|‡ˆHª|ÛÑ[0Õ–ñDDdV3óe6ŽÈ7/=$½û?%“þL±l“±çl¨¥.΋tû%K$o³L|´ôZž¥%:ižVûhm7\¼'Q""éó¤ƒç5¬ÛÓÒ8Ù´ù¼–4%mvÒÐ –¡\×Ý9]ÕàZÚÌ2ôq%‹‹Ô õ§ä‰Hܲ©2zp_éÞGÙßS-}œ–º(CLrÝ}îÖwkѧ,þ|½üœØ_ܨ5Ë¥ËÆê2f¿ˆìyAªÐ‰_ÏÿI–¤ÈW=Êà¼:1×þ—ÌXõ·¤:Œ*–lIŽÚ$ÓZ]¶ ³Ô}òÙ•lu¤Ë9!ËÇ×7ÍMEéùÁ29”b‘sdÇn“y/·ºtS‹k5ypÆZ‰É-JdÏ–„ƒKåõ†æó;…|¶UN¦ŸË'Wb7})Ï6ó»°ÉCë³4”«,•l ³·%‹]D$?VV¾Z”Æ×ØN^]x@Ò KÌÁh±H®üÞÍ« Îc–&3N‰ÄL•{Í$äÉb)øCî÷¿¨q«!N[%Q9""VIÚ9O^léÁ†Zêâ’MJÉÜ=Í%/æBÙAp
•þï.’ƒ©¶óuvúÐyù^ƒ„ ùS
DäääFWúŸ“Ë¥EJ,ûµø†_Gù8Vľû
‰0ŸÛ¸TI:¿òƒl‹;§tž$îž+_ËnâRÞe-6t–}´<«´4ZmèŒ`Y£ÎZÛ
cåÇä·$»dn 'õ\¯Á¾Zú§û6Ÿ×’¦ÄNZK{¨¹\×Ù9±]Õ䥵™eêãJÈò:N”ÿí:%ç¬hK;*Ë_k ý=-SpZR]”%&¹þ>÷Öê»5èS6V–G&ˆ=ÿ€Lk[†S“n@ñÏËJî
ñhù¹$É)™ÑÔ¬ìq±]šO—˜ü2¦¦IÙC‰Õ *Q¢|õ.u ç݈·¦#ž¢QÚ!Ž%åáR©)ƒÿýåcf2ÿ°ºÇGïS‡¦a^Ê·eÌ'£°Ñ™¹Qå7
…j
å«w)ê«ánS5ybÁ!I=7«V˜,—L’kš¯cúäίßH¼ˆˆå´lýô©é¦l¢D‰j•(Q¾z·Š®è
…B¡P(
…â2ôÊ
…B¡P(
Åm,ëý[òÜ´ a¾ @›1 1{LfåswîËt'øªB¡P(ŠÛ+X6–kǨ—FÒ%Èô™¨|¿ï‰³¦³fTÍbn×{סCÿ^Ô¿ÚíÆr´}z4Ov¨„sJáJƒ÷£ëJzû“D§Ç¿²7UŒ7¡’5èã$;_/†*Ï°ûÜuµ"dÌï€ç ã«
…B¡P(nr°l¤ú˜ýHú÷´ó¼ôç¡ÏíA2ÐÑóN7‘¯já„| ó/öÖ ÷&ÿfÑoSé]ñf 0"X ¬`ÉÃ"W×ù¾©]IÞÙEÃbtÃtÉ]®:Œ®F$ï,yö;ÝD¢fu¤Î†`2 âÖ8œÅFvröì²mWO¡Óën)}n;[Òˆ:˜.…œV'í(
…B¡(}©ÁrF btÅxy°ìfº4Xv«Î“Vp4S)$á¯oÝÂï’*tbüœ%lJ!ÛR4n‰ã§>œË^ï݈g¾ÞN¢UÉáè/OQýr¥ýZ0fÞò‹ò(<ËÉ5¯á¦µØ^tû=û¦A”»,¦t©7£–C¼RÛtaÊÞšÎß»rôÛ«LÙ{¶ç‡³BÖš‡ñ"Œ÷" ÎOñÿýVÝKFuÝzýÀÉBAÄFêþ…ŒoíK$ldœJ!'5†tË¥õ4¸ Ö¤ÞlìxrågÚ“ÔkR?¬"hf>gg †OiMÔIÇïR6¶`b/wÜ.Ê˯q(S¿hÍ¡C½ ŸÔëéž šU‘@½}´¡ÉΆ úÏþ“Cñ™ØÄaÃ3ûòj»ÀKG¡ufª÷}›Å]T…gòýÃÁh ówkÄ”!ñÓ¸Ÿó‹:¯qDòYÜÝû‚ jðULAtyãgö$[òã6óù°úxêTã£P(
Åí@©ñƒ%;|½;F ¸”«Ký "$at5^IÔÒó³-,|,o^ Èè(oÚù6†áR¿-S# GH/ž Þ”Ù/òÔÊ¿I̲ã àGöÎ Çùu† ú~=Ÿôˆb΋ù¿x Ï;õ/‰Ni5m1Óûìá!X‡K`(aOqZs fáLÔ¤f>FH5Q½¢…¸èŒþ¡øÙSˆJµ`˘πºëqwÎÓ‹3äjYålglÓzÌh3õ_…ñEŸ~|~ÂùIQ\¢RÔϼþÚb¢mUè3a&“ÌêƒYž^öµ 9{fóæ¤b
/þ© ŸÊò-6‚ëá ¤d°ñ˜;`MÈ"ØEg쀉Ð'²÷«žœ]:•× ÛÌÑ žA•‘]g°:óÍÑâ«: ÚMßÌÊ'’™õb_^ˆÔQçÁ·™ùÕ*Œ'ëðÔŸêÜF…B¡P(nJ<ˆÙ½Õ’\¸Nî÷÷•n?gˆÈ.y¾š§4š|R
¶<*tˆ1t”ì‘]/ÔÓ¹œ}»ÈwgDÎ|ÝV<5ÞÙmªñ¢ì»l YE E?s©óš ‘|YÜÝ»èny¹¥E$jŠ´ 0\ãÓz ~j‡X?•îF©ñâ~‘‚2 P/×JþéO¥…ûEé‹îlϘßá|Y.ÏŽ $SŽÈku\®üýUî|77)ñ’&ßµó¸h¤åô bMê'Ñïø\vÏ;âÕª±¤$õkt \I'`ã:‰5©ŸX7Ô’Ú&‡Â_é,Ö¤~’÷K°›Šîªws‘Š>úsðwIv¾š
›ÌS’!ó;z:Òxµ—oSEr–?*Á†ëx–[#™#’øi q/Ƶøª¡ÊÙfÍ”ßï/wáîzS-{P$ëçÎâ¥zW¢D‰%Jny)u€-+‰,»sÀ}<Ù*‘%;BÒ/³«‚ÔTòÌ5ÛS‡hþXwêüHªœÝÉoûì4iJE‡¸UoE
NòçÖ$Š]ú*é¬ û2KÜDz.%–-?LdX›ÜÊ4m'ãøQ²üjäL—AáàÒ’ÁM©ñ{‰/¸±_(… ûIÀ—Ê~7ûä=ÁMüðì»cXqZ ‘ËNs f9ê¸_æy²Š*Öž_HbƱP½ a? xSÉÇaC—Êmháogۗˈ·ÝØgkñUsNÔ3xÑï×䢥#‚ eJ8xVŒ§:å\¡P(Š[žR»këÙx2l&*´yŠVñ³™ðŸõ=~?5½àl\úESÛ:®{¦‚C‰›Ó„œý3éÌ}ƒg±/àA>ÞGì’ÑÔw×®A~ìvbuÁD4îÏÐÐõ¼ûU
m†¶¥nƒrd
§Ã»Sè‘´šÕ»£I·yS»KCüÉâtzv—å gÝ ÷à»Në9}äoæÆO`Ò=§™½?õÒ©uk
{÷¤a < Ä5Ù É\ÊW+âÏ/;É?¹™Hû“ {w »go'ëU3—ðÅòSXnzµÚˆý+“‚ánxtoÎñÝ9$‰ !¶XÚ¶>Èî G™¸#˜iM+2W7&&¨ l
øþ½XNXþ!oÔ`çÉÚÌ¿ßZËÀÙ?ò×â{™2oGS-¸T¦|ʾ^•p!@µ¤p02Sï×ÿ¨ŽíöJÒØN³zþ^˜<™/Þ*dö¦$\Â_â‡Z|Õ»€×ç¼ÆÊwÖ³²Âùlù!Rñ%4ÌÝs>g{ÆE#àž˜ôãdû@ß¼DLŒä
ovV…B¡P(e¢ä…ÍÆê2f¿ˆìyAªÐ‰_ÏÿI–¤ÈW/ÚœæVC œ¶J¢rDD¬’´sž¼ØÒÿÂÆ&
ü Á5Tú¿»H¦ÚÄA®œ>´D^k`vüÞPQz~°L¥Xä Ù±ÛdÞË$@_–Ûfi2ã”HÌT¹×ìØòäF±ü!÷ûë®Ho ³·%‹]D$?VV¾Zÿ²sf©ûä7²+ÙêP*ç„, _”æ*›Óô‡È6Yÿ€ß
Ú,ç!Lk+ñ§ú96îê)ÿRG™‹žïí+#?l#ѱŽß§nn!ïõò¸¨L6øeWþ¼Þ7ZŠµ³Vê<¤Îƒå»NIn‘ØÒŽÊò×\±ÑÑ¥úc2wOš#Q^Ì¥uêZM œ±VbÎebÏ–„ƒKåõ†fí¾
‚©’t~åÙw.£¥µDtü.ec ™ØË]ÜÎ?K'~CeêåСÞò8ÝSͪ(z-åQrçÊí嫆*ÏÈn¹@Æüây•r™B‡ÉoQ™b+J—yl•L*®ªÎoO1„ÈÐ? Dâ>–ö¾ºbÓ•Zï† é?ûO9.MÎì_(¯¶ ªíU¢|U‹¯úöýC2#ß’z.W–«äþBÉÝ"FMá´GC†ô3³nØvR¢ø)nC{†ðÙÇ'±àI«i‹™Þgï éÄÊè<\C «xŠÓG<ž ŸÊò-6‚ëá ¤d°ñ˜;`MÈ"Ø—w“rJ2d~GOÕö*Q¾z=¾ª¹¿Pr§‹†5ËfîÜï óØvV€<"]IFÃÇé\±h1¨¤³rìË,q ˺”X¶ü0‘amBp+Ó²#=ÁMüðì»cXqZ ‘ËNs f9ê¸_¶Ò(ÏBVÑ×=¿Ä 5´qwsçúª)¨oüô'Óò±ÙrIÚú
0áî¦Î5¸-G(ì6ìrê½ a? xSÉǤÚ^…òÕëñU§ôŠ;b†¥Ôna<Ð;N H² "BöÆ')gjÊ#mŠ2röϤoh0÷
žÅ¾€ùxC ±KFSß]»W]íeÔé@ ‚¨ªŠ;ÞW¯¢ƒK Æ,YÁ»OñéS]ivoú>÷5ÇU߶X’"I$€÷úɵֻ݆ Еá;Jµ½
å«Wš3ú Å],»TïCÿãLêÞ€ððp‡ÜÓš—vèhñH |/ò)H`Û‚x¦{A f’ßs
“;û^ú%™ãøªó¯fÆ£èo]=
±¿#4@ß°
*è@g¤Á€ ª M!R ¸S}Õ^@v¸xqÅ‹¹6]#àà‡¯ðá¯Øµw[6ì&YUùm‹-i- öBãqÏÓÌ«˜N×Éõ®Ú^…òÕk ™5ôŠ;ci¿é<€šéX²i?‡s·%Ø çñÑÐóÿø3Û—ïN¡GÒjVïŽ&ÝæMí.
ñ'‹Ó鯘·ûW&ÃÝðèÞœã»sHBl±´m}Ý;Ž2qG0ÓšVdþ®nLL6P=Øðý{±œP êwª¯ZSØ»'
ãà L&¬É®HHæR¾Z%ÿ¿GMà™c_²-! —*
UÅßžX¢øêùiŒØø2ë6•ãi Ù•¤§Bxkš~Ë+³’ïÔzWm¯Bùj™Ñií/wÅ/jÖW’!mb]7HÊë.ÛHÕæk9# 2«™Y0T”ž ,“C)–óG`eÇn“y/·’€ËrñG¦µ•øSEG¹œê)ÿRG?ÆWF~ØF¢c ¿OÝÜBÞëåqÑ"ÿ ÷³¿+~£€’»\î _5† ÙÛ’Å."’ ++__”—N̵ÿ%3Vý-©…EJ[²%9j“Lkå©êþ¶ƒÜ7J¾X%™EÕšwj›|?¦‰xë4ÖûU6Mé+‘m"²þ?Õö*Q¾z=¾Z–þBÉ -:@FS(
…B¡P(®‚ÚJ¯P(
…B¡P¨`Y¡P(
…B¡PÁ²B¡P(
…B¡‚e…B¡P(
…BË
…B¡¸=?-ŸŸÆŒçëcVÖP(ŠÛ XÖéñ¯ìMD£Šæ·67ÕW]ið~4b]Io ezÅ…f¼|¿ï‰³¦³fTM\®% cy:Œz‰‘ƒ0Ývï…Bµ½
Å-,ëp¯ó ïý¾¤BA$—Ä}‹x`5\®’û¦v%yg
󸶆_q7· w°¯
Ö+Xò°¨ •¯^ä‡^Õ 1øæ_ü•Ä7
#|d IDATÕ†+_U>¦¸³0jIä6šå{fÐ2êGÞyê-v¥{Pã¾®Dxé°ßFuçºâÚ¸³}ÕFvröì²mª®•¯žÃBÔ¬ŽÔÙLÆÁCÜ
7S«6\ùªò1ÅF)7Ø„ÈÐ? Dâ>–ö¾ºbÓ™B‡ÉoQ™b+ºå&óØ*™60T\/J£÷k!cæí„ü¢D…gåäš×%ÂÍqPÐàvŽÛz®&"¤ÙùÛ{|dø”ÖuÒñ»”-db/÷‹nïщ_ãP™úEk9t¨÷…¦±¾n9 S¢¤Ô‘e}….ŒìàÂþ§±élñs¿Ö3[™ûú#ÌŠK"Ç¥
^ú„‰?ÿDtVÌŽ¶ž´š¶˜é}öðÎN¬ŒÎÃ%0”°Š§8mqÄìùñ©,ßb#¸^ ¾@JY°Ö„,2l€É“æ·eJ=X 8«§Ví
¼2·-U†¬eèŠlèêR“1}=.+Œ K!¹võ…t'r7øjΞټ9)†˜ÂËKUšÎŠÛÎWõôül Kã›—2:Ê›vc>ä£a¸ÔoËÔÈl óPw=î®ÕyzÑb†\%SÅf´ªü7¯w Câ“¿2wà!Æ÷ë‰þÕÿñÞ'òSËO‰9ÿÌtÖ|ð8¯G›h:r*þŸ½3‹ªÜÿøçÌ0Ã6ì.ˆä¦WP#CQ”pE…4›Þ²L-¯¹¥fj™ý®¶!j¢•VZ©×%˼ššæŽ"h
†(‚ì0,ƒÌ0Ë÷÷Ç ›¢ †8À÷ýz=Àœ9ç™9ïóÌ÷yÎyžïÿƒžê…%±eF];z]v¸ú4"_ËEÄÜÌNà5þ¬ýö0ÌR¼0åh§§mÄvUê63§ƒ|Ý\L‰¼†ì ¬œ ¸`8Fž/“rŒaŒ Y¶|z
¥S>m `]¿(Üc&]¢r:8ÒNÿ?Á‘ÆDª‰’Âh “ø9èû AšœPJ^fW¨/6þ½IžJšd?šÐN @L> ‚ô=Â]ÈSR3/|Ù®ä*1ô4-¤äl'â^R3--ÚU£ëÌ¥©¸jæ1ƒ.QÌìN$1üO° B?äåm¨9‚l®mdÙvø>ºSö+°9?Ašâ ô¬LLnÓ.&û+êkUõþ²½Ãȶâ½6´1›èöŸ%c¯F¼.ÄîÓ(JSL¿Œi]9ÒIš GT²kð}ëÌåÑ´«–O¢4Ê¡
}j y~Èóõ8 ãÂ¥òÎm‘´N ¨Î ºÄe–ì<‡”%´Ú;È9» >ÀÊÂp*DäüyØo5 ÈSqfÛ
L à‹z=v$‚«¯ èboáPÐ"á@R skxYÕ|‡¶LÃÈšNYŽì"î.6Û^_KvµAê̘’«–Á ÉøítTÜ Û°çO œ|Ÿ†óC,[¡Ó ˆ FˆD¸¯"%Wp N ;ïÞh+1òÚiÄë²Kº‰mús.´D "Py"º²í!ã%µ] cÏ—)9Æ0UVÕ:'Ùp‚Ï?ZÝ–µÔ sö ÂòþéørÊPôyj BÞÚŒw
`—^^‹Wô?Æcý‰4¤îŸ… VÆÿ¢×vÁ
ô
>ˆï»µXZ¶«
SgÆ„\Õƒú½:¶Öi¡ÕêŒvOTnlÔµÓx×… ˆ ÇöB÷îÝk”'_Ü9Ç;ìjœ/sŒaŒ–µ9Ç°ãÐ{ÁLô±¹OCl鉡Þ@ܪ…Xõó Ä\ŠÁ™±ÈMbU&¢v|‚éûÂ%p-”Áaøl°}mT¥úVÎñ KXi.à :dD¢ €¨§;‚Ú
€`Ÿ±.è ‰r$”ñIm©°«ÆÕ™i®–Ý8ŽkðÀ°@·Êµ{_Œñ!ÿB4²«?‹®SA¡¬œl ¸NrážganÿO UÜ8<ƒç{V;V=®Æ¸.Ên C\àCòÕ«¸Z$¤Ü††5k¼vµ¡Î—‰9Æ0Ô½tœ: ßÎ Ç´“óðÇ©ÖX¾19"´íÞ ¾åßcáº8(•7q2øpÆRL¿þ
¢2•º÷D+ Ù•-¯=—‡aDÎ ‰MF¡ÖžCzÂ%È*¬>[I‹ÔsÅPMµ€õðgp#¶9$…›6ýãˆÑ®ÚÛc†aE® ]Í ¨°å£TÜäÉL-x¤»jt™&ãjê,ýþ=ü¾ _‹>À0+ /ÛÂO£P#ÞÕÈqébÌ&,ÅÒÉ„ßÎp+þß Ê¨Wµ,<uæÒD\Á¢?LI¥DDʹ°•æös¬š U}"”ÛXZ•K:""e*E¾Ûƒ,îšà‡jÞ¹L>OšÜÔÏ
± ýê,¥Vøs‡RO}CÿîãPíXF\;}]HÚÑà…Û(*íNÅ7HÙ±›èW3ö«‘]k‚ŸqçË ã àÕu†a†a¦6x¾0Ã0 Ã0 Ãp°Ì0 Ã0 Ã0 ,3 Ã0 Ã0 Ë Ã0 Ã0 ÃÁ2Ã0 Ã0 Ãp°\ ÛÛÂÛݬ>„9|>Ni"1ÊŽ¥a —‡ î2ìªiÂqË`å5 ýò'rÊ Dwýç^|<î ˜?–j‹ÑwåPä^ÄÞÉÖ>òã4*
.ƒšÚ3]™Û> I
èˆ@¤CQrv,ƒÎ–B3ñaWÙU†]5M8NhñÁ²y×Y8xitŽÃÚ)¡ò:þók mè [ÇShÄ£i¡È-N!‡BËÒ˜ì`„yxv´FÌ;Cà 83¿¹Žn‹~Æ•ßæ ›EsðaWÙU†]5M8NhîÔ‘Ì^=ª"J[Oƒì…ûn'nDïlÜOç“䤨H¥N££H¨ÌÞãBC–좋¹""R¦¦
“{L¨ÚÄc2íI*&aÅ×Sø827d÷q™0PŸ§¶rÅ›úTfï±£©aý))Eÿšü¤ iU-{@½=hå×ý)>~TÕ>²‚)>™ZÝ•õÌ>ä7*NxŸºIïýì"?š³5š2•†J—ߦ”ß“·g½iÌ"vŸN±¤¦C#í*ϱM¿Õ”BJ:ü/WlkÑ‘žÿô%•Sæ¹ïi–ŸCͬh‚%u ù€vœ»EŠŠÓšG[^t%³Çè!vÕä]}`mhØ/wHwêŸÔZ¨ùH»-¥Du<-ô”°#ìj“t•ã„æ[Ìê¾3oJqyn8Nݾÿ½©ÛHÌœ: òus1%ò²Kt°rr€âB‘>E `‡«O#òµ\DÌ
Áì^ã?ÀÚoÃ,Å SŽê·ÓäŦő–ƒR©;‚Þþ+víDr'¬KÖ@™‘ƒg´píæo{ ò"œ¼®†€&³EZ fo@˜¯Ð¨p=U„.žm±pS Ü' ë‡TÐB€ËΘb}×–ÀQ]Ž;w
™—^\‡÷>½…[åwrüÃ÷aõè‹X6)‘Ée¶ò@WçtdqþùÇÞ,‰þ_þ5Ë'õ…ý¶Ÿ/´BðWg°ûå|7o f%ÙbàœUøüdWH{`e‚
€ ¯íÆ¥oƒqûוXüòi$ÊÕ¹´ÅäAzl 2ìªI»*ª«Îjä%å:»ÁÎ È—¸ £³iÉr˜9zÀA'GR>7œìjÓt•ã„<²lùôJ§|Ú<ÀúÁÛÕ‘^ì>¢4Åô˘ÖU=MIš GT²k0ÙÜ/š÷˜I—¨œVöjõyêû AšœPJ^fW7©/6þ½IžJšd?šÐN @L> ‚ô=Ë]ÈSR3/|Ù®ä*1ôþ,¤äl'2¾Ç!8Ò˜H5QR
ts̤F@@€- P]}—¼$ 3tˆbfw"IEÎwû!ôC QÞæ ’›Aô}>QéÁ‘«øAÇ4!¹°«&àjÝu‘ë”hÒdI~VfÔiîe"Õ!ÛJDN㎑2ëKò³b?ØÕfæ*Ç M¾ÔùÌ2é´ÐðwŸW·ì„nb„þœ -ˆTžˆ°î€¬C{È 5‘¸ Ã’çR „V{9g—ÁXY;'VW_8 ÐÅÞ¡, EÂ,¤ @çÖð²ºëI£25J ½;² ÙEõΣBDΟ‡ýVóñ‡<g¶Àän°àÇM AB,;‚’ñÛ é¨èÐÓí Øó§N¾OÃYHÛ€Ÿ£Qß @ÆC?{ÖÈ 2ìª ¸Zwu(º‘ˆO¸È\1äŸÝi?LxºÚvu2.!CÅ
°«ÍÌUŽšÿhñߺ¦D‰c{¡{÷î5Ê“/î\@ê…9ûayÿt|9e(ú<5 !omƇ*¯íš €Ô 3U ¥—×"ÄÃ}'DàO§ñX"
©ûg¡‡_ ‰3þÑA
mÆuäi*mÀÏŒNß=$ ýM3ÓC†]5W \geêy¤
®ðîý ^õ8ŽåßÊ1àÕ <éÓÅqWQÀ“£ØÕfç*Ç Í>XÖæ ÃŽK@ï3ÑÇæáOjÙcH€ ¼uH¾zW«•„”ÛÐ €¥'†zq«bÕÏ's)gNÄ"·–ý©Jõ½CÇ',am¨–¹L 3è]ˆ ¢žîj+ ‚|ƺ $Ê‘PÖð_$©2µãL Þ.k¡ ÃgƒíÙ°ÇŒu¯)x³[9Žÿp· (»q ×àanT4—ö¾ã#Bþ…hd«òŒ3ˆ.Ãïõáp©£‡hj 2ìêãtÕ˜:krÿD\‰BfÍ@‡Ó«ñÅÚ( ²oì³,‚=®øš>›õ"
í߇žî;˜&®8N
Ê£Mu<çÍåQ<[G½ ˆžé7˜ÆÏùŠ¢DªÓ è – ¶¢àﲉ´Ñwo¿@£ž›BŸ -$RGÑü®Rþ¤ÔyÆQ*#¢´+iÖ„>l…N˜FS‡¸™)zÈ…]5W©³Ø¦FåÓ÷ÏÚ$žôÎ"¢LŠècÉ~°«ÍÏUŽšC1f#19õA_ÿ‘DņUOÊÒ£hË _²Œ –‚¤
^¸¢ÒîTì…²c7Ñ ®f•¹¥çK´æð5Ê/¯X~NA¹I§(Ü_Vs_Rkš @é†%aÒƒéÚ^Ô«ri{zcÕ JNÕ¿žÚ>i]m²@)bg
þä ÅË+ÖË#R¤FÑÖyþäÄË~5îømÇÑΛ¥•ç¡8%Švþßóäiu×’‡h|øaJ*%"ÒPÎ…4·Ÿã]K Y“×øôSL:Uت-H¤ƒ‹|jN81¹°«¦âju¶$ß5éD·VÒS–úß·×O’ZõqØvµù¹ÊqB“/Â} b†a†a˜ˆ¿†a†a†á`™a†a†a8Xf†a†a–†a†a†ƒe†aj\¸ŽýðVøç˜åmÉ_î2 Ãp°\ ‚ŽímáínÆ?Óâ 3k=3Þ~C\$|ž˜fìª9|>Ni"1ÊŽO3ûÌ0&,Kà¹ð*ˆèžru¡' ÏOµ}WEî…@ìl
)ŸG¦ª•…õ“/!ìÀUh D:&þŽˆ OÔÓvŒaW ?J¨Ë æEN Öý7!’°¼‡yµÿÚaô-èÂ4¸‰ù÷iþ˜½¥êÞœ‡¨ÒŠèp'3êÇÖñä|ê̽Xt›‹C±áx&ñ;,zá-œ+”¡sß¡è^ª„– cØÕ&†ŠÜèr(´ìL‹éFrÛ˘d×ýEBž ¯•ì¢ ›¤ÄlDïlÜOç“䤨HR£N££H¨ÌàçBC–좋¹""R¦¦
“{L¨žáÇ’:†|@;ÎÝ"…a7åyq´åEW2ƒ@.R[ÖR®xSŸÊ ?v45¬?%¥è_“Ÿô£#ªeøÈ¡·üº?ÅǪÚGV0ÅG8S+ΪÓôŠØ^=VN”þÚß?»’Äc2íI*&mEFªë‡)|œ™¼hlÇ \ŸŠcõ¢é›ÏS¶†ˆ¨”R.'‘Š”´o¸mµ ™F\_\ØÕ&æª}ÈoTœð>u“Ö’]ÎÁæl¦LeÅÅmJù}1y[°c
U¬ûo¢D ?`Ò‹1×î6/W ¥—×"Äc7žó
&½:ëO,Æ'f#h|®Üᆾá(Cf|,b®¨ ÛÁ¥HØóï;Ó2h´ñ¦²Ç xë|õ*®V+ )·¡PžqÑ…bø½> .u,G£*Õ·¨ŽOXÂÚÐ.›ËÄ0ƒÑ…( êéŽ ¶ ˜Ág¬ : @¢ e|â›#ÚÜ?ðßX ÷¼ÃWvŸ kKO õâV-ĪŸO æR ÎœˆEîãr̈úè¯ Œ æqße”Œ¹¾vµ9ºJªLDíøÓ‡w…KàZ(ƒÃðÙ`{–¬1Ciþ}gš9Æ,K Ðé Þ—Vk¤Ê²‘x#*#zršÔ X¼q"— GdÛÿૃñȇ=<º: vãœ/" ä4>|ÿÆû/Îí{
a[O 1_
s§öh#ß͇3
©©çŠ¡šjëáÏàFl)rH
7m*úÇ!6:+¢]þ´3¶Ç Ê\1:ºšPaËG©¸É“?šépÝMlžŽé§ÞÁÑ£vX ö3þ̳¿«¨ðVy'g,Åôëß *S ©{O´]3œi ÇŒ¨&u'–~·>9‚ ßǦӀg/8¸QŸë‹aW›“«‚=—‡aDÎ ‰MF¡ÖžCzÂ%È*,gÇþ}gZ7Áˆèú2ênnÜ? I;¼pE¥Ý1ì Œ²c7Ñ ®fÕ&mX“×øôSL:Ul¥-H¤ƒ‹|j>è/µ¦‰á”‘nX&=˜®ýèE½*—–±§7V
äTýëù§ý裑ÖÕöQ5@ñC²åØ›IS«þ³iÓ©”Ê¥‰Ê²ãèàò ²ôK
Yz¾Dk_£üòŠ%”›tŠÂýe5÷Õ(ŽY sznù^ŠË¯X´ëeÅï§E>–õ»¾¸°«ÍÅU±3r€âåêÊŸ$EjmçON¼4ØcX:Žß¹4ß" ¼¢Ã0 Ã0 ÃÔÏ‘g†a†a–†a†a†ƒe†a†a†á`™a†a†a8Xf†a†a–
"8¶·…·»Y#TÐ > 'ƒ4‘eÇB0-Áy†ýy4ˆÝ§#¶"Ý1Š¶BÆg‡i®r,Ñ¢ƒeëþ›GIXÞüÚí0úˆtaÜÄ
®0ú® ŠÜ Ø;Ùú¾Y ‚F¥ÔePó"zM±¦F(~!<%úÙþ€*ÆŽgMù'»±gš—«¦ã6k'Æ÷ðï¬OåÓÌ®¶$W9–hÑÁòãéx
yÉ@‘[B…–…hÒHÚÀ«
€'_ÂHw3 Öèù¯ap€5<:Øšôˆmã:Ï47WMÆ u’â.ãò•dqÚavµE¹Ê±ËF]P.²d.æj@DP¦Æ†É= «~]–èòvœ»…áÖGy^ ¶¼è
3p™0šœQ81Aßßl?}9¡Ðä„BsÅ},
•¶µÃÔ°þHJÑ¿&?é‡#`Qu 8ôöÀʯû#>~”þý9¡Ðd#>ÂD5/J—£4ÿ
kI“)rðÃœÑÈTn×”ßFÊï‹ámÁò˜ Ò6ð´¾½çñÏn0³òÆ„AÅ8p& N^mªF1ŒpUÜ6ïlÜóIr(Ô†s¯NÃÎÑNŒòÙp(ÉØ“T áõâë‡>ÎæO óL“qÕ¢#žÿô‹ DåÈ<÷=fù9îÇàÏëSŸ‹^ »Ú]åX¢9cÖ0Ãbv¸ú4"_ËEÄÜÌNà5þ¬ýö0ÌR¼0åhx¼¶—¾
Æí_Wbñ˧‘(WCæÒ “
ÊŒ| <£…k7'xÛáäu5t 4™%(ÒÈ0{{ Â|E€F…ë©"tñl‹…›à>é^=¤‚\†tÆœë»l•ÀQ]Ž;ºšÿ.½¸ï}z ·Êïþ`2ø‡ïÃêѱlR"“Ë må®ÎéÈâüó¦×ó³vFóBìø*s§
C§˜î*Ú†åñ¯#ÌÍ^/»Q®R·‘˜9uäëæbJä5d—è`åä Å…"CÊ˺|Ö£É;‹M‹'""-¥Rw½ýVìÚ‰äNþX—¬ylÎ3MÀUQ+u»_.ÀwóÆaV’-ÎY…ÏOv…´G V&¨× #êc,u] »Ú]åX¢ycD^øû`È /vŸFQšbúeLkU¼WÒ…æÇ•ìL6 Áf}ŸOTzð_ä*~Ð1ÅÔoõÒä„Rò2»šùâ²ñïMòœPÒ$ûÑ„vbòY¤Ï ¢ yJjæ…/ûÑ•\%†|òRr¶Ÿ\p¤1‘j¢¤0è$æüè&^¤ÝÞ§kwNÑKÓÖ›çiýÎDŠyLJüVÞ¢;¿!é*@–O¢4Ê¡
}j?žÑ>×,f 3é•ÓÁ‘v¦é<“qÕÌc] ¢˜ÙHbxŸ`?„~È#ÊÛ @²FöÇøú€ íJKˆŠ¶Öü½® .ìj3q•c‰&_Œ¼#‘…Í/õƒ¯¯¯¡ ¼ U¯Zv B7±
BμUAå‰ëÈ:´‡LHÛ€Ÿ£Qß @ÆC?Ï#‚«¯ èboáPÐ"á@R skxYÝuc¤LCÏM§,GvQ=†Ø¨‘óça¿Õ|ü!OÅ™m+0y€,øñRÓ¼MbÛ¶b5Ê
ÎáÛ“Oàß/¨°ã—›¸SŠ IDAT£Ò@lã+‘q®ugÒHŸ%.ðdç9¤(¡ÕÞAÎÙeðV"Ótž1 W;‚’ñÛ é¨|¢Û°çO œ|Ÿ†³¤qýi˜ú4ÔuÁ°«MÈUŽ%šþ ã6+Cf|,bbb å®WûdbãØ^èÞ½{òä‹{ ×Ðé@ îïMíÝ‚ ýs¤D …J(½¼! ®è;!:ÇúiHÝ? =¬ØrSC,k© Ö–àÔÛàÛk4¾¼¡‚Z©`å K±‘®ƒ1>K½0gÿ!,/§ EŸ§ ä͸aÒÎ3¦âªáLCøÛXCúó÷ëÓP×î6 W9–h!Ár ¡ôcH€ ¼uH¾zW«•„”ÛÐ (Ï8ƒèB1ü^ —:–›S•ê#Ç',amðÈ\&†tȈ.D QOwµ Á >c]Ð åHx3°I•‰¨ Ÿ`úð®p \ ep>lÏö˜Úˆ,uJhPç' æR
:‚V¥ÈÒV"ã\5£|¶ôÄPo nÕB¬úùb.Åà̉Xä6çSpõ8®ÁÃÝP1&ØûbŒù¢‘n\êS J5`io
ñ߸.vµ9¹Ê±D¾b'šÔ X¼q"— GdÛÿૃñȇ=<º: vãœ/" ä4>|ÿÆû/Îí{
a[O 1_
s§öh#ß͇3
Š©çŠ¡šjëáÏàFl)rH
7m*úÇ!6:+¢]þ´3¶Ç Ê\1:ºšPaËG©¸ÙË ö\ †9Gp$6…Z[xé G” «°œí1±~Ÿ…½Dš\h¨f^S®…`å +±‘®ƒ1>+oâd"ðጥ˜~ýDe*!uï‰V ²kìÌ„œgLÊե߿‡_Ã÷ãkÑØ}Óf…áe»sXðiìñõ –#.AɨExç_ÎëÚ=ÄuÁ°«ÍÄUŽ%šFLðK¢å=Ì«ýߎF ÑVNð@´£Á ·QTÚ Ãì¿2ÊŽÝD/¸šU{ÈÝš¼Æ¯ ŸbÒ©b+mA" \äSóA©5M ŒôPýƒýéÁtíG/êeixÐÚÖžÞX5€’Sõ¯çŸö£FZWÛGÕ ÅmÈöa ê;Sð'(^®®œÓ¨H¢óüÉIļ›V1£Žs.n¡Ö5'Œvøw,QÑv
”ïjüŒòY KÏ—hÍák”_nØ@ ܤSî/«¹/Sqž‹i¹jщƇ ¦¤R""
å\ØJsû9VMNmlŒ@ÒŽ/Ó¦‹†KìE¾Û£þ×vµ9¸Ê±D“/jLˆa†a†aø Ã0 Ã0 ÃÁ2Ã0 Ã0 Ãp°Ì0 Ã0 Ã0 ,3 Ã0 Ã0 Ë Ã0 Ã0 ÃÁ² AÇö¶ðv7ãhž1mÕUsø|œ ÒDb” õŒ©º*B›Ð-HÓâ÷!åožaŸ™æ ,‹]§ šÅ{Æ¡mÅÖBL<£†üX7x•Äè»r(r/bïdk“1Þœfï*A£Ò ê2¨yÁGvÕd]Ãæ‰îpÛ£kWGˆùt7uY1qO*ʈ@D Ò ÿ¯H¬}Õ6-S3û̘X°\ÍsŸãƒþ¶hŒkCq®tæái¾®j¡È-N!‡BËç™]5UWÕHŠx^Oý½çgcoâæhÝ©=ÌϽ@__<ŠE¿Ù`ÊæÓØöb»Ç<²ÏŒéËÚÄDIðzÄ t½_Nâ‚!Kváb®DeÚil˜Ü²j>‹ ü0gk42•† jùm¤ü¾Þ ÀeÂ@hrFáÄýAÚO EN(49¡Ð\ñF KÃ~lí05¬?’Rô¯ÉOúaÅH+XT]Fpèí•_÷G|ü(ýûsB¡É
F|„3Zñ³ Í—fíªEér”æßBa-i_ \g†]}ô®ŠÝ§#–¤)ĵ˜8$~ ÙÝŸÉ¢Ân²¿ôƒ•á_R¯Eø‹”Ø7Ü–}6Q4׃ó'ÅƯ`i¼ #§õ‡½ÁEqÛ ¼³q?Î'É¡PΙ:
;G;Uv% “±'©ZÃ(uñõà çs£7AŸù\b<·î(â3*¶Ñ"ïòn¼;°T7̌ڊ8ÿñB¤} ÏÆlÆs»twuñì0põiD¾–‹ˆ¹!˜ ÀküXûía˜¥xaÊÑ"dð߇գ/bÙ¤ D&—AÚÊ]Ó‘¥ ‚2# ÏháÚÍ Þö äE8y]
Mf Š´ $2ÌÞ €0_ Qázª]<Ûbᦠ¸O:†W© … —!1'ä®›™" Õ帣ãßliæ®–^\‡÷>½…[åwðºêÌ°«ÞUmævŒ}ò8¬Ì;âͽû0é¡¿ ö٤ѩPZb¡2–ºÄÌ©Ã _7S"¯!»D+'(.U¦ ÖäŦő–ƒR©;‚Þþ+víDr'¬KÖå¼)ú\ççÛ¢ûà@tË_‰W¦ Fže„¼· ïᯎã°7ƒ’&Ñd?¨ˆ]§P´:“"ž±§nK®êÆÇÔ˪-M<£&ù7þd
Ø}EiŠé—1«ò®KºÐü8¢’]ƒÉ Ž4&RM”FÄ8¦˜ú AšœPJ^fW- ¼¾Øø÷&yN(i’ýhB; 1ù,Òç˜?Ñ…<%5sÇ—ýèJ®CÎy )9Û‰8Ïy3--ÚU£ëÌ…]mW¥]iIQÑö@’Ý]‹^v‹(ûK?²2üO굈þ"%ínË>›Z1ëHs.• &[€ÄÖnä7u¥“šNO÷ 3Ãv–O¢4Ê¡
}ŒÞ·™ÇLºDåtp¤þº0ÆySóÙˆÏUñþ²½Ãȶâûò]CéTDÛŸ•±cM ÿ@©ð×— ñ³Ýt|8²M[–]‚ÐMlƒÐŸs+oCPy"º²í! BDΟ‡ýVóñ‡<g¶Àän°¨×cG"¸ú:À€.öe -d! :·†—Õ]w:ËÔ(1ŒDè”åÈ.â \óïþµ@W¤Î »j"í*ûlrHFüŠ""hi8»1×ÞNjߤ@SŸ}¸ Ã’çR „V{9g—ÁXYˆŒwÞ}®ësÕ†*ó22a‹vv–« P¯§w©àw,ÈÄ÷'¡sµgìA™Ø8¶ºwï^£<ùâ ÈuúìÒËkâኾ"ð§Óx¬?‘†Ôý³ÐÃÊø°¶E ú[AD ^%€i‘®6Lvµa]j=šVˆ¥f˜ØÈ>›º³3áïÓÝ:»ÀVâ‚Àwþ‡ôú<#õÂœý‡°¼:¾œ2}ž€·6ãê뼉ùlÄçªý ÕB@à9TÍ/XTøkÃ2 u Ó½« w.»q pA€·ÉW¯âjµ’r»FÏ“T™ˆÚñ ¦ï
—ÀµP‡á³Áö5Rª¿" Ÿ°„µÁMs™fÐ!#º D=ÝÔV 3øŒuA H”#§ª2-ØUcêÌ°«ÜU
`ådƒ{ÆÍÔ…H-Z=Ùv"ö¹© ½}q—ãðWRJ4±KO õâV-ĪŸO æR ÎœˆEnµMêã¼ÉølÄçbš>fõ}ƒ.çWüç‡<œéŠ<Ãÿ4©;°xã"D.;ŽÈ¶ÿÁWã‘{xtu@ìÆ
8_D€`Àåa‘sGb“Q¨µ…çžpD ²
«ÏVÒ"õ\1TS-`=ü܈-EIá¦ME@ÿ8ÄF'bE´+ŸvÆö˜aX‘+FGW3 *lù(7yòÓ]5ºÎ »Ú®jä¸t± f–bédÂï
g¸ÿŠoe@Í‘헀Ï>Ã×ï—cÝ© H»÷†P5Ç>7?”7q2øpÆRL¿þ
¢2•º÷D+ ÙõqÞÔ|6âs1Íã&¢ô±¬üŸ¤Ólº@T9 AÒŽ/ÜFQiwHOeÇn¢\Íô¯‹)ø“/WSŠÔ(Ú:ÏŸœDw WjMÃ(#=Tÿ@~z0]ûÑ‹zY ´¶µ§7V
äTýëù§ý裑ÖÕ ò¯zp_ñC›Êê¹´IS-ÑÕúÔ™ »Ú®š¹¥uQ¹¤#"R¦Rä»=ªöeþ_sŒnU|,‚2ã~¥Å=-ÙgŸàw¿íêžà'¥çK´æð5Ê/7œTµ‚r“NQ¸µInu9or>ñ¹j™à'ržDQDtüyv¬ µ?ÞÃ0 Ã0 Ã0- ~´œa†a†a8Xf†a†a–†a†a†ƒe†a†a†á`™a†a†a8X6 ˆàØÞÞîf¸‚"´ Ý‚4M!~ŸÑRöi®šÃçãd&£ìø6wÄîÓ[‘:˜EÛ!{ì>3ìáqriÚÅì¡Âk
¥å€ *oJÝFbæÔa¯›‹)‘×]¢ƒ•“Šô); \}‘¯å"bnf'ðÿÖ~{f)^˜r´ÊŒ| <£…k7'xÛáäu5t 4™%(ÒÈ0{{ Â|E€F…ë©"tñl‹…›à>é^=¤‚\†tÆœëšõIà¨.Ç ÍÜŽ±O ‡•yG¼¹w &Ýç£jòÎbÓ≈HËA©Ô Ao»v"¹“?Ö%k¸«eê°«µºZzq Þûôn•ß½üÃ÷aõè‹X6)‘Ée¶ò@Wçtd©Y§GªêÛ(ƒVƒ©FxH
ÒFQ£úÌ414r\‰+†õ³Sñ\çSØz£¬Ö´¿
áaþ©-8«Ý‚‘#;bá…x”€MoL”!sëOHPw¬FõÙÈë”ia#Ëbk7ò›ºÒIM§§{™‘yáÅîÓ(JSL¿ŒiM¢»FýJv
®ÖcS¿Õ#H“JÉËìªõðôÅÆ¿7ÉsBI“ìGÚ ˆÉgA¾·w¢ yJjæ|/ûÑ•\%†^¤…”œíDFörïÓ»ð˜I—¨œŽ´ãÞ–‰,³«áªàHc"ÕDIa4ÐIÌN5ÊȲˆ¬\ûÑ[{äD…»(¤µ¨ž yÞëô§‘}æÒdŠÈi -9˜AD³s9½Ò·]wW ÊC± M:®!ººˆ¼ w½lo£BJ¥•OYÔóXãóÃ^§\šØ5`lD-ñ+Šˆ Q¤áìÆ@\{ /~“cÇV-»¡›Ø¡?çB[1©¥<aÝY‡öU\} à @{ ‡²€ ² [Ã˪æ;´ej”FÄtÊrdÕohCâ2 KvžCJZí äœ] H`eÁskMvõo¸J…ˆœ?ûæãy*Îl[ÉÜ`Áþ=v€H‹ÒôÓˆxêæ žŠýr]½3M
®ìEø›ÿÆo–âLôz|óÛ Ø˜
mƒy¨Cîáu8 Ø‹É<±f}7Ì mƒ˜…[Qy 4бÊç†ú½`šI°¬½}q—ãPü*»q ‡ o æì¹úÀÙüªR½]ŽOXÂZ(‚’ s™Z…Ñ…(€ Ž=ÝÔ6?æŠá3Ö QŽ„úβթ PVN6Üýš¥'†zq bÕÏ7 dx!—½1iØÕ¿ï*©2µãDíø ‹ÆŸÇÂðÙà-ñ¿B¬Q¤%àj\!Þx
Ï&ü‚M · ×{Qf¬‡õ9ï¤R
XÚ[ßwéÁFõ™i¢ñq×ç÷‚iÁòßîÀ⋹ì8"Ûþ_ ŒG>ìáÑÕ±7à|QE7N‹ÔsÅPMµ€õðgp#¶9$…›6ýãˆÑ®ÚÛc†aE® ]Í ¨°å£Tܬï$$ —.ÀlÂR,Lø]á ·â_ñí¡ ¨•7q2øpÆRL¿þ
¢2•º÷D+ ÙìNó ?iÉ®
ö\ †9Gp$6…Z[xé G” «°œåxDèäðî»'pmýz¼¾i ÖÝTça}λZŽ¸$£á 8¯k‡6òýØ|8Óˆ4²ÏLÓ@ÒW-A×øßpüJ:JDà=î}LiW‚GnB4°‡
œÿ|=¦ý ¶~d}Ù ‡r«
Ï}¬ÆñÙøß ¦éwë» W-¥®IS ’v4xá6ŠJ»cX𥌲c7Ñ ®fwM °¦‰á”‘nX¦%=˜®ýèE½*—{±§7V
äTýëù§ý裑ÖÕ à¯z(_ñC›Ö ™¹¥uQ¹¤#"R¦Rä»= ûÈÒó%Zsøå—W,1¦ ܤSî/ã‡Þ›ÂÒqìjý\;Sð'(^®®\ªN‘E[çù“/ûõH—Žƒµ }žFTðßàÊeëö°~ç]ÚñeÚt±À°«[Õüy<>siżMX¹—.¤ëÛ "*J:N_¿éKö"<EÎôσeDM³:Iîz=ŽÕX>û{Á¥ÉàUM†a†a¦6xž&Ã0 Ã0 Ãp°Ì0 Ã0 Ã0 ,3 Ã0 Ã0 Ë Ã0 Ã0 ÃÁ2Ã0 Ã0ŒÈ æ|Žus¼aÉßÓÜ‚e±ûtÄV¤‚$BÑö@È õA ÛÛÂÛÝÌDzæðù8¤‰Ä(;–¯Å`r 2M©‰nºišBü>£3¤ÍÈC‘Ÿ‰ v¢¿µ
ÓÂ0k€7gáõÀv÷&gb˜Ç, ÖÝðʺ£H*Öºº’T\øi ü ŒoÀ´Y;1¾‡||Ç`}j£„çè»r(r/bïdë¿÷#Ó`4*
.ƒšì{4qi¸Úü=d 7Ï ¯ 8¸§Ü
C/‹*lžè7±=ºvu¼o潦衕ï‡Ø»g%F9›ým˜GÛ~
ˆ†&'ô>eÞtøkbš îM¬Ñ÷³ÃøþÛønþX¼~^‰[/ ò-CÞz$=W )® –#«‘òA
"S»ˆµPä–@§C¡eùžrµÙ{È6A×ÂÞé)ø÷ Y8 H™ƒëªÊ†IÏÂë„+ŠââÿV*]ö©?„üË9ˆt6‡X0C—þp€’«y8ŸG€²ÉJþ–˜–r5<¨HäE8y&ÇÏäá÷%(ÒÈ0{{ ¾|Å $*\OUÃÁ³-n
À×ÃÍ
·;¸ éŒ9!NðjUí¨HGu9îè v¸ú4"wÀÉ÷B0pà(ÌüE‚W¾=ŒÏíîù¾J/®Ã{ŸîÅò»?¿ þáû°zt!6L
B¿gúaÐsÓññ¶“ÈRsÎ(ŒqÕ˜ó%¶E÷Áè–¿¯Ž†àñ³ð£. ïÛˆQDF:ßÈ 2ÍmævŒ}²;º÷ ˆ[÷Ù¨NWM°=,=ùOwCŸ×CnaíèžèÞ½;ºwï†_$Amì6¢Vþê vÏwÇé¥ã0"ä
|¯Áç'áí®æ,PcÒ€í˜Ñ±DÒ.,þg0†?÷olWƧûÖc˜ß=a ×È2@"§´ä`PÌÎåôJßv÷ŽßUÌ,¤äl'2ŒþL£(M1ý2¦uU¯VÒ…æÇ•ìüàÎêEp¤1‘j¢¤0è$æžÜÃöþêpÕ¨óep´lï0²5lc黆ҩˆ¶?+3I¹4¿‘e£ÚL£]5½öPöì*¦¿h‘—ô¾ßσ¶1ó˜Aˆ(fv'’þ'Ø¡ òˆò6Üû]qyd#˲ »§]Íù§×RÐùéÌ£²Üh4(¸²áoD§§—¡pìz|ó/wýí©æì?„åýÓñ唡èóÔ „¼µ7ê ê ÷ð: P<‰ÉôùÒi¡ ˆLÓC¦%`d;p·«M²=4þ;áÖññÓ`íØC¶«¤UC "1ÛÀ<Ì æ²PÄ Äñ¬ex¾‡3¤HE™¥'†zq bÕÏ7 dx!·Ö·k T–öÖµ.ƒDùGþß œœ: cïôÂ`ÝüsG
4•Ã Æ KUªo™ Ÿ°„µP%æ21´
-2¢ Q {º#¨m6~ÌÃg¬ : @¢ FN;/»q ‡ o æ칊¿»Ð©2µãDíø ‹ÆŸÇÂðÙà-ñ¿B¶µ!\m¨óeb 2Í
`ådó·Ö•5µöT
¨`
'kÑCmSvã8®a †ºaéŸúç˜{_Œñ!_4²y®Gc ÚpíX}b †1©`YÒW-A×øßpüJ:JDà=î}LiW‚GnB Ê›8™|8c)¦_ÿQ™JHÝ{¢€ì»÷§–#.AɨExç_ÎëÚ¡|?6 Î4Ä
œÿ|=¦ý ¶~d}Ù ‡r«
G},-RÏC5ÕÖßÁØRänÚTôClt"VD»"üigl†¹btt5 –RqÓȆV“º‹7.Bä²ãˆlû |u0 ù°‡{²" IDATGWÄnÜ€óEÆÉØ#pyFä Á‘Ødjmá9¤' Q‚¬Âr6ÕŒpU×PçËÄi].U?´©œLpO‘´£Á ·QTÚ C…Ê(;v½àjfüäbg
þä ÅËÕ•K$)R£hë<râ¥ÁŒ+F¹jÄùªe‰ÈyEÑñç L×C.Ís‚ @fnci]T®ÞkejU›i”«¦Ú ZÒ“¯G1†%æ¨ô& |ç®ß‚º¶±èDãÃSR)‘†r.l¥¹ýx 14ò¿†óLjvµ>ÎsáÒ@E@í1 Ã0 Ã0L‹GÄ_Ã0 Ã0 Ãp°Ì0 Ã0 Ã0 ,3 Ã0 Ã0 Ë Ã0 Ã0 ÃÁrõ;aÀœÏ±nŽ7,ùü1ì*Ã0 Ã0 ,Wì5Þœ…×Û±@¿9|>Ni"1ÊŽO6cÊ®2Ì£mêÛ„nAš¦¿Ïè )!LK°ÞÖ ÏD;¾‰ÎüÍŸó¿,Æ€ˆa8öÂý~ê‹ðVïãø*ÃTWŸ#hT@]5/×Ìiê®2ìê£tU ›'ºÃMlQWÇZ³§2LskW|?ÄÞ=>ø¸ëa\)âä^Ì# – ù—sél±`†.ý à. %Wóp> e1’•¦üñ´Pä–@§C¡å“ݼiê®2ìê£tU¤ˆgáuÂEqñà,ê ·« Sß«¡A²÷ØÑÔ°þ””¢ÏÞ#?éG+FZUËÞ#CoZùuŠ ¥Ï •Jš¬`Šp¦V† kÉ´'©˜´†ä=Å×Sø82¯ÌB¥ÏÞCš<*('"ÒRþåÝôNÿÚ³6Ù‡üFÅ ïS7齯‰ ühÎÖhÊTV~›R~_LÞœÍ:Ó”i¹Ê ²«ÒU±ûtŠ¥*Š¶’¬Öº¸Ð%»è¢![ž2í4m˜Üƒd»Ê¥ñÚUXt¤ç?=D‰ÅDDå”yî{šåçPÕfŠ]è¹uG)>£¢íÕRÞåÝôîÀV$®ØF6ˆ¶Ý¦Z¹öþ“$…‘ÇâÂ¥"‹jƒ„Ûfo@˜¯Ð¨p=U„.žm±pS Ü' ë‡TÐB€ËΘb]ó½" Õ帣Óÿ©É;‹M‹'""-¥Rw½ýVìÚ‰äNþX—¬©z_Ò.,^´ÉZwŒ^ºŸî[+ 'à`aÍÛA¥×á½OoáÖ=w`dð߇գ/bÙ¤ D&—AÚÊ]Ó‘¥æ T³Åä\e™Gëª6s;Æ>y Væ ñæÞ}˜TÛ±; \}‘¯å"bnf'ðÿÖ~{f)^˜r´Ä®2º]µBðWg°ûå|7o f%ÙbàœUøüdWH{`e‚
Û¢ûà@tË_‰W¦ Fže„¼· ïᯎã°7O”žÇü§»aÍ€Õ8þmW|=:nª”9IPÃÈc1LCŽ,Ûø÷&yN(i’ýhB; 1ù,Ò÷Ot!OIͼðe?º’«Äе’³èþѼÇLºDåtp¤Ý}óÂ[>½–2¨€~hm|OAp¤1‘j¢¤0è$æžS 19WÙCvµ±\5øXÛȲØ}EiŠé—1«FÕ$]h~ QÉ®ÁdîriWÍŸÏúCÏ>k/Î~öÚk½Öw¥í'
_ZøÕ"æ€ä9u
Sù9+• _ÎbbŸæ¸´÷Ôp©ƒ®ª‡ÊUpõb¸·H'S#F¯ÎÄ&‚ˆ % „w¯V-ð2ª«Ê•wÕ½mBH⇟Rþ²BNîáÛ_íø÷ìE@5øâ´ý¤áÍ>5o\ê¹”ëÕr
MŸ÷VÏ ¤¦ e]B˜ ±™½òÁ£C¸õ–>ŒzêSþ¼Øùml0š µ*uÁþw Äíãò«ÿ8ÞÛz„Ôˆ§é⡵C~R·\U•+ìêù¹T‘¯i, s3;w®”:þõ[²ìêªrµ\5Pk›ì6ì€ÁXû{AÍU®RcÙαè\r c÷– lf ƒÝÆÒ
!‹øš.½voÏ®p`þ‹Ì_½•˜}1ìØK敼ɋӈZ1›IÃ:8à]Š†‡3g¯šÑ ©»®ª‡ÊsõL–Ř‹ÁÿÑyq¿ ÿÜL<ôíj'é÷ßù½BŠO>‰U]U®‚«…ná Á ÐüŒ£ßžÜÛÍHöžhŽ×rn¼›)ÆOã?—Ò°qÈ?st³¢ƒ˜×+€å1C™•i¢MPÌo¦r¸¦Ò f[¼ñä & ú˜¨´"\Zv§ pÜѹÁ—3ù+c›b“ȵyÓ~pwsŠô\ÇØP©s®ª‡Ê•vµ kûöæà4~3&
?šhžÿ=Ÿl8†%uÓO#òõ-D6û?>\ G6¾wð#vñGìÎuU¹â®ZSW0ãóWø~^KŒ¯±ê°7}žçAŸ]<ÿvæZ–«(y;ñöG˜8óybí&¯QkZåG°dýQ,>—ÒðqPØ_yb~ IJ-
“½=TÞ áY!lÌÙÉýæ7=31¿r2ˆ{û¿É‚%»¤,΋Å,™‰¿È¼0¯jM&H”ˆlù‹_Í'l›døìu—e9RÆœ%˦„‰¿Q'³Ó C Õ!WÕCuõŠ»ZaQSó1²(*Sì""E©ùR—³y9ß(ƒ^üR¢Žœ.3±PŽÇ.•û‚œÔUMWÏU·›dܼ’X "b•Œ=ËäÙ;*„Û¬UÀ]:>ò™Ä”…C”‚òþ…
Î_ì\š4•/þ¤êéFŠ¢(Š¢(ŠrÝ£¦+Š¢(Š¢(Š6–EQEQEËŠ¢(Š¢(Š¢eEQEQEÑƲ¢(W¦h|OÍûOwu× CQEQ®·Æ²Ñ;„÷Œ ‹Ïåþ™®t{+ ±F2ÒG¥QN7ôãÉçž`p îíª(Š¢(U>+/ü±‰> ‡²ù¾ê ¤y<Õc «›Ñç\âH“ò ÜÚÈ_ÞÞ ù""%’¶ësy:ÔïìŽ:¦@¹gÑOw,_l""b“ûWÉKýšˆ©ü¯þòåI©’ƒ¯vjx®
ÉwÔ’ ÿªtr9ÿ3£_¨L^-iEe')9)É?N—®nºë
ur§)¹êÚJFýßw²?«lw(KŽ ÞóLíâVæ×Íž"rüƒPñ(ËÛ%dšü!E²v˜w…òÊà—¿’½e»L Ù. Mì"^†ÒÏÝ»¿*›’Í¥;¦%n’ϾØ*G‹EŠRÖÉ =‰¡, çà‰òmbù}!’h£Ì,®•þö›eÒ§»å¸UD¤@’÷'Jñ9å©I>šê—«¦få…Ų;1KÌåðYŽÈÊ»ýkîOMê^ îÒfÔk²bWŠ˜Ë«Ää‹¿‰S
פ®^ÈÕ‹úSCWõÙ©¦ÉÉ!Ímg/žYÞ—ðžF°s(ÕH»öÍxqi_ZNØÌCŠ±a pp[&ò¬ü]£3-%œ¶Æ& ÿp« Ìá³)cy:Ñ›~“çó¯m péÒ—¹ñÅ`ò¦ó tÊžËß ßÈ ÷vŒzeo5òG›±¬9a‡‚ÝLíÕ‰}ÞaË' Xr÷h>:l„¢ŒD,Ôð\(Ø»ˆWÞN!å¼Ù ^„Í[Ë;wïåõ ‰L*Ä¥I0 Ž’nÑžXÃa®ú3ô½¬yDXû¿0}Û1hûwp ý‚\˜û[
‡[ >ô{g;‘g²ðÙQ<o dÜk¼ûÉFœ’Cxô§<œn%¬ÅA¦™ÌñGV³tl /Œ Žñ¥oxóýXyǤXÁzb'K§ßÏÂ#¸´dàsï3ë«•$ÝÆ¢$+˜¹ï‹-¼W"‹Ÿ Ëÿ;æC±/ðz—ÊEºh>Jýrpi>‚>6”¬EÏòhäAŽŸ²ãáï‡yOÞ™-\/îO
ê^œ ~xû>ÎÉïç2ýÁí$dYð
lÄœÀZCçõ¥¾ºZ«5ñ§F®ê³[¹Ê#ËÂzHVÆh±&…Êø
&éöüÀÒ^ãÖvÒÞ¹ò¾ð…_IsYÏÎÍE|Œ¥-÷à'eˆÄ.QÖ|ùîÞξÑpn'Sˆœúj4ñ ¶VN~/wy#þ㶊5…Üée’æïëñåvjzÂÁÿ”}R"ëGø”Ž Þô¬ü*vÙùDË3£+UŽt_$ MõËU@Üo™/G$C>ºÝ£æ#)ç^÷šÔ½úËçÙ"ë SÕùÖÄyuC]ÎÕùSWõÙ©ÉÑ0ŒõôðǦ°!] ñëÒIh{! •¿a+´pª¬çf/*áx^i—Ò½mBH⇟RÞ±““{øöW;þ={P̓â´ý¤áÍ>5_Ñ©ç:¿«‘KäÔ)DxLåç¬Tv|9‹‰}šãfÐ^XÝ“Ž$±î0Å—Q"÷védjÄèÕ™ØD¤$ðÎàÕª^çÜ¡v»€ÁˆÁ Øv0)WÍ9p(/¯ÜErN6Ûi2v¾N7œñp+ÍÄM7‘ÌO;3¸ÐÔû‹å£Ô/Wk<8x ×ýܺץE BÛ‰úx ÇlŽq^QW áÏyí}v+µ²ÜACÓçb0PúAjõNÍ@]µÛ°†Zÿ5—p®*þú‚ýï2*8ˆÛÇ/äWÿq¼·õ©OÓÅCﺺøÅ1®0 Ø/øÁf“‹Sµž F ¤±xÌÍtîܹRêø×oɲŸïºÍf?¿œ.!LŽØÀÌÞGùàÑ!ÜzK F=õ)V*Ž 0/àeMòQꙫ5àR¯û¹u¯ÝŽ ˆ½úÂÕÚyE]u„?çµôÙ\ÕƲcѹä Æî-ØÌ 'º ¤@Bñ…5Ë©ðÏ- $˜¡šS>°kðíɽ݌dï‰æx-çI±™b<ñ÷4^…s¥µb6“†u pÀ»
gÎ _5¬Ná@WoåÔûÆêCÊXrIÍ…& ÛQ]¨ïÂ?7O }»ÚIúýw~¯â“Orî áÜoïÄÕ÷¿ùÉ|îpK{†t…ó_dþêÄì‹aÇÖX2Ï;W0#†ãRí°ÍÅóQê—«5ÂA×½äØ¢sM„>2Œ@“cœWÔÕ+é>»•šà~æèfE1¯W Ëc†2+ÓD› ' ˜/ÞLåp
žÖÔÌøü¾ŸÁãk¬:ìMŸ§ÃyÐgÏ¿ …¹–å*JÞN¼ý&Î|žØE»ÉkÔšVù,Y‹£ÎeðeÀÌpîÊØĦØ$rmÞ´ ÜÆœ"=·D
«c8ÌÕ”¯xë»™¬\ðÿøÐi&kŽzÑõÞÇé ¤– dKgÓò}0gK^-aÑ/¸tî?œ±³¦®`úâiD¾¾…ÈfÿLJëãÈÆ—à~Ä.þˆÝy5 ’):̶xãÉL:ô1QiE¸´ìNàø™sdÆg3X7{_{¾ÊÒíÇ ýÍ•ÊS“|”ú媣ü©§¶óÆ«›»è?ìZ{ á˶’mÁÕ¿M³"øtcšãœW®KW æ>»•Úv¬pHØ_yb~ IJ-
“½=TÞ áY!lÌÙÉýæ7=3éþ¼äv“Œ›·Q DD¬’±g™<{Gã³ù«˜¸o ˜ Q"²å/~çäç. ùLbÊÂËHÁaYÿB—³eºØ¹j’L2|ö:‰Ë²œ OgN’eSÂÄߨ“â©“!Ž ãªÁûfùÇ™0lfIÚwè¼0l¸¶–q 6KÊé29ìfI;ð½Lïî^¡¼7Ê ¿”¨#åÊñØ¥r_PiÙ+.ð£B'îkæb¹Ã£4,“{û¿É‚%»¤<Ü’Y2‘ya¾ºË=3×Èìò a§%=.B¦us?Þ©FùhªW®^|_
®{Më^ƒ§„Œ›%ßÄ •r£m9 ²~Z·³å¾ˆóšÔÕ .F½˜?5qUŸÝšj‘ QzŸ„Lã×ø×øó®¦Ü½!_EQEi èºcEQEQEÑƲ¢(Š¢(Š¢Ô†¡(Š¢(Š¢(Õ #ËŠ¢(Š¢(Š¢eEQEQEÑƲ¢Ô©[¬éè/8bÍåÇ'ÛV¿Èebj9‰Øò_EÈ[> ¯K8æj–YQW¯ž«®t{+ ±F2ÒG¯t7Ñ;„÷Œ ‹ñŠ9¦(µá"›’˜è³p(›ïs®æó<žê±…é´gåZSW]5Ѩugš›|1vhŒé
Å–¾’q]¶ãéÚ†ÇW˃—xÌÕ,³ºª®^=Wk±,…XôqUç]õèùk¾íÆ[ 6ò[^ÉqLQ ØX²÷gàŠÉàD»Þ~´4À©ßO°û„@Q>IEú#*uºêª…Ä…w²5ˆ¼q^±Óäx \JH/¼Œc®f™ÕUuõª¹jÃœy
»9 ³M
¬ÿ®:À1E©õÝàÝ{|ä±ðÞ’˜\º{OÖ¶P™5£Âî=ñë,s—ô–¸¸‘bÍ(=Κ>\âH“² sLÍÊ ‹#dwb–˜Ë7Ö± ‘•wû‹áLYeðË_ÉÞ²ùŠŽl—&v/C…òø…ÊäeÑ’VT–GÉIIþqºtuÓh¸îwšº:®šZN’X9KÞòâUUy
îÒfÔk²bWŠ˜Ëu=q@¾øk8ÕÂy*ì\Uí¹.rLˬI]g®úŽúAòã_•N.ç¦Ï‹:âªWùò¤TÉÁW;ŠË™ÝwÛÈ_ÞÞ ù""%’¶ësy:ÔïüÝw/â˜sðDù61_Ê÷3Í?´Qæ
W½ÞšÎINin;{ñÌò¾„÷4‚µ˜C©FÚµoÆ‹KûÒrÂf ÚPŒ
ƒÛ2y”gåïil)á´½ôŸ.ÍGðÏdž’µèY <ÈñSv<üý0ïÉ+qgð¡ß;Û‰|8“…ÏŽâ™x!ã^ãÝO6┠£?å!x6o-ïܽ—×' $2©—&Át8JºE{G×5WÑU[ÚrÆtÜ‚‡kþ±f-ª.Á¯bß'Ã9ùý\¦?¸„, ^-˜Xkì¼c¨Y™uµþ¹Z°w¯¼BÊyoõõyQg\-ØÍÔ^XÐç ¶|Ò%wæ£Ã@(ÊHÄ`lÂðw°êÁ >›2–§½é7y>ÿÚÖ—.}™_\ãb[OìdéôûYx$ƒ—– |î}f}µ’¤›ÂX”dÕëª8vd¹QXÉÊ-Ö¤P£AÀ$Ýž XÚkÜÚNÚ;WÞ¾ðë r.뺹H€±Æû›Z>.QÖ|ùîÞÎö"ÛÉÔ"§¾$@04–{#-"‰áÒÏߤ½" ¹&®Öht£Qù<[¤`ýdâÒwÐh]ŽÑ¤®6WõyQ§\ÄëÎ’/È´—óGø‚Ÿ”="óÌMâ\ößÁòï"'>í[ÙZºáüOÙ'%²~„^oM•ßœ\~[ÛHPO?ü {l
Ò°¿.d€¶7âqΈ@¡…Se=v{Q Çóì5>›{»t25bôêLlå«]Kï ^Zàe$—È©Sˆð˜ÊÏY©ìørû4ÇÍ =£ë›«ëjMpiчÐÆv¢>^Ç1Ûe8¯¨«êê%éó¢^µÚö'„$~øù(åÿrrßþjÇ¿g/œk1 8”—Wî"9§›í4;_§Îx¸i¥ªTÆ!Ó0ªzf0”nˆâÀ…²ƒi, 3‚ ¬ü>Í~:,{i‰
ö¿Ë¨àUÜvïß™ðÐDÞÛ:ÙëžaฅüvZ—C_ϯQ®–«Uœéüÿ²Û±Ëe:ˬ¨«
ÊU}^Ô?W
—_3¹„09b3›æ¥GŸgÓáÜnúŸš¢T©¢KxÙØ9K`ìÞ’Í `p¢Û˜@Z$dïÀÕ¨…n&ž@úvµ“ôûïü^!Å'Ÿ¤â,#)N#jÅl&
ë@à€w) ÎœA¾zÕ¯[®®«gO[Œ¹<üqî Gɱ Dçš}d¦Ëw ±Rdw_ÏêÃhÕä˜ ”YQW¢«ú¼¨;®J±™b<ñ÷4VáØÌÐÍÏ\oƒoOîíf${O4Ç-5ôǽ=CºÂù/2õVböÅ°ck,™zA•*pÈȲ9:YÑAÌëÀò˜¡ÌÊ4Ñ&È (æ‹7S9ìÀEÖÔL_<È×·Ùìÿøp} ÙøÜÁØÅ ±;OÀàË€™áÜ•±‰M±IäÚ¼i?¸;9Ezn‰^õ똫éêYi³Ø·7§ñ3˜1QøÑ @óüïùdÃ1,§¶óÆ«›»è?ìZ{ á˶’mÁÕ¿M³"øtcZÍœ/Ç’Åx3Î#§ñÂvÛo<›OmŽ¹P™U#uµ!¹ªÏ‹:çjQòvâí0qæóÄ.ÚM^£Ö´Ê`Éú£XRW0ãóWø~^KŒ¯±ê°7}žçAŸ]<ÿvæŠ]ÈŸ¢ÃlK€7žœÁ¤C •V„KËî4Žë%UªêÄá°1¾òÄü>’”Z&{{¨¼9³Bؘ³“ûÍÿn*ÞÕœ§F Qœo”A/~)QGN—|)”ã±Kå¾ ²r™døìu—e9vÆœ%˦„‰¿Q'ªs݇8ºŠ®–/ i>FEeŠ]D¤(U"_êrö|O 7K¾‰9*åFÛrdý´ng¹˜ó’K›eéÞœ²ÃR*Ÿ«Ç\°ÌšÔÕ†âª>/ꔫ¥É]:>ò™Ä”… ”‚òþ…
×Ôí&7o£$ˆˆX%cÏ2yöŽÆ燎» ?qoÿ7Y°ñ d—”‡S4Kfâ/2/ÌK¯·¦JÉ è„,EQEQE©]ò©(Š¢(Š¢(ÚXVEQEQm,+Š¢(Š¢(Š6–EQEQEËŠ¢T¾qßÁSóþÅÓ]ÝõÇPÔUEQ”ë±lôaÀ=#èâ£my¥acj9‰ØòmEÈ[> ¯|Ïé†~<ùÜ Ô-C”†ìª+ÝÞJB¬‘ŒôÑk (ʵá"›’˜è³p(›ï«®’Ëã© [øð˜c£Ïyô|ƒ5ßvãù-OƒÂ+5z”_W/[úJÆuÙŽ§k _ý-ê…TWÕÕ
Öb+X
±hSuUQêfcYÈÞŸAd€+&ƒízûÑÒ §~?ÁîEù$é¨Ôê©«– ä€K é…zÕUuõœ&:æÌSØÍY˜mjŽºª(×ònpÈî=>òXxoIL.ݽ'k[¨ÌáQa÷ ƒøõ–¹KzK\ÜH±f” gM .q ¤‰Á«¿|yRªäà« Å·›%x(c^Ú‚OÏ‘ô r9s˜õÄN–N¿ŸÁa·:` ³ÿèÆs_ä±ÖNÚ…j¨8ÄU!û—/ØikΈm8cT£ Œ àEÚÿû†ø":f
ä¾/¶ðþýάyv,#ÿòO>9`9çµaóÖòÎݹ|4a wÜvýï™Ä[_n#Ý¢—]]¿®ì]Ä+o¯!å¼yê|Ãrì™?³b ´ÕË1øtgdgøcÍv²ìúSÇÈê² ºIDAT+õxd¹QXÉÊ-Ö¤P£AÀ$Ýž XÚkÜÚNÚ;WÞ¾ðë r.k»¹H€±R~^w®|ùC¦…¸œ_ŽŒ,;µú‡ì‘ýÏ·ç >Ÿ“œ‚ÿ)û¤DÖðÑžT q˜«¦@™°Å*òû4 )ñò ô¥äJªÌ½ÅöŽ]`´Îù¦gåW±ËÎ'ZŠ©:Ÿ
åÞH‹Hb¸ôó7©êjÃwUox®â,7=»OÄö‹<TzM=Ã>–,I•ypU“¦z0²l$¨§ ~€=6…
é؈_—N2@Ûñ¨ü
[¡…Se={Q Çó Û]tk{' Iaý¦Ô ŽF;åå•»HÎ)Âf;MÆÎ×é†3 n…£aâ@WmÇÙðÁO”t|1]ÀàGØã#ñMø˜O+r¨cnm¸‰d~Ú™AµÓ6%—È©Sˆð˜ÊÏY©ìørû4ÇÍ W]]m ®ªó
ÏU,¤¬^L´á6 Ô ®´ÚŸ&™ëùæ \KË 44}. D‡.”lv0¹8Q]h09aÄF‰õ'v arÄfö>ÊáÖ[ú0ê©OùShð¯Q ãªÌ‹XgîÈÄñíq¿a0ÏÜ݈˜÷–q°ÄÁŽ‰ 0
üË
ö¿Ë¨à n ¿_ýÇñÞÖ#¤F&*—–Ýi W/,ŽuÕÌî½Güãÿ˲ÙþAo6dV˜RTÇ,Y ˆ7ã’”Z&{{¨¼9³Bؘ³“ûÍÿn*Þ<Ÿ»t|ä3‰É´–†*8,ë_èr6/×Ö2nÁfI9].Èn–´ßËôîgC#™šô“—Vý&9""b–”Ib‘ÓòÝÐFgÂظ·ÿ›,ØxP²KÊò±˜%3ñ™æ¥Útˆ#ºj ÿ^_("ÑòôMÎç|^;Ç\Ú<(K÷–+…)ùREçƒåž™kä@vy`¯Ó’ !Óº•9o
á³×I\–åL¸Esj”,›&þnI]mˆ®ªó
×ULÒ|ÂOR,"Ésn®‡&M×&¨zºQƒÃóŽ8¼}ËomÇähÝýAQEQêì3û¶wø}K Þù¯ÛYð§ÆT®-
3 °Á‡^?ÊÍ9q Ê(ÄåÆ^ŒãQš¦¼Ëòßµ¡¬(Š¢(u
£O½:4ÂÔ´/“ßû’A,MÔ†²R7h€¯‹ZËÃ+â$»üí\I¦ ˆx[Ƶuƒ¾NФI“&Mšê\j4à39&"bI— Ü/mu'FM:
CQEQEQê6ºû†¢(Š¢(Š¢hcYQEQEQ®›Æ²+ÝÞJB¬‘ŒôÑ ©ÔNû¦£¿àˆ5— Ÿl{ÑÍ.ˆÁHãÞtmé¤=OE]ÕúY]W®:°ÌÊõÜX6Ñgáp¬£«IýùGеÚVT°[ÁRˆEg]+†Æܳ¾I™ÃÍn•?ò ²
³$3çÌ&µîLs“/ :4®~—Ç‹bâö¹CÈÜ3€5=µ¢UÔUŸÕÕz媣ʬ4tœ.VáeïÏ 2À“Á‰v½ýhi€S¿Ÿ`÷ ¢|’Š®UÑm˜3Oa7ga¶é…¼î‘<ö|³†ÝÉmMMìM-—¶Czᙳ™ï•Ëj!qá„l
"ï@ —LÐ`4èo¯¨«Z?««õÒUÇ•Y¹n ²{<Þ[“KwïÉÚ*³FxTØyÇ ~=‚eî’Þ7R¬¥ÇYÓ‡KÜ ibDŒÉ/v‘„ÄåÌ.MäbDdÇÃxήL¾£~üøW¥“Ëùå5ú…ÊäeÑ’VT >î¤$ÿ8]ºj(š›œÛN‘ߤX6Œñ?"й<÷›HÁw#ÄÄÔr’ÄÊYò–¯ªò3¸K›Q¯ÉŠ])b.WèÄùâ¯Aâ„AÇ÷;ëð¹é·®r«»ãî ½¶êj}tUëguµ.»ZÓ2;O”oó¥|?ÊüCeÞØ`qU7®«ä˜MIœ½xfy_Â{ÁZÌ¡T#íÚ7ãÅ¥}i9a3m(ƆÀÁm™<ʳòwÎ4¶”pÚöÌŸY±Žêdz~'ÅŸîŒì ¼¶,{å¯ì]Ä+o§Rrn¼›·–wîÞËë™TˆK“`: %]ã›7X,©ëù:a.ÏëŽ×ê 9˜šöel§b~ùßÝœ$m9c:nÁõ
ÿX³– U MðëØ÷ÉpN~?—én'!Ë‚W` $æV„¢cÙ¬ßa#¨“?]}¬<¶ ²`¬i§È³9î¾PÔÕúèªÖÏêj]vÕV£2ƒõÄN–N¿Ÿ…G2(piÉÀçÞgÖW+Iº)ŒEIVDG–k>²Ü(¬‡deŒkR¨Œ¿Ñ `’nÏ,íÉmm'í+ï _øu9—õÝ\$ÀÇX–—³Üôì>Û/òPI ñ ûX²$UæÝâVó^€¡±ÜiI —~þ&í]7ÉUºÎLIOns/ ]h2ö)*Ù,÷+ ëÒA^Ž¯f4¡Qù<[¤`ýdºÐùLrÇ;w‰5c´$½îSaTÃÑ÷…&uµ¹ªõ³ºZ—\½P™«a þ§ì“Y?ÂGݸŽ’š êé‡ `MaCº 6â×¥“ ÐöB<*ÃVháTÙ‚½¨„ãyö3ó‡RV/&Úpj† WÚ íO“Ìõ|óG-&GK.‘S§á1•Ÿ³RÙñå,&öiŽ›N/màsðë•$Œä/ ÜÀàKèaw~ÊO™5 ¢uiчÐÆv¢>^Ç1[]¸/uµ¹ªõ³ºZêUçÀ¡¼¼rÉ9EØl§ÉØù:ÝpÆÃMã ]O8äjWµØÙ` €R‹ÕÐ֣߱h‹Ð{Òݹ5gàè6äü°‚ßN×®DûßeTp·_ȯþãxoëR#ž¦‹‡ÖÈ
ºZ?ø_%·`̽mqõîŃýØññF2ª «ðÁnGÄ.uæ¾PÔÕ†ãªÖÏêj]tµŠ2»„09b3{ åƒG‡pë-}õÔ§ü©Jhc¹öØ9K`ìÞ’Í `p¢Û˜@Z$d_›%¦¶tÖ¾½šüÛ&3±ÿÆwÊaíÒ=œº”›ª8¨³™4¬Þ¥hx8sùêUoÈųbe
ÿ{,=Â&0Èy Efp^n/Æ\ þp>磒c;ˆÎ5úÈ0/K¨¸ 4çÆÝñ,«k]½L89ú¾PÔÕæªÖÏêjpõeƽ=CºÂù/2õVböÅ°ck,™jÄu‡Cø™£˜ ļ^,ʬLm‚œ€b¾x3•ÃµZ´!än™Ãâä¦þÎ9Ë™²§–Meƒ/f†sWÆ&6Å&‘kó¦ýàî4æé¹%zÕvÎ ÿù’äþ‡¹³=púñ"«zUhÍbßÞ œÆÏ`ÆDáGs Íó¿ç“
Ç°œÚίnfì¢ÿ°kí-„/ÛJB¶Wÿ4ÍŠàÓi”.ë°‘º+ŸâÇÜð vÆ!.4·¥Ò·÷b z_(êjqUëguµ.¹z¡2 f[¼ñä & ú˜¨´"\Zv§ p\¥¸îpPè8_yb~ IJ-
Ñ’½=TÞ áYarþÙ ÷æ7o.<Á¿ù„Ÿ¤XD’çÜ|Þÿ‹&S€ Ÿ½Nâ²,g˜S£dÙ”0ñ×P\
?¹þ—¼qHD$OVõ=îèÜ…ÍÇÈ¢¨L±‹ˆ¥JäK]κfð”q³ä›˜£rºÌ![N‚¬ŸÖ².žrÿ¼¾rìhYh¢£Ãåà×!r³û•¸/4©«
ÀUŸÕÕ:æjõe6ˆ{û¿É‚%»¤¬À³d&þ"ó¼ԉë(¨z
Ð5Çó¶wø}K Þù¯ÛYð§Á)Š¢(Š¢(W §ºT£O½:4ÂÔ´/“ßû’A,MÔ†²¢(Š¢(Š¢e<{LcõO´ 'êã‡üüVò5b€¢(Š¢(Šr¨³Ó0EQEQåZ£QµEQEQEËŠ¢(Š¢(ŠrÍËFšŽþ‚#Ö\~|²-.—“•ÁHãÞtmét…[ó,3®t{+ ±F2ÒGŪëÚ_ß®*êjCrUë^uUëUåZ6–
¹g}’2‡›Ý*ä=dfIfΙL4jÝ™æ&_:thŒé’‹dâö¹CÈÜ3€5=¯°¼Ž*3€`-¶‚¥‹Î¿ú¨«Šºzºªu¯ºªõªreqN Mª®ƒòØóÍ>v'·55±7ÕVöm‡ôÂ3g3ß **û? ‰ ï$dky⸜ÝQ
FÃUúó Wf°aÎ<…Ýœ…Ù¦b]uÔUE]½N]ÕºW]ÕzU¹¢œ ˆæ»–8·"¿I±lãvÇ ç¶òÜo"ß?SËI+gÉ[>@¼ªÊÏà.mF½&+v¥ˆ¹ìØ’ä‹¿‰ ߯t·žªÒo]åÖ3»÷øÈcá½%1¹ô³¬m¡2k„G…Ý{ â×#Xæ.é-qq#Ïæ‘>\âHcÍËì Ï)Xÿ€™.t>“ÜñÎ]bÍ-I¯ûTÞ/ ¤QXÉÊ-Ö¤P£AÀ$Ýž XÚkÜÚNÚ;WÞ¾ðë r.ëÙ¹¹H€O-Ê\Õ òÁÿ”}R"ëGøÔ¼Wbh,÷FZDÃ¥Ÿ¿I{iW,©«tµìû…k†ŠwÙ1î=ÈQÉ“åwz©?êjÃsUë^uµ.¸ª Ö÷t¿ø°Vß .æà×+I
É_:¸Á—ÐÂ0îü”Ÿ2k>åÒ¢¡íD}¼Žc—<¯ÌHPO?ü {l
Ò°¿.d€¶7âqÎl¶B §Êznö¢ŽçÕnôÌ9p(/¯ÜErN6Ûi2v¾N7œñp«Å]É%rê"<¦òsV*;¾œÅÄ>Íq3hwͱ¨«µuµ8m?ixs£³ê£®6ÊáÖ[ú0ê©OùóJ]°ÿ]Fqûø…üê?Ž÷¶ !5âiºxèÝâÐj]]«vvÀ ×ÕÕéªÖ½êj]pU=¬Ç|”_Ê<´(ž+Shýßcé6AÎÛø(2ƒóî{1æbððoĹ}ÿ’c;ˆÎ5úÈ0/Ÿ¥¸ 4çÆÝñ,óÈÕË„vŽEç’»·d`3œè6&V YÄ×v9ëÊŒ{{†t…ó_dþêÄì‹aÇÖX2/õ&/N#jÅl&
ë@à€w) ÎœA¾ª¢#QW ⪢®6$WµîUWµ
\" 4t @ 0˜ZÍ ÿù’äþ‡¹³=púñ"«zýbÍbßÞ œÆÏ`ÆDáGs Íó¿ç“
Ç°œÚίnfì¢ÿ°kí-„/ÛJB¶Wÿ4ÍŠàÓiesAl¤îʧø17<‡ÝÆŸ±dˆ Ím©ôí}€ØèfE1¯W Ëc†2+ÓD› ' ˜/ÞLåpm'Ë_¨ÌE‡Ù– o<9ƒI‡>&*—–Ýi ¯U‡Õ—3ù+c›b“ȵyÓ~pwsŠôÜUѱµººz9®*êjCrUë^uUÛ Ê¥3·¬}| Õ‡‘sý/yãˆHž¬ ê{6„̹“ß›‘EQ™b)J•È—ºœ oð”q³ä›˜£rº,zŠ-'AÖOëVy¿‹§Ü?¯¯ ;Zîåèp9øuˆÜ|&lŒ¯<1¿$¥–~ž½=TÞ áY!³“ûÍÿnzfÒ=µ.³AÜÛÿMl<(Ù%e¶˜%3ñ™V‹E&¦ >{ÄeY΄©1§Fɲ)aâoÔÉóOêjÕ®V±Å0A¢DdË_üÔuµá¹ªu¯ºZ\Uëe¸¸JýsËŸ©n“EQEQEi¸œ úW U>w©D pOÙŠ¢(Š¢(Šr=5”ïáœéU+Þ^Ö¢Þ£¿™¢(Š¢(Šr °§¬ý»ýܪ[“š,¼€;ô÷SEQEQ(sqeí_jÚX.g#°
pºRõH´¢(Š¢(Š¢Ô'¬ÀRàïÀ—:°6Ñ°=)ÇÑ è£ EQEQ”ºÏ ØGi0‹ï(ݘï¢üîè!6yg¡Ñ IEND®B`‚ stem-1.8.0/docs/_static/buttons/ 0000775 0001750 0001750 00000000000 13602232262 017264 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/_static/buttons/resources/ 0000775 0001750 0001750 00000000000 13602232262 021276 5 ustar atagar atagar 0000000 0000000 stem-1.8.0/docs/_static/buttons/resources/button_background.xcf 0000664 0001750 0001750 00000147426 13157571677 025555 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 ± ¿ð ÌÞ ô P Background ÿ
X ô P x ¿Ì ¿Ø ¿ä ô P Ä ² -É A¿ U¯ j5 ~c ’Ë ¥é ©¿ ¬ê ¯ì ³ ¶
¹/ ¼m ü¨½×Õ'Õ þëç çþæç
çþæççþæçç þíç6ç þíççþæç ç çþæççþæçç þêç8ç :ç :ç æþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ åæåèæååææåæåææååæåææåææååææååüæåæååüæååææå þäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå äþãääþãääùãääãäãääþãääãäþãääþãää :ã :ã âûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ âáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þ¬ááþàááàýáàááüàáàááûàááàááüàáàááþàáá þ²à9à þà9à ümààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùhÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûlÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þeÝ-ÝþÜÝÝþÜÝÝ þfÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þfÜ9Ü þfÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þfÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þfÚ(ÚþÙÚÚ þfÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üfØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þfØ9Ø þfØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þf×9× þfÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þfÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øfÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þfÔ9Ô þfÔ9Ô þfÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üfÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýfÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þfÑ9Ñ þfÑ9Ñ þfÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûfÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þfÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ýfÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ þfÍ9Í þfÍ9Í ÷fÍÍÌÌÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýfÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þfËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þfÊ9Ê üfÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þfÉ9É þfÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ
ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ ü[ Ç9Ç ÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ :Æ úÄÓäããä%ä þëç4ç þíç6ç þíç7ç 9ç þêç8ç :ç :ç þçææûçææçææþçææþçææøçæççææçææçþæçç æ ýåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå åäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä äþãääþãääã
äãäøãäããääãääþãääþãää :ã :ã ýâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ üáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÊá áþàááàáþàááúàáàáàááúàáààá þÏà9à þÄà9à ý§àßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà û¥ßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þ¨ÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þ¤Ý9Ý þ¦ÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þ¦Ü9Ü þ¦ÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þ¦ÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þ¦Ú9Ú þ¦Ù
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù ö¦ØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þ¦Ø9Ø û¦ØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þ¦×9× þ¦ÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷¦ÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ù¦ÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þ¦Ô9Ô þ¦Ô+ÔþÓÔ Ô ü¦ÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ ü¦ÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þ¦ÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þ¦Ñ9Ñ þ¦Ñ9Ñ þ¦ÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷¦ÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ù¦ÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ û¦ÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ þ¦Í9Í þ¦Í9Í ù¦ÍÌÌÍÍÌÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ù¦ËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË û¥ÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þ¤Ê9Ê þ¤ÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þ¢É9É ó¡ÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ ÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ üz Ç ÇþÆÇÇ üÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ :Æ +ÿ þëç4ç þíç6ç þíç%çþæçç 9ç þêç8ç :ç :ç æüçæçææüçæçææûçææçææçæøçæçææççææþçææþç ûåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå äåøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå
äþãä
äþãääþãääþãä äãäýãä :ã :ã þãââùãââãâãââãâãøâããâãâãââþãââãâãâþã üáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÿááþàááþàááþàá
áàüáààááþà þÿà9à þÿà9à òÿßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÿÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÿÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÿÝ9Ý ûÿÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÿÜ9Ü þÿÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÿÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÿÚ*ÚþÙÚ Ú ûÿÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÿØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÿØ9Ø ùÿ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÿ×9× þÿÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÿÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÿÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÿÔ9Ô þÿÔ9Ô þÿÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÿÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÿÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÿÑ9Ñ þÿÑ9Ñ þÿÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÿÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÿÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÿÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ þÿÍ9Í þÿÍ9Í þÿÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÿÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÿË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÿÊ9Ê þÿÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÿÉ9É þÿÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ üÿ Ç9Ç ÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ :ÆI ýåýÿ3ÿ þÿ6ÿ þÿ7ÿ 9ÿ þåÿ8ÿ þýÿ8ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ :ÿ ?Õ ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?äÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÿçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ@ Àÿ ?Õ?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?ä+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÿkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ@ Àÿ ?ÕFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?äçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÿÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ@ Àÿ ?ÕÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?ä
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?ÿþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ@ Àÿ ?Õýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?ä=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?ÿ
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ@ Àÿ ?Õ éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?ä “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?ÿ|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ@ Àÿ Ð Õü×½¨ )çþë +çþí ,çþí -ç -çþë .ç .ç æþçææþçææüçæçææçæúçææçç åþæååæåþæååæýåæååæåþæååüæåæ ÷äåääåäåäååäåäåúäåäååääýåäååûäåää äùãäãääãääþãääþãä äþãääãäã .ã .ã âûãâããââãâãâøãâããââãââúãâãâãâ â áþâááûâáââááâþáââ÷áâáââáâáââáüâáâ áúàáàáàá
áýàáààöáàááàááààá áûàáᬠ.àþ² .àþ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþm þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßh ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþl þÜÝ,Ýþe ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝf .Üþf ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛf ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚf .Úþf ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙf ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙf .Øþf ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþf .×þf Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖf ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕf öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕf .Ôþf .Ôþf ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓf ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþf þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑf .Ñþf .Ñþf ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþf ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏf þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþf üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍf .Íþf .Íþf üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍf ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËf ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËf .Êþf ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþf .Éþf úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉf ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈúÇÈÈÇÈ .Ç ü[ ÆÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆ .Æ Ð äãüäÓÄ )çþë +çþí çþæççþí -ç -çþê .ç .ç æçæþçææþçæ æùçæçææçæ
æç úåæååæååæúåæåææååæåþæååþæåå÷æåæååæåæ þäååûäååäååýäåääåòäåäåäåääååääåääåäåýäå äþãääþãääùãäããäãääþãääþãääüãää .ã .ã âúãâãâãââãâûãââãââþãââãâýãâ âá÷âááââáââááûâáâáââþáââöáâáâááâááââüáââ ýáàááàáüàáàááþàááàáþàááþàááþÊ .àþÏ .àþÄ ßà ßþàßßàßàßôàßàßßààßßৠÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþ¥
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþ¨ ÝþÜÝÝþ¤
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþ¦ .Üþ¦ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛܦ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ Ûþ¦ .Úþ¦ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚ¦ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþ¦ .Øþ¦ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýئ .×þ¦ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþ¦ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖ¦ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔ¦ .Ôþ¦ -ÔýÓ¦ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔ¦ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓ¦ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒ¦ .Ñþ¦ .Ñþ¦ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑЦ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏЦ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎϦ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
Îþ¦ .Íþ¦ .Íþ¦ þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþ¦ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüË̦ ËÊ ËÊüËÊÊËËþÊËËþ¥ .Êþ¤ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊɤ .Éþ¢ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉ¡ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈ .Ç üz Æ ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆ .Æ Ð ÿ )çþë +çþí ,çþí -ç -çþë .ç .ç æþçæ æþçæ
æüçæçææ åþæååþæååæåûæåææååþæååöæåææååæååææþå üäåäååûäåäåääåþäååäåäåüäåä äã
äþãääþãääãäüãäãääúãäãää .ã .ã â÷ãâãâãââãââüãâãââãþâããýâãââã úáâáâáââþáââþáââáâ÷áâáâááâáââóáââáâáâáââáâ áùàááàáàááüàáàááþàááþàááàýáÿ .àþÿ .àþÿ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÿ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÿ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
Þþÿ .Ýþÿ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÿ .Üþÿ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÿ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÿ ÚþÙÚÚþÿ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÿ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÿ .Øþÿ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÿ .×þÿ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÿ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÿ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÿ .Ôþÿ .Ôþÿ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÿ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÿ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÿ .Ñþÿ .Ñþÿ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÿ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÿ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÿ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎýÍÿ .Íþÿ .Íþÿ þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÿ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÿ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÿ .Êþÿ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÿ .Éþÿ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÿ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈ .Ç üÿ ÆÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ Æ .Æ (ÿýýå +ÿþ ,ÿþ -ÿ -ÿþå -ÿþý .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ .ÿ ÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ ÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ :Ä þÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ óÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà þÅÂ8 þÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ þÂÁ7Á þÑÁ7Á ýÑÂÁ5Á ýÉÃÁ3Á
þZ ,f ü†a[ í ÆòÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ ÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ :Ä þÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà ÂÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàþÄÂ8 ýÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ þÂÁ7Á þÑÁ7Á ýÑÂÁ5Á ýÉÃÁ)ÁþÀÁÁ
þv ù £¥§¨¨ª%ª ü’y~ í ÆÅÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ ÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ ýÄÃÄ7Ä þÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà öÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà þÄÂ8 þÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ þÂÁ7Á þÑÁ7Á ýÑÂÁ5Á ýÉÃÁ3Á
þÿ ,ÿ ÿ î :ÿ :ÿ :ÿ :ÿ :ÿ þýÿ8ÿ þåÿ8ÿ 9ÿ þÿ7ÿ þÿ6ÿ ýåýÿ3ÿ@ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?f øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?ª þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?ÿ Àÿ@ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?f øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?ª ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?ÿ Àÿ@ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?f ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?ª ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?ÿ Àÿ@ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?f ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?ª ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?ÿ Àÿ@ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?f ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?ª ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?ÿ Àÿ@ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?f ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?ª ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?ÿ Àÿ@ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆûÅÆÅÅ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅýÄÅ .Ä ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃüÄÃà ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃùÂÃÂÃÂà -ÂþÄ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂþÊ ,Áþ ,ÁþÑ *ÁýÂÑ (ÁýÃÉ f þZ . ü[a† ª ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆþÅ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅ .Ä ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄà õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃüÂÃà -ÂþÅ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂþÊ ,Áþ ,ÁþÑ ÁþÀÁ!ÁýÂÐ (ÁýÃÉ ª¨û§¥£ þv . ü~y’ ª óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅùÆÅÆÆÅÅ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÄ .Ä ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃà ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂûÃÂÂà -ÂþÅ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂþÊ
ÁþÀÁ ÁþÂ ÁþÀÁÁþÀÁÁþÑ *ÁýÂÑ ÁþÀÁ ÁýÃÉ ÿ þÿ . ÿ « .ÿ .ÿ .ÿ .ÿ .ÿ -ÿþý -ÿþå -ÿ ,ÿþ +ÿþ (ÿýýå ú ( } >
ô P
New Layer ÿ
Àž ô P À¾ ̺ ÌÆ ÌÒ ô P Á
Å Å2 ÅR År Å’ Ų ÅÒ Éâ Êò Ë Ë2 ËR Ër Ë’ ˲ þÇÍ5Í ýÕÎÍ6Í þÕÍ8Í þÎÍ8Í þÇÍ9Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í þÇÍ5Í ýÕÎÍ6Í þÕÍ8Í þÎÍ8Í þÇÍ9Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í þÇÍ5Í ýÕÎÍ6Í þÕÍ8Í þÎÍ8Í þÇÍ9Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Ð *ÍþÇ +ÍýÎÕ -ÍþÕ -ÍþÎ .ÍþÇ /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í Ð *ÍþÇ +ÍýÎÕ -ÍþÕ -ÍþÎ .ÍþÇ /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í Ð *ÍþÇ +ÍýÎÕ -ÍþÕ -ÍþÎ .ÍþÇ /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í /Í Ð )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ ;Í ;Í ;Í ;Í ;Í ;Í ;Í þÇÍ9Í þÎÍ8Í þÕÍ8Í ýÕÎÍ6Í þÇÍ5Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í þÇÍ9Í þÎÍ8Í þÕÍ8Í ýÕÎÍ6Í þÇÍ5Í ;Í ;Í ;Í ;Í ;Í ;Í ;Í þÇÍ9Í þÎÍ8Í þÕÍ8Í ýÕÎÍ6Í þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ Í Í Í ÿ /Í /Í /Í /Í /Í /Í /Í .ÍþÇ -ÍþÎ -ÍþÕ +ÍýÎÕ *ÍþÇ × /Í /Í /Í /Í /Í /Í /Í .ÍþÇ -ÍþÎ -ÍþÕ +ÍýÎÕ *ÍþÇ × /Í /Í /Í /Í /Í /Í /Í .ÍþÇ -ÍþÎ -ÍþÕ +ÍýÎÕ *ÍþÇ × /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG × ú ( } >
ô P New Layer#1 ÿ
͆ ô P ͦ Îò Îþ Ï
ô P Íò Î Î Î" Î2 ÎB ÎR Îb Îr ΂ Î’ ΢ β ΠÎÒ Îâ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ
ÿ
ÿ
ÿ
ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ@ÿ@ÿ@ÿ@ÿ ú ( } >
stem-1.8.0/docs/_static/buttons/resources/download.xcf 0000664 0001750 0001750 00000244150 13157571677 023642 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ A B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 µ Mû ˆÊ Ê > Download ÿ
g ' E gimp-text-layer )(text "Download")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 202.000000)
(box-height 62.000000)
(box-unit pixels)
§ Ê > Ã ó ÿ Ê > ß
³ € € € À þ ý . ý,óÿ ÿøõæÔ§s? ) ü `ÞÿÿûèÈÖøÿÿûø«N ( þ>ÿÿô· ChŒ¼þÿÿüée ' þóÿÿþa ü"ˆóÿÿýÍ) & þÞÿÿþL ý ¸ÿÿýå! % þÍÿÿþL þ¡ÿÿýÜ $ þÌÿÿþL ýÈÿÿýÒ # þÌÿÿþL ýåÿÿþ¾ # þÌÿÿþL
þ;ÿÿþ= " þÌÿÿþL þÊÿÿþ¯ " þÌÿÿþL þhÿÿýý# ôBr¡ÐôСrB üz€€ þÌÿÿþL ýöÿÿþ’ ÷%Èÿï¶}˜àÿÿýÂ" üvíÿ þÌÿÿþL þ«ÿÿþÌ úgôÿ¾ ù1åÿÿóf ýCÿ þÌÿÿþL þ‡ÿÿþë ú–ÿÿ± ý*ìÿÿþ þ¼ þÌÿÿþL þmÿÿþ ú=þÿû" ù3ùÿÿþ: þD þÌÿÿþL þSÿÿþ' úÔÿÿ¡ þ©ÿÿýÖ þ þÌÿÿþL þ<ÿÿþ7 þvÿÿþM þBÿÿþ€ þÌÿÿþL þVÿÿþ þÜÿÿþ, ýÚÿÿþÖ þÌÿÿþL þÿÿùü ýÿÿþ þ‚ÿÿýû þÌÿÿþL þ§ÿÿþâ þ0ÿÿþû
þaÿÿþ/ þÌÿÿþL þÏÿÿþÂ þZÿÿþ þFÿÿþ\ þÌÿÿþL ýõÿÿþj þ€ÿÿþ+ þ+ÿÿþs þÌÿÿþL þ ÿÿýò
þjÿÿþE þÿÿþK þÌÿÿþL þ‡ÿÿþ” þ>ÿÿþ^ þ ÿÿþ! þÌÿÿþL
ý3üÿÿþ* þÿÿþŒ þ(ÿÿýô þÌÿÿþL ýÒÿÿþ• þèÿÿýâ þCÿÿþË þÌÿÿþL þ€ÿÿý´ þ£ÿÿþ> þ_ÿÿþo þÎÿÿþL ýNúÿÿýÍ ýñÿÿþ˜ ú¯ÿÿÏ þâÿÿþL ý3¾ÿÿýá þmÿÿýï ú üÿþ8 ý÷ÿÿþn ü!¦þÿÿý¶ ýÌÿÿýÈ ûÿÿš þTÿÿôÊ!
.Oq’µùÿÿýÚW ý Æÿÿþ útÿÿ– û5}ïÿÿýíëÿÿû÷¨B
ñƒýÿÿ¼e C˜ÿîR þ2ÿ ÿ÷øçÖŧo6 ô=¼îÿÿüûÿߦ 6 ú!TrG € € € ¿ þ
: û"n»ú 6 ûZœÞÿÿ6 û ÓÇöÿÿ9 ý ÿÿ: þ5ÿÿ: þ ÿÿ: þÿÿ: þÿÿ: þÿÿ: þÿÿ: þÿÿ€û t€€þ þ:€€þZ ðG›è
H‰ËðÁ‰ þÿÿø¸g píÿÿûû¤e ó%‘íÿÿïV M¡ïÿÿû !ÃÿÿýÙ* þÿÿýç ý¢ÿÿþ› ÷gÿÿS (íúÿÿø AïÿòÎõÿÿýÝ þÿÿþÝ ýòÿÿþo önÿÙ £ÿÿögù´7 þÿÿþb þÿÿþ þŽÿÿþ° ü°ÿo þ$ÿÿýþu þ¬ÿÿþÍ þÿÿþÜÿÿþu þ0ÿÿýø ûî÷ þ
ÿÿþg þDÿÿþò þÿÿþxÿÿþÖ þÒÿÿþd üBÿ£ ÿþ4 þ ÿÿþ þÿÿýûÿÿþ8 þŽÿÿþÄ üªÿ= ÿþ4 þÿÿþ/ þÿÿý ®ÿÿþ™ ýãÿÿþ$ üúÖ ÿþ4 ÿþ4 þÿÿý Iÿÿýð ü^ÿùÿÿþ„ üzÿp ÿþ4 ÿþ4 þÿÿü áÿÿþ[ ÷Òÿ^þÿÿá ûß÷ ÿþ4 ÿþ4 þÿÿ þÿÿþ½ úHÿÆ »ÿÿþD üIÿ¤ ÿþ4 ÿþ4 þÿÿ ù ýÿÿþ ú½ÿO Xÿÿþ¤ ü±ÿ> ÿþ4 ÿþ4 þÿÿ þµÿÿí 2ÿÖ íÿÿõ ü× ÿþ4 ÿþ4 þÿÿ þPÿÿùÞ §ÿ` þ’ÿÿúd €ÿq ÿþ4 ÿþ4 þÿÿ ýæÿÿúA üã þ/ÿÿúÄäø ÿþ4 ÿþ4 þÿÿ þ…ÿÿû¢‘ÿr þÌÿÿütÿ¥ ÿþ4 ÿþ4 þÿÿ ÷"þÿÿõôî þiÿÿüûÿ? ÿþ4 ÿþ4 þÿÿ þ»ÿÿþƒ ýöÿÿþ× þÿÿþ4 þ ÿÿþ4 þÿÿ þVÿÿýö þ£ÿÿþr þÿÿþ9 þ ÿÿþA þ0ÿÿ úëÿÿ” ú@ÿÿø þAÿÿþ‚ þVÿÿþf þeÿÿ ûŠÿû! ûÚÿ¡ ý Æÿÿýâ. ý,ØÿÿýÜ1 üQçÿÿ üù› üpþ, üÜþÿÿúèe âÿÿûæ1Êùÿÿ ý` ý
f * € € € € þ = þ = þ < ý < ýU = þ = þ = þ = þ = þ = þ = þ = þ ôBr¡ÐôСrB
õe©ÉéóÏ«~
÷=yµíÙ¥ ÷%Èÿï¶}˜àÿÿýÂ" ò|êÿË‚C[ªÿÿàA ö ÎÿøÁ‚†» úgôÿ¾ ù1åÿÿóf ú¦ÿÿw ú}ÿÿù ú7çÿÊ þ ú–ÿÿ± ý*ìÿÿþ úÿÿü úíÿÿŽ úU÷ÿÃ
þ ú=þÿû" ù3ùÿÿþ: þåÿÿþ úÅÿÿô úòÿü þ úÔÿÿ¡ þ©ÿÿýÖ þ ÿÿþ$ þªÿÿþ û—ÿÿ® þ þvÿÿþM þBÿÿþ€ ûÒÿÿÍ þ¨ÿÿþ= ú)üÿÿB þ þÜÿÿþ, ýÚÿÿþÖ û!Žˆ þ¨ÿÿþY ú²ÿÿý þ ýýÿÿþ þ‚ÿÿýû
üCÖÿÿþh úúÿÿç þ þ0ÿÿþû
þaÿÿþ/ úyÞëâÿÿþh þ'ÿÿþË þ þZÿÿþ þFÿÿþ\ ø8¦úÎa¨ÿÿþh þOÿÿþ° þ þ€ÿÿþ+ þ+ÿÿþs ú=¾ÿ×B þ¨ÿÿþh þwÿÿþ½ þ þjÿÿþE þÿÿþK ù ÿý‚ þ¨ÿÿþh þœÿÿþÚ þ þ>ÿÿþ^ þ ÿÿþ! ú Òÿÿ~ þ¨ÿÿþh þŒÿÿþö þ þÿÿþŒ þ(ÿÿõô ÎÿÿÄ þ¨ÿÿþh þgÿÿþ þ þèÿÿýâ þCÿÿþË þzÿÿþz þ¨ÿÿþh þAÿÿþe þ þ£ÿÿþ> þ_ÿÿþo þéÿÿþJ þ¨ÿÿþh þ ÿÿþÔ þ ýñÿÿþ˜ ÷¯ÿÿÏ ÿÿþ€ þÂÿÿþh þÊÿÿþE þ þmÿÿýï ú üÿþ8 þÿÿþ× ýîÿÿþr þ>ÿÿý× þ) ýÌÿÿýÈ ûÿÿš þìÿÿþM ûLÝúÿÿ÷” ¯ÿÿýÝ! þP ý Æÿÿþ útÿÿ– þ¢ÿÿ÷ü t•×ùw{ÿÿöøšö $æÿÿøêšZ%=Ò2 ñƒýÿÿ¼e C˜ÿîR ýìÿÿûÑ. =ÿÿþ„ ý¼ÿÿýï® ô=¼îÿÿüûÿߦ ý(Çÿÿü×~ ù¦ýÿÿûc ü}ãÿÿýþÓ ú!TrG ú7ec ûjJ úIrJ l l l i ý ô[¯ö4 4|Ãûÿÿú4 Ñùÿÿþ4 ý
wÿÿþ4 þÿÿþ4 þÿÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿù4 ^ ÿÿù4 þÅ,ÿÿù4 Dâûÿÿþ4 ý)öÿÿþ4 þwÿÿþ4 þ0ÿÿþ4 þÿÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ4 ÿþ8 þ8ÿÿþL ý Þÿÿù® ó™ÿÿûàÿ ÿÿôò¡Ga ÿù±V ý_ ¤ e 2 X P Icon (red) ÿ
@ º X P Þ MË M× Mã Mï X P : 2! Fu F… F• F¥ Fµ FÅ FÕ Få Fõ K. MK M[ Mk M{ M‹ M› M« M» ð óÿ™ª¹¿Ä¶°¹ªª / íÿ¶¼»½¼½¼½½¼¾¼½¼½¹Ì ( è ¿»¾½¼½½ÀÂÅÆÇÈÇÅÃÁ¾½½¼¼ # ä'ÿ¿º½¼¾ÁÇÐÙàæêíïïîìèãÜÔËľ ! (ó º½½¼ÀÉÕáëïòôôóûñíæÛ ò&
)+ ¶¼¼öÁÎÝêñòóôôõõôóþò þ88ð67)+)½¼½¿Íßîòóóüôõõööõôþó æ:Kjd (* (ªº½½ÈÙëðñòóôôõõööõöø÷ööõõôô Ö!;Q|$++$+Ƽ¼¿Ðäïñòòóôõöö÷ø÷õòðññðóöøø÷ööõ å($0@ '+ '+¿½¾ÄØëïñòóôõö÷÷øøðõðñõööõðñöøùø÷÷ ß:KG@ ', ',¿½½ÆÜíïðòóôõö÷øøùùøòóùÿÿ÷øòóùúùøø ç3LXK*+4*+²½¼Èßíîðñòôõö÷øùùúúöð÷þÿÿ÷þöð÷ûúùù à2M *+ *+ª¼¾ÆÞìîðñòôõ÷÷øùúûûüöóýÿÿøüòøüüûú æ. '+ '+;¼½ÃÛëíïñòôõ÷øùúûüýýüöòþÿÿøýòøþýýü æ-',4',4½¼¿Öéìîðòôõ÷øùúûýýþþüöòþÿÿüþòøþþ à$+.$+.¶¼½Îæëíïñóõöøùûüýþþÿÿþöòþÿÿûþñøþÿÿ ç+, +,X¼½Æßêìîðòôö÷ùûüýþþÿÿûþöòþÿÿûþñøþÿÿ è(+<(+<º¼¿Ôçêíïñôö÷ùûýþþÿÿûþõñþÿÿûþð÷þÿÿ é(+0(+0ÿ»¼Êãéëîðóõ÷øúýþÿÿûþõðþÿÿûýð÷þÿÿ ê),J),J¿½À×çêìïñôöøúüþÿÿûþôðþÿÿûýï÷þÿÿ é *3 *3rº½Êãçêíïòô÷ùûýþÿÿûþôïþÿÿûýî÷þÿÿ ê),L),L¿¾ÀÔåèëíñóõøûýþÿÿûþôîþÿÿûýî÷þÿÿ é$+.$+.i»¾ÅÝåéìïòô÷ùüþþÿÿûþóîþÿÿûýíöþÿÿ ç(+A(+A‚¼¾Îâæéìðóõøûýþÿþþÿÿûþóíþÿÿûýìöþÿÿ å+, +,V¼ÀÕãæéíñóöùüþþûúúûþÿÿûþóìþÿÿûýìõþÿÿ é+0+0k¶¾ÄÛãçêîñôöúü÷ñëëûêñøþÿÿûþòìþÿÿûýëõþÿÿ Û'+<'+ACDB@_Áýÿ
ÿûüµT@ ÞJMNJMNP'))*,.//1245439JOQRSSTz×þÿÿúþËnTS ñ?KM?KMOb%()*+.//ö233/MœÒâãääþõÿ
ÿþðää éKMOKMOQ&())*-.//02/A¶ýÿÿ öGLNGLNP ())ý+.//û0/‘úÿÿ LíNLLN &'))*,.//.4Éþÿÿ öDKMDKMO %))÷*-./.4Ðþÿÿ ëlKLNKLN $'())+-..0°ýÿÿ ë‡?LM?LMN[#())*+-.+oìÿÿ ó©JLNJLNNf&'))ø+-,+Óøþþ ó„« HL HLNO &))÷+-+,MzŒŽŽŽ ð‚§¶?JM?JMNU$&())ô+-,+**+,-..//0/. ï=‘ªª IM IMNa!&())û+-..//û01223343ý21 ïswjm{ JM JMMc'))û*,..//ý012232þ10 0ó ù 3 õü ( çŸ )16;<94-$ " 㪜£
$8UtŽ °¹Áý´¨—€dD, 𑪨‘ "LTVWX\]]~Ìýÿÿ
㯪¯ª³ '2>IQWZ[ZyÈþÿÿ
♫¬™«¬² !'/;HQUWsÆþÿÿ
ªã«ªª«° !"%+09?BfÄýÿÿ ᨫ¯¨«¯¶ !"#'*-011Z¿ýÿÿþû
ªâªª´ !"%),/11/X¼ýÿÿýú§
ߟª¬Ÿª¬²f !"$'+-0220R¶þÿ ÿüü¦@
Þ¿¨«¿¨«°¶ !!#%(*./10/R¼ýÿ
ÿûü¯F/ Þ¨ª®¨ª®´ !! (;@ABDEFoÔþÿÿúþÇbEE 檩«ª©«±b ?•Ïàááâþôÿ
ÿþïââ ö§ª®§ª®´ ù 3±ýÿÿ ꣪¬£ª¬± ‰úÿÿ ö©ª®©ª® ÷ $Åþÿÿ ªô«ªª«° û %Íþÿÿ 릨ª¬¨ª¬ !«ýÿÿ ôË”¨«”¨«®[ù fëÿÿ óÌÿ§ª¬§ª¬¯fø xÐøþþ ñÂþ §ª §ª¬° ÷ Aq„…†† ‡† ð%Çþþ¿ªª¿ªª¬U ø ïYÚÿþÿ¿¦ª¿¦ª¬a þ ! î*ª®›Ÿµ¨ª¨ª«c þ ð ó
/ í =_€ž²ÁÉÊõ¢…dB! ) ø-cœÌìýþ þûðÒ¥l % øR›Øôüÿÿýý÷ $ ú^´ëýÿÿ# ûP¬ïÿÿ" ü †êÿÿ úJ´úþÿÿ û cÔþÿÿ ü xäÿ ÿ ü …óÿ ÿ û
xóþÿ ÿ ücäÿ ÿ ýIÓÿ ÿ ü µþÿ ÿ ü†úÿ!ÿ üPêþÿ!ÿ ý¬ÿ#ÿ ü_ïÿ#ÿ ý´ÿ$ÿ ýRëÿ$ÿ üšýÿ$ÿ ý-Øÿ%ÿ ýdôÿ%ÿ üýÿ%ÿ ý Ìÿ&ÿ ý=ìÿ&ÿ ü_ýÿ&ÿ ü€þÿ&ÿ ü žþÿ&ÿ ü ³þÿ&ÿ ü Áþÿ&ÿ ü
Éþÿ&ÿ üÊþÿ&ÿ ü
Ãþÿ&ÿ ü µþÿ&ÿ ü ¢þÿ&ÿ ü…þÿ&ÿ üdþÿ&ÿ ýBðÿ&ÿ ý"Òÿ&ÿ ü¥ýÿ%ÿ ým÷ÿ%ÿ ý5ßÿ%ÿ ü
¦þÿ$ÿ ý^ïÿ$ÿ ý!¾ÿ$ÿ ül÷ÿ#ÿ ý!¹ÿ#ÿ ü_ðÿ"ÿ ü”ûÿ!ÿ ý2Êÿ!ÿ ý]àÿ ÿ ü wìÿ ÿ üŠõÿ ÿ üŒúÿ ÿ ü‰òÿ ÿ@ ý»° < ú½¼½¹ÿ 9 øͽ½¼¹ ù* # ýëòóóé÷üýûöñìçáÛÕÎÈÁ½¼ ƒYR: # þÙÚÚçÜÝèôøóîéäÞØÒËÅ¿¼½*Q…ZR; " øçòåØàððëçáÛÕÎȽ½¿)Q‡ZSC " ÿèþèÏßìèãÝ×ÑËÅ¿¾·?TQˆZSG " ÿéûÝÓæåßÚÔÎȾ¼¿(TQ‰ZSF " ÿéþæÊàáÛÖÐÊÄ¿½¹_ TQ‰ZSE- " ÿêåÅÜÜ×ÒÌÆÀ½¼¿*TTQ‰ZSG= " ÿéýÞÅØØÓÍȾ¼º? XWPˆZSH@ " ÿèñÌÇ×ÓÎÉÄ¿¾¼b$glbRˆ[TH= ! ÿåþüëÏÀÍÔÏÊÅ¿½¼¿*^d\ZP‡[THB2 ! âáàßÝÕÅÁÊÓÏÊÅÀ½½¿? ``[_Q†[TMJ@ ! âÓÐÎËÉÊÏÒÎÊÅÀ¼¼´f bhff_Q…[TQN< ! áåâàÜØÖÒÍÉÅÀ¼¼½b"VUVVWUQ„[TIG= ááÞÛ×ÔÐÌÈÄ¿½¼¶f&jda`^_`^…dSC;8 @ ý& < û('% : ùY9*(%& ù$Fm…Ž * ê¿Ÿp>*)(h~Š„wlho|†ŽŒm ) êÌËȨs:)'#€…†…„„……’’„R ) ÉçÈÛ`0(& ŽŒŒ”—˜”‰wz…‰’ # ÇÆ÷ŵ€D(($”••–—û–Ÿ™… # ÄÃê¿•S,(!·¶µ´²¯¬ª¨¥©·™| # ÁÀ¿ú£c+(¬¬ù®¯µÃ { # ¾½¼ú«e+' ¦¦§û·˜{ # »º¹ú¨a*'§§û·™{ # ¸·ô¶··¶µµ¢X+% §§û¬·š| # µ´³÷²±±E)& §§û¬·š~ # þ³²²±°¯ú®~6)§§û¬·›€ # ý±°¯¯þ®¬«ú¤`*' §§û¬·œ€ # ü¯®««ª©ø¨§ŽE'!¦§§û¬¶œ‚ # ù««©¨¨§§þ¦¥¥ù£ l+( §§û¬µž… # ôª©©§¦¥¤¤££¢¡¡ò Ÿ“G(% §§¬´ž† # ø©§¦¥¤¢¡ žœšj,' ©§¬³ž‡ # ¥ú¤£¡ žœœî›š™™š™—‰@( ¨§²Ÿ‰ # 󣢡 Ÿœš™™˜—––ô”“\+&H§®± ‰ # ä ŸŸžš™—–•””““’’‘t3& §¯± ‰ # 䜛š™—••“’‘ŽŽŒ‚C)( ¯±¡‰ # ñš˜•”›˜ŽŽŒŠŠõ‰†T)$D°°¢‹ # ÷”“«ËÞÚÞŠŠð‰ˆ‡‡†…„d/'I±°¢‹ # ñ³çþÿÿüÙ™„†‡†…ƒƒõ‚€n4(K ¯£‹ # ý´ëÿÿ÷ýÊ…‚~~ö|s:'L?®£‹ # ýîþÿÿ÷þê}~}|{{öyrB':£‹ # þþÿÿøñ”y{zzywwöuqI(!G¬¤‹ # ÿëþã…vwwvustsqnL( F«¤‹ # ÿëû·ustsrrpponkK("G«¤‹ # ÿöýÁyqqpponllöj`<)(H«¥‹ # ÿõýÇ}nomllkjhhö]D*)&Lª¥‹ # ÿèüÇ€mnmjihgfc\O:+)( Iª¥‹ # ÿçüÃ}klkifed_TE90+))(Hª¦ # ÿæû¼vjkjhd]TH=4/..*))( Hª¦Œ # äÿüÀsghd\SF=6320//-+)(( Hª¦‹ # äû¼kUUOG@<75432//.-*)(&M8ª¦‰ # ä³ZCFFB?<955431//.+))(%KU©¦‡ # íUBEFDA=:754320//-+))ù I¾©¦„ # äCFGEC?<9654310//-*)(( G¿©§ # DæCA?<;755320//.,*)(% 3Àª§v # ãSRQOJ9445431//.-*))' H¥Á©¦t " äåãâΔF/3320//.+))(' J¥Âª¦, " ÿùü®þÿÎ # ÿüý¼nccûbaa`__÷V.þÿÎ # ÿúýÂra`^^ñ]\\[ZQ7ªþÿÎ # ÿèüÂt__][ZZYXUN@+ «þÿÎ # ÿçü¾r]]\YWWTPE6( ªþÿÎ # ÿæû·j[\ZWTMC7+" þÿÌ # äÿü»hXXSK@3*# £þÿË # äû·_FB<3,&"! ©ªþÿÈ # ðM221.+($"! øªªþÿÅ # äG021/,)&#!! «ýþÿÁ # ä1321.+($"! §ýþÿº # 1æ/.+(&#"! ™ýþÿ¯ # ùDCB?;'!! ð ªÿýþÿ° " áæàËŒ8 ¬ÿýþÿ¿B " ÿõü¨- õ?ÿÿýþÿÉM " ÿöôt õ ªÿÿýþÿÅT " ÿúþ© ñ_ªÿÿýþÿÃu " ÿñþ¯ ªÿÿúýþÿÇœ " ÿýû’ ÷?ªþþúýþÿÉ£ " ÿùØT ñbûúüþýþÿÈ›< ! þøöÆg ð ªüûüýÿýþÿȨ… ! †÷…ƒm< ï ?ªüüýüþýþþȸª ! þü îf‘ûúúûüÿýþþȹ› ! þúb™þþõýþÿýþÿȵžB ý þüf¥þþøýþþ½–“^ @ ý5
< úߦ^! 9 øÿþï¾l! 7 ÿû÷¹^ 6 ÿüð”2 5 ÿûûÊ] 3 ÿüàw 2 ÿüìŠ 1
ÿüõŒ 0 ÿüú‰ / ÿüò|
.
ÿüá^ - ÿýË< - ÿüý› , ÿüñh + ÿüþÆ& + ÿüü} * ÿýÈ) * ÿüøo ) ÿý· ) ÿýæH ) ÿüúƒ ( ÿý¹ ( ÿýá1 ( ÿýóU ( ÿýù ( ÿýý¡ ( ÿüþ» ' ÿýÈ ' ÿýÑ ' ÿýÖ% ' ÿýÖ& ' ÿýÒ! ' ÿýÊ ' ÿý½
' ÿüý¥ ' ÿýú… ( ÿýõ\ ( ÿýå6 ( ÿýÀ ( ÿüüŒ ( ÿýêQ ) ÿýÁ ) ÿüú| ) ÿýÔ2 * ÿý * ÿüþÒ0 + ÿüõv + ÿüý± , ÿýÙM -
ÿüíp - ÿüù . ÿüû /
ÿüûž# 0 ÿüù# 1 á&@J )+ )+,f¸½½¾ÁÆÉÍÑÔ×ÚÝßâäæçèééøèçæäâàÝ Ô3FEE *+ *+-c¿»¼¾ÀÄÇËÎÑÔ×ÙÛÝßàáâãääããâáßÝÛÙ× ß
)+ )++j»½½¾ÁÅÈËÍÐÒÔ×ØÙÚÛÜÝÝ÷ÜÛÚØ×ÕÓÑ ç (+ (+ j¢¼½½¿ÁÅÇÊÌÎÐÒÓÔÕÖÖ÷ÕÔÓÒÐÎÌÊ *ß+**+f»»½½¿ÀÃÅÇÉÊÌÍÎÎÏÏÎÎÍÌËÉÈÅà ß') ') dªÀ¼¼½¾¾ÀÂÄÅÆÇÇÈÈÇÇÆÅÅÃÁ¿¾ î$))$)UiÿÁ»¼¼½½¾¾¿ÀÀù¿¾¾½½» # ñ & ffÿ»»½¼¾¼½½õ¾½½¾¾½¾¼´ & è ]hijj¢¼·ºÀ¹·° kjgj 1 ý\cggüdfb … ñCnt HL HLMf '())ú*+-..//01210/ ñXxvw KL KLNc%))ú*+-..// ð, ML MLLj &))û*+--..
/.- ó?HM?HM j''())*ø+--..//..÷/..--++* óHLLHLLf !&(())*þ+,,û+*+*)) òIJ IJ d %$()())*)þ( óHLLHLUi &&'(()(ý'( # ñDI D ff $'(''(()(ü$% ' è?: ? ]hijj! ")& kjgj 1 ý\cggüdfb … ñe¤¢U©ªU©ª«fþ ®¯ªªªª«c í(B1,'ÿ¦ªÿ¦ªªj þ þ 󯩫¯©« j ªõ©ªª©f ªò©ªª© d þ òª¨©ª¨Ui ü " ðUœªUœ ff
ü & 矜Ÿ ]hijj kjgj 1 ý\cggüdfb … ü|áÿÿ û ^Ìýÿÿ! ú<›ñþÿÿ# û hÆüÿÿ$ ú&}Èøÿÿ& ø)o·æúþÿÿþü ' õHƒ¹áóùýþÿÿùýúôåÀŒ * ë1U¡»ÈÑÖÖÒʽ¥…[6 0 ö %%!
Ä âÛØÕÑÎÊÆ¿¾½½f"afmry~€~nT; ! äÕÒÎËÈÄÀ¾¾¼¿b QSTUTTSSRPmYSC # äÎËÈÅ¿½¼¼¿f 05:?>>=:<<>FHLA # õÈÅ¿¾½½ºi? ø # ÷Á¿½¾¼¿¿b 6 ø½¼½·¿j? 7 ú¹´¿f_ 9 ügb? < ù/..-,*))ì( fD°´¶º½¾¾½Í´¦w ! ú.-,**))í(&b$£¥¨©©¨§§¦¤³©¦† # ü,**))(ì' f `lx}}zwwz~‰‘™„ # þ*))ú(' i? ÷#2B- # )(û'% b 6 (ú'# j? 7 ú% f_ 9 ügb? < úf™þþýùüýÿ¶)4 ! þ÷ b‘ùüÿÿûýþÿÍ # é fª•¥µº·³±°³»ÂÏÞëÊ # úi? ÷ (8MfI # ú bª 5 ø j? 7 ú f_ 9 ügb? < ÿüì 2 ÿûýÙp 3 ÿúþõ±M 4 ÿüÒu 6 ÿúúÔ0 7 úêÁ|2 9 üQ | € € € € , ( – K
% X P
Icon (smoke) ÿ
> N¤ X P NÈ ˆš ˆ¦ ˆ² ˆ¾ X P O$ lV €» €Ë €Û €ë €û + ; …î ˆ ˆ* ˆ: ˆJ ˆZ ˆj ˆz ˆŠ 1 õfU\jb[b\UU , ñ " dhhijkkjkiihýdf $ ç' '_fijkjjpv{~‚€}xrlkjj" (ä ( _fikks€“¦¸ÃÍÓØÙÖÐȽ®œ‡wn æ&
)+ )+bijkp‚¹ÍÙÞááúàÛÓê þ88î67)+)+Hijjr°ÌÜßß àß ê:Kjd (* (*,jkjnŒ³ÕÝÝÞÞ ßÞ í!;Q|$++$++Ujjk‚¨ÏÚÜÜÝÞÝ ê($0@ '+ '+,Uikq“ÁÖÙÚÛÛÜÝ÷ÜÚÚÜÜÚÚÜÝÝÜ è:KG@ ', ',.jjkx¦Í×ØØÙÙÚÛÛÜóÚØÞêïïéÜØÛÜÜÛÛ ç3LXK*+4*+4jik¯ÓÕÖ××ØØÙÙÚÚúÛÚ×âõÿÿûþñÞØÛÛÚ æ2M *+ *+ # ä‹•™˜—•“‘Š‡„}zvsolk ƒYR: # üŽ’‘é‘ŽŒ‰†ƒ€|xtqmkg*Q…ZR; " ㎎Œ‚„‹Š‡„~zwsplkb)Q‡ZSC " íìç߸ˆˆˆ…‚|xuqnlj?TQˆZSG " ÿèýÈ~†ƒ€}zvsolkf(TQ‰ZSF " ÿé÷©xƒ{xurnlj_ TQ‰ZSE- " ÿéþÇt|yvroljj*TTQ‰ZSG= " ÿéþÉr}}ywspmki? XWPˆZSH@ " ÿèü¸q{zwtqmkjb$glbRˆ[TH= ! ÿèäqzxurolji*^d\ZP‡[THB2 ! þæùÙ›mtxuromkk? ``[_Q†[TMJ@ ! â´³²°¡nrwurolkjf bhff_Q…[TQN< ! áxvtsrruwuromkkb"VUVVWUQ„[TIG= á‚€~|{ywtrolkjf&jda`^_`^…dSC;8 € ýib < ûkiid ù$Fm…Ž * êwlkjd Gh~Š„wlho|†ŽŒm ) êÕ¾{lji[z€…†…„„……’’„R ) äÞÝÚÅŸwkjkEŽŒŒ”—˜”‰wz…‰’ # ÜõÛ×»‘pkhU ”••–—û–Ÿ™… # ÛÚéÙͨ~kka?·¶µ´²¯¬ª¨¥©·™| # ñÛÚÚÙÙØ×Ô¸‰mic?¬¬ù®¯µÃ { # ðÚÙØØ××ÖÕÕÁ“mif?¦¦§û·˜{ # ïÙØØ×ÖÖÕÔÓÒÆ•mjc §§û·™{ # îØ××ÖÖÕÔÓÓÒÑÅ’ljb §§û¬·š| # í×ÖÕÕÔÓÒÑÑÐÏÍÀŒli §§û¬·š~ # íÖÕÔÔÓÒÑÐÏÎÍÌË´ljG§§û¬·›€ # ìÕÔÔÓÓÑÑÏÏÎÍÌÊɧtj\?§§û¬·œ€ # ëÔÓÓÒÑÐÏÎÎÍËÊÉÈ“li¦§§û¬¶œ‚ # ëÓÒÑÑÐÏÎÍÌËÊÈÇÆųjdH§§û¬µž… # ÑæÐÏÏÎÍÌËÊÈÇÅÄÃÀ›mjU §§¬´ž† # þÐÏÏèÎÍÌËÊÉÇÆÄÃÂÀ¶kiI©§¬³ž‡ # þÏÎÎèÍÌËÊÉÇÆÅÃÂÀ¿¼™ni ¨§²Ÿ‰ # ÍÌèËÊÉÈÈÆÅÃÂÀ¾½»°|kfH§®± ‰ # äÌËËÊÊÉÈÇÆÅÃÁÀ¿¼»¹·ljL§¯± ‰ # ÊÉèÈÇÆÅÄÃÁÀ¾½º¸·µ¡sk ¯±¡‰ # úÉÈÇÅÄÃÃíÂÀ¾½»¹·µ³«~jkD°°¢‹ # äǽ»¿½¹»¾À¿½»º¸¶³²¯‹khI±°¢‹ # äÀºÉÜèæ×À¶»½¼º¹¶´²°•olK ¯£‹ # ä·Íïþÿÿýå¼´ºº¸¶´²°®«žsjL?®£‹ # ýÎñÿÿëþܱµ¸¶´²°¬©¡wjL:£‹ # ýóþÿÿëþñ·²¶´²°®«ª§¡~j\G¬¤‹ # þþÿÿìö»¯´²±®¬©¨¥ ƒkcF«¤‹ # ÿëþì°®³°¯ª§¥¢ž…kgG«¤‹ # ÿëüШ®°®¬ª§¥£ œ„kgH«¥‹ # ÿêþÕ§©¯¯ª¨¦£ ž•zkdLª¥‹ # ÿéýÚ«¦®ª¨¦£ ž•‚njdIª¥‹ # ÿèýÙ¬¥¬®¬ª¨¦£Ÿ™Ž~rmkfHª¦ # ÿçýÖ«¤ª¬ª¨¥ ˜‚ztpmkbHª¦Œ # ÿæüÑ¥£ª¬«©¤ž•Œ…{xsplj Hª¦‹ # äÿýÔ¢¡¨©¥Ÿ˜’Œˆ…‚zxsolkM8ª¦‰ # äüÓŸ—™•“Š‡…}zwrnkiKU©¦‡ # äÌ“‹”˜–•“‘Œ‰†„€|yuqmjgI¾©¦„ # 䊔˜—–”’Ž‹ˆ…‚~{wtplkjG¿©§ # ä‹•™˜—•“‘Š‡„}zvsolk 3Àª§v # üŽ’‘é‘ŽŒ‰†ƒ€|xtqmkgH¥Á©¦t " ㎎Œ‚„‹Š‡„~zwsplkbJ¥Âª¦, " íìç߸ˆˆˆ…‚|xuqnlj?§¥Âª¦†3 " ÿèýÈ~†ƒ€}zvsolkfL§¥Â©¦ƒ7 " ÿé÷©xƒ{xurnlj_*§¥Ã©¦‚O " ÿéþÇt|yvroljjK§§¥Ã©¦„i " ÿéþÉr}}ywspmki?U¨¨¥Âª§†m " ÿèü¸q{zwtqmkjbH±´¯¦Âª§…i% ! ÿèäqzxuroljiH¬°«ª¥Âª§…rX ! þæùÙ›mtxuromkk? ®«¥Áª§ˆ}s ! â´³²°¡nrwurolkjf$¯²±±¥Á«§‹€i ! ïxvtsrruwuromkkbD¨¨ö§¥À«§…zj, í‚€~|{ywtrolkjfL²¯¬¬ö¬À¯¦}ea8 € ýib < ûkiid ø 6cÇÖÄ * êwlkjd hšºÎDz œ§·ÉÔÒ¢ ) ñÕ¾{lji[¸ÁÈÉÈÆÄÄûÆÅÅ{ ) äÞÝÚÅŸwkjk¢îëèæåäãâÞÙÄÉÑÕÜèÁ # ÜöÛ×»‘pkhU ÿ
ÿüþÿÒ # ÛÚ÷Ùͨ~kkaýýþýýþÈ # ñÛÚÚÙÙØ×Ô¸‰mic¿þþûýüþà # ðÚÙØØ××ÖÕÕÁ“mif¿ÿÿþüýþà # ïÙØØ×ÖÖÕÔÓÒÆ•mjcUÿÿûþýÿà # îØ××ÖÖÕÔÓÓÒÑÅ’ljbÿÿûþýÿà # î×ÖÕÕÔÓÒÑÑÐÏÍÀŒli ÿÿûþýÿÅ # íÖÕÔÔÓÒÑÐÏÎÍÌË´lj¦ÿÿûþýÿÅ # ìÕÔÔÓÓÑÑÏÏÎÍÌÊɧtj\¯ÿÿûþýÿÅ # ìÔÓÓÒÑÐÏÎÎÍËÊÉÈ“liÿÿûþýÿÈ # ëÓÒÑÑÐÏÎÍÌËÊÈÇÆųjdªÿÿûþýÿË # ÑæÐÏÏÎÍÌËÊÈÇÅÄÃÀ›mjUUþÿþýÿÌ # þÐÏÏèÎÍÌËÊÉÇÆÄÃÂÀ¶kiªýÿþýÿÎ # þÏÎÎèÍÌËÊÉÇÆÅÃÂÀ¿¼™ni ýÿþýÿÎ # ÍÌèËÊÉÈÈÆÅÃÂÀ¾½»°|kfªþþýÿÎ # äÌËËÊÊÉÈÇÆÅÃÁÀ¿¼»¹·lj¨ÿþýÿÎ # ÊÉèÈÇÆÅÄÃÁÀ¾½º¸·µ¡sk ªþýÿÎ # úÉÈÇÅÄÃÃíÂÀ¾½»¹·µ³«~jk¦þýÿÎ # äǽ»¿½¹»¾À¿½»º¸¶³²¯‹kh¦þþÿÎ # äÀºÉÜèæ×À¶»½¼º¹¶´²°•olªªþÿÎ # ä·Íïþÿÿýå¼´ºº¸¶´²°®«žsjªŸþÿÎ # ýÎñÿÿëþܱµ¸¶´²°¬©¡wjªœþÿÎ # ýóþÿÿëþñ·²¶´²°®«ª§¡~j\þÿÎ # þþÿÿìö»¯´²±®¬©¨¥ ƒkc¥þÿÎ # ÿëþì°®³°¯ª§¥¢ž…kgþÿÎ # ÿëüШ®°®¬ª§¥£ œ„kgþÿÎ # ÿêþÕ§©¯¯ª¨¦£ ž•zkdªþÿÎ # ÿéýÚ«¦®ª¨¦£ ž•‚njd«þÿÎ # ÿèýÙ¬¥¬®¬ª¨¦£Ÿ™Ž~rmkfªþÿÎ # ÿçýÖ«¤ª¬ª¨¥ ˜‚ztpmkbþÿÌ # ÿæüÑ¥£ª¬«©¤ž•Œ…{xsplj £þÿË # äÿýÔ¢¡¨©¥Ÿ˜’Œˆ…‚zxsolk©ªþÿÈ # äüÓŸ—™•“Š‡…}zwrnkiªªþÿÅ # äÌ“‹”˜–•“‘Œ‰†„€|yuqmjg«ýþÿÁ # 䊔˜—–”’Ž‹ˆ…‚~{wtplkj§ýþÿº # ä‹•™˜—•“‘Š‡„}zvsolk ™ýþÿ¯ # üŽ’‘é‘ŽŒ‰†ƒ€|xtqmkgªÿýþÿ° " ㎎Œ‚„‹Š‡„~zwsplkb¬ÿýþÿ¿B " íìç߸ˆˆˆ…‚|xuqnlj?ÿÿýþÿÉM " ÿèýÈ~†ƒ€}zvsolkfªÿÿýþÿÅT " ÿé÷©xƒ{xurnlj_ªÿÿýþÿÃu " ÿñþÇt|yvroljjªÿÿúýþÿÇœ " ÿñþÉr}}ywspmki?ªþþúýþÿÉ£ " ÿèü¸q{zwtqmkjbûúüþýþÿÈ›< ! ÿèäqzxuroljiªüûüýÿýþÿȨ… ! þæùÙ›mtxuromkk?ªüüýüþýþþȸª ! â´³²°¡nrwurolkjf‘ûúúûüÿýþþȹ› ! ïxvtsrruwuromkkb™þþõýþÿýþÿȵžB ð‚€~|{ywtrolkjf¥þþøýþþ½–“^ € ý5
< úߦ^! 9 øÿþï¾l! 7 ÿû÷¹^ 6 ÿüð”2 5 ÿûûÊ] 3 ÿüàw 2 ÿüìŠ 1
ÿüõŒ 0 ÿüú‰ / ÿüò|
.
ÿüá^ - ÿýË< - ÿüý› , ÿüñh + ÿüþÆ& + ÿüü} * ÿýÈ) * ÿüøo ) ÿý· ) ÿýæH ) ÿüúƒ ( ÿý¹ ( ÿýá1 ( ÿýóU ( ÿýù ( ÿýý¡ ( ÿüþ» ' ÿýÈ ' ÿýÑ ' ÿýÖ% ' ÿýÖ& ' ÿýÒ! ' ÿýÊ ' ÿý½
' ÿüý¥ ' ÿýú… ( ÿýõ\ ( ÿýå6 ( ÿýÀ ( ÿüüŒ ( ÿýêQ ) ÿýÁ ) ÿüú| ) ÿýÔ2 * ÿý * ÿüþÒ0 + ÿüõv + ÿüý± , ÿýÙM -
ÿüíp - ÿüù . ÿüû /
ÿüûž# 0 á&@J )+ )+,fjklnpsuxz{}‚ƒ„…††‡‡†…ü„‚ á3FEE *+ *+-cjklmprtvxy|}~‚ƒƒ„„ƒú‚€~} â
)+ )++jikkmoqstvxzz|}~€€€û}|{z ç (+ (+ jijlmoqstvwxyz{{|}}|ù{zzywv *ì+**+fijklmoqrsuvwxxyyxûwuts ì') ') djkjlmooqrsttuuõvuutssrqpo ù$))$)Uii÷kllmmoppqqpúonmll # ñ & ffijjllklmmùklkjkk & ÷ ]hijjk÷jkjjkjgj 1 ý\cggüdfb … áCnt HL HLMfjklnpsuxz{}‚ƒ„…††‡‡†…ü„‚ áXxvw KL KLNcjklmprtvxy|}~‚ƒƒ„„ƒú‚€~} â, ML MLLjikkmoqstvxzz|}~€€€û}|{z ç?HM?HM jijlmoqstvwxyz{{|}}|ù{zzywv êHLLHLLfijklmoqrsuvwxxyyxûwuts ìIJ IJ djkjlmooqrsttuuõvuutssrqpo ùHLLHLUii÷kllmmoppqqpúonmll # ñDI D ffijjllklmmùklkjkk & ÷?: ? ]hijjk÷jkjjkjgj 1 ý\cggüdfb … áe¤¢U©ªU©ª«fjklnpsuxz{}‚ƒ„…††‡‡†…ü„‚ ᄳ®¯ªªªª«cjklmprtvxy|}~‚ƒƒ„„ƒú‚€~} â(B1,'ÿ¦ªÿ¦ªªjikkmoqstvxzz|}~€€€û}|{z 篩«¯©« jijlmoqstvwxyz{{|}}|ù{zzywv ªì©ªª©fijklmoqrsuvwxxyyxûwuts ªí©ªª© djkjlmooqrsttuuõvuutssrqpo ùª¨©ª¨Uii÷kllmmoppqqpúonmll " ðUœªUœ ffijjllklmmùklkjkk % öŸœŸ ]hijjk÷jkjjkjgj 1 ý\cggüdfb … ü‰òÿ ÿ ü|áÿÿ û ^Ìýÿÿ! ú<›ñþÿÿ# û
hÆüÿÿ$ ú&}Èøÿÿ& ø)o·æúþÿÿþü ' õHƒ¹áóùýþÿÿùýúôåÀŒ * ë1U¡»ÈÑÖÖÒʽ¥…[6 0 ö %%!
„ â€~|zxvsqomkkf"afmry~€~nT; ! ä|zxvurpmlljb QSTUTTSSRPmYSC # äxwusromkjhf 05:?>>=:<<>FHLA # õtsqonlkji? ø # ÷qpnlljjb 6 ømllkjj? 7 küjf_ 9 ügb? < â€~|zxvsqomkkfD°´¶º½¾¾½Í´¦w ! ä|zxvurpmlljb$£¥¨©©¨§§¦¤³©¦† # äxwusromkjhf `lx}}zwwz~‰‘™„ # õtsqonlkji? ÷#2B- # ÷qpnlljjb 6 ømllkjj? 7 küjf_ 9 ügb? < ñ€~|zxvsqomkkf™þþýùüýÿ¶)4 ! ð|zxvurpmlljb‘ùüÿÿûýþÿÍ # äxwusromkjhfª•¥µº·³±°³»ÂÏÞëÊ # õtsqonlkji? ÷ (8MfI # öqpnlljjbª 5 ømllkjj? 7 küjf_ 9 ügb? < ÿüù# 1 ÿüì 2 ÿûýÙp 3 ÿúþõ±M 4 ÿüÒu 6 ÿúúÔ0 7 úêÁ|2 9 üQ < € € € € , ( – K
% X P Background ÿ
‰q X P ‰• H8 HD HP H\ X P ‰ñ ¡H µ_ ÉU ÝE ñË ù a -ã -ó . 1ô 5 8! ;H >? Ad D¢ H H( þÇÍ5Í úÕÎÍçæççþæç
çþæççþæçç üÕÍÜç6ç ýÎÜççþæç ç ýÇÍççþæççþæçç þÍç9ç ýÍæç8ç þÍç9ç þÍææþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ þÍååæåèæååææåæåææååæåææåææååææååüæåæååüæååææå ýÍäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå þÍääþãääþãääùãääãäãääþãääãäþãääþãää þÍã9ã þÍã9ã þÍââûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ þÍââáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þÍááþàááàýáàááüàáàááûàááàááüàáàááþàáá þÍà9à þÍà9à üÍààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùÍÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûÍÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þÍÝ-ÝþÜÝÝþÜÝÝ þÍÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þÍÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þÍÚ(ÚþÙÚÚ þÍÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üÍØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þÍØ9Ø þÍØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þÍ×9× þÍÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þÍÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øÍÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üÍÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýÍÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûÍÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þÍÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ÍÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ ;Í ;Í ÍÌüÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýÍÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þÍËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þÍÊ9Ê üÍÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þÍÉ9É þÍÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ þÍÈ ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç7ç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç ýÍçææûçææçææþçææþçææøçæççææçææçþæçç æ üÍåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå þÍååäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä þÍääþãääþãääã
äãäøãäããääãääþãääþãää þÍã9ã þÍã9ã üÍâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ ûÍáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÍá áþàááàáþàááúàáàáàááúàáààá þÍà9à þÍà9à ýÍàßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà ûÍßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þÍÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þÍÝ9Ý þÍÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þÍÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þÍÚ9Ú þÍÙ
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù öÍØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þÍØ9Ø ûÍØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þÍ×9× þÍÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷ÍÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ùÍÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þÍÔ9Ô þÍÔ+ÔþÓÔ Ô üÍÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ üÍÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þÍÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷ÍÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ùÍÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ ûÍÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ ;Í ;Í ÍÌÍÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ùÍËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË ûÍÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þÍÊ9Ê þÍÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þÍÉ9É óÍÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ þÍÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ þÍÇ ÇþÆÇÇ ûÍÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç%çþæçç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç þÍææüçæçææüçæçææûçææçææçæøçæçææççææþçææþç úÍåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå üÍääååøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå þÍä äþãä
äþãääþãääþãä äãäýãä þÍã9ã þÍã9ã ýÍãââùãââãâãââãâãøâããâãâãââþãââãâãâþã ûÍáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÍááþàááþàááþàá
áàüáààááþà þÍà9à þÍà9à òÍßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÍÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÍÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÍÝ9Ý ûÍÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÍÜ9Ü þÍÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÍÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÍÚ*ÚþÙÚ Ú ûÍÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÍØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÍØ9Ø ùÍ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÍ×9× þÍÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÍÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÍÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÍÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÍÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÍÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÍÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÍÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ ;Í ;Í þÍÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÍÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÍË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÍÊ9Ê þÍÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÍÉ9É þÍÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ûÍÈÈÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ þÍÆ9Æ ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ?Í ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/resources/back.xcf 0000664 0001750 0001750 00000013020 13157571677 022721 0 ustar atagar atagar 0000000 0000000 gimp xcf file d B B ' gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
‡ í < Back ÿ
!ÿÿÿþ
D gimp-text-layer ((text "Back")
(font "Ubuntu Italic")
(font-size 27.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.152941 0.152941 0.152941))
(justify left)
(box-mode fixed)
(box-width 60.000000)
(box-height 32.000000)
(box-unit pixels)
| < < €'€'€'^ ü ÿä 7 ü[ÿ§ þÿÿúðصg ü˜ÿi þQÿÿýÑ üÕÿ, ó‡ÿŽ.qêÿœ ûþì ü½ÿJ ü=ÿê üOÿ° ûñÿ üÿò üŒÿs ü)ÿÜ ü5ÿÉ ÷4‡Êåøá³K ø6˜ÙôóØŠ üÉÿ5 úÿÿ~ ü_ÿ¥ ûÉÿZ ý °ÿÿþã ü˜þÿÿñ© ûó ¸ÿûh ò•ÿo <†çÿš ô8êÿ÷—GXÿ« é³ÿó{$ –B Cÿº 3ßÿìA þËÿÿýàc ú îÿ½ ü‘ÿr ûzÿä& ö€ÿ| eøÿÌ! ýùÿÿýàU ûÀÿ³ öÉÿ: öý7 ÷½ÿHŸÿÿ“ ü6ÿÆ ø ,yôþU û>ÿê öùù rÿ¨ øõÿÙÿèM ülÿ’ üQÿÓ ü–ÿz ü:ÿÉ ü¶ÿN þ7ÿÿýþD ü¢ÿ^ üÿ÷ üÕÿ- üsÿ üäÿ øtÿµŠÿô> üØÿ* ü ÿã üñÿ
ü¬ÿX üøÿ ÷±ÿq uÿò/ ûþó üuÿ¯ üúÿ üïÿ* üôÿ õíÿ/ ”ÿä üDÿ ûVøÿD üàÿW úŒÿÿ üÉÿi ô+ÿë ËÿÅ òzÿœ0d¾ÿÿ‹ ÷˜ÿìR
D¿ÿÿ ñiÿòa%g¨ hÿª û)÷ÿ þ°ÿÿýìi ý éÿÿûÚ…ÿÿ ý²ÿÿùò ¥ÿg û‰ÿû) þåÿÿù÷êÌ¡\ õ ¢èùÞ‡
&ÿÿ òhÈôùà¥B âÿ% ûïÿ· i È 0
New Layer ÿ
“ È 0 ¯ ø È 0 Ë È Ø è
ýhWVVýUT þXVVýWU * úUZUUTUUûT ÇUUúTUUWx ) êKMNOPOORUV PLOPPOQSVh ( ê`DDFFEFGI CDFGFEFHHT ýwVUUT é49<==<<== 8<<==<==4TT ýJTSST ý0122ú3B 022ú5LMST KLûKMST é%')**(*-. '&(**))+-$GE õD@DEEDDEGE ð ! !#
! ö"!=0 46==þ0 ç 48< ü534554ý8< Ú
/0v 9)+..-,-/0v þ ýü &%kký "&&þ%kk ýù ô!``Î ü %!`` û ø ðTTT ì& ! þ II ê% !"!!"$; !#"!"$#$ü
>>! æ*)+-,++.0')*,,++,/$ 22$ æ64566557<;
5456556858
& ü?;>??í>?AA9=>??>?ACD % ýCFHH÷GHKgU>EGHHøINVb ! þòOQRSRSTVV CNQRRöSUVi $! þþ\XXëWVV[&&$XWXWWVWˆ%%&&$ ! þëi[\[XWWb--/\Z\ZXXY..--ü/1 û845655ý8< û845655ý8< ! þ%''ý96==ú*''96==þ* " þ433õC@DEDDCDGE33õC@DEDDCDGE " ý@?>>ýKJLLûKMTU>>ýKJLLûKMTU " þGIIýJSTTUIýJSTTU% þWUUþwWWVUþWUUþwWWVU' ý^a`` ý^a``, ý€lkk ý€lkk; þqww= ýƒ‚
þfYYXýWV üXYYXXýYW * ûTYWXWWóV ¨VWWVWWYz ) ñILNQRQQTWX QLOQQûSUXj ( ê]CEGGFGHI BEFGGFHIHV ýtWXXWV é8:=>>==>> 9<=>>=>>5VV üJTTUUV û433433û4C 33ú6MNUV KMüNUV é%)*+*)+./ ')++**,/%HF õCAEFFEEFHF ã ! "$ ! !#">1 87=>>þ1 ç 59= ü845665ý9= Ú
01 x 9+-//.-.01 x þ ûü '&mmü "(''þ&mm ýù ô"aa¿ ü &"aa û ø
ðVVV ì( ! þ JJ ä% "#""#% < !#""#$$%
??! æ+*+.-,,/1(++--,,-0% 33$ æ84677668=<
5467667979
& ü??@@?@BDE % úDGII÷HILhV=FHIIøJOWc ! þòOQSTSTUWW BORSSöTVWj %" þç\XYYXWW\''%WXYXXWX‰&&''% ! þëi\]\YXXc..0\[][YYZ//..ü02 û856766ý9= û856766ý9= ! ý%)((ü87=>>ù+((87=>>þ+ " 4õCADFEEDEHF44õCADFEEDEHF " þ@??KþLMMûLNUV??KþLMMûLNUV " ýGIJJýSTUUVJýSTUUV% ùWUVVtWXXWVùWUVVtWXXWV' þbaa þbaa, ý€nmm ý€nmm; þ€yy= ýƒ„
ü_VVUUýTS þVUUýVT * úVUTUSTTóS RSTTSTTVv ) êJKLOPNNQTU PJMOONPRUg ( ê]ACEEDDFH ABDEDDEGGS ýeUTTS ü48:;; ô89:;;:;;2SS ûIORSRRS û/11211÷2; /11211ú4BLRS ýJIKKûJLRS é#&(*)(*,- !%&))()*,%FD õA?BDCCBCFD ñ " ö! ;- 45;;þ- ç 369 ú5234433ý69 á
./ t ;(*--,,û./ t þú ü %$iiý"%%þ$ii ýþ
ýö
^^Î ü $ ^^ ü ø
ðSSS æ% þ HH ê# ! !#2 "! !#"#ü
<>í=?A?8<=>>=>@BC % ýBEGGøHJbS:DFGGøINT` ! þæMNPQPQSTT GKOQQPRSTg # þþZUUTîY%%#VTTUUTU„$$%%# ! ýiXWWðUT_,,.[VWWVVW--,,ü.0 ý û534544ý7;û534544ý7; ! þ%&&ü56;<<ù)&&56;<<þ) " þ122õA?CDCCBCFD22õA?CDCCBCFD " þ@==õJIJKKJJLRS==õJIJKKJJLRS " þGHHýIORRSHýIORRS% þQSSýeUTTSþQSSýeUTTS' ^ ^, þ€ii þ€ii; ûqstt < ý|€
ýü ýþ , ì r•’–˜] GŠ”’šŒ1 ) û&ŽïÿÿøÒg
OÂÿÿûó¨5 ( ë;¢ùÿÿï¤6 gÖÿÿþ×q
) ü=½ÿÿñì— yèÿÿüÒS ) ëZßþÿýÞy &™ôÿÿùº< ) ëtÖÿÿüÍe >¥ðÿÿôž: ( ë ‰æÿÿõÀR J¸üÿÿä' * ò8Ÿóÿÿ÷¦? eËÿÿüÙw ) ëH²ÿÿüá˜+ "tÝÿÿöÇb * ý.Õÿÿ÷ø¢
sùÿÿýãV , ì'·òÿÿù¯& bÞýÿÿçn + ë
4•òÿýê°G [Ãûÿù×}! , ì#yèÿÿýÃ\ F±ýÿÿê—' , ìjÕÿÿþ×p 2õÿÿó®= , ü
YÃÿÿ÷â~! 'Œçÿÿü¸P + ë C·ôÿþé˜* wÜÿÿûÍa + ë/œðÿÿó¬? `ÊûÿþÝs , ì$ƒòÿÿùÃN GÃþÿÿî‘ , üfãÿÿøë‚ +§ÿÿüÌD + ÷UsosxK ÷1iqovp( + ýü ýþ ' þ
$ ä
! ç
& è
¨ € € € € d 2 stem-1.8.0/docs/_static/buttons/resources/faq.xcf 0000664 0001750 0001750 00000256156 13157571677 022613 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ U B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 µ ¾ XO œÈ Ê > FAQ ÿ
g ' @ gimp-text-layer $(text "FAQ")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 202.000000)
(box-height 62.000000)
(box-unit pixels)
Ê > ¹ ¦ ² Ê > Õ n † – € € € À þ þ
ý‘Y ý[ùÿÿþ* û+ÿÜ û&‹ùÿÿþÙÌÌûÎÞðþÿÿþ/ û—ÿÿO þÿÿþJ ø8öÿÿ4 úôÿÿ¿ þ9ÿÿþ ûbÿÿ9 þpÿÿþ/ þ ÿÿþ ü¼ÿ>
ýÚÿÿþŸ þ
ÿÿþ ükÿC
þIÿÿýø þ ÿÿþ ü ÿH
üµÿÚÿÿþ€ þ ÿÿþ
ý ú#ýû'ñÿÿýè þ! þ ÿÿþ úŽÿ« ’ÿÿþ` þ™ þ ÿÿþ ý& ø
ïÿ@ (þÿÿþÐ ýù þ ÿÿþ ý]ô üfÿÕ þ»ÿÿþA
ý`ÿ þ ÿÿþ ý›ô üÒÿj þOÿÿþ±
ý¤ÿ þ ÿÿþ ü åô û?ÿò
ýàÿÿýý# ýæÿ þ ÿÿþ û—ÿô ü«ÿ” þwÿÿþ‘ üÿÿ þ ÿÿþohhøm‚šçÿÿô
û ûÿ* ý÷ÿÿýò ü#ÿÿ þ ÿÿþô
ü„ÿ¾ þŸÿÿþr ü7ÿÿ þ ÿÿþ¬¨¨üÃÚÿÿþô ûéÿR þ3ÿÿýÞ üEÿÿ þ ÿÿþ û+¿ÿô û]ÿã þÇÿÿþR ü,ÿÿ þ ÿÿþ ü ôô üÉÿ| þ[ÿÿþà ü
ÿÿ þ ÿÿþ ýªô û6ÿù ýèÿÿþ2 ýçÿ þ ÿÿþ ýnô ü¢ÿùØ Øþóÿÿþ£ ýÅÿ þ ÿÿþ ý n ýøÿÿýù ý£ÿ þ ÿÿþ ü{ÿÖ4 4þÓÿÿþƒ ýzÿ þ ÿÿþ ûâÿq þfÿÿýë ýó þ ÿÿþ ûUÿø ý
îÿÿþd þ„ þ ÿÿþ üÄÿ§
þŒÿÿþÓ þ þ ÿÿþ û5ÿÿC
ý!ýÿÿþD þÿÿþ û¬ÿÝ þÄÿÿþµ þ(ÿÿþ" û)ýÿ þ{ÿÿþ3 þDÿÿþ< û®ÿÿZ þ2ÿÿþµ þÿÿþ˜ þUÿÿþ‡ ýþÿÿþR ûA¤þÿÿûü< ü"}üÿÿû÷d.
ü%«ÿÿüð‹6 þfÿ ÿþ• þ>ÿÿþ¦ þpÿ
ÿþK A € € € É õ(p‘¨¿Áª“u/ 1 ü‡Üÿÿüã“ , ëvïÿÿþÁc0
'Nªùÿÿö…
) ýÊÿÿýíB ý ÅÿÿýÙ# ' ý)ßÿÿýØ$ ýÿÿýë9 % ý êÿÿýÆ
ýºÿÿýõ- # ýÇÿÿýþ0 ýõÿÿýÚ " þŽÿÿþ© þ–ÿÿþ¬ " þûÿÿýü' ý'þÿÿþ9 ! ÿþ® þ´ÿÿþ¸ ! ÿþh þBÿÿþ1 ÿþ% þöÿÿþ~ ÿþâ þÚÿÿþÂ ÿþ« þ½ÿÿýú ÿþ— þŸÿÿþ+ ÿþ† þ‚ÿÿþ? ÿþt þeÿÿþT ÿþl þQÿÿþa ÿþ{ þaÿÿþH ÿþŠ þsÿÿþ) ÿþš þ„ÿÿþ ÿþ± þÿÿþí ÿþå þÙÿÿþÉ ÿþ þÿÿþt ÿþS þWÿÿýû ÿþ© þÿÿþ± ! þîÿÿýú ý ùÿÿþI ! þyÿÿþ þšÿÿþž " ý
Éÿÿý÷, ý"ûÿÿýÖ
# ý »ÿÿýÔ
ýÀÿÿýï- % ý¬ÿÿýÞ9 ý!Öÿÿýß) ' ÷•þÿÿü ý<êÿÿýÅ * ò/®þÿÿÛži4$AkÇÿÿüà[ - ü.þÿÿûþ¿^ 1 þ^ÿÿý 5 þƒÿÿýþX 5 ý¦ÿÿýùD 5 ý—ÿÿýó7 6 ýxþÿÿýøl 6 ýSÞÿÿý¯ 5 ü`ÙÿÿüëŒ) 5 ûR›ØÿÿúÅ`? 4 ôS‡›¬½ÎßãÚ
€ € € € l l l l e 2 X P Icon ÿ
% _ X P ƒ X X+ X7 XC X P ß 5T N N$ N4 ND NT Nd Nt N„ N” Tª WŸ W¯ W¿ WÏ Wß Wï Wÿ X ¯ ü ú - ú
ý & û
õ ( å "%&$! " ã 2F[q‚Ž–—“ˆydN7 í %BeŽµÕìþÿÿúöÝ»U è&
6dšÊíÿ
ÿýŒ! þ88ï677
32" %,3;CJQX`o|ƒ”®¿ÄÃÆÑâèççéêìëëêÓ°›‹…… Ò¿3:`B70 (.6>EMT[eu€‚Ž¤·¾ÆØççèêëëììéãÊ®’†… Òw1A.7:,#+19AHOW_hw‚ƒƒ‰š°ÇàêéìîíëéâÖȺ´¸–‡… ÒK7@19='%-3;CKR[bju}‚†‡†‰š½ãêèéèãÛÔɾ¾¼Á—‡… Ñÿ;A{Z+BP4"*3;CKT\dlt|…Ž–¤¬µ¾ÆÐÚâðô÷ùÿÒ˜‰……„†† ×=B\2ER3#+3BFJNRTVcv~~ö}~s_YWUR ÝAZs‰hd / C 4|šd, $(-27;?CGKMN[r{||}ø~nXQOMK Ð
@Uryouz Ha>†›g1!'+047 Þÿ±µÅ¼¶³«©¯²´·º½ÀŽh (Os—Ðûøöùøøöù÷õíãÿ` Ò̲·Á¶¶°¨©®°³µ¸»¾Âƺf# 9cžçÿö÷úú÷÷ôïëçãÿo Ò¹³·¼··¯¨«¯²´¶¸¼¿ÂÇÁ˜kZJ;.(Gœóýö÷øöòñêêèèéÿ_ Ñÿ¶·Éº¸·¨«¯²´¶¹½ÁÃÇÊÐÖÑÈ»¦Œ‡·ñöôôòìòóòóìíÿæ9 Ñÿ´»å»º¶«©¬°²µ·¹½ÁÄÇÊÎÔÙßãéïóëèêíðóòõù÷ôòÿÿl ߶´¾Æ¸¼µªª°³¶¹»¾ÁÃÇËÍÏÔØÛÞàçééêð÷÷ù÷úÿÿv
ÑÄ´¿½¸¼´ªª¯³·¹¼¾ÂÄÈÌÎÐÔÙÝÞàåééíó÷÷ý÷öýÿéV Þ¶À¼¹¼´©ª°³·¸¼¿ÂÅÊÌÎÑÕÛÝÞáåéìñõûÿÿ÷¥3 ¸áÁ¼º¾³¨ª°³·¸¼ÀÂÆËÍÏÒÖÚÝÝàäéîòûÿÿö7 ߶¹Þ·¼¿³¨ª°³¶¸¼ÀÂÇËÍÏÒÖÚÜßáåìðõýÿÿõ Ú³ºÆ¸½Á´§ª±³¶¸¼ÀÂÆÊÍÏÒÕÚÝÞáåìïòùúÿÿ# û Ú±º¸º¼Â´§ª°³¶¹¼¿ÁÅÉÍÏÑÕÚÝßâæêëðöþÿW û Û¯¹¢¶»Ã¶§ª°³¶¹¼¿ÁÄÈÌÍÏÕÚÜßáåèèîùÿ” ý0 ܪ·’¹Å¹¨©°³µ¸»¿ÂÃÇÊÍÏÔÙÛÝßâçéíÿê: û
7¤ ܪ¶Í·Æ¼©¨¬¯³µ¶º½ÁÃÇÉÎÏÓ×ÚÜÝàåèóÿ‚ û
@´ñ ݶ²Î¨³ÆÁ«§«®²´¶¹¼ÀÂÇÉÌÎÑ×ÙÛÜÞääøôM ú
G»óä Ñÿ®Ì}¯Äů§«®°³¶¹»¾ÁÅÈÊÍÐÕ×ÙÚÝâàüÇ4
D¿òæÞ ÝªÆ¨§¿Èµ§ª®¯²´·º¼ÀÂÇÈÌÏÒÖ×ÙÝÞáÿ©)÷ /óæßÝ Ý§¿ ¨¹Ê½©¨¬¯±³·º¼ÀÃÅÆÉÎÒÓÔ×ÚÛáù–$÷
bâéáÝÛ Ý ¶™¤²Éŧª®°²¶¹º¾ÃÄÅÇÍÐÑÓÖØÚáðŽ$÷ €áâÞÛÙ ÒªÐR¦ÃË´¦¨¬°²µ·¹¼ÀÂÃÆÉÎÐÐÓÖÖÝì$ "’áÞÛÙ× Ñ
m¤Ä¤¡»ÎÀª¨«®°³·¸º½ÁÂÄÇËÌÎÐÓÓÚæ“*
+›àÚÙÖÓ å#‰¢·•¯É̲§©¬¯²¶·¸»¿ÂÃÅÇÊÍÏÏîÔÜ]<:;;:6]³ÙØÕÒÐ â,Ÿª© ® ½Ñ¿ª¨«®°´µ·º½ÀÂÃÅÉËÍÍÏÑÑñÇÁÁÂÁÂÁÊÕÕÓÒÐÏ Ñ%¤¦Ÿ¾ž±Ì䨩¬¯³´µ¹»½ÀÁÃÅÈÊËÍÎÎÒÓÓÔÖÖ×ÖÏÎÑÐÐÍË Ü+ž¦œŠ ¾ÒĨ«°²³¶¹¼½¿ÁÄÄÆÇÉÍѵz][\\÷[YˆÄÐÎËÊ ÑE›¨¸¡À¡‹¬ÉÔ¼©¨«®°±´·¹»½¿ÂÃÄÄÆËÒš>SµÏËÈÈ Ül ª¾”¬³ž·Óд¨ª¬¯±´¶¹º¼¾ÀÁÂÃÇΘ:÷P²ËÈÆŠч§«Á¥ž»Ÿo¤ÂÖɲ©©¬¯±´·¸¹»¼¿ÁÁÅËš?U°ÇÅàѩ«¿¦ª£‚«“°ÊÙÆ°©ª¬®°³µµ·¸¹»¾¾ÂÈ›BX°Å¿¾ Ñ„«·Ã±¯ ±—¸Ÿ³ÎÙű©©¬¯±³²´¶·¸»»¾Ä™E Z®Á¾¼º Ђ§¶»µ¸» º¤Ã›¸ÒÙDz©¨¬®¯°±³µ¶¸¸»À™G [¬¾º¹¸ ù=‘ªª§¦¦ÙžŽ¨I¢ºÓÚʶ«¨ª¬®¯±²³µµ¸½—F Y©»¸¸µ Ñswjm{ƒƒ…™¢‰q£¼ÑÜμ°©©«®°±±³µ¸^=;=<<99mª¸¶µ³r ÿþÔÿÿ2 ÷ÿççíðïîðïïîûìðõß ) ôÿìñîîðïæÿ÷ý÷÷öþ÷õú÷òÿïï % òéïðïïðõÿüÿüõøõõúùôóõôÿÿþõ # ïðíîïîÐÿýùòóññòòóòòþðññôýõû ! îÚíîïîàÿùôóññòôôõöùùøø÷÷öôñò þëïïò½ÿøññòóôöùûþþÿÿûþüõñ è§yfZOB4$Ôïïð+ÿõóððô÷úýÿÿýùó ëRâäàÞßÞßíîïðâøòññó÷üÿÿüþøó é]îþýýþþðíîÞÿöðñôöüþÿÿþÿÿ þÿüýõó ü‹ñþýýïîïïõýóðñöúþÿÿþýþÿÿ ýüûõó ëXm`®úþýþïîðæùòðóöüþþÿÿþÿþûÿþýýþþýüùõô ìš¾®Åÿþÿñïñòüòòôùýÿþÿÿþÿþÿþüùõô ëˆÁ·Ìÿþñïðùùóòõúýþÿÿþÿÿþÿùþüûúùùúúùýÿÿü÷ô ¸Ôÿðñðèþóòöúýþýþþÿíþùóîéææåãäåçëòéæõù ò{¼·àÿñïðÿõñôûýýþÿ÷ýöìáÚÖÕÓÒÒ÷ÓÒÕÛ¨…©Ú ñw¹·ÿðïððôòñ÷üüýýþ÷ýÿþøêÛÑÌÊÊóÉÊÊÌÌËÎÉs9Ft Ýq·´éïðôõñðñòöûüýýþþýþþõßÌÄÄÃÂÃÄÄÃÃÄÄùË´\,)1 ül´ÿññõúóòñòññõúüýýþúóÙü¼½½»ºø»ÆœH'*' ùdÿøññÿóóîòññóóõøúýþÿö×»µ·¶µµ²ô³´´±²»‚6#&# ÷bÿòñÿýôóòòßóôóôøüþúÞ¹®¯¯®¬«ª¶ÁÈÌÊ»±f' "! ÓUñðñÿ÷ôóòòñòóôóóõùü辧§¨§¦¥£¤¯Èáðõ÷öòêÊ_ ! ùÿðòõôóòòüóòóôôðõ÷ê²”¡¢Ÿžšœ®Õöÿÿùû 5 Úðññÿòóóñòóòóóôôõ÷øÃ^M–˜–“’£Òüÿÿþþÿÿþÿÿû€) öÿîòòøóôóñóóõâôùö¡4 @j‡Š’»óÿþüýþÿÿþþýÿãH øÿðòð÷ôóòòóýòóõõîøí‚#,Su‚™Õÿþüýýÿÿøþüýÿl ùÿòòÿõóññóýòôööðøæ~+" ;e¢ëÿþþÿÿ÷ýüüÿÿv âóòóÿ÷ôòññóôóòôöõõøîºkXF5.L¢öÿÿòþÿþÿþýüþÿÿf áÿõóøùöõóñòóôóòôõö÷øùýÿøìÚÀ —Çüÿÿþûÿÿøþÿÿù? éÿòóÿùõôòññôôóóõöö÷÷øúýÿÿþþÿÿþþÿÿût
äÚóôÿ÷öôòñòôôóôõö÷õ÷øø÷ùüýüýÿ ÿú#
ôëóôÿ÷õóòòñóôôûõö÷õøø÷úüýûûýþþÿÿøëY
øòóóÿöôóòòôþõööøøûýüûûýþÿÿ÷¤5 âöôóÿöõóòñòôôóôõ÷õõøø÷øûüüùùûýÿÿö6 âðôÿø÷õóòñòôôóôõöõöøù÷øúüýúùûþÿÿõ øñôÿøööôòò÷ôóóôõ÷ö÷øøùúüýüûýÿÿý! ù áðóÿÿööóðòòôóóôô÷öö÷ùøùùûýüûýÿýÿÿüZ û áïóïýööóññòóôóôõ÷öõ÷ø÷øùûüüúüþüÿÿüš ý 6 ñôòåùööôññóóôóóööíõøö÷÷úüûüúûþþÿÿí= ü ?³ øîóöÿööõòòòóôóòôõöôøöø÷úüüúÿü† úFÃÿ Ýÿñöÿõööññòóóôóôõõô÷ö÷÷ùüûûøùÿþÿ÷R
úNËÿþ ûÿðõÿööØòñòòóóòôöôõ÷÷ö÷ùüûûùùýýÿÌ9 JÐÿýú Þïõñ÷ööôñòóóòòôõôõõøö÷ùûûùúúûýÿ²-÷ 4¼ÿÿøú öòõïÿööõññóóþôõõùö÷÷öùûùù÷úûýÿ¦)÷ løÿþüü Ýìóüÿôööññóòòóõôôõø÷÷öùúúùúùûÿÿ (÷ ûþýüû öÿðöÿóö÷óñòòôãöø÷ö÷ùùøùúùýÿ¡) &¦þþüùø õ§ïôï÷÷øõñòòóúõôôõ÷ööèø÷÷øûùþÿ©0
1²ÿüüúù Ñ5Õðôîÿø÷öòòññòóõôôõö÷õõööøúù÷úÿÊlFEEDC?mÐýûúùú õBïÿñìô÷ôøõññýòóôôðõö÷õöö÷÷ø÷÷øùõáÓÓõÑÒÑäùüúùøù ô8ðÿîóòþõ÷÷óññúõôóôõööõêø÷÷øø÷ùøöõõö÷÷òóùûû÷ö ôEìÿëñðAõõ÷õòòþñóóúôõ÷öõööø÷ùüÚ“pmnn÷mk¢ëûúö÷ èníþýîôðÿóöøôñðòóóòóôôõõööëõööúÿ½L eÜüùöø ê¦õþýéñîóòóøøóñòóòñòôóõõöõîùÿ½IcÛûùö÷ èËýþüþíóðÿôöù÷òòóñðòóôôóõõöíõùÿÂP jÜúøõõ ÑÌÿþüþÿðäñúõ÷úõôòòñòóôôóõôôõöõøþÄT" !! oÞú÷öõ ÛÂþýüýþðòóóøô÷øöôòñòóôôóôóóôõõ÷ýÅX%#$$÷" sßúööô ý%Çþþýñîóñõòôøùöóññòòóóôî÷ýÇ])'('(%#vßøöõò ûYÚÿþÿÿïïðñíóôøù÷óñóòóóòóóìôòõûÈ]'$&%&$!vß÷õôó å*ª®›ŸµºÁÉÌïèòðñõ÷ú÷ôóòóññòóóîôõùÒ~QNPOONL“äõóôóñ 0 ì$,49<94,# ( é$868=A=Ïâ ÕšòðäÛÓÌĽµ¥•…}wrpqspfdeVF80,+,.267B—Øá Ô/µ÷íáÚÑÊû²ª£›’‹„{qibZSKFB=4.*(&%&(+-/d¾ââ ÔEÈøëáÙÑȹ²ª¡›’‰zqiaZSKC;5/*%! !(Q§Ýäâ ÔY×÷êáÙÑÈÁ¹±© ™‰xog_XQI@:2+% Q¥ßèäã Ô
hãöèß×ÏÈ¿·¯§ —Žˆ€vme_WOG?7/' Wãëèåä Ô séöçß×ÏÈ¿·¯§ –Ž†~ume]VOG>5-% cºéîêèæå Ôzí÷çß×ÏÇ¿·¯§Ÿ–Ž†~ume]UNF=4,$
pÊðñíìêçæ Ô}îöèß×ÏÈ¿·¯§Ÿ–Ž‡~ume]UNF=5-% }Ø÷õðïîìéì Ô|î÷éß×ÏÈÀ¸¯§ —†€wnf^VNF>7/( (…àüùôòñîîðå Ô
vìøéáÙÑȺ±©¢š‘‡€yph`XQHA:1* )~Þÿüùöôññóà¥ Ú lçøêâÚÒÊú±©£š‘Š‚zqibZSLD<5*(fËûþúùöôôüÙ–\ Ô`ÞùìâÚÒÊļ³«£œ“Œ„|skd\VOGA9,H¦ïüúù÷õöõÒ‹SI àNÓûïäÜÔÌľµ¥ž•Ž‡wnha[TLF<7qÏøøöùö÷÷ЃNFP Ô8ÁýñåÝÖÏÇ¿·°¨¡™‘Šƒ{rle_XQL@G’â÷õõöõúÚ‡MENV à!©üôèàØÑʺ³¬¤ž”Ž†~voic]WPEW©ëõòò÷÷ïŸTFMUZ àˆóøëãÛÔÍŽ¶¯¨ ˜‘Š‚ztnhb\VLe¶íòðð÷úØzLNTY_ ÕaáýðæÞ×ÐÉÁ¹²«£œ•‡xrlgb\Tp¼îðîïïúÈqRUZ_d Õ9ÄÿôêâÚÓÌĽ¶¯§Ÿ™”…~ysmic[wÁîðîïðúÂpY]afk Ö•÷ùíäÝÖÏÈÀº³¬¤ž—‘‹†€ztpjc|Àéëéêìô¼t`ehmr Ö]àþñçáÚÓÌľ·°©£—‘‹…{wqlx´´³´µ¸™rhkotx ×(¶üöìäÝÖÐÈ»´§¢œ–‹†‚}yurssrqqpqomorvz~ × sëþñèáÚÔËÆÀ¹²¬§¢˜’ŽŠ„~yvtrqppqtwx{}‚† ×0¼þøíæßÚÒÌÅ¿¸²¨¢™”Œ‡ƒŠŸ¬«ª©©«¬—ƒ‚…‰Œ Ø lèÿóëåÞ×ÑËž¹³®©¤Ÿ›—“Ž‰šÈäååæåæ纉Œ“ Ù$ªüúñéâÜÖÑËÿ¸´¯ª¦¢žš•‘¢ÐìíìííîïÁ–“—š ÙLÑÿ÷ðçàÛÖÐËÅ¿ºµ±¨¥¢™§ÐéêéêêëìÞ˜›Ÿ£ äuêÿ÷îæàÛÖÐËÅÁ¼¸´°¬©¥¡ÒêëêëëùÆ¥ £¦ª Û šúÿõíæáÜÕÐËÈÿ»·³°¬©µÕêëêêéëìˬ§ª± Ü0°þþõïèáÜ×ÒÎÊÆ¿»¸´±¼Øëìëëêìîϳ¯²µ¹ è<·þþöïéâÞÙÔÑÍÉÆÂÀ½¹ÂÜíîîïùÔ»·º¼À ç@µÿÿ÷ñêåßÛÙÕÑÍÊÇÅÁÆØääãååúÓ¿ÂÃÈ ü ; ù
3 8 ÷
ª 6 õ
'ÿ ù*951,'! ).//-fSSTTû_yA5 # íHD?:3/+'" .424j™TTû_yB6 # ìOHB@>90)$! "374/9ÿTTû_yC6 # ì_]sˆ’~]7" '::201TTû_xD9 # ë|žÅÖßäÞÉ•N# 0@;0&UTTû^xE9 # ë”Éßäçëñöê²R" ;D7% TTû_xF9 # äšËÖÚÞáæëõî«F +GB0TT_vG; # ä¼ÍÒ×ÛàâèðÞƒ. =L=%TT_tG< # ä‚¥ÃÌÏÕÙÜàäè´M" (LH0T_rH= # ä²ÄÊÎÒÕØÛãÊl(#BQ; S_pI= # 䄃–µÃÆËÎÐÔÚу2& .TH* aoJ? # ä…ƒƒ˜±¿ÅÈÉÌÑÏ;($ OT5 bmK? # …æ‚“«ºÁÃÅÊÉ?+& A[C%dlK? # ä…„ƒ‚œ®·½Á¶y6,$(y`. PB # äšž—†~unf^UME=5,#,}b- PB # ä ¦•Ž†}tme]TMD<4,#2a) PB # 䬣›’‹…|tld[SLC;3+";…_# QD # 䧟˜ˆ‚yqjbZRJB:2* I‡[ QD # 䣜•Œ…xog`XPH@91( […R QC # ä ™’‰ƒ|umd\VNE>7/&$p€G RB # äš”†xpibZRKC<4,#2„w: RA # 䕈‚|tme^XPH@92* Gk+ R@ # ä‘Œ„}voib[TMF=70' %e\ YR> # ä‹…xqjd^WPIB:3-# 6ƒˆK YR: # ã„zsmg`YRLE>71( $S–x4 ZR; " ã~ytmgb\UNGA:3,# 5w–_# ZSC " ãxsnga\WPIC<5/' &S“„A ˆZSG " ãqlga\WQLD>81+! ;yšg* ‰ZSF " ëifa]VQLG?93-% .^—‹H ú‰ZSE- " ãc`ZUOKF@:4.' &N†œi+ Q‰ZSG= " ã]XSNID?94/( !Cvžƒ@ PˆZSH@ " íUQLHD>94/)! ;j—•Z ÷bRˆ[TH= ! âNKFB>93/(!!8dŸr1 \ZP‡[THB2 ! âFC@;72.( :d‹ €? [_Q†[TMJ@ ! ï?<950+& #>f‹¢‡G f÷_Q…[TQN< ! á851.)" (HlŒ¢‰N VVWUQ„[TIG= á1.)$ 3UrŽ¢‰N `^_`^…dSC;8 À þ¥ = û ª : ù«ÕŒž£² 8 £ù¤«¡§ÿ 6 õ¥¤£§¨°”Ÿ°ÿ ù$Fm…Ž * §¦î§ªª±^Âÿ„wlho|†ŽŒm ) ꫪ©©¨§©·á«¸…„„……’’„R ) 䬫ª©¨ªª¬±Áµ´Œ”—˜”‰wz…‰’ # ñ°¯®¬«©ªª«°¼²¶••–—û–Ÿ™… # ù´³°¯®¬««í®°¸íùµ´²¯¬ª¨¥©·™| # ﶵ³²°¯«©«®¯²¾Â´¬¬ù®¯µÃ { # ¸ï¶µ²°°ª©«¯²µ·µ»¦§§û·˜{ # í¼º¸·´²°°®¬©¬²´³ºÿ̧§û·™{ # ì¾½¹¸·µ²°¯®¬ª´µ´»²ÿ§§û¬·š| # 싼ÍÒÖÕÎö®«ª±·¶¶ß¯§§û¬·š~ # ëJ°çòóôóëÙ¿®¬«ª³¸·º´ª§§û¬·›€ # ëHªÝó÷øùûø俪¬¶º¶¸–§§û¬·œ€ # äN£¾Úòôõ÷üùຬ©°º¸²É§§¬¶œ‚ # ä8‹«»Þòôô÷ùòѲ©ª¶½¸¶½§§¬µž… # ä `˜§Àèòóôõö侬¨°½¼¶ß£§¬´ž† # ä3t—§Ñïñðñôëɯ®ª©º¾¸¶¼§¬³ž‡ # äAz•·èïìïòîг¯¬¦²¿»²À›²Ÿ‰ # äCtÛîêìîíÕ·°®ª«¾À¸Á¢®± ‰ # ä> . C|¡‹\8" "&),/05?FGGHøG?521., ý3FEEåF 0 ;sœyP5" $')+,-.//ø.--+)&! à
/ 4b‹¥”nQ<) !$%&&%ù$" ì# !Jv™¥”rZM>- ú #0D[ á 6Wz¬œj`\TJ@931149BMZgmmq ! í< 9Xv”ª¯ž‡ukhikmm÷nllmv† " ã& 8M`y”ª¶µ¢™’’˜¡µ·ª”| $ å, $9IVdr~‡Ž‘’’Ž‡~sgWK= & ç- 4Ldy‰‘’‡ydM3 ( ü"8 ð6Vr†‘’„qU5 + ë +?Sgy†Ž’‘Œ‚saM9% . ñ6Tm€‹‘ˆ{dJ+
ÔCntpll¡¤—±ˆ¦¹ÏÜÔĶ©©«¯¯°²´¬˜ŒŽŒ‹ž±´²±° ÛXxvwwvw¦˜²q ·ÌÛÚÍ¿´¨©«¯¯°±²³³´´³²²°ý® Ô, ¢£±@¡´ÄÓÝ×ʾ¶°«©©«®®¯°¯¯°¯®¯¬ªª¬ ë •£¼ÌÙÞ×ÊÁ¼·²ª©¨¨©úª®²ºÃ êU gš¦´ÀÍÚàÙÏÇÿ»¸µ³³÷¶¸½ÂÆÉÇÊ àž¨µd©·ÂÌ×ÞáÛÒÌÉÇÆÈÈÇÉÊÉÈÈÌÓÛà ᔎŸ®s™®®µ¾ÄÍÖßääàÜÙÖÕ×ÚÜàäåß×Ï " ãš—¦¯–ª¤¨µ¼ÀÆÌÏÒÕÕÖÖÕÓÐÌÇÀ»¹ $ åz—«±‘pܲ©¬¸¾ÆÏÖ×ÖÖÔÏǾµ©ª¹ & 犢§¬´¤”¯¶ÁÎ×ØÖÕÓͶª˜Ÿ¤ ( éuž¦«¯·¿ÆÌÒÔÕÖÔÐËļµª + ì…”œ¨´¾ÈÏÓÕÖÒÍÅ»¯¤— ÿ ée¤¢¢¡ ñïðñÿõôøùøöôóñðñòòðóôõëϾ½¾½½¾¼Öïôóó Ù„³®¯°¯°æïíñòóö÷ùúøöôòñòñòòóòóôôóôôõôóôóóýñò å(B1,'"$(óîñòÇ÷ôöøúù÷õôóóññòòóòøóôóòñòò êâðëókþõöøùúù÷öõôóóòññððöñðòññòóôö ëªñíôÿþõöõ÷ùúùøöö÷öôôóóò÷õôõö÷øö÷ íðéñòÑøôõö÷ùùúúùø÷ö÷÷õõöøø÷÷øùùú ûéîðóÿÿøùö÷õ÷øùúúòùúøøùûúúûûúøø " ûïðññÿÿùùóôõööøøþ÷øøùúø÷ôôø $ åãëñòÿÉÿÿùõú÷øûüúøøùúùøöñûÿ & ïäüóòóÿÿöþ÷øýÿüøùúúúøöïïÿ ( éìêñïòòóõõ÷ø÷÷øø÷÷öôóññ + ùçîïñóô÷÷øöúõòñîî ÿ é;¬ûÿúòíçãàÜØÕÒÎÌÉÊÎÑÐÎÎøÏËÇÇÉÌÏ ß1šïÿüöðìçãÞÜÚ×ÔÓÐÎÍÌËÊÉËÌÌÎÐÒÕ× ì$zÓÿÿúôñìçãáÞÛÙ×ÖÕÔÔøÕÔÖ×ÙÛÝ ðQ©ñÿþùõòîêæãáÞÞÝõÜÛÜÛÜÞßâæê " î+qÀøÿþúöõòïíìéèçææøçéëìïóô # ä7xÀöÿÿýù÷öõôóòòóòñòóôôöøý % ø2e¢Üýÿÿôþúùøùø÷÷øúþÿÿþý ' ÷ @lšÄèÿÿúþæÁ—g ) ê )5?DEEFGGFEC>4( ,
‚ â)$ )Gf|”£…L ry~€~nT; ! ä 'C^qˆŸž~H UTTSSRPmYSC # ä.Iao~•¦“f9 ?>>=:<<>FHLA # òio|”¨œ|R# ø # ÷‚Ÿ[9 þ 2 ôª•{[= , 3 úcP; þ 5 ü&
ý# 6 þ ý% 9 ü0 : þ ~ ⯬«°¼ÆÏØÝÒ¼¡Š¨t¶º½¾¾½Í´¦w ! «æ¯¹ÄËÓÛÛϼ¢Šˆ©y©©¨§§¦¤³©¦† # ä²¼ÄÉÏØÞ×Ƶ¢¤‡©}}zwwz~‰‘™„ # ñÇÈÍÖÞÚÏ¿«Ž_ˆ©p ÷#2B- # òÐÚàÚÏ·¦œ™T¨€ 1 óßÙζ˜_°¢w 2 ôž¸ª¥¡ž<©ŠD 3 ö²©šŒ›„¦ƒ 5 øÔ|˜b®¤ 7 ù·°«¥d 8 ü©¨Ž ; þ€ > òòóô÷øøú÷ôñõòñäýýùüýÿ¶)4 ! ïðòòô÷÷øúùøöõÿîñíÿÿûýþÿÍ # äóõõöøúúùöõ÷ÿññ康³±°³»ÂÏÞëÊ # ÷ôøúùøõõëüøòà ÷ (8MfI # òøúûúøö÷øÿòËóï 1 úõøööûñÏðóòç 2 ö÷õÿÿø³ñï½ 3 öù÷ðòðÿóôë 5 øÿÛîÐóóð 7 ùÿññïëÿ 8 ü÷ùë ; þÿ > ñÒÕ×Ûßæíòùÿö©; 0 òÙÛàåëðõüÿç”1 1 óáçíñô÷ÿÿÑs# 2 ôîòõøýÿë¨L 3 öõ÷ýÿõ¿i( 5 ÿùñ¾s3 6 ùØ `1 8 û<
: ý ý € € € € , ( – K
% X P Alternate Icon ÿ
2 Xú X P Y œ˜ œ¤ œ° œ¼ X P Yz {Ô ’ ’ ’" ’2 ’B ’R ’b ’r ’‚ ™ œ œ( œ8 œH œX œh œx œˆ « î+Mz™§¯¶º¶®§“oC) * èd—ÀÝëïóö÷øùøõôóîèض‹Y $ ôd¥Òëõø÷÷ööõõö÷úøôåɘ ! ó"zÃåóøøöôóòñððïðñùóôõ÷÷ò ñpÇëøøöôóñïîíëëêêëøìíïðòôõ îWµçùøõóñïíëééçæååääöåææèéêìîð ü& íŒÙõøöóðîìéèæäãâáàßßöàááãäåçéë ü88 ï#µçù÷ôñîëéçäãáßÞÝ ÝùÞßàâäæ þ ñGÄôùõòïìéæäâßÞÝÝÞßÞÝüÞßá ódÏöøôðíêçäáßÝÝìÞßßàÜØÔÑÏÎÐÒÕÙÞàßßÞÝÝ ü($ ôlÙù÷óðìèåâßÝÝþÞßßëÍ¥‚iUD618FWk‡®ÔßàßÞÞ ý:K ØYÓù÷óïìèäáÞÝÝÞßßÊ£nC)(4?HQTND:. 'Gu©Ñàß þ3 ×CË÷÷óïëçãàÝÝÞßßÉI1>Sk‹Ž‘“”’Œ†yaH2)PÒ æ%Ç÷÷óïëçãßÝÝÞßÕ—T2Jm„“–—˜˜ò—–••“’Žˆ{_9)W Ö£ïøóïëçãßÝÝßß¼i1Ko†‘’“‘ŽŒŠ‰ˆ‰Š‹ŒŒŠ†{`8 ä‚æùôðìçãßÝÝßà©R9b}‡ŒŒŠ†€ztrrqörx~ƒ……ƒ}p Ô#ÌøõñíèäàÝÝßÙ“GHl~„‡ˆ…€wno”¥¯·¹²§’yinw}~z ãªõ÷óîéåáÝÝß߉3Kq|€€ymt™Ëìùÿÿöøæ·€_luww î]ÞùôïêæáÞÝÞà BLlv{{øzwp•Þ÷þÿÿ÷þüä—^dmp æ®ööñìèãÞÝÞÞ²OIgptuutsod—üÿ ÿúò¡Y`e åLàùôîéåàÝÝßÇ`>_imnnmlli]nåÿ
ÿûåyR[ ä¤ô÷ñìçâÞÝÞØw3Ubghhggfec[QÁþÿ ÿûþ³OR ÛÓøôïéäßÝÞß°FHY_aa``_^^]WJ–øûîÜȾÐìþÿÿüÞZH ðtî÷òíçâÞÝßÜq9OWZZYîXWVVRImÑ¥lPHCIrÉþÿÿüïg? ÙµùöñëåàÝÝߥ@@û=5?ÎÿÿüíZ0 ãbë÷òíçâÝÝßÁB7BFGFEEDCCBA@@?=<<;ú:81@ÑÿÿüàD+ Ù›ôöñìæàÝÝà™,6=@??>==<;:998776531/.+&dîÿÿü¼3% Ù¹øõïêåßÝÞØm(3798766554321/-)&" %¦üÿÿûöx ñ ÊùôîéãÞÝßÈE'/22ê10/.--*(% yôÿÿúþÄ2 Ú>ÙùóíèâÞÞà²/#*,,+*)(&$" U×ÿÿúðm
ÚVäøòíçâÝÞàŸ( %&&%$#"! 4¼þÿÿùôŠ
ò\è÷òìçáÝÞà#!%%ë$#"! —øÿÿûû¥*
òaî÷òìçáÝÞà !%%ë$#"! iôþÿÿ÷þ³5
ògñ÷ñìæáÝÞáw!%%ì$#"! ,¸þÿÿ÷ÔI
òjñ÷ñìæáÝßáw!%%í$#"! `ìÿÿöòo
ò`ì÷ñìæáÝÞá !%%í$#"! ”þÿÿöÀ%
ò\è÷òìçáÝÞà#!%%î$#"! %»ÿÿõú‚
ÞVã÷òíçáÝÞàŸ( $%%$#"! .ÎÿÿõëW
ÞAÙøòíèâÝÞà±- #%%$#"! 2ÖÿÿõåB
Þ ÌùóîèâÞÝßÈA #%%$#"! 0ÄííõÐ8
лøôïéäÞÝß×j !$%$#"! MZYXXYQ
ÙœóõðëåàÝÞà— #%$#"! ù
édëöñìæàÝÝàÀ9 "$$#"! î
ì3Ú÷óíèâÞÝßÚf #$#"! ü!"#$$ï#9`{qN&
ì·÷õïéäßÝÞà£. !##""!!ú"$&(*,,î+bºîúõà™:&&$! ïxíöñëæáÝÝàÛk "#""ò#%(,/24662XÏþÿÿôþù”/..,($ à Ô÷óîèãßÝÞà¯7 ""#$'+047:<=;8ùÿÿöãZ2531-)$ á§ôõðëæáÝÝßØs "#&+17;>@A@=@Éþÿÿöö}488641, âRà÷òíèãßÝÞàÆZ !$(.6<@BCCA=GÕÿÿüø†499ü852 á±õõïëæáÝÝßß°A "(08>ACDDB>8¶ýÿÿöñi39::963 â`Þ÷òíéäßÝÝßáž1 &-6<@ABBA>5víÿÿûþÄC399ü751 â¬ôõðìçãÞÝÞà߆&!(06;>@@A?70—ñÿÿôþÍg+587630+ Ô&ÍõóïêæâÞÝÞàÙ‘: '-369;<<8/4u³ÑÇ›O*/4420+'! þA Õ…åöòîéåáÞÝÞàà§K #(,035651*%-51)$*./-*&! ü
@U Ö¦îöñíéåáÞÝÞàá¼e !%(+,--+(%##$&''%#
ü HU Ö-ÈöõñíéåáÞÝÞßàÓ”O !"##""!
T û9<5 ØHËõôðìéåáÞÝÝßààÈC LšÑ« î+Mz™§¯¶º¶®§“oC) * èd—ÀÝëïóö÷øùøõôóîèض‹Y $ ôd¥Òëõø÷÷ööõõö÷úøôåɘ ! ó"zÃåóøøöôóòñððïðñùóôõ÷÷ò ñpÇëøøöôóñïîíëëêêëøìíïðòôõ îWµçùøõóñïíëééçæååääöåææèéêìîð ü_F9 íŒÙõøöóðîìéèæäãâáàßßöàááãäåçéë ü,†… ï#µçù÷ôñîëéçäãáßÞÝ ÝùÞßàâäæ þ7 ñGÄôùõòïìéæäâßÞÝÝÞßÞÝüÞßá ódÏöøôðíêçäáßÝÝìÞßßàÞÛÙ×ÕÔÕ×ÚÜßàßßÞÝÝ ü7HA ôlÙù÷óðìèåâßÝÝþÞßßëÕ¼¦–‰|rnr}‰–¨ÁÙààßÞÞ ýg ØYÓù÷óïìèäáÞÝÝÞßàÓ»œrqy„ŠŒ‡€zrhlœ½×àß þZ ×CË÷÷óïëçãàÝÝÞßàÓ±†xŽŸ´¶¸º»¹¶³¯¦•ƒslƒµØ è%Ç÷÷óïëçãßÝÝÞßÚ¶zŠ¡±º¾ÀÀó¿¾½¼º·±§’xlˆ Þ£ïøóïëçãßÝÝßßËšyŠ¤´»¾¿¿¾¼º¹¶µ´µ¶·¸¸úµ°§“v ã‚æùôðìçãßÝÝßàÀ€œ¯¸¼¾¼º¶°©£¡ŸŸôžŸ¡§¬°²²°ªŸ Ô#ÌøõñíèäàÝÝßÝ´ˆŠ¤²¸»»¹³© §´¾ÅËÌÇ¿±¡—ž§¬®© ãªõ÷óîéåáÝÝßà®|©³¸¹¹·¯¢ ¸Úñûÿÿöùíˤ‘Ÿ§©© ä]ÞùôïêæáÞÝÞà»…§±µ¶¶µ±¨¹çúþÿÿ÷þü뵚¢¥ æ®ööñìèãÞÝÞßÆ¥®²³³²±¬Ÿ¹üÿ ÿúõ½Ž˜ž åLàùôîéåàÝÝßÒ—…Ÿ«¯°¯¯®¬©œžìÿ
ÿûì¡‹– ä¤ô÷ñìçâÞÝÞܤ~˜¦«¬«ª©§ŒÔþÿ ÿûþɇ ÛÓøôïéäßÝÞßʼn ¨ªª©¨§¦¥¤Œ·úüóæ×ÐÜñþÿÿüç‡ Útî÷òíçâÞÝßÞ¡„™¤¦§¦¥¤¤¢¡ œŸàÀ˜‡ƒ~šÖþÿÿüô•€ ÙµùöñëåàÝÝß¾ƒŽ£¤££¢ žžœš”Œ–‚‚†‰ˆƒv–ðÿÿüõ˜{ Ù4ÛøôïéãßÝÞÝ“ Ÿžœ›šš™—”Œ‹ŒŽŽ‰~zÛÿÿüòw Ùbë÷òíçâÝÝßφ‡–œœ›šš˜˜––•“‘ŒŒŠ‡}|Þÿÿüé~u Ù›ôöñìæàÝÝà¸|‹—šš™˜—–””’‘ŽŒŠ‰‡†„t•óÿÿüÏtr Ù¹øõïêåßÝÞÜŸ|•—–”““’ŽŒŠˆ…ƒ€}{yuopÂýÿÿûù¡ho Ù ÊùôîéãÞÝßÓˆ“”“‘ŽŒŠ‡…‚}|zyxvpi¥÷ÿÿúþÕsfl Ú>ÙùóíèâÞÞàÆ|€ŒŒ‹Š‡†ƒ‚~}|zywskäÿÿúô™\cf ÚVäøòíçâÝÞà»x€ŠŒŠ‰ˆ‡…„ƒ‚~}|zyun|Òþÿÿù÷¬^`ee Û\è÷òìçáÝÞà±u‹ŒŠ‰ˆ‡…„ƒ‚~}|zxrq¹úÿÿøû¿m_dfe Ûaî÷òìçáÝÞà§r‚ŒŒŠ‰ˆ‡…„ƒ‚~}|zvn÷þÿÿ÷þÈs]dffe Ügñ÷ñìæáÝÞáŸpƒŒŒŠ‰ˆ‡…„ƒ‚~}|ysxÏþÿÿûà€^dggþe Ýjñ÷ñìæáÝßáŸpƒŒŒŠ‰ˆ‡…„ƒ‚~}{wo—ñÿÿöõš]dhihge Ý`ì÷ñìæáÝÞá§sƒŒŒŠ‰ˆ‡…„ƒ‚~}{uk¸þÿÿöÒjbhjihge Þ\è÷òìçáÝÞà°u‹ŒŠ‰ˆ‡…„ƒ‚~}{ttÑÿÿõû§]gjjihge ÞVã÷òíçáÝÞà»xŠŒŠ‰ˆ‡…„ƒ‚~}zsxÞÿÿõñ‹aikjihge ÞAÙøòíèâÝÞàÆ{}ˆŒŒŠ‰ˆ‡…„ƒ‚~|zrzãÿÿõì~djkjihge Ý ÌùóîèâÞÝßÓ†z‡ŒŒŠ‰ˆ‡…„ƒ‚~|zsz×òññõÞzfkkjihge лøôïéäÞÝßÜžvƒŠŒ‹Š‰ˆ‡…„ƒ‚~}{vp‰Š‰‰Š‰kjlljihge ÐœóõðëåàÝÞà·v‰‹‹Š‰ˆ‡…„ƒ‚€~}yskfcbabejnnmkjige ÐdëöñìæàÝÝà΂z†Š‹Š‰ˆ‡…„ƒ‚€}{wtpnmnpqrqomkihf è3Ú÷óíèâÞÝßÝ›vˆ‹Š‰ˆ‡……„ƒƒí€{†œ¬¥wvxvtrpljh ë·÷õïéäßÝÞà¾|{…ŠŠ‰ˆ‡††è‡ˆ‰‰ˆ†Óóüø꽃{}{yvrol ßxíöñëæáÝÝàÞžu‡‰‰ˆ‡‡ˆŠ‹ŒŽˆ˜àþÿÿôþûº}‚‚€~zvr ç Ô÷óîèãßÝÞàÄ€w‚‡ˆˆ‰ŠŒŽ’””û‘ˆÀûÿÿö앃‡†„~y á§ôõðëæáÝÝßÜ¢q{ƒ†ˆŠ“•—˜—–‰Ûþÿÿöù¨€ˆ‰ˆ†ƒ€ âRà÷òíèãßÝÞàÒ“s|„ˆ‹Ž“–˜™š™—‹ãÿÿöú‰‹Šˆ‡ƒ á±õõïëæáÝÝßàÅ…s~…Š”˜š›š™˜Íþÿÿöõš‰Œ‹‰ˆ… â`Þ÷òíéäßÝÝßáº{t†’–˜™™˜—‘¢òÿÿõþÕŠ‹Šˆ†ƒ â¬ôõðìçãÞÝÞàà¬ut~‡Ž’”–˜—–“†vµõÿÿôþÛ•u„Š‰ˆ…‚~ Ô&ÍõóïêæâÞÝÞàݳr|„ŠŽ‘“””’Œ}uÇÜÕ¶ƒq~†‡…ƒ{u þ„ Õ…åöòîéåáÞÝÞàΈpw…‰ŒŽŒ†znnqnknzƒ‚|vpi ü‚§ ê¦îöñíéåáÞÝÞàáÌ™ppw~‚…‡‡î†‚|vrrty}~|zvqjc[ ü=‘ª â-ÈöõñíéåáÞÝÞßàÙµ‹pouy|~~}{yxxöwurnic]d† ûswj çHËõôðìéåáÞÝÝßàáÓ¯ƒolmqstuuótrpnlida_c´Ø« î+Mz™§¯¶º¶®§“oC) * èd—ÀÝëïóö÷øùøõôóîèض‹Y $ ôd¥Òëõø÷÷ööõõö÷úøôåɘ ! ó"zÃåóøøöôóòñððïðñùóôõ÷÷ò ñpÇëøøöôóñïîíëëêêëøìíïðòôõ îWµçùøõóñïíëééçæååääöåææèéêìîð û§yf íŒÙõøöóðîìéèæäãâáàßßöàááãäåçéë üRâä ï#µçù÷ôñîëéçäãáßÞÝ ÝùÞßàâäæ þ] ñGÄôùõòïìéæäâßÞÝÝÞßÞÝüÞßá ódÏöøôðíêçäáßÝÝìÞßßààÞÞÜÜÛÜÝÞßààßßÞÝÝ üXm` ôlÙù÷óðìèåâßÝÝçÞßààÜÓÉü´«®´»ÁÈÓÞààßÞÞ ýš¾ ØYÓù÷óïìèäáÞÝÝÞßàÜÔǽ¸·º½¿ÁÂÀ¼¸´¯°·ÄÒÝàß þˆ æCË÷÷óïëçãàÝÝÞßàÜÐÀ»ÀÈÑØÜÝßßóÞÜÚ×ÑȽ´¯¸ÎÝ æ%Ç÷÷óïëçãßÝÝÞàßÑþÆÒÛáäæçææòåäããâàÝÙÓƶ®¹ Ö£ïøóïëçãßÝÝßßÙȽÇÔÞäççèææãáàÞÝÞÞßààßÞÙÓÆ´ â‚æùôðìçãßÝÝßàÖÅÃÑÝãçèçåâÜ×ÑÎÌËËõÌÎÓØÜÞÝÛÖÎ Ô#ÌøõñíèäàÝÝßßÒÃÇ×áæééæáÙÏÊÍÓÙÜßàÝÙÑÉÆÍÕÚÜÚ× ãªõ÷óîéåáÝÝßàÐÀËÛäèééçàÔÌÖèöüÿÿöûóàËÄÑ×ÙÙ ä]ÞùôïêæáÞÝÞàÔÃÌÜäèêéèäÚÛñûþÿÿ÷þýóÔÂÎÕ× æ®ööñìèãÞÝÞßÙÆÊÜåèééèçãÕÚýÿ ÿúùØÂÎÓ åLàùôîéåàÝÝßÜÉÇÙäèéèèçåâÕËôÿ
ÿûóÊÅÏ ä¤ô÷ñìçâÞÝÞßÎÃÕâèéèççæäâØÄæþÿ ÿûþß¿Ê ÛÓøôïéäßÝÞßØÆÏßçéèçæååãâÛÉØüý÷ðçãêöþÿÿüñÀÅ Útî÷òíçâÞÝßàÍÈÙäèèçæååäâáÝÐÏîÛž½º¹ÄåþÿÿüøÄÀ ÙµùöñëåàÝÝßÖÅÑàçèççæääãáàÞ×ÍÍÃÅÊÌËŸÂõÿÿüùƾ Ù4ÛøôïéãßÝÞàËÈÚäççæåäãâáàßÝÚÕÒÒÓÔÔÓεéÿÿü÷¿¼ Ùbë÷òíçâÝÝßÜÅÏßåçæåäãâáàßÞÝÛÙØ××ÖÕÔÐĸëÿÿüò¸¼ Ù›ôöñìæàÝÝàÔÄÕâæçæåãâáàßÞÝÜÚÙØ×ÖÕÓÑ̾Æøÿÿüãµ¼ Ù¹øõïêåßÝÞßÍÈÚäææääâáàßÞÜÛÙØ×ÖÓÒÐÎ˹Ýþÿÿûûʲ¾ Ù ÊùôîéãÞÝßÝÅÍÝåæåãâáàßÝÜÛÙ×ÖÕÓÒÑÏÌƺÐúÿÿúþæ´¶¾ Ú>ÙùóíèâÞÞàÙÂÐßååäãâàßÝÜÛÙØ×ÕÔÓÒÐÎɾÇðÿÿúøƹ¼ ÚVäøòíçâÝÞàÕÂÓàååäâáàÞÝÜÛÙØ×ÕÔÓÒÐÌÿæþÿÿùúЪ´»¼ Û\è÷òìçáÝÞàÐÀÔáååäâáàÞÝÜÛÙØ×ÕÔÓÑÎȽÛüÿÿøýÚ±²º½½ Ûaî÷òìçáÝÞàÊ¿ÖâååäâáàÞÝÜÛÙØ×ÕÔÓÑÌÁÏúþÿÿúþß³°º½½ Ügñ÷ñìæáÝÞážØâååäâáàÞÝÜÛÙØ×ÕÔÓÐÈÁæþÿÿû츮¹¾¾þ½ Ýjñ÷ñìæáÝßážØâååäâáàÞÝÜÛÙØ×ÕÔÓÎÃÌ÷ÿÿöùÅ«¸¾À¿¾½ Ý`ì÷ñìæáÝÞáÊ¿×âååäâáàÞÝÜÛÙØ×ÕÔÒ̽Ûþÿÿö䮵¾ÀÀ¿¾½ Þ\è÷òìçáÝÞàÐÀÔáååäâáàÞÝÜÛÙØ×ÕÔÒʾæÿÿûüͼÁÁü¿¾½ ÞVã÷òíçáÝÞàÕÂÓàååäâáàÞÝÜÛÙØ×ÕÔÑȾìÿÿõö¿³ÀÂÂÁ¿¾½ ÞAÙøòíèâÝÞàÙÂÐÞäåäâáàÞÝÜÛÙØ×ÕÔÑÈ¿ïÿÿõôº¸ÁÃÂÁ¿¾½ Ý ÌùóîèâÞÝßÝÅÌÜãåäâáàÞÝÜÛÙØ×ÕÔÑÈÀé÷ööô÷í»»ÂÃÂÁ¿¾½ лøôïéäÞÝßßÍÇØâäãâáàÞÝÜÛÙØ×ÕÔÒ˿¿¼»»½À¸¾ÃÃÂÁ¿¾½ ÐœóõðëåàÝÞàÔÃÒßããâáàÞÝÜÛÙØ×ÕÔÓÏǽµ²°°±¶¾ÃÄÃÂÀ¿¾½ ÐdëöñìæàÝÝàÜÅÌÜâãâáàÞÝÜÛÙØ×ÕÔÓÑÎÉÄÀ½¼¾ÀÃÆÅÃÂÁ¿¾½ Ð3Ú÷óíèâÞÝßàËÅÖßââáàÞÝÛÛÙØ×ÖÕÔÒÏÈÈÐ×ÓÊÁÃÆÆÅÃÂÀ¿¾ з÷õïéäßÝÞàÖÃÎÛáâáàÞÝÛÛÙÙ××ÖÔÐÉÑéùýûôÞÃÃÇÇÅÄ¿¾ ßxíöñëæáÝÝààÍÅÔÞááßÞÝÛÛÚÙ××ÖÔÌÍîþÿÿôþüÚ¿ÆÈÇÅÄÁÀ à Ô÷óîèãßÝÞàÙÄÊØÞàßÞÝÜÛÚÙØ×ÖÒÆÞüÿÿöôÆÃÈÉÈÆÄ á§ôõðëæáÝÝßàÍÁÏÙÞßÞÝÜÛÛÚÙØÕÐÄëþÿÿöûÏ¿ÇÉÉÈÆÄ âRà÷òíèãßÝÞàÝÈÃÐÚÞÞÝÝÜÛÚÙ×ÕÎÂîÿÿöüмÇÊÉÈÇÅ á±õõïëæáÝÝßàÙÅÅÒÙÜÝÝÜÛÚÙØÕνâþÿÿûùļÇÉÉýÇÆ â`Þ÷òíéäßÝÝßáÕÁÆÑØÛÜÜÛÚÙØÖпÈ÷ÿÿõþä·¿ÈÊÉÈÇÅ í¬ôõðìçãÞÝÞàáпÄÏÖÙÚÚ÷ÙØÖÒƲÒøÿÿôþè¿´ÃÉÊÉÇÅà Ô&ÍõóïêæâÞÝÞààÒÁÁËÒ×ÙÙØ×ÖÔͽ°ÂÛèäѳ¯¾ÇÉÉÇÅþ ý ë…åöòîéåáÞÝÞàáÖľÅÎÓÕÖÖìÕÑɽ®©©¨ª°½ÅÈÈÆÄÀ¼µ ü%Çþ Ö¦îöñíéåáÞÝÞàáÛȺ¿ÇÍÑÓÔÔÒÐË»·¸¼ÁÅÈÇž¸±¨ üYÚÿ Ö-ÈöõñíéåáÞÝÞßáßÑû¾ÄÉËÎÏÎÍÊÈÅÄÄÅÄÃÀ½¸²«ª¸ û*ª®› èHËõôðìéåáÞÝÝßàáÜÏ¿¸¹½ÁÄÅÅóÃÂÀ¾¼¹µ¯¬«·ÎÞ) ì
' æ
!$%&%#!
" ã ".:H^s€‡‘Œ…}oYD7+ á $4TvžÆÜèñöùüþûùöïæ×¾”nM/! ñ .Q€³Ýõüþþÿ ÿøþýûñÖ¨u õ 4^ŸÕòýÿÿýüí ö +[¤Ýýÿÿ ö"IÚüþÿÿ ø
/kÀòÿ ÿ ø 9Ûþÿ ÿ ÷
G¡òþÿ ÿ ø!Q²öÿ ÿ ù
U½ýÿ!ÿ ù M·ýÿ"ÿ ù D¬÷ÿ#ÿ ù6¢ùÿ$ÿ ú(~êÿ%ÿ ù `Óþÿ%ÿ ù9¬úÿ&ÿ ú
&‚óÿ'ÿ ùLÇþÿ'ÿ ú(‰õÿ(ÿ ûIÉÿ)ÿ ú $ñÿ)ÿ ú7·ýÿ)ÿ ú `åÿ*ÿ ú
*’ûÿ*ÿ ú:Àþÿ*ÿ ûSßÿ+ÿ
ú vñÿ+ÿ
ú '“üÿ+ÿ
û1ªÿ,ÿ
û=¿ÿ,ÿ
ûGÑÿ,ÿ
ûMÛÿ,ÿ
ûQáÿ,ÿ
ûTçÿ,ÿ
ûTçÿ,ÿ
ûRâÿ,ÿ
ûMÛÿ,ÿ
ûGÒÿ,ÿ
û>Àÿ,ÿ
û1ªÿ,ÿ
ú '“üÿ+ÿ
ú wòÿ+ÿ ûTßÿ+ÿ ú<Âþÿ*ÿ ú
+“üÿ*ÿ ú açÿ*ÿ ú8¹ýÿ)ÿ ú $€òÿ)ÿ ûJËÿ)ÿ ú)‹öÿ(ÿ ùMÉþÿ'ÿ ú'…ôÿ'ÿ ù;®ûÿ&ÿ ù cÖþÿ%ÿ ú)ìÿ%ÿ ù8¤ùÿ$ÿ ù F®øÿ#ÿ ýU < û߶c : ú÷öá½V 9 øòõ÷÷ß©3 ù*±áßÝÝßäéíòõÈ TT_vG; # ìgfd^S0QÁàßÝÝáæêïõí‹ úT_tG< # ^ç[VL(gÛàÞÝÞãèíòöÍ) T_rH= # WîVSM<%ßßÝÝàåêðôì€ û_pI= # þMNNèLJC.FÇáÞÝÞâèíòô¾ aoJ? # äEGGFED?7 zßßÞÝàæëðõßM bmK? # þ>??î>=:5(;ºàÞÝßäéîôð’ ülK? # ê57765430*áßÝÝâçìòóÀ ükLA # ä/0/.-,+*&LÒàÞÝàåêðõ×# jLA # ä(''&%$#" %µáßÝßäéïôéi iMA # ý ë„áßÝÞãèíóóŒ gNA # æ PÜàÞÝáæìñõ¥
eNB #
ê
-ÇáÞÝáæëñõÀ cOB # ä ·áÞÝàåëðôÒ' `OB # ä ªáßÝßäêðôÚ- _OB # ä
žáßÝßäêðôá/ ^OB # ä –âßÝßäêïôå2 ^PB # ä –âßÝßäêïôå2 ^PB # ä žâßÝßäêïôà. ]PB # ä ©áßÝßäêðóÚ- ]QD # ä ·áßÝßåêðôÒ' \QD # ä ,ÇáÞÝàåëðôÀ [QC # ä MÛáÞÝáæëñõ¦
ZRB # ä ‚áàÝÝâçíòó ZRA # ä ´áßÝÞãéîóèj YR@ # ä EÒáßÝßäéïô×& YR> # ê {âàÞÝáæëñóÀ üYR: # ê 0¹áßÝÞâèíóð“ ûZR; " ã vßàÞÝßäéïôÞP ‡ZSC " ã
:ÅáßÝÝáçìñô¿ ˆZSG " ë&
‹ààÞÝßäéîóë„ ú‰ZSF " ã,# aÚáßÝÝáæëðôÌ- Q‰ZSE- " ì-%H¿áàÞÝßäéîóí ùQ‰ZSG= " ã+"
2¯âßÞÝÞâçìñôÉ WPˆZSH@ " í$ )’áàßÝÝáåêïóæˆ ÷bRˆ[TH= ! â ?£àáßÝÝàäèíòò¹ \ZP‡[THB2 ! îWµâàßÝÝßãèìðôÕZ ö[_Q†[TMJ@ ! ï rÐâàßÝÝßãçìðôä… f÷_Q…[TQN< ! á£ØáàÞÝÝßãçëïóì VVWUQ„[TIG= ðáàßÞÝÝàãçëïóð»% ó`^_`^…dSC;8 ýU < û߶c : ú÷öá½V 9 øòõ÷÷ß©3 ù$Fm…Ž * ÷íðòõöðÎu öwlho|†ŽŒm ) õèëíðóõ÷ߢ „…’ý„R ) ôãåèëîðô÷ïº/ ò”—˜”‰wz…‰’ # óÞàãæéìïóöðÀE •–—û–Ÿ™… # ÝôÞáäçëîòõòÉ7 ô´²¯¬ª¨¥©·™| # þÞÝÝõßãçêîñõ÷Æ9 ¬ù®¯µÃ { # ðáßÞÝÝÞâæéíñõñº! §û·˜{ # ð»ÜàßÝÝÞâåéíñõî® §û·™{ # ïk›ÖàßÞÝÞâåéîòöæ‚ §û¬·š| # î…jˆÆáßÞÝÞâæêîóöÖY §û¬·š~ # ë¡Žp|ºáàÞÝÞâçëïôó· §§û¬·›€ # í¦Ÿ”sn°áßÞÝßãèìñõç… §û¬·œ€ # ä¤ ›rvÂáßÝÝßäéíòõÈ §§¬¶œ‚ # 쟛–Šn‚ÌàßÝÝáæêïõí‹ ú§¬µž… # ™æ˜•„gÝàÞÝÞãèíòöÍ) §¬´ž† # ”î’‰xe©àßÝÝàåêðôì€ û¬³ž‡ # 䎎Œ‰€mzÐáÞÝÞâèíòô¾ ²Ÿ‰ # 䈊Š‰‡†v`àßÞÝàæëðõßM ®± ‰ # ꄆ…„ƒ‚xisÇàÞÝßäéîôð’ ü± ‰ # ꀀ~}zvm^ áßÝÝâçìòóÀ ü±¡‰ # {çzyxvtm`~×àÞÝàåêðõ×# °¢‹ # vçusrqokbdÃáßÝßäéïôéi °¢‹ # qæponmljf`Y£áßÝÞãèíóóŒ ¯£‹ # änlkjihgfc^UÞàÞÝáæìñõ¥
®£‹ # ägffedcb`^ZQhÐáÞÝáæëñõÀ £‹ # ädcba`_]\ZWO^ÅáÞÝàåëðôÒ' ¬¤‹ # ädcba_^]\ZWPV»áßÝßäêðôÚ- «¤‹ # ädcba_^]\ZWPN³áßÝßäêðôá/ «¤‹ # ädcba_^]\[XQI¬âßÝßäêïôå2 «¥‹ # ädcba_^]\[XQI¬âßÝßäêïôå2 ª¥‹ # ädcba_^]\ZXPO³âßÝßäêïôà. ª¥‹ # ädcba_^]\ZWPV»áßÝßäêðóÚ- ª¦ # ädcba_^]\YVO^ÅáßÝßåêðôÒ' ª¦Œ # ädcba_^]\YUNhÐáÞÝàåëðôÀ ª¦‹ # ädcba_^]\YUN~ÞáÞÝáæëñõ¦
ª¦‰ # ädcba_^][XSQ¢áàÝÝâçíòó ©¦‡ # ädcba_^][WQ]ÃáßÝÞãéîóèj ©¦„ # äecba_^\ZVOyØáßÝßäéïô×& ©§ # êfdba_^\YSQâàÞÝáæëñóÀ üª§v # êheca`^[VPlÆáßÝÞâèíóð“ û©¦t " ãmidb`^ZTOšààÞÝßäéïôÞP ª¦, " ãtnhd`]WQrÏáßÝÝáçìñô¿ ª¦†3 " ëzslf`[RW¨ààÞÝßäéîóë„ ú©¦ƒ7 " ã~wog^WQŒÝáßÝÝáæëðôÌ- ¥Ã©¦‚O " ì€yoe[R|ËáàÞÝßäéîóí ù¥Ã©¦„i " ã~vk`UnÀâßÞÝÞâçìñôÉ ¨¥Âª§†m " íxncXi®âàßÝÝáåêïóæˆ ÷¯¦Âª§…i% ! âlbYx¹ááßÝÝàäèíòò¹ «ª¥Âª§…rX ! î`\ˆÅâàßÝÝßãèìðôÕZ ö«¥Áª§ˆ}s ! ïd™×âàßÝÝßãçìðôä… ±÷¥Á«§‹€i ! í¹ÜáàÞÝÝßãçëïóì ¨¨ö§¥À«§…zj, ðáàßÞÝÝàãçëïóð»% ¬ö¬À¯¦}ea8 ýU < û߶c : ú÷öá½V 9 øòõ÷÷ß©3 ø 6cÇÖÄ * ÷íðòõöðÎu ö² œ§·ÉÔÒ¢ ) õèëíðóõ÷ߢ þÆÄÄûÆÅÅ{ ) ôãåèëîðô÷ïº/ òåäãâÞÙÄÉÑÕÜèÁ # óÞàãæéìïóöðÀE ÿüþÿÒ # ÝôÞáäçëîòõòÉ7 ýþýýþÈ # þÞÝÝõßãçêîñõ÷Æ9 þûýüþà # ðáßÞÝÝÞâæéíñõñº! ÿþüýþà # ðÐßàßÝÝÞâåéíñõî® ÿûþýÿà # ï¬ÂÝàßÞÝÞâåéîòöæ‚ ÿûþýÿà # ¹ÕáßÞÝÞâæêîóöÖY ÿûþýÿÅ # ëÐð³ÏáàÞÝÞâçëïôó· ÿÿûþýÿÅ # íÖÐDz¬ÊáßÞÝßãèìñõç… ÿûþýÿÅ # äÖÓÏÅ°¯ÓáßÝÝßäéíòõÈ ÿÿþýÿÈ # ìÔÓÑÌÁ®´ØàßÝÝáæêïõí‹ úÿþýÿË # äÒÑÑÎȾ©»ààÞÝÞãèíòöÍ) ÿþýÿÌ # ëÏÐÏÎÊĶ§ÇàßÝÝàåêðôì€ ûþýÿÎ # äÌÍÍÌÊǾ¯±ÙáÞÝÞâèíòô¾ þýÿÎ # äÊËËÉÈÇÁ·¦ÁáßÞÝàæëðõßM þýÿÎ # êÈÉÉÇÇÅ»ÕàÞÝßäéîôð’ üýÿÎ # êÅÆÆÅÄÃÀ¼²¤ÂáßÝÝâçìòóÀ üýÿÎ # ÄçÃÁÁ¿½¶¨²ÝàÞÝàåêðõ×# ýÿÎ # ÂçÁ¿¿½»¶ª¦ÔáßÝßäéïôéi þÿÎ # äÁÀ¿¾½¼º¹µ¬¢ÄâßÝÞãèíóóŒ þÿÎ # 俾½¼º¹¸·´¡²ààÞÝáæìñõ¥
þÿÎ # ä¼»»º¸·¶´²¡¦ÚáÞÝáæëñõÀ þÿÎ # 仺¹¸·¶´³±¬ ¡ÔáÞÝàåëðôÒ' þÿÎ # 伺¹¸¶µ´³±¬¡ÏáßÝßäêðôÚ- þÿÎ # 伺¹¸¶µ´³±¢˜ÉáßÝßäêðôá/ þÿÎ # 伺¹¸¶µ´³±£•ÅâßÝßäêïôå2 þÿÎ # 伺¹¸¶µ´³±£•ÆâßÝßäêïôå2 þÿÎ # 伺¹¸¶µ´³±£˜ÊâßÝßäêïôà. þÿÎ # 伺¹¸¶µ´³±¬¡œÎáßÝßäêðóÚ- þÿÎ # 伺¹¸¶µ´³°« ¡ÔáßÝßåêðôÒ' þÿÌ # 伺¹¸¶µ´²°ªŸ¦ÚáÞÝàåëðôÀ þÿË # 伺¹¸¶µ´²¯©ž±àáÞÝáæëñõ¦
þÿÈ # 伺¹¸¶µ´²®¦žÃâàÝÝâçíòó þÿÅ # 伺¹¸¶µ´²¬£¢ÓáßÝÞãéîóèj þÿÁ # 伺¹¸¶µ³±ª °ÞáßÝßäéïô×& þÿº # 꼺¹¸¶µ²¯¦žÁâàÞÝáæëñóÀ üþÿ¯ # ê½»¹¸¶µ±¬¢ªÕáßÝÞâèíóð“ ûþÿ° " ã¾»º¸¶´¯§žÀáàÞÝßäéïôÞP ýþÿ¿B " ãÀ½»¹¶²«¢ÚáßÝÝáçìñô¿ ýþÿÉM " 뿼¹´®¥¡ÆáàÞÝßäéîóë„ úýþÿÅT " ãÃÀ½¸²© ºàáßÝÝáæëðôÌ- ÿýþÿÃu " ìÃÀ¼µ¬¢²×áàÞÝßäéîóí ùÿýþÿÇœ " 㾸¯¥¬ÓâßÞÝÞâçìñôÉ þþýþÿÉ£ " í¿¹°¥ªÉâàßÝÝáåêïóæˆ ÷üþýþÿÈ›< ! â·®¥±ÏâáßÝÝàäèíòò¹ üýÿýþÿȨ… ! ¹ÕâàßÝÝßãèìðôÕZ öýüþýþþȸª ! ïªÁÝâàßÝÝßãçìðôä… õúûüÿýþþȹ› ! áÐßáàÞÝÝßãçëïóì þþýþÿýþÿȵžB ðâàßÞÝÝàãçëïóð»% þøýþþ½–“^ € ü ; ú
9 øH) 7 ÷ËR- 6 õÿùÒ—M& 4 ÿöþùÊ€< 3 ÿ÷þì¯[' 2 ÿøýÍ|0
1 ÿøþê’; 0 ÿøþì›B / ÿùò¦@
.
ÿùù£> -
ÿøþð•6 , ÿúè…* , ÿùþÚf" +
ÿùþ¼J * ÿúö“. * ÿúÚe
) ÿúû©5 ) ÿúél!
( ÿúý¯7 ( ÿùþåc ' ÿúüš, ' ÿûÍH ' ÿúîq & ÿúúž) & ÿûÁ: & ÿûßU & ÿûôm & ÿûú†& & ÿûü¢.
& ÿûý¸4 & ÿûþÅ8 & ÿûþÍ; & ÿûþÕ= & ÿûþÕ= & ÿûþÎ< & ÿûþÅ8 & ÿûý¹4 & ÿûü£.
& ÿûú‡& & ÿûôn & ÿûàV & ÿûÂ; & ÿúúŸ* & ÿúïr
& ÿûÏI ' ÿúüœ- ' ÿùþçd ' ÿúý²8 ( ÿúên! ( ÿúû«6 ) ÿúÜg
) ÿú÷–/ *
ÿùþ¾L *
ÿúÝi#
+ ÿúê‡+ ,
ÿøþò˜7 , þ& ØZÔ÷õðíéåâÞÝÝÞßààÉ h=
Ap¦Ñáá ý3F õqÙ÷ôñíéæãßÝÝæÞßààÝË¢~eRA3.4BTgƒªÐßááàß ý
ôiÐôõñîêçäáßÝÝèÞßààáÝØÔÐÎÍÎÑÕÙÞâáàßÞÝÝ óKÇóöòïìéæãáßÝÝüÞßßààáàüßÞÞÝÝþÞ ñ)¯äõóðíëèæãáßÞÝÝÞþßÞÞÝüßàâ î|ÐðõòïíëèæäâààÞÞÝÝÞùßàáãåç î:Þöôòðíëéçæåãââáààá÷âãäææèëì ïO¯ßöõóñïíìêéèèçææç÷èéêëìîñò ! ñS¤Ùîõõóñðïîííììíøîïñòôóë # ù?€¹àñôôþóòòñò÷óôôõîÚ¯t & è Gw¦ÍàçíðòôöóñïëæÝÇm< * î 5[|Œ•¢›“‰vS. þC êZÔ÷õðíéåâÞÝÝÞßàáÓº˜~keeócb`^\e{™»×áá ýXx õqÙ÷ôñíéæãßÝÝæÞßààßÔ»¤”‡zpkq{‡”¦¿×àááàß ý, ôiÐôõñîêçäáßÝÝèÞßààáßÜÙ×ÕÔÕ×ÚÜàâáàßÞÝÝ óKÇóöòïìéæãáßÝÝüÞßßààáàüßÞÞÝÝþÞ ñ)¯äõóðíëèæãáßÞÝÝÞþßÞÞÝüßàâ î|ÐðõòïíëèæäâààÞÞÝÝÞùßàáãåç î:Þöôòðíëéçæåãââáààá÷âãäææèëì ïO¯ßöõóñïíìêéèèçææç÷èéêëìîñò ! ñS¤Ùîõõóñðïîííììíøîïñòôóë # ù?€¹àñôôþóòòñò÷óôôõîÚ¯t & è Gw¦ÍàçíðòôöóñïëæÝÇm< * î 5[|Œ•¢›“‰vS. þe èZÔ÷õðíéåâÞÝÝÞßàáÝÓƼµ³´µµò³²±¯ªµÃÑÞáá ý„³ õqÙ÷ôñíéæãßÝÝæÞßàááÝÓɼ´ª®´¹ÀÇÓÞáâáàß ý(B ôiÐôõñîêçäáßÝÝèÞßààááàßÝÜÛÜÝÞàáâáàßÞÝÝ óKÇóöòïìéæãáßÝÝüÞßßààáàüßÞÞÝÝþÞ ñ)¯äõóðíëèæãáßÞÝÝÞþßÞÞÝüßàâ î|ÐðõòïíëèæäâààÞÞÝÝÞùßàáãåç î:Þöôòðíëéçæåãââáààá÷âãäææèëì ïO¯ßöõóñïíìêéèèçææç÷èéêëìîñò ! ñS¤Ùîõõóñðïîííììíøîïñòôóë # ù?€¹àñôôþóòòñò÷óôôõîÚ¯t & è Gw¦ÍàçíðòôöóñïëæÝÇm< * î 5[|Œ•¢›“‰vS. ù Oºþÿ"ÿ ù!XÀýÿ!ÿ ø!U´÷ÿ ÿ ø J¥ôÿ ÿ ÷#D™àþÿ ÿ ô 0IƒÍöÿ ÿ ð %.GR`t•Âå÷þÿÿýýô è #(-16>=:<<>FHLA # ôßâåèêîñôí½2 ø # õäçéìïòôÝ 4 ÷éìîñóëÄh 6 øîñóôÒ" 7 úôñÕ¥< 9 ûЖD : ý3 ½ ñßÞÝÝÞàäçëïóõÉ< 󶺽¾¾½Í´¦w ! òÞÝÝÞáåèìïóðÈ@ ©ö¨§§¦¤³©¦† # óÝÞàãæéíðóî¾K ó}}zwwz~‰‘™„ # ôßâåèêîñôí½2 ÷#2B- # õäçéìïòôÝ 4 ÷éìîñóëÄh 6 øîñóôÒ" 7 úôñÕ¥< 9 ûЖD : ý3 ½ ñßÞÝÝÞàäçëïóõÉ< ýùüýÿ¶)4 ! òÞÝÝÞáåèìïóðÈ@ ÿûýþÿÍ # óÝÞàãæéíðóî¾K óº·³±°³»ÂÏÞëÊ # ôßâåèêîñôí½2 ÷ (8MfI # õäçéìïòôÝ 4 ÷éìîñóëÄh 6 øîñóôÒ" 7 úôñÕ¥< 9 ûЖD : ý3 ½
ÿùû§? - ÿùó©C . ÿøþïŸD / ÿøþí—= 0 ÿøýÒƒ6 1 ÿõþñ¼p;&
0 ÿòüÙ_C1% . íÿûá¶{XG9/'! , íݵ‡hUG<4-(# , îgYLA:3-(# - ïQF>71,'"
. ò2,(# 1 õ
4 ý ½ € € € € , ( – K
% X P Background ÿ
w X P › \> \J \V \b X P ÷ µN Ée Ý[ ñK Ñ ÿ .g Aé Aù B Eú I% L' ON RE Uj X¨ \ \. þÇÍ5Í úÕÎÍçæççþæç
çþæççþæçç üÕÍÜç6ç ýÎÜççþæç ç ýÇÍççþæççþæçç þÍç9ç ýÍæç8ç þÍç9ç þÍææþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ þÍååæåèæååææåæåææååæåææåææååææååüæåæååüæååææå ýÍäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå þÍääþãääþãääùãääãäãääþãääãäþãääþãää þÍã9ã þÍã9ã þÍââûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ þÍââáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þÍááþàááàýáàááüàáàááûàááàááüàáàááþàáá þÍà9à þÍà9à üÍààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùÍÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûÍÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þÍÝ-ÝþÜÝÝþÜÝÝ þÍÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þÍÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þÍÚ(ÚþÙÚÚ þÍÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üÍØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þÍØ9Ø þÍØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þÍ×9× þÍÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þÍÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øÍÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üÍÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýÍÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûÍÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þÍÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ÍÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ ;Í ;Í ÍÌüÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýÍÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þÍËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þÍÊ9Ê üÍÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þÍÉ9É þÍÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ þÍÈ ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç7ç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç ýÍçææûçææçææþçææþçææøçæççææçææçþæçç æ üÍåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå þÍååäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä þÍääþãääþãääã
äãäøãäããääãääþãääþãää þÍã9ã þÍã9ã üÍâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ ûÍáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÍá áþàááàáþàááúàáàáàááúàáààá þÍà9à þÍà9à ýÍàßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà ûÍßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þÍÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þÍÝ9Ý þÍÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þÍÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þÍÚ9Ú þÍÙ
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù öÍØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þÍØ9Ø ûÍØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þÍ×9× þÍÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷ÍÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ùÍÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þÍÔ9Ô þÍÔ+ÔþÓÔ Ô üÍÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ üÍÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þÍÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷ÍÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ùÍÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ ûÍÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ ;Í ;Í ÍÌÍÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ùÍËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË ûÍÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þÍÊ9Ê þÍÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þÍÉ9É óÍÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ þÍÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ þÍÇ ÇþÆÇÇ ûÍÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç%çþæçç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç þÍææüçæçææüçæçææûçææçææçæøçæçææççææþçææþç úÍåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå üÍääååøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå þÍä äþãä
äþãääþãääþãä äãäýãä þÍã9ã þÍã9ã ýÍãââùãââãâãââãâãøâããâãâãââþãââãâãâþã ûÍáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÍááþàááþàááþàá
áàüáààááþà þÍà9à þÍà9à òÍßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÍÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÍÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÍÝ9Ý ûÍÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÍÜ9Ü þÍÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÍÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÍÚ*ÚþÙÚ Ú ûÍÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÍØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÍØ9Ø ùÍ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÍ×9× þÍÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÍÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÍÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÍÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÍÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÍÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÍÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÍÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ ;Í ;Í þÍÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÍÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÍË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÍÊ9Ê þÍÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÍÉ9É þÍÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ûÍÈÈÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ þÍÆ9Æ ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ?Í ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/resources/bug_tracker.xcf 0000664 0001750 0001750 00000243424 13157571677 024326 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ B B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 µ 5 N× ‡v ' < Bug Tracker ÿ
g ' H gimp-text-layer ,(text "Bug Tracker")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 295.000000)
(box-height 60.000000)
(box-unit pixels)
' < Í ) ' < í Û
€ « À þ ý . ý"ïÿ ÿùðØÁ©Š3 * üA²ÿÿúäÀÀÍëÿÿüÐl ) ýÕÿÿýì û '‚îÿÿýî- ) þƒÿÿþÁ ý …ÿÿýæ! ( þlÿÿþÀ þŸÿÿýÜ ' þYÿÿþÀ ýÖÿÿþO ' þXÿÿþÀ þŽÿÿþˆ ' þXÿÿþÀ þ^ÿÿþÀ ' þXÿÿþÀ þ4ÿÿþå ' þXÿÿþÀ þSÿÿþ¹ ' þXÿÿþÀ þ‚ÿÿþƒ þF€€þ` þ€€þl ýQ“ þXÿÿþÀ ý Õÿÿýþ7 ü"_ÁÿÿþÀ ûiˆÙÿÿþØ û³ÿÞ þXÿÿþÀ þœÿÿþœ ýÔÿÿþÀ ýÇÿÿþØ ú8ïÿÁ þXÿÿþÀ ý(©ÿÿý² þŽÿÿþÀ þuÿÿþØ ú ÛÿÿS þXÿÿþÓLLúPlŒµýÿÿýØ\ þvÿÿþÀ þ[ÿÿþØ ú˜ÿÿû þXÿ
ÿýÉG þtÿÿþÀ þXÿÿþØ ú ýÿÿ þXÿÿøí¸½ÃÒåúÿÿüùªC þtÿÿþÀ þXÿÿþØ þ;ÿÿþŸ þXÿÿþÀ ú&Y§üÿÿý¹" þtÿÿþÀ þXÿÿþØ þlÿÿþº þXÿÿþÀ ý,ÂÿÿýöS þtÿÿþÀ þXÿÿþØ þ€ÿÿþÖ þXÿÿþÀ ý½ÿÿýñ þtÿÿþÀ þXÿÿþØ þbÿÿýô þXÿÿþÀ ýñÿÿþ¿ þtÿÿþÀ þXÿÿþØ þ-ÿÿþ\ þXÿÿþÀ
þÿÿþ þtÿÿþÀ þXÿÿþØ þ¼ÿÿþÆ þXÿÿþÀ
þJÿÿþQ þtÿÿþÀ þXÿÿþØ ý$æÿÿþn þXÿÿþÀ
þ*ÿÿþ‹ þtÿÿþÀ þXÿÿþØ ý(Öÿÿ þXÿÿþÀ
þ1ÿÿþ þtÿÿþÀ þXÿÿþØ û{þÿ þXÿÿþÀ
þiÿÿþ^ þtÿÿþÀ þXÿÿþØ û–ós þXÿÿþÀ
þ ÿÿþ- þtÿÿþÀ þbÿÿþØ û Ï! þZÿÿþÀ ýÝÿÿþ½ þ`ÿÿþà þˆÿÿþÙ û¦þ1 þoÿÿþÀ ý¶ÿÿý÷$ þ9ÿÿþ1 ýìÿÿþí û‘ÿØ þˆÿÿýå ý»ÿÿþv ýúÿÿýÑ ûcéÿÿþ2 øøÿÿÃ|Y ýÝÿÿýb ú
_µúÿÿýüt þŒÿÿ÷ê’u¡Úÿ—ÿÿùñ¡ :ÿÿú LºÿÿûòÞãöÿÿüüª2 ý
Þÿÿûüÿÿøö®X Èÿÿý&þÿ
ÿøüÜ·‘lF
ý£ÿÿõ×6 ÿôªV üvõÿÿ% ú NsS" üP úiã2Ae 7 ûœü= 9 ûÿ‡ : û–ÿÿ% 9 ú2þÿø 9 þ|ÿÿþG 9 þpÿÿýìF 8 ýüÿÿûþÂp/ 6 ýKòÿÿ8 ü*²ûÿÿ: úr¢¾Ù ÿ Ý þþ ! þÞÿÿþ] ! þçÿÿþf ! óñÿÿü²T5 LÿÿöÌ )=vÛÿÿþp ! ûúÿø0 þLÿÿþÌ ú•ÿÿy ûÿÿs þLÿÿþÌ û
Úÿ‚ û
ÿì þLÿÿþÌ ügÿŒ üÿ¡ þLÿÿþÌ ü ÿ• ü ÿR þLÿÿþÌ ýП üh þLÿÿþÌ ý?C , þLÿÿþÌ øÂïÞ®~M
þLÿÿþÌ ô-‘u¤úÿÿó¼aXXþ, þLÿÿþÌ ûrÐÿ ý.îÿÿþ€ þLÿÿþÌ
üE·üÿÿ þeÿÿþÀ˜˜þL þLÿÿþÌ
ùM^‚òÿÿ ýÁÿÿþŒ þLÿÿþÌ
üÿÿ þRÿÿþÆ þLÿÿþÌ
üUÿÿ ùýÿÿø þLÿÿþÌ
ü5ÿÿ þÏÿÿþ8 þLÿÿþÌ
ü4ÿÿ þ¬ÿÿþ* þLÿÿþÌ
ü4ÿÿ ú–ÿÿ÷ þLÿÿþÌ
ü4ÿÿ ûÆÿÿÊ þLÿÿþÌ
ü4ÿÿ úýÿÿO þLÿÿþÌ
ü4ÿÿ û`ÿÿ› þLÿÿþÌ
ó4ÿÿu 6âÿ´ þLÿÿþÌ
þ4ÿÿùúÆÛþèW þLÿÿþÌ
ö4ÿÿdy„^/ þLÿÿþÌ
ü4ÿÿ & þLÿÿþÌ
ü4ÿÿ & þVÿÿþÎ
ü4ÿÿ & þjÿÿþâ
÷4ÿÿ7( ! þ„ÿÿýù þEÿÿùùíТf ýßÿÿþW þqÿ
ÿý×8 û*XÇÿÿûí4 übêÿ ÿýê þþÿ ÿþ• ý¡ýÿÿöˆœ¥®·ÁÍÙíÿÿþ£ : û#}úÜ < üú ; ýuÆ < ýÈ„ ; üsæ 9 û §ô3 2 ô '=qÇþåG 3 üÿþúÿÿüò|
4 ÿüû” 6 ùÖ¯ˆa: 9 ¼ ý 9 ú`¬óL 5 ú@‡ÏþÿÿþL 5 ü‰ÅíÿÿþL 7 ýsÿÿþL 8 ýþÿÿþL 9 þîÿÿþL 9 þèÿÿþL 9 þèÿÿþL 9 þèÿÿþL 9 þèÿÿþL 9 þèÿÿúL Šâ ù.°éÓy õe©ÉéóÏ«~
õ;p¥ÚôÔ²q þèÿÿöL ÿÿ XüÿÿþP ò|êÿË‚C[ªÿÿàA òºÿöËœÞÿÿï} þèÿÿ÷L ÿÿ Püÿÿþ¦ ú¦ÿÿw ú}ÿÿù úMëÿ˜ ýÚÿÿýœ þèÿÿõL ÿÿ$ðFÃÿÿþz úÿÿü úíÿÿŽ û{ÿýn þWÿÿþh þèÿÿøL ÿÿÐf ûL¿ þåÿÿþ úÅÿÿô û/ûÿ¦ ýòÿÿþ¶ þèÿÿùL ÿÿ¤ þ ÿÿþ$ þªÿÿþ úÈÿü( þÿÿþ» þèÿÿùL ÿÿ/ ûÒÿÿÍ þ¨ÿÿþ= ûjÿÿ© úØÿà: þèÿÿùL ÿÿ û!Žˆ þ¨ÿÿþY úíÿÿr ý' þèÿÿúL ÿÿ üCÖÿÿþh þ ÿÿþP þèÿÿúL-äÿÿ úyÞëâÿÿþh þJÿÿþ. þèÿÿýŒðÿÿ ø8¦úÎa¨ÿÿþh þsÿÿþ% þèÿÿþãÿÿ ú=¾ÿ×B þ¨ÿÿþh þÿÿþG þèÿÿý[Ýÿÿ ù ÿý‚ þ¨ÿÿþh þµÿÿþk þèÿÿúL3øÿÿ
ú Òÿÿ~ þ¨ÿÿþh þ”ÿÿþŽ þèÿÿúL lÿÿ ùÎÿÿÄ þ¨ÿÿþh þnÿÿýÙ þèÿÿúL ÿÿ þzÿÿþz þ¨ÿÿþh þGÿÿþb
ýRI þèÿÿúL ÿÿ þéÿÿþJ þ¨ÿÿþh þ ÿÿýà ü+ð) þèÿÿúL ÿÿ þÿÿþ€ þÂÿÿþh þ±ÿÿý¡ ü Ú” þèÿÿùL ÿÿ þÿÿþ× ýîÿÿþr ý'ûÿÿýÅ û-âÚ
þèÿÿùL ÿÿ þìÿÿþM ûLÝúÿÿ÷” ’ÿÿõç›c,-P¨üò1 þõÿÿùP ÿÿW þ¢ÿÿ÷ü t•×ùw{ÿÿöøšö Ëÿ ÿýùC þÿÿ÷’ ÿÿâJ ýìÿÿûÑ. =ÿÿþ„ ý˜ÿÿýáH ü<¸ÿÿüæBÿÿüõÖ0 ý(Çÿÿü×~ ù¦ýÿÿûc ü\Ôýÿÿüë‚ ý‰øÿÿþð
ú7ec ûjJ ú >oX" ‘ ‚ þ€€ ö ZŽÁñݱ†* ü-Šâ ù.°éÓy û KtúÿÿûçŠdE ùcöÿîÙúÿÿüøu ürÐÿÿ ýXüÿÿþP úØÿú„ õ
¡ÿ© Oçÿÿþ° üE·üÿÿü Püÿÿþ¦ û‡ÿÙ/ ûÑÿ‰ ý-ýÿÿøS M^‚òÿÿú$ðFÃÿÿþz ú’ÿ«
ûuÿÞ þ¥ÿÿýâ þÿÿýÐf ûL¿
û¬ÿ ûðÿw þRÿÿþd þUÿÿþ¤ ûÂüe û”ÿÿ7 þÿÿþ¡ þ5ÿÿþ/ üÕöL ú
ûÿþxttþóÿÿþÝ þ4ÿÿþ ýó> þ2ÿÿþ þ4ÿÿ ýú< ûXÿÿì(
(þ þ4ÿÿ üÿç þ}ÿÿþ þ4ÿÿ ÿýÆ þ¢ÿÿþ6 þ4ÿÿ ÿþ– þµÿÿþ_ þ4ÿÿ ÿþ` þ–ÿÿþ‡ þ4ÿÿ þ«ÿÿý÷3 þsÿÿþ¶ þ þ4ÿÿ ýÝÿÿýà þQÿÿýû
ù(å 4ÿÿ ý3ùÿÿý¼ þ-ÿÿþ‘ üÑ‚ þ4ÿÿ þmÿÿþŠ ýÏÿÿýþI û«î þ4ÿÿ þ¬ÿÿþW þIÿÿü÷u û¼ÿu þ4ÿÿþ ýÝÿÿýøA þÂÿÿôÈW)2‡ðÿ¡ þEÿÿþ ý6ûÿÿýòJ ý2íÿÿþüÿÿý° þqÿÿþW þÁÿÿ÷ýI Èÿÿüú“ übêÿÿüâJ ùÆ ~Îþÿÿøó2 Œæÿÿüþ«% ý¡ýÿÿüõÖ0 $ ùJt[2
¥ $ $ $ $ “ I $ X P Icon (original) ÿ
@ á X P N§ N³ N¿ NË X P a 4ü Is Iƒ I“ I£ I³ IÃ IÓ Iã Ió L N' N7 NG NW Ng Nw N‡ N— ø&
6 þ88Û67789==<=?@@?@>=:7541/+(%#"!! $, ï:KjdJHGEC==B
CDDCùBA@@??==ü>==>>?> â!;Q|}vy}ƒˆ=?
Œ‰†ysojd^ZXVUTTUTýQO ÷($0@Hp[VVÞWVAE;
UUVVXZ\^afiloswyz{{zyxvtpn ÷:KG@BK|QTTúJSW TTSùXbmndZRRúQRSTU ÷3LXKCLƒPTTùGV\TTò;@KV`ghaXMC=aTT ÷2M]NCN}RTTúNU TTóA=:GQX^_ZSI?==ü
TT ÷.JSKEUoSTTùS;T7TTða›N9ANSTQKC=?9>
ø-IOJEdcTTëSUX3X=XVUT=9 PŠ’qUGGöC==:%AU
÷,HKGEs`STTÞS^YV2W^`
]==>>/#Jq{rX/0Eap^VTD ò)FGFDz_XTSS^aSS÷;IWUQE3;==>ð7*%*'.^\IGMUZG æ%ECFFv^\`SRTNPRS$
9KETŽ99==ñ>?>>('03=DKQW^ á$ECGJn]Xuš¥¨ª¨§¦* >Aˇ7125:;==õ%!*19?FLS[ à CDHSnZa`|¬ª{kigg аeèÏ¢†oXG;==õ%%-5;AGPT ñAEH[uRSRKjš”X??ä ?ÈÿÿÈz÷ÿÿì¤[A;=>" '/6=DJ3 Ó@=>>1RTSROT nD@@ñÿùùÿ»l÷ÿÿÛ†L==>"
"+19?+¬ Ó@>719=SbmSQUx¤‹RÿÿüûúúÿŸqöÿù¼hA;>" $.42¤ë ÓAGK2Scjqh\QE7Góÿüüúúûÿ¢^ÇÿðœR=>"
=£æÑ ÓAINr^T!'3QWQE-‘þÿþüûúúüÿÕnwÑÖ‚C=! sÊãÓÒ ÓAKO„WTT '7\ôÿÿþüûúûüýÿÿÀql{U: .y¿æÞÑÒÛ ùBLOUTTø+( ˆÿÿæýüûüÿÿýýüÿùÈ{$
.”ÑæâÖÔÓÚ© ùBMP‰VTTß" ËÿÿþüûüùÛæÿýû÷ô÷ö³EÃêáÙ×ÖÕÖÅ ùEMVxVTTSûûþýüüéý°U;®ÿú÷ôñìè±ÜÚÛÛÙÖÓ× úHNdjTTùV^abdýüüèýôsI.ôûöóïëâ¯ØÚÜÛØÓÏÒ¦ ùJMreSTTþWXXýùúüüçþ÷a% ìúôñîéà°ÖÚÜÚÖÐËËÈ: ùLMxeSTTSüKÛÿüüèÿ› nûõñðìéß±ÖÙÛÙÓÎÊÈϳ ùJNvdSTTûJGæþüüýèþüÁ°ï÷ñïîëçÝ°ÒØÚ×ÒÌÉÉÊÒ ù!KQq`STTøbZK¤ùùûüüÿì÷ñîíìéåÜ®Ð×ÙÖÏËÈÉËÍ ú.KVqXTTiöcUbÝ÷úûûúùù÷ëôñîìëéçãÙ®ÎÖ×ÓÍÉÈÉËÍ Ó>N\yJT^dgg[:_üüùùøööõôòðîìééçäà×ÍÔÖÑËÈÈÊËÎ ÓE7=?GEEAG6 ƒûù÷õôòññîîìëéæåãàÝÕËÒÔÏÊÇÈÊÌÏ øC9! !
Ý_ìñôòñîíììëêéçåãáßÝÙÒ«ÉÑÒÎÈÇÈËÍÏ ôAQap
%!( úùèîììèèéçææãâàÝÛÙÖÏ©ÆÏÑÌÈÈÉËÎÐ ùDQlcSTTÛVæáçåãâãääããâàÞÜÚÙÖÓͨÄÎÏËÈÈËÍÏÑ ú&LP{\TTöWfR×ÚàÝÜÞààêßÞÝÛÙØÕÒÐË¥ÀËÏËËÑÑÒÏÒ ú/QO„[TTöVhRTÖÝÛÙÜÝÝêÛÚÙØÖÔÒÐÎÈ¢¼ÈÍÑÇ‚R©ÖÔ ú,RO[TTÚSUTWhSUÒÙÙÖØÙÙÛßÞÛÖÔÒÑÏÍËŹÆÏÁD bÖÖ ú+PTvZTTÚVagi}omÏÕ×ÒÓÕ×ËŠx·ØÑÏÎËÊÈÄš·ÄÒz (@dÏÙ ù5PapVTTÚSTUWiYTÀÎÕÐÏÑÓ|3*.ªÓÌËÉÈÆÁ—·ÃÒuG\~ÓÚ ù CQnrSTTÝU[]UTÕÍÌÏÆZE=!FÈÊÈÇÆÅÁ•¸ÄÏ7Ul¥ÛÛ ùNRuvSTTùSRZXT‚ÈÈÊèn?;!1ÀÈÅÄÅÆÁ•ºÆËÑŸžÑÜÝ ùQRttSTTßW\Se£ÆÄÆʱX:D™ÉÄÄÅÆÆÀ’¹ÇÍÏÖÖÙÚÝà ùNTrkSTTàZ]ZoºÀÂÃǽ¯ÀËÅÅÆÇÈÈÀ¸ÈÏÑÓÖÙÜßã ú"MWu]T T[ôZ‡ÃÀÂÃÆÈÇÆÇÈÈñÊɾŽ¹ÉÑÔÖÙÝàâæ û3PZT
TSóD©ÃÁÄÅÆÆÇÈÈÉËË󿎼ÌÔ×ÙÜßâæé úBS[…PT TäXN¼ÂÃÅÇÈÈÉÊËÌÍÍÁÀÏÖÙÜÞáæéì úFT]‚RSSTå/aÄÃÄÆÈÊËËÌÎÏÏÑÂÏØÝßâåèêì úAZs‰hddÙeddb_]YVTSRRfoÅÄÄÇÉËÍÏÐÑÑÁŽÁÏÚßâäæééè Ð
@Uryouz{{zwtrppsv{~U fÂÈÅÈËÍÐÒÓÒÀÃÐÝàâãäæéâ ÷ HUZVTSSRRÜTUWZ\]_``__C L®ÊÅÅÈÌÏÒоŒÇÒÚÝÞàåëÏj ñ9<58BNHEGILMNOOPæQRs> $~¸ÆÅÄÇÉÉ·ˆÉÑÖÙàèÜ> ö_F91+% 4 Ö,†…„ƒ‚†‡ ’•–••“Š„zwqi`\VUQOMHKHIMX ð7Œ›ª›š™˜— — ——÷–•““’’‘ø’“”•’‘‘ âQŸ¹»·º»¾Á Å ÂÁ¿¼·´±®«§¥¤£¢¡¡ü Ÿž ÷7HAi“š³ª¨¨ú"%
§§ó¨©ª««°²´µ·¹»»øº¹¹·¶´³ ÷gw|—œº¥§§ú*26
§ §ñ8BMOD9¦¦¥¥¦¦§§ ÷Z‚†ˆ˜¾¥§§ù(6;§§ò !+6@GHA8.# ¯§§ ÷W‚‰˜ž»¥§§ú05§§ó" '18=>:2) ü §§ ÷Rƒ‘™£´¦§§ù¦ 7§§ð?|.#.330+# øN~•š¬®§§ß¦§©9 4¨¨§ 3ltP5(('# "")9
÷L|}—š´¬¦§§ó¦ª¨6>A î
-S]P7.JZLJH) òHzz—™¸©¦¦¥¬®¥¥÷ +750$ ð KJ<;BLO0 æEwz—›¶¬«¬ ž™šœœ ,'7 õ"%.6>ENU á@v™ž³¬©µÇÍÏÐÏÏÎ (Ñt ÷#*19@GS à8r†›£³ª¯¨³ÑѲ§¦¥¥ >,GïÈoV?* õ %-4;CL ñ3p‰œ§¸¦¦¤š§ÄšŠŠä?`c:Vùþþè’B# (/7A" Ó1o ¦§¦¥Ÿ™¼É©‹‹_nqnl6NõþþÒp2
#*4 p Ó/p 3BM¥¡¯Ì½—s{€ztp-Xõþø®P%
).n” Ó.t’Ÿ3CKRG<0& !{‡€{v3:¼þí‡7
1hw6 Ó,w˜ ´¬§
270%Pª¢œ˜Š†ƒ~P ZÉÎk&
D€d9: Ó({ž¡¿¨§§
(¤¼¯§ –Ž‹‰‚{k7 Li: DiwO,5A ú$}¡¡Å§§Ü 4 «¢—‹‡xqgQ- ?f`J2+19- ù$¡¢Â¨§§ßLŠš¢£”ˆmluomgZL= 'H8(*..0- ù+ˆ¡¥¹¨§§¦â,d’˜˜”ŽX%3! $(" % úc›¦µ©§§IÝB9-CWaZVQNMJGB=7349>:/ #& & Ó¡ªº*4=DGF; vuVMJFDA?:5200483* "$ ( û ''Ú$* !usREA=;8630.,,..+$ ! ") øŒ
Ý 7vabG=7420/.,*)'&%# $+ ô‡¥¶ àƒKT93.-,+,+)'&#! &. ú0¤³¯§§Û¨ F7D.('))(('&$! ")0 úS›¤»«§§õ©²¥'3'!#%$$ê#! %,3 úd¤£¿ª§§õ¨³¥§!/' ! ê 17 ú]§£¾ª§§ñ¦§§¨´¦§ )' ë
4; ú\¥¦¹©§§Ú¨¯³´Á··#&
%7A ù
m£µ¨§§ô¦§§¨´©§ $è
)5=F ù#‰¤´¶¦§§¬ï¨§ "
ó '9@BL ù,Ÿ¥¸¸¦§§¦ù«©§è
&'1?BIR ù%¤¦·¸¦§§ß©¬¦
%+17>GPZ ù+ž¦¶³¦§§úª«þí!+17>FNXb úE›¨¸¬§ §«ý
ì &18>ENV`j ûl ª¾§
§¦ûë "
-8?FMV^is ú‡§«Á¥§ §ä !$'* #3@GNV_hqy û©«¿¦¦§å
!#$&(*-0 %6GPW_hptt ú„«·Ã±¯¯°ø¯®¬©¨§¦¦å "$'*,/157" %7NYagkli] ø‚§¶»µ¸»»üº¹¸¶¶à·¹»½¾¾ #&&)-159<;" ';T^ab_\VI ù=‘ªª§¦¦§Þ¨ª««¬¬¬
!)(*/4:?< *M òUªÒüþýýùîéòøðííò 0þŃ\B,
÷ (09E ÓK¥Øþþýÿÿûíæëôêæçç 9ýþþè„0
"*7 ðJ£
ÿÿþüóàéòíççå 5õþþÌ]
)R ÓF¦ (1ý÷êåòñé
?õþù <
'Rt ÓE®çÿ
(/6-"
#+0.' ®þìv$
*JT Ó@¶óþýþÿ '`LC>3*# ?¾ÈW
1]B å9½üþýþÿÿ
h„eWL<0*" ð0T% .HP/ ù5¾þþýþÿÿî Lc_^Q>0& ó(B8' ù9ÅþþýþÿÿñK %&þÿÿ õ(h£·ûÿâJ+‡ÿ ÿ ò4l¦÷ó¾¸ÇœngYxÿ ÿ òRcqdEKdgaL%?ÿ ÿ û
ý3ýÿÿ ýòÿÿ ýÛÿÿ! þµÿÿ! þÿÿ! þ?ÿÿ! ý
áÿÿ" þ•ÿÿ" ý;þÿÿ" ýÆÿÿ# þ`ÿÿ# ýÇÿÿ$ ý^óÿÿ$ üŸþÿÿ% ýI¼ÿÿ% ümÆÿÿ& û+~¾ýÿÿ' ûA€¬îÿÿý÷Ë & ùL•Ïúÿ ÿüýᶚΠù*EFC@>?CGKLKKLNOacM. ) ý=?A AñCIOTXTF53689?6 # öNLJGEDBA@??þ@AAû?NB9 # lækjkmnpsvwx=>wvtqkgc_[czE6 # äUVXZ[\]^_``(75_
__`bcfqP6 # TSöD7 S SSTTû_yA5 # TóSTSTTSJ(S TTû_yB6 # TSôU]^bZWC TTû_yC6 # ðTW_\]b`b`P TTû_xD9 # îTZWXY[e] ZTWTTû^xE9 # í!XWW`bd? " ^^]STTû_xF9 # ëK@KQW]_X ! `gk_TSTTû_vG; # ëZ2=NTTQ7 1 VX`fZRVTTû_tG< # ä9€z@ $
;>ifSZaVTT_rH= # ä®éË7 * “/:œ
hj_WS_pI= # äîÐÔ” . //%q
d_XUSaoJ? # øÑÒÒÓx* î^R6A`]`[TbmK? # äÒÖÖÓ×~*Q`da\L* QaVTSTdlK? # ëÖÙÚÙÜŽ/PZ^^I OcUTTûekLA # ÷ÞáÝÞÞÑmAGGö MfVTTûfjLA # ñ\™âààçµ9"! üMhVTTûgiMA % õ¤æáæà ûMhVTTûhgNA # ó @ÛàâäV ( ú§{MgWTTûieNB # ô Èáàé·B? ù¨}SeVTTûjcOB % íC×ßàèÇ|I+=> C§|\eVTTûj`OB # ä^qÄÝÝáèÔlK3†~w¬tZl^VSTl_OB # äÖÚÚÙÞâèàeN9‰ŠŒ’ndpj\TSo^OB # äÐÒÖÛÞãèêiQIMNPSQWZc_SSs^PB # äÐÓ×Ûßãèðy:PVTSSTTWbTSu^PB # äÑÔØÜàäéòz2W]^]\^_`n^Sw]PB # äÒÕØÝàåéôLaf Y\^`bq_Sy]QD # äÒÖÙÝâæëôy Vhje"TSSTlTSz\QD # äÓÖÚÞãèìôl Ped_VLTVcUS|[QC # äÕØÜàäéîð\ /CLQMASR}ZRB # äÖÙÝáæëñæA
26;=
R~ZRA # ä×ÚßãèìôÑ% ! 9
YR@ # õÙÝàæêîø®
þ û
YR> # õÚÞãçìðö
ûfcYSTTúRƒYR: # óÝàåéîóäG
üVTSTTùQ…ZR; " õßãèìð÷¸ TùQ‡ZSC " õáæêîñôr TùQˆZSG " ôåéìð÷Í+ TùQ‰ZSF " ôèìîñóu TùQ‰ZSE- " öêîïöº! STùQ‰ZSG= " öíïñßL$ ðTZ^[Y[VXWPˆZSH@ " îäêw . `dgcgiglbRˆ[TH= ! ëä+' gc]cXZ^d\ZP‡[THB2 ! âç– $6 XWWZaYY``[_Q†[TMJ@ ! â‰
1" SSWfcebhff_Q…[TQN< ! ô.' QRRïWTVUVVWUQ„[TIG= á+" ††ƒ~wqjda`^_`^…dSC;8 Î ù$Fm…Ž / ï+Gh~Š„wlho|†ŽŒm ) êgt~~yrpsz€…†…„„……’’„R ) ý‘’““é’‘ŽŒŒ”—˜”‰wz…‰’ # ÷œ›™˜—––••þ”••–—û–Ÿ™… # ý²±°°é±²³´µ¶· ¶µ´²¯¬ª¨¥©·™| # ÷§¨©ª««¬¬ï¬
¬¬®¯µÃ { # §¦÷% ¦¦§§û·˜{ # §ó¦§¦¦§2*§
§§û·™{ # §¦ô¨°97$
§§û¬·š| # 𧩮¬°®¯@0
§§û¬·š~ # ©©ª«D= «§¨§§û¬·›€ # í ª©¨@AD# «¦§§û¬·œ€ # ë4!*17<>9
®³µ®§¦§§û¬¶œ‚ # ëM%.441 ¥§±ª¦¨§§û¬µž… # ä&B,"
§©¢ª¯¨§§¬´ž† # äs}4 Á Ç
³´®©§¬³ž‡ # ä›;<# « °®©¨§²Ÿ‰ # ø8>@; ' ï>2Œ®¬®¬§®± ‰ # ë;DID@(%0?DA;,¯¨§§û¯± ‰ # ëDMTSL0 09>=+œ°¨§§û¯±¡‰ # ëJTZ_ZN,"())
œ²¨§§°ý¢‹ # ñ/XadbE3
üœ³¨§§û±°¢‹ % ù5^egN þ ü³¨§§û±¯£‹ % õ
Q_db úϲž³©§§û²®£‹ % öCZ`gH=: ùд¢±¨§§û²£‹ % í GU^hT,C'‰‰ δ©±¨§§û²¬¤‹ # ä7IS_j_%F.¹´¯Ò¯¨¶¨¦§³«¤‹ # ä/8@HT`li'I4ºº»À®¯¸µ¬¦§µ«¤‹ # ä-5?JUamq/$C››œŸ¡¨«°®¦§·«¥‹ # ä.7@KWcou4%2§¦¦¥¦§¨°§¦¸ª¥‹ # ä/8BMYeqy+7< ¬¬®®·¦¹ª¥‹ # ä1:DO[hs|.-AFª¬¯°¹¦ºª¦ # ä26,§¨°§¦¼ª¦‹ # ö8BMXes}} ð&-0,"§¦¼ª¦‰ # äA+ úþþÿÿúýþÿ° " ø#*19A> üÿÿúýþÿ¿B " ø'/7>B7
þ ÿúýþÿÉM " ø,3;@?% ü ÿÿúýþÿÅT " ù18><5 ü"ÿÿúýþÿÃu " ñ6<<6 "$ÿÿúýþÿÇœ " ï:<4% +'þýüýýþúýþÿÉ£ " ñ91% $7'üûûöúüþýþÿÈ›< ! ü* è 3: ûûüûýýüûüýÿýþÿȨ… ! ý
ç $B0ýþýýüýýüüýüþýþþȸª ! þ æ 7?"ÿÿþúûúûúúûüÿýþþȹ› % ù .B(ÿÿþõýþÿýþÿȵžB # ù (B0ýýþøýþþ½–“^ ý< ; ü0‰ : ü º' : ü/↠: û îì : ü¥÷t : û=ü‘; 8 ù .ÉÇ_ 3 õ">=Ý<;::;;<=>ABo? :}®ÄËË̸…ÑÛãàËšQ ý3FEEÚFEDCA>:73.($! h>
+V|˜©§‘¯¨f9
÷
ëS'
(. $ + öa?!
ø
".* - ïZD- (25$ 1 ü
€ ÖCntpllkjihhfghilqtx} !(+-0 1=GG>* èXxvwwvwwvtpjc^XQF?92* ñ!(!,1) ÷, ö
ý
ö ý + ü
û
- ú
ø
1 ý þ ×e¤¢¢¡ žš™˜˜šž¤ª¯¶½
脳®¯°¯°±®«§ž“Œƒxh]TJ@ ó
ç(B1,'"$(%%&#
þ + ý ü - ü ù $ 0 ú^K7+ú $+7< ( øI}…¥Óôÿÿù÷áÁ£Ž~ ( é;u€‹£¾ÕäîòòîæÚʸ¦“„vg * ë"`}‚†•œ¡¢Ÿœ™•Žƒyn\? + ø5bx|{{||}øzvn_F* - ï)Kbnstsoh_O;% À â-" [[ZZ[^afmry~€~nT; ! ä/( NMLLNPQSTUTTSSRPmYSC # ä/'
&05:?>>=:<<>FHLA # û ø $ ý ; þ ¾ ÷ ªªï¬°´¶º½¾¾½Í´¦w ! ä œš™š £¥¨©©¨§§¦¤³©¦† # ä '4@P`lx}}zwwz~‰‘™„ # þ ÷#2B- $ þ ý ù $?0þþýùüýÿ¶)4 ! ð '<0ççéìñõùüÿÿûýþÿÍ # ä .B6$-=Qc|•¥µº·³±°³»ÂÏÞëÊ $ û$7:0 ÷ (8MfI # û6?7$ : ý:+ ½ ûmT/ : üM) ; ý < þ > € € € € , ( – K
% X P Icon ÿ
B O€ X P O¤ ‡F ‡R ‡^ ‡j X P P m› ‚ ‚" ‚2 ‚B ‚R ‚b ‚r ‚‚ ‚’ …? †Æ †Ö †æ †ö ‡ ‡ ‡& ‡6 ø&
6 þ88Û67789==<=?@@?@>=:7541/+(%#"!! $, ï:KjdJHGEC==B
CDDCùBA@@??==ü>==>>?> â!;Q|}vy}ƒˆ=?
Œ‰†ysojd^ZXVUTTUTýQO ÷($0@Hp[VVÞWVAE;
UUVVXZ\^afiloswyz{{zyxvtpn ÷:KG@BK|QTTúJSW TTSùXbmndZRRúQRSTU ÷3LXKCLƒPTTùGV\TTò;@KV`ghaXMC=aTT ÷2M]NCN}RTTúNU TTóA=:GQX^_ZSI?==ü
TT ÷.JSKEUoSTTùS;T7TTða›N9ANSTQKC=?9>
ø-IOJEdcTTëSUX3X=XVUT=9 PŠ’qUGGöC==:%AU
÷,HKGEs`STTÞS^YV2W^`
]==>>/#Jq{rX/0Eap^VTD ò)FGFDz_XTSS^aSS÷;IWUQE3;==>ð7*%*'.^\IGMUZG æ%ECFFv^\`SRTNPRS$
9KETŽ99==ñ>?>>('03=DKQW^ á$ECGJn]Xuš¥¨ª¨§¦* >Aˇ7125:;==õ%!*19?FLS[ à CDHSnZa`|¬ª{kigg аeèÏ¢†oXG;==õ%%-5;AGPT ñAEH[uRSRKjš”X??ä ?ÈÿÿÈz÷ÿÿì¤[A;=>" '/6=DJ3 Ó@=>>1RTSROT nD@@ñÿùùÿ»l÷ÿÿÛ†L==>"
"+19?+¬ Ó@>719=SbmSQUx¤‹RÿÿüûúúÿŸqöÿù¼hA;>" $.42¤ë ÓAGK2Scjqh\QE7Góÿüüúúûÿ¢^ÇÿðœR=>"
=£æÑ ÓAINr^T!'3QWQE-‘þÿþüûúúüÿÕnwÑÖ‚C=! sÊãÓÒ ÓAKO„WTT '7\ôÿÿþüûúûüýÿÿÀql{U: .y¿æÞÑÒÛ ùBLOUTTø+( ˆÿÿæýüûüÿÿýýüÿùÈ{$
.”ÑæâÖÔÓÚ© ùBMP‰VTTß" ËÿÿþüûüùÛæÿýû÷ô÷ö³EÃêáÙ×ÖÕÖÅ ùEMVxVTTSûûþýüüéý°U;®ÿú÷ôñìè±ÜÚÛÛÙÖÓ× úHNdjTTùV^abdýüüèýôsI.ôûöóïëâ¯ØÚÜÛØÓÏÒ¦ ùJMreSTTþWXXýùúüüçþ÷a% ìúôñîéà°ÖÚÜÚÖÐËËÈ: ùLMxeSTTSüKÛÿüüèÿ› nûõñðìéß±ÖÙÛÙÓÎÊÈϳ ùJNvdSTTûJGæþüüýèþüÁ°ï÷ñïîëçÝ°ÒØÚ×ÒÌÉÉÊÒ ù!KQq`STTøbZK¤ùùûüüÿì÷ñîíìéåÜ®Ð×ÙÖÏËÈÉËÍ ú.KVqXTTiöcUbÝ÷úûûúùù÷ëôñîìëéçãÙ®ÎÖ×ÓÍÉÈÉËÍ Ó>N\yJT^dgg[:_üüùùøööõôòðîìééçäà×ÍÔÖÑËÈÈÊËÎ ÓE7=?GEEAG6 ƒûù÷õôòññîîìëéæåãàÝÕËÒÔÏÊÇÈÊÌÏ øC9! !
Ý_ìñôòñîíììëêéçåãáßÝÙÒ«ÉÑÒÎÈÇÈËÍÏ ôAQap
%!( úùèîììèèéçææãâàÝÛÙÖÏ©ÆÏÑÌÈÈÉËÎÐ ùDQlcSTTÛVæáçåãâãääããâàÞÜÚÙÖÓͨÄÎÏËÈÈËÍÏÑ ú&LP{\TTöWfR×ÚàÝÜÞààêßÞÝÛÙØÕÒÐË¥ÀËÏËËÑÑÒÏÒ ú/QO„[TTöVhRTÖÝÛÙÜÝÝêÛÚÙØÖÔÒÐÎÈ¢¼ÈÍÑÇ‚R©ÖÔ ú,RO[TTÚSUTWhSUÒÙÙÖØÙÙÛßÞÛÖÔÒÑÏÍËŹÆÏÁD bÖÖ ú+PTvZTTÚVagi}omÏÕ×ÒÓÕ×ËŠx·ØÑÏÎËÊÈÄš·ÄÒz (@dÏÙ ù5PapVTTÚSTUWiYTÀÎÕÐÏÑÓ|3*.ªÓÌËÉÈÆÁ—·ÃÒuG\~ÓÚ ù CQnrSTTÝU[]UTÕÍÌÏÆZE=!FÈÊÈÇÆÅÁ•¸ÄÏ7Ul¥ÛÛ ùNRuvSTTùSRZXT‚ÈÈÊèn?;!1ÀÈÅÄÅÆÁ•ºÆËÑŸžÑÜÝ ùQRttSTTßW\Se£ÆÄÆʱX:D™ÉÄÄÅÆÆÀ’¹ÇÍÏÖÖÙÚÝà ùNTrkSTTàZ]ZoºÀÂÃǽ¯ÀËÅÅÆÇÈÈÀ¸ÈÏÑÓÖÙÜßã ú"MWu]T T[ôZ‡ÃÀÂÃÆÈÇÆÇÈÈñÊɾŽ¹ÉÑÔÖÙÝàâæ û3PZT
TSóD©ÃÁÄÅÆÆÇÈÈÉËË󿎼ÌÔ×ÙÜßâæé úBS[…PT TäXN¼ÂÃÅÇÈÈÉÊËÌÍÍÁÀÏÖÙÜÞáæéì úFT]‚RSSTå/aÄÃÄÆÈÊËËÌÎÏÏÑÂÏØÝßâåèêì úAZs‰hddÙeddb_]YVTSRRfoÅÄÄÇÉËÍÏÐÑÑÁŽÁÏÚßâäæééè Ð
@Uryouz{{zwtrppsv{~U fÂÈÅÈËÍÐÒÓÒÀÃÐÝàâãäæéâ ÷ HUZVTSSRRÜTUWZ\]_``__C L®ÊÅÅÈÌÏÒоŒÇÒÚÝÞàåëÏj ñ9<58BNHEGILMNOOPæQRs> $~¸ÆÅÄÇÉÉ·ˆÉÑÖÙàèÜ> ö_F91+% 4 Ö,†…„ƒ‚†‡ ’•–••“Š„zwqi`\VUQOMHKHIMX ð7Œ›ª›š™˜— — ——÷–•““’’‘ø’“”•’‘‘ âQŸ¹»·º»¾Á Å ÂÁ¿¼·´±®«§¥¤£¢¡¡ü Ÿž ÷7HAi“š³ª¨¨ú"%
§§ó¨©ª««°²´µ·¹»»øº¹¹·¶´³ ÷gw|—œº¥§§ú*26
§ §ñ8BMOD9¦¦¥¥¦¦§§ ÷Z‚†ˆ˜¾¥§§ù(6;§§ò !+6@GHA8.# ¯§§ ÷W‚‰˜ž»¥§§ú05§§ó" '18=>:2) ü §§ ÷Rƒ‘™£´¦§§ù¦ 7§§ð?|.#.330+# øN~•š¬®§§ß¦§©9 4¨¨§ 3ltP5(('# "")9
÷L|}—š´¬¦§§ó¦ª¨6>A î
-S]P7.JZLJH) òHzz—™¸©¦¦¥¬®¥¥÷ +750$ ð KJ<;BLO0 æEwz—›¶¬«¬ ž™šœœ ,'7 õ"%.6>ENU á@v™ž³¬©µÇÍÏÐÏÏÎ (Ñt ÷#*19@GS à8r†›£³ª¯¨³ÑѲ§¦¥¥ >,GïÈoV?* õ %-4;CL ñ3p‰œ§¸¦¦¤š§ÄšŠŠä?`c:Vùþþè’B# (/7A" Ó1o ¦§¦¥Ÿ™¼É©‹‹_nqnl6NõþþÒp2
#*4 p Ó/p 3BM¥¡¯Ì½—s{€ztp-Xõþø®P%
).n” Ó.t’Ÿ3CKRG<0& !{‡€{v3:¼þí‡7
1hw6 Ó,w˜ ´¬§
270%Pª¢œ˜Š†ƒ~P ZÉÎk&
D€d9: Ó({ž¡¿¨§§
(¤¼¯§ –Ž‹‰‚{k7 Li: DiwO,5A ú$}¡¡Å§§Ü 4 «¢—‹‡xqgQ- ?f`J2+19- ù$¡¢Â¨§§ßLŠš¢£”ˆmluomgZL= 'H8(*..0- ù+ˆ¡¥¹¨§§¦â,d’˜˜”ŽX%3! $(" % úc›¦µ©§§IÝB9-CWaZVQNMJGB=7349>:/ #& & Ó¡ªº*4=DGF; vuVMJFDA?:5200483* "$ ( û ''Ú$* !usREA=;8630.,,..+$ ! ") øŒ
Ý 7vabG=7420/.,*)'&%# $+ ô‡¥¶ àƒKT93.-,+,+)'&#! &. ú0¤³¯§§Û¨ F7D.('))(('&$! ")0 úS›¤»«§§õ©²¥'3'!#%$$ê#! %,3 úd¤£¿ª§§õ¨³¥§!/' ! ê 17 ú]§£¾ª§§ñ¦§§¨´¦§ )' ë
4; ú\¥¦¹©§§Ú¨¯³´Á··#&
%7A ù
m£µ¨§§ô¦§§¨´©§ $è
)5=F ù#‰¤´¶¦§§¬ï¨§ "
ó '9@BL ù,Ÿ¥¸¸¦§§¦ù«©§è
&'1?BIR ù%¤¦·¸¦§§ß©¬¦
%+17>GPZ ù+ž¦¶³¦§§úª«þí!+17>FNXb úE›¨¸¬§ §«ý
ì &18>ENV`j ûl ª¾§
§¦ûë "
-8?FMV^is ú‡§«Á¥§ §ä !$'* #3@GNV_hqy û©«¿¦¦§å
!#$&(*-0 %6GPW_hptt ú„«·Ã±¯¯°ø¯®¬©¨§¦¦å "$'*,/157" %7NYagkli] ø‚§¶»µ¸»»üº¹¸¶¶à·¹»½¾¾ #&&)-159<;" ';T^ab_\VI ù=‘ªª§¦¦§Þ¨ª««¬¬¬
!)(*/4:?< *M òUªÒüþýýùîéòøðííò 0þŃ\B,
÷ (09E ÓK¥Øþþýÿÿûíæëôêæçç 9ýþþè„0
"*7 ðJ£
ÿÿþüóàéòíççå 5õþþÌ]
)R ÓF¦ (1ý÷êåòñé
?õþù <
'Rt ÓE®çÿ
(/6-"
#+0.' ®þìv$
*JT Ó@¶óþýþÿ '`LC>3*# ?¾ÈW
1]B å9½üþýþÿÿ
h„eWL<0*" ð0T% .HP/ ù5¾þþýþÿÿî Lc_^Q>0& ó(B8' ù9ÅþþýþÿÿñK %&þÿÿ õ(h£·ûÿâJ+‡ÿ ÿ ò4l¦÷ó¾¸ÇœngYxÿ ÿ òRcqdEKdgaL%?ÿ ÿ û
ý3ýÿÿ ýòÿÿ ýÛÿÿ! þµÿÿ! þÿÿ! þ?ÿÿ! ý
áÿÿ" þ•ÿÿ" ý;þÿÿ" ýÆÿÿ# þ`ÿÿ# ýÇÿÿ$ ý^óÿÿ$ üŸþÿÿ% ýI¼ÿÿ% ümÆÿÿ& û+~¾ýÿÿ' ûA€¬îÿÿý÷Ë & ùL•Ïúÿ ÿüýᶚΠù*EFC@>?CGKLKKLNOacM. ) ý=?A AñCIOTXTF53689?6 # öNLJGEDBA@??þ@AAû?NB9 # lækjkmnpsvwx=>wvtqkgc_[czE6 # äUVXZ[\]^_``(75_
__`bcfqP6 # TSöD7 S SSTTû_yA5 # TóSTSTTSJ(S TTû_yB6 # TSôU]^bZWC TTû_yC6 # ðTW_\]b`b`P TTû_xD9 # îTZWXY[e] ZTWTTû^xE9 # í!XWW`bd? " ^^]STTû_xF9 # ëK@KQW]_X ! `gk_TSTTû_vG; # ëZ2=NTTQ7 1 VX`fZRVTTû_tG< # ä9€z@ $
;>ifSZaVTT_rH= # ä®éË7 * “/:œ
hj_WS_pI= # äîÐÔ” . //%q
d_XUSaoJ? # øÑÒÒÓx* î^R6A`]`[TbmK? # äÒÖÖÓ×~*Q`da\L* QaVTSTdlK? # ëÖÙÚÙÜŽ/PZ^^I OcUTTûekLA # ÷ÞáÝÞÞÑmAGGö MfVTTûfjLA # ñ\™âààçµ9"! üMhVTTûgiMA % õ¤æáæà ûMhVTTûhgNA # ó @ÛàâäV ( ú§{MgWTTûieNB # ô Èáàé·B? ù¨}SeVTTûjcOB % íC×ßàèÇ|I+=> C§|\eVTTûj`OB # ä^qÄÝÝáèÔlK3†~w¬tZl^VSTl_OB # äÖÚÚÙÞâèàeN9‰ŠŒ’ndpj\TSo^OB # äÐÒÖÛÞãèêiQIMNPSQWZc_SSs^PB # äÐÓ×Ûßãèðy:PVTSSTTWbTSu^PB # äÑÔØÜàäéòz2W]^]\^_`n^Sw]PB # äÒÕØÝàåéôLaf Y\^`bq_Sy]QD # äÒÖÙÝâæëôy Vhje"TSSTlTSz\QD # äÓÖÚÞãèìôl Ped_VLTVcUS|[QC # äÕØÜàäéîð\ /CLQMASR}ZRB # äÖÙÝáæëñæA
26;=
R~ZRA # ä×ÚßãèìôÑ% ! 9
YR@ # õÙÝàæêîø®
þ û
YR> # õÚÞãçìðö
ûfcYSTTúRƒYR: # óÝàåéîóäG
üVTSTTùQ…ZR; " õßãèìð÷¸ TùQ‡ZSC " õáæêîñôr TùQˆZSG " ôåéìð÷Í+ TùQ‰ZSF " ôèìîñóu TùQ‰ZSE- " öêîïöº! STùQ‰ZSG= " öíïñßL$ ðTZ^[Y[VXWPˆZSH@ " îäêw . `dgcgiglbRˆ[TH= ! ëä+' gc]cXZ^d\ZP‡[THB2 ! âç– $6 XWWZaYY``[_Q†[TMJ@ ! â‰
1" SSWfcebhff_Q…[TQN< ! ô.' QRRïWTVUVVWUQ„[TIG= á+" ††ƒ~wqjda`^_`^…dSC;8 Î ù$Fm…Ž / ï+Gh~Š„wlho|†ŽŒm ) êgt~~yrpsz€…†…„„……’’„R ) ý‘’““é’‘ŽŒŒ”—˜”‰wz…‰’ # ÷œ›™˜—––••þ”••–—û–Ÿ™… # ý²±°°é±²³´µ¶· ¶µ´²¯¬ª¨¥©·™| # ÷§¨©ª««¬¬ï¬
¬¬®¯µÃ { # §¦÷% ¦¦§§û·˜{ # §ó¦§¦¦§2*§
§§û·™{ # §¦ô¨°97$
§§û¬·š| # 𧩮¬°®¯@0
§§û¬·š~ # ©©ª«D= «§¨§§û¬·›€ # í ª©¨@AD# «¦§§û¬·œ€ # ë4!*17<>9
®³µ®§¦§§û¬¶œ‚ # ëM%.441 ¥§±ª¦¨§§û¬µž… # ä&B,"
§©¢ª¯¨§§¬´ž† # äs}4 Á Ç
³´®©§¬³ž‡ # ä›;<# « °®©¨§²Ÿ‰ # ø8>@; ' ï>2Œ®¬®¬§®± ‰ # ë;DID@(%0?DA;,¯¨§§û¯± ‰ # ëDMTSL0 09>=+œ°¨§§û¯±¡‰ # ëJTZ_ZN,"())
œ²¨§§°ý¢‹ # ñ/XadbE3
üœ³¨§§û±°¢‹ % ù5^egN þ ü³¨§§û±¯£‹ % õ
Q_db úϲž³©§§û²®£‹ % öCZ`gH=: ùд¢±¨§§û²£‹ % í GU^hT,C'‰‰ δ©±¨§§û²¬¤‹ # ä7IS_j_%F.¹´¯Ò¯¨¶¨¦§³«¤‹ # ä/8@HT`li'I4ºº»À®¯¸µ¬¦§µ«¤‹ # ä-5?JUamq/$C››œŸ¡¨«°®¦§·«¥‹ # ä.7@KWcou4%2§¦¦¥¦§¨°§¦¸ª¥‹ # ä/8BMYeqy+7< ¬¬®®·¦¹ª¥‹ # ä1:DO[hs|.-AFª¬¯°¹¦ºª¦ # ä26,§¨°§¦¼ª¦‹ # ö8BMXes}} ð&-0,"§¦¼ª¦‰ # äA+ úþþÿÿúýþÿ° " ø#*19A> üÿÿúýþÿ¿B " ø'/7>B7
þ ÿúýþÿÉM " ø,3;@?% ü ÿÿúýþÿÅT " ù18><5 ü"ÿÿúýþÿÃu " ñ6<<6 "$ÿÿúýþÿÇœ " ï:<4% +'þýüýýþúýþÿÉ£ " ñ91% $7'üûûöúüþýþÿÈ›< ! ü* è 3: ûûüûýýüûüýÿýþÿȨ… ! ý
ç $B0ýþýýüýýüüýüþýþþȸª ! þ æ 7?"ÿÿþúûúûúúûüÿýþþȹ› % ù .B(ÿÿþõýþÿýþÿȵžB # ù (B0ýýþøýþþ½–“^ ý< ; ü0‰ : ü º' : ü/↠: û îì : ü¥÷t : û=ü‘; 8 ù .ÉÇ_ 3 õ">=Ý<;::;;<=>ABo? :}®ÄËË̸…ÑÛãàËšQ ý3FEEÚFEDCA>:73.($! h>
+V|˜©§‘¯¨f9
÷
ëS'
(. $ + öa?!
ø
".* - ïZD- (25$ 1 ü
€ ÖCntpllkjihhfghilqtx} !(+-0 1=GG>* èXxvwwvwwvtpjc^XQF?92* ñ!(!,1) ÷, ö
ý
ö ý + ü
û
- ú
ø
1 ý þ ×e¤¢¢¡ žš™˜˜šž¤ª¯¶½
脳®¯°¯°±®«§ž“Œƒxh]TJ@ ó
ç(B1,'"$(%%&#
þ + ý ü - ü ù $ 0 ú^K7+ú $+7< ( øI}…¥Óôÿÿù÷áÁ£Ž~ ( é;u€‹£¾ÕäîòòîæÚʸ¦“„vg * ë"`}‚†•œ¡¢Ÿœ™•Žƒyn\? + ø5bx|{{||}øzvn_F* - ï)Kbnstsoh_O;% À â-" [[ZZ[^afmry~€~nT; ! ä/( NMLLNPQSTUTTSSRPmYSC # ä/'
&05:?>>=:<<>FHLA # û ø $ ý ; þ ¾ ÷ ªªï¬°´¶º½¾¾½Í´¦w ! ä œš™š £¥¨©©¨§§¦¤³©¦† # ä '4@P`lx}}zwwz~‰‘™„ # þ ÷#2B- $ þ ý ù $?0þþýùüýÿ¶)4 ! ð '<0ççéìñõùüÿÿûýþÿÍ # ä .B6$-=Qc|•¥µº·³±°³»ÂÏÞëÊ $ û$7:0 ÷ (8MfI # û6?7$ : ý:+ ½ ûmT/ : üM) ; ý < þ > € € € € , ( – K
% X P Background ÿ
ˆ X P ˆA Fä Fð Fü G X P ˆ Ÿô ´ È Ûñ ðw ¥
, ,Ÿ ,¯ 0 3Ë 6Í 9ô <ë @ CN FÄ FÔ þÇÍ5Í úÕÎÍçæççþæç
çþæççþæçç üÕÍÜç6ç ýÎÜççþæç ç ýÇÍççþæççþæçç þÍç9ç ýÍæç8ç þÍç9ç þÍææþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ þÍååæåèæååææåæåææååæåææåææååææååüæåæååüæååææå ýÍäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå þÍääþãääþãääùãääãäãääþãääãäþãääþãää þÍã9ã þÍã9ã þÍââûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ þÍââáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þÍááþàááàýáàááüàáàááûàááàááüàáàááþàáá þÍà9à þÍà9à üÍààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùÍÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûÍÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þÍÝ-ÝþÜÝÝþÜÝÝ þÍÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þÍÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þÍÚ(ÚþÙÚÚ þÍÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üÍØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þÍØ9Ø þÍØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þÍ×9× þÍÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þÍÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øÍÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üÍÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýÍÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûÍÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þÍÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ÍÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ ;Í ;Í ÍÌüÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýÍÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þÍËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þÍÊ9Ê üÍÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þÍÉ9É þÍÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ þÍÈ ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç7ç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç ýÍçææûçææçææþçææþçææøçæççææçææçþæçç æ üÍåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå þÍååäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä þÍääþãääþãääã
äãäøãäããääãääþãääþãää þÍã9ã þÍã9ã üÍâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ ûÍáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÍá áþàááàáþàááúàáàáàááúàáààá þÍà9à þÍà9à ýÍàßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà ûÍßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þÍÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þÍÝ9Ý þÍÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þÍÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þÍÚ9Ú þÍÙ
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù öÍØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þÍØ9Ø ûÍØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þÍ×9× þÍÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷ÍÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ùÍÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þÍÔ9Ô þÍÔ+ÔþÓÔ Ô üÍÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ üÍÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þÍÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷ÍÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ùÍÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ ûÍÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ ;Í ;Í ÍÌÍÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ùÍËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË ûÍÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þÍÊ9Ê þÍÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þÍÉ9É óÍÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ þÍÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ þÍÇ ÇþÆÇÇ ûÍÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç%çþæçç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç þÍææüçæçææüçæçææûçææçææçæøçæçææççææþçææþç úÍåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå üÍääååøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå þÍä äþãä
äþãääþãääþãä äãäýãä þÍã9ã þÍã9ã ýÍãââùãââãâãââãâãøâããâãâãââþãââãâãâþã ûÍáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÍááþàááþàááþàá
áàüáààááþà þÍà9à þÍà9à òÍßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÍÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÍÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÍÝ9Ý ûÍÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÍÜ9Ü þÍÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÍÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÍÚ*ÚþÙÚ Ú ûÍÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÍØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÍØ9Ø ùÍ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÍ×9× þÍÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÍÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÍÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÍÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÍÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÍÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÍÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÍÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ ;Í ;Í þÍÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÍÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÍË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÍÊ9Ê þÍÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÍÉ9É þÍÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ûÍÈÈÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ þÍÆ9Æ ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ?Í ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/resources/api.xcf 0000664 0001750 0001750 00000224503 13157571677 022604 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ 2 B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 µ ˜ 9 i¥ Ê > API ÿ
g ' @ gimp-text-layer $(text "API")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 202.000000)
(box-height 62.000000)
(box-unit pixels)
Ê > ¹ € Œ Ê > Õ ð ` p € € € Ñ ý‘Y þ þ
þ û+ÿÜ ý,öÿ ÿùòÙÀ›J þ û—ÿÿO û)~òÿÿüÖÓîÿÿüï¡? úôÿÿ¿ þsÿÿþ[ û#[Ëÿÿýþw þpÿÿþ/ þ&ÿÿþ ý>Ïÿÿý ýÚÿÿþŸ þÿÿþ ý ìÿÿý¾
þIÿÿýø þÿÿþ ýFþÿÿþM
üµÿÚÿÿþ€ ÿþ þ×ÿÿþº ú#ýû'ñÿÿýè ÿþ þ©ÿÿþç úŽÿ« ’ÿÿþ` ÿþ þ{ÿÿþ
ø
ïÿ@ (þÿÿþÐ ÿþ þeÿÿýþ
üfÿÕ þ»ÿÿþA ÿþ þÿÿþè üÒÿj þOÿÿþ± ÿþ þºÿÿþ½
û?ÿò
ýàÿÿýý# ÿþ ý
ìÿÿþP
ü«ÿ” þwÿÿþ‘ ÿþ þ¡ÿÿýØ û ûÿ* ý÷ÿÿýò
ÿþ þ_ÿÿýî2
ü„ÿ¾ þŸÿÿþr
ÿþ ý=¿ÿÿýî2
ûéÿR þ3ÿÿýÞ ÿø‘zmx—µ×ÿÿý¾, û]ÿã þÇÿÿþR
ÿüã“:
üÉÿ| þ[ÿÿþà ÿö…ƒ“}aE( û6ÿù ýèÿÿþ2 ÿþ ü¢ÿùØ Øþóÿÿþ£ ÿþ ýøÿÿýù
ÿþ ü{ÿÖ4 4þÓÿÿþƒ
ÿþ ûâÿq þfÿÿýë ÿþ ûUÿø ý
îÿÿþd ÿþ üÄÿ§
þŒÿÿþÓ ÿþ û5ÿÿC
ý!ýÿÿþD ÿþ û¬ÿÝ þÄÿÿþµ þÿÿþ û)ýÿ þ{ÿÿþ3 þÿÿþ/ û®ÿÿZ þ2ÿÿþµ þ0ÿÿþI þUÿÿþ‡ ýþÿÿþR þÿÿþ§ ü"}üÿÿû÷d.
ü%«ÿÿöð‹6 =ùÿÿúý < þ>ÿÿþ¦ þpÿ
ÿýK2ÿ ÿþÉ
þ ? € € € À
þ / þíÿ
ÿýû« 0 ü;¥ÿÿûêt 4 þÀÿÿþ[ 7 þkÿÿþ 7 þTÿÿþì 8 þAÿÿþÙ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þ@ÿÿþØ 8 þBÿÿþÚ 8 þWÿÿþð 8 þpÿÿþ 7 þÉÿÿþl 3 û E®ÿÿúóŠ4 / þþÿ ÿþ½ p € € € € l l l l e 2 X P Icon (original) ÿ
.
D X P
h 9p 9| 9ˆ 9” X P
Ä "= 49 4I 4Y 4i 4y 4‰ 4™ 4© 4¹ 7
8ð 9 9 9 90 9@ 9P 9` ø&
6 þ88Û677899;<=?@@?@>=:7541/+(%#"!! $, õ:KjdJHGECBBCDCùBA@@??==ü>==>>?> â!;Q|}vy}ƒˆŒŽŽŒ‰†ysojd^ZXVUTTUTýQO ÷($0@Hp[VVþWVVUVéXZ\^afiloswyz{{zyxvtpn ÷:KG@BK|QTTSRúQRSTU ÷3LXKCLƒPT TþaTT ÷2M]NCN}RT TþmTT ÷.JSKEUoSTTS TþSTTþmTT ø-IOJEdcTTòSUX\Y[YWXVUTSTTüSXZTTýlUTT ÷,HKGEs`STTæS^YV[Z]^^a^]YTSTTafd[XVTSRRúhTSST ò)FGFDz_XTSS^aSSRþSRRSï`g`\]]_bdfhvhea_ è%ECFFv^\`SRTNPRSSRQONNOQQïP]QPRSTUUTW_TSTV Ö$ECGJn]Xuš¥¨ª¨§¦§¦§©ª©§ –†vhi—¨£œ“‡~ukgg]\\ Ó CDHSnZa`|¬ª{kigghjnrtwy|€ˆ•£§‚xy|ƒˆ’š£©¬« ñAEH[uRSRKjš”X??>ë?BEILO?>>?BCEHJKMMNO ï@EI]{RTSROT nD@ @?@? ø@FJ]wSTT÷SQUx¤‹R?@@ øAGKckSTT÷SRMh•¨wD@@ ùAINr^TTöSPTzŸ_C?@@ ùAKO„WTTõSRNb‡§‹\??@@ ùBLOUTTSöQMj“§‡^F?@@ ùBMP‰VT TòSTZ`pŽ¤“sRBA?@ @ ùEMVxVTTSñZccXQM]£¦Ÿ{T?@ @ úHNdjTTéV^abdfefmf\YWVSSUkƒ¤‚B@ @ ùJMreSTTþWXXïYi^WY[]adggf_Œ”A@ @ ùLMxeSTTSü]aSTTSRûOl¨R@ @ ùJNvdSTTûSaXSTTúRQ¤r>@
@ ù!KQq`STTúU\aUTSSTúSQŽA@
@ ú.KVqXTTëSWbh]_adeei^STTSPt‰F@
@ ú>N\ySTTôSZaUWXYXX\YTTúSPvˆF@
@ úEQ]QTTøVTTV_UTSSTûSP•}@ @ úCQ]}RTT÷U]USRbYSTTSúP^§f?@
@ ßAQapSTTU[]\cYYZcbZYWVUTSQSQQ‘F@ @ ùDQlcSTTèVY^lacdcmm^]]^_bc…–™R?@ @ ú&LP{\TTüWfRSSòR[bSUVWX^pV@
@ ú/QO„[TTüVhRTTSaö\XXW^ V??@
@ ú,RO[TTùSUTWhSUUT÷X]eedg§R?? @ ú+PTvZTTÚVagi}omkgb_\YXYYXd«kVUTRQNLIFCA>>=>>? ù5PapVTTÚSTUWiYTTUVX[^`cdbfš¢©¬®¬¨ ™“Š‰††„}v ù CQnrSTTûU[]UTTSëR^XVVWWY\afnv‰ŠŽ’••” ùNRuvSTTûSRZXTTêU`jefggdb_[XVSdUQPPNO ùQRttSTTûW\STSSéTSZ]WWVVUUV[^]_sgeedb` ùNTrkSTTûZ]ZYWWþXVVTþUSSøZ[VSRgVSS ú"MWu]T T[èZ[\^_`^_`_`_^]][[VTTRdVTT û3PZT
TSTóVUTVVUVWYZVSTTüSbVTT úBS[…PTTSTSTý^VTT úFT]‚RSSTþVTT úAZs‰hddõeddb_]YVTSRRST Þ
@Uryouz{{zwtrppsv{~|uoib^\[ZZ[[YûXVUTSS ÷ HUZVTSSRRöTUWZ\]_``__è`cgnt{…‡†ƒyuroopsuvvu ñ9<58BNHEGILMNOOPæQRRSSTTSSRQQPQRVY\chmsuvvt ö_F91+% 4 Ö,†…„ƒ‚†‡‰‹’•–••“Š„zwqi`\VUQOMHKHIMX ö7Œ›ª›š™˜—
—÷–•““’’‘ø’“”•’‘‘ âQŸ¹»·º»¾ÁÃÄÅÅÄÂÁ¿¼·´±®«§¥¤£¢¡¡ü Ÿž ÷7HAi“š³ª¨¨§ó¨©ª««°²´µ·¹»»øº¹¹·¶´³ ÷gw|—œº¥§§¦¥¦§ ÷Z‚†ˆ˜¾¥§ §þ¯§§ ÷W‚‰˜ž»¥§ §þ·§§ ÷Rƒ‘™£´¦§§þ¦§§þ·§§ øN~•š¬®§§ò¦§©¬ª«ª©©¨¨§¦§§ü¦©«§§ý¦¶§§ ÷L|}—š´¬¦§§ò¦ª¨««¬¯®ª§§÷¯²±«ª¨§¦¥¥ú´§¦¦§ òHzz—™¸©¦¦¥¬®¥¥þ¤¥¥¦ï®²®«¬¬¯±²³¼´²¯ ìEwz—›¶¬«¬ ž™šœœœ›™™ü›žŸ 󟥞 ¢¢££¥«¤¤þ¦ ì@v™ž³¬©µÇÍÏÐÏÏÎÎÏÏÐÐéÎÉ·¬£¢ÃÐÌÇÀ¸²¬¥£¤žžŸ ð8r†›£³ª¯¨³ÑѲ§¦¥¥å§ª¬®°²µºÄÍз°±²´·ºÁÆÌÐÒÒÐ ñ3p‰œ§¸¦¦¤š§ÄšŠŠ‰ëŠŒŽ‘’”Š‰ŠŠŒŽ‘’““”• ï1oŒ¨»¦§¦¥Ÿ™¼É©‹ ‹Š‹Š ø/pŽž¨¹¦§§÷¥¡¯Ì½—Š‹‹ ù.t’Ÿ¬³§§÷¦¤œ¦Àϯ‹‹ ù,w˜ ´¬§§õ¦¥ œ°È¿ŸŠ‹‹ ù({ž¡¿¨§§õ¦¤¤¸Ï½ŠŠ‹‹ ú$}¡¡Å§§ô¦¥¢š§ÁκŸŠ‹‹ ù$¡¢Â¨§§¦ó¥¨§¬½ÌÁ—ŒŒŠ‹ ‹ ù+ˆ¡¥¹¨§§¦ñª±°©¢› ³ÌÎʲ˜Š‹ ‹ ú/’¡²§§é¨¯°±³²²·²¬ª¨§¤ ©µÉ¶Œ‹ ‹ ù1š¡µ°¦§§©ªðµ©ª«¯±²²°¤¹ÂŒ‹ ‹ ù3¡¸°¦§§¦ü¬¯¦§§¦ú¥ ¨Ï–‹ ‹ ù3¢·°¦§§û¦¯©¦§§ú¤šË«Š‹
‹ úEš£µ§§û¬¯§§¦¦§û¦¼´‹ ‹ úc›¦µ©§§ë¦©°³¬¯±±²´¦§§¦Ÿ©»‹
‹ ú¡ªº¦§§ô¦«¯¨©©ªª©¬ª§§ú¦Ÿªº‹
‹ ú¥«½¥§§ø¨§§¨®§§¦¦§û¦œÁ³‹ ‹ úŒ¥«¼¥§§÷¨§¦¦°ª¦§§÷¦¥¥¡ŸÎ£Š‹
‹ ߇¥¶¦§§¨«¬¬°ªª«±°ªª©¨§§¦£ œ—¿¾‹ ‹ ú0¤³¯§§è¨ª¶¯°±°·¶®¬¬®¯ª¸¼ÀÅ—Š‹ ‹ úS›¤»«§§ü©²¥¦¦ó«¯¦§¨©¨¤Ç¶«™‹
‹ úd¤£¿ª§§ü¨³¥§§¦¯ö¬©©¨£É™ŠŠ‹
‹ ú]§£¾ª§§ù¦§§¨´¦§§ö¦©¬²²°©Î–ŠŠ ‹ ú\¥¦¹©§§ó¨¯³´Á··µ³°®¬ªªï¨§Ñ§š˜˜—–”“‘Ž‹Š‰‰Š ù
m£µ¨§§ù¦§§¨´©§§ã¨©«¯°±¯ªÇÊÏÒÓÒÏÊÆÁ½»º¹¹¸¶´¯ ù#‰¤´¶¦§§¬þ¨§§¦í¥¢¦ Ÿœœž £¨º»¾ÀÁÁ ù,Ÿ¥¸¸¦§§¦ý«©§§ü®´±²²ñ°®«¨¦¥£¬¢Ÿ›™š ù%¤¦·¸¦§§ü©¬¦§§ö¦§¦¦§¦ª¬©¨¨ô¬¬º²²±±¯® ù+ž¦¶³¦§§ôª««©¨©©§¨¨§§¦øª«¨¦¥³¨¦¦ úE›¨¸¬§ §«èª««®®®¯®®¬««¨§§¦²©§§ ûl ª¾§
§¦§¨þ§¨¨ú©ªª¨¦§§ü¦°©§§ ú‡§«Á¥§§¦§¦§ý¨§§ û©«¿¦¦§þ¨§§ ú„«·Ã±¯¯°ø¯®¬©¨§¦¦§ ø‚§¶»µ¸»»üº¹¸¶¶û·¹»½¾¾ø¼¸µ²®¬«ªªþ«ªª©ü¨§§¦¦ ù=‘ªª§¦¦§ø¨ª««¬¬¬ì®±´¸»¿ÁÂÂÀ½º¹¶µ´µ·¸¸ ïswjm{ƒƒ…‰”—šœœùžŸ¡£¤¥§§¦¥ò¤¥¦§©«®±´·¸¹¸· ô§yfZOB4$
3 ÖRâäàÞßÞßàáãæçëíñóôööôîäÛÓÍŨ ™“ˆ‚|{yw}‹ ú]îþýýþ
þõÿýüûúúùø÷÷öö÷üöôô ü‹ñþýýþ øXm`®úþýþþ
ýþþ ÷š¾®Åÿþüþÿ"ÿ ÷ˆÁ·Ìÿþüþÿ ÿüþûþÿÿ ÷‚¾¸Ôÿþýþÿ ÿüþøþÿÿ ÷{¼·àÿþýþÿÿþþÿÿüþøþÿÿ ÷w¹·ìÿýýþÿÿúþýüýüýýþÿüþýýÿÿüþùþÿÿ øq·´óÿýþÿÿèüýþüüûûüûûüýþÿÿþûúúýýþþÿÿüþùþÿÿ ÷l´²ôÿýþýþþûúùüýüüýþøûøúûûüûúúùùöùúûü ñd°¸öÿýþû÷òìèèéêêåéèèéìîñóôöóëìîïñòóôõõô÷øùù ób®ÅøÿýþûðñòóôôéóðíèãàÝéôòîìèåãáßßáãæç òUªÒüþýýùîéòøðííþîïïúñóõ÷ñïïð÷ñóôõö÷öô ðK¥Øþþýÿÿûíæëôêæççæçèþéææçèþéèèþé ðJ£Ûÿþýÿÿþüóàéòíç çæçæ ùF¦ßÿþýÿÿ÷ý÷êåòñéæçç ùE®çÿþþÿÿøþûîçêöïçç ù@¶óþýþÿÿõþüõèçïòëçæçç ù9½üþýþÿÿõþúðèèôòêææçç ù5¾þþýþÿÿôþýøëçìòñëçæçç ù9Åþþýþÿÿþöüôêåéòóîéçç ùBÓþþýþÿÿþþÿÿòýúûûøìåçðôõðêç ç ùHåþþýþÿÿûþüûûúúòøúüüýüøñççäéñç ç úLîÿýýÿÿþþýýðüùûýýüûûúù÷ôäâôç ç úKïÿýýÿÿûüûþÿþþûöåôéç ç úNîÿýýÿÿüþúýÿÿúûæðîæç
ç úlðÿýþÿÿúþýûþþÿÿûþïéïç ç ú›ôþýþÿÿùýûùüûûúúýùüÿÿûþòßñç ç ûÈûþýÿÿûýûþþýýýüýÿÿúþòàñèç
ç ûØÿþýÿÿþûÿþûþÿÿþÿúýìêïæç
ç ûÏÿþýÿÿþùûýÿÿûýÿÿ÷þýýöäòìæç
ç úÍÿþýÿÿþþüü÷úüýýûúýýþþ÷ÿþûòëßêóç ç úKÚÿþþÿÿùþýýüøûúúøøûüüûûúïééüòêæç ç úðÿýþÿÿüþùþÿÿüþüûþþùûëïñîêç
ç ú”ûÿýþÿÿüþùþÿÿõþûûüýýúéðêçç ú‡ûÿýþÿÿþýýùþþ÷ýüúú÷çòéææ ç ú‰úþýþÿÿóþûúùõøøùúûüüýýùùèõíêêééèçæ ù§úþýþÿÿþüýùüþþýüíûúúøêíðóôööõôòññððññýðï ú5Õüýýÿÿûþüüþÿÿ÷þ÷íìëèçäááöäååëììííì úBïÿýýÿÿüþüýÿÿýþûøø÷öõ÷ôïðïìêçæ ú8ðÿýýÿÿûýûþþÿÿüþýüýýþüýû÷ùù úEìÿýþÿÿýýüýýþþýþþÿøýüþÿÿùýÿÿ úníþýþÿÿþþüüûüüýüþÿÿýúþÿÿ ú¦õþýþÿ
ÿ
þûýüýþÿÿýûþÿÿ úËýþüþÿÿþÿüþûþÿÿ úÌÿþüþÿ ÿþÿ ùÂþýüýþþ ÿ ý%Çþþýþ ý
þÿ ûYÚÿþÿÿ þýüýþý ñ*ª®›ŸµºÁÉÐÙáæéëë÷íîñóõùûýþþý™ 4 ú é CEC>:61*%"
Ô (¾ÞÚÖÒÎɾ»¸¶³±®¬««ª¦¢žš–‡ysojc\XUT^p… ûJáÿÿêþýüüûúù÷õôóòñðîííìîòö újïÿ%ÿ ù?b¬úÿ%ÿ ùeÙí÷þÿ%ÿ üvôÿ(ÿ üuóÿ(ÿ üròÿ(ÿ ükðÿ(ÿ ügïÿ(ÿ ücîÿ(ÿ ü`íÿ(ÿ ü[ëÿ(ÿ üVéÿ(ÿ üTèÿ(ÿ üRèÿ(ÿ üPçÿ(ÿ üMæÿ(ÿ üKæÿ(ÿ ü Kåÿ(ÿ ü
Låÿ(ÿ û Låÿ(ÿ ûMåÿ(ÿ ûQåÿ(ÿ ûSæÿ(ÿ ûUæÿ(ÿ û^èÿ(ÿ ûqîÿ(ÿ û ˆöÿ(ÿ û ›üÿ(ÿ û
"¤ÿ)ÿ û *ÿ)ÿ û6¾ÿ)ÿ ûDÔÿ)ÿ ûOéÿ)ÿ ûVóÿ)ÿ ûbõÿ)ÿ û |÷ÿ)ÿ ú &žúÿ)ÿ ú +½ýÿ)ÿ ú
.Ðþÿ)ÿ û6×ÿ*ÿ ûFÞÿ*ÿ û_éÿ*ÿ ûvõÿ*ÿ û†ýÿ*ÿ û Žÿ+ÿ û
&œÿ+ÿ û 0²ÿ+ÿ û 6Ìÿ+ÿ ÷ j‚”Ëþÿ'ÿÎ ù*EFC@>?CGKLKKLNOacM. ) ý=?A AñCIOTXTF53689?6 # öNLJGEDBA@??þ@AAû?NB9 # lækjkmnpsvwxyxwvtqkgc_[czE6 # öUVXZ[\]^_``_^_÷`bcfqP6 # T
STû_yA5 # TüSTSTTþSTTû_yB6 # TSõU]^b]]^\TSTTû_yC6 # ñTW_\]b`bb`bbYZTTû_xD9 # TðZWXY[[]^a^VXZTWTTû^xE9 # ú\XXWWXXõYWVUTT^^]STTû_xF9 # ëX[^bdffed`_^\^`gk_TSTTû_vG; # ë[YVTQNMLLNOQTVX`fZRVTTû_tG< # 䧟˜’ŠŠ‰ˆˆ„ypjifSZaVTT_rH= # ôQV]dnx€‰Ž‘’““ò•œœhhj_WS_pI= # ?@?ê>=<<;=?DIq›bd_XUSaoJ? #
@òAnU`]`[TbmK? #
@òBw†QaVTSTdlK? #
@ùC…‚OcUTTûekLA #
@ùCMfVTTûfjLA #
@ùB™~MhVTTûgiMA #
@ùB¡|MhVTTûhgNA #
@ùB§{MgWTTûieNB #
@ùB¨}SeVTTûjcOB # @ý?><<ö=>>C§|\eVTTûj`OB # @êY‰“’Œ†~w¬tZl^VSTl_OB # @è?F’•€†ˆ‰‰ŠŒ’ndpj\TSo^OB # @úlŸ^NNMMñNPSQWZc_SSs^PB # @øB—ŠYYVUVVòTSSTTWbTSu^PB # @èC¦wT\bghea^]\^_`n^Sw]PB # @ûE¥qPSSRñTVY\^`bq_Sy]QD # @úC¦xNSTTS÷TlTSz\QD # @úC„MSTT÷VcUS|[QC # @ùe XOQSTTöSa]SR}ZRB # @÷?K›ƒraQSTTöWcTTR~ZRA # @ø?l›º„OSTTôST\^STR€YR@ # @úBF”QSSóU[e_STTRYR> # ?@ô’b]ZZ\fcYSTTúRƒYR: # íog^VQLIM”oS\cc^VTSTTùQ…ZR; " ”ö—›Ÿ¦ª®´fQSSTùQ‡ZSC " ôQRW\`gil{WRT TùQˆZSG " ú^\]]^``ûobUSTTùQ‰ZSF " ôTUWYY[[Yc]RT TùQ‰ZSE- " TSýWTSSTùQ‰ZSG= " TìU]b[TZ^[Y[VXWPˆZSH@ " TäSWYWWVVYcfe`dgcgiglbRˆ[TH= ! TäS\heca`jcdgc]cXZ^d\ZP‡[THB2 ! TûSTUUWWìSXWWZaYY``[_Q†[TMJ@ ! STSïWfcebhff_Q…[TQN< ! ôrkgaZWSQPPQRRïWTVUVVWUQ„[TIG= ároopsw|‚…††ƒ~wqjda`^_`^…dSC;8 Î ù$Fm…Ž / ï+Gh~Š„wlho|†ŽŒm ) êgt~~yrpsz€…†…„„……’’„R ) ý‘’““é’‘ŽŒŒ”—˜”‰wz…‰’ # ÷œ›™˜—––••þ”••–—û–Ÿ™… # ý²±°°ù±²³´µ¶··ò¶µ´²¯¬ª¨¥©·™| # ÷§¨©ª««¬¬¬ù®¯µÃ { # § ¦§û·˜{ # §ù¦§¦¦§¦§ §û·™{ # §¦ö¨°¬®¨§§û¬·š| # ñ§©®¬°®¯¯®¯°©ª§§û¬·š~ # §ð«©©ª««¬¯¨©«§¨§§û¬·›€ # í«©ª©¨©©ªª©¨§¦¦«¦§§û¬·œ€ # 먪¬®°²²±°®®¬®³µ®§¦§§û¬¶œ‚ # ë¡ Ÿžœ›œ›œŸ¢¤¥§±ª¦¨§§û¬µž… # úÎÉÿ¼ººî¸µ²«§§©¢ª¯¨§§¬´ž† # õ–™¢©¯µ»¾ÀÁÁòÂÇdz´®©§¬³ž‡ # Š‹Šþ‰ˆˆï‰Š‘«Å§°®©¨§²Ÿ‰ #
‹òŒ©» ®¬®¬§®± ‰ #
‹ùŒ°¸¯¨§§û¯± ‰ #
‹ùŒ¸´œ°¨§§û¯±¡‰ #
‹ùÀ³œ²¨§§°ý¢‹ #
‹ùƲœ³¨§§û±°¢‹ #
‹ùŒË²³¨§§û±¯£‹ #
‹ùŒÏ²ž³©§§û²®£‹ #
‹ùŒÐ´¢±¨§§û²£‹ # ‹ýŠ‰ˆˆ‰øŠÎ´©±¨§§û²¬¤‹ # ‹ê›»ÁÁÀ½¹´¯Ò¯¨¶¨¦§³«¤‹ # ‹ùŠÁÁµ¸ººò»À®¯¸µ¬¦§µ«¤‹ # ‹èŠ¨È žœ››œŸ¡¨«°®¦§·«¥‹ # ‹èŒÄº£©¨§¨§§¦¦¥¦§¨°§¦¸ª¥‹ # ‹è࣫°³³²¯¬¬®®·¦¹ª¥‹ # ‹ûŽÎ¬¡¦¦¥ñ¦¨ª¬¯°¹¦ºª¦ # ‹úŒÍ°Ÿ¦§§¦ø¶¦¦»ª¦Œ # ‹úŒ¿¶›¦§§÷¨°§¦¼ª¦‹ # ‹øŠ£ÉœŸ¤¦§§ö¦¯§¦¼ª¦‰ # ‹÷Š’Ƴ«§£¦§§ö©°§§¦½©¦‡ # ‹øŠ¨ÇÛ¹ ¦§§ô¦§¬¦§¦¾©¦„ # ‹úŒŽÂ´¡¦¦ó§«±®¦§§¦¿©§ # þŠ‹‹ôÁ¶«ª¬³±ª¦§§ú¥Àª§v # íª¥ž™–“‘“Áª£«°±¨§¦§§ù¥Á©¦t " ÀöÂÄÈÍÐÓצ£¦¦§ù¥Âª¦, " šõ ¢§¨¨´¢¤¦§§ù¥Âª¦†3 " þ¬««¬ú«µ¯§¦§§ù¥Â©¦ƒ7 " ô§¨©ªª««ª°¥§ §ù¥Ã©¦‚O " §¦ý©§¦¦§ù¥Ã©¦„i " §ù¬®ª§ª¬ªª¨ù¥Âª§†m " §ä¦©ª¨¨§¨©¯°°°²¯²²±´¯¦Âª§…i% ! §ä¦¬²°¯®³°°±¯¬¯©ª¬°«ª¥Âª§…rX ! §þ¦§§é¨©©¦©¨©ª¯ª©®«¥Áª§ˆ}s ! ¦§¦ï©±°±¯²±±¥Á«§‹€i ! ø¶³±ª¨¦¥¥¦ý©§¨¨ö§¥À«§…zj, þ¶µµñ·¹¼¿ÀÁÁÀ¼¹¶²¯¬¬ö¬À¯¦}ea8 Í ø 6cÇÖÄ / ïAhšºÎDz œ§·ÉÔÒ¢ ) ñ ²À¸°«¯¸ÁÈÉÈÆÄÄûÆÅÅ{ ) äôö÷ø÷öôòñïîëèæåäãâÞÙÄÉÑÕÜèÁ # þÿüþÿÒ # þýþýýþÈ # ÿþûýüþà # ÿþüýþà # ÿþ
ÿûþýÿà # ÿûþüüûüüþÿûþýÿà # úÿýûüüûûúüýüþÿÿûþýÿÅ # ýÿþýýüûùýüüþýþÿÿûþýÿÅ # þüýýþûûüüþÿÿûþýÿÅ # úùúûøüûûùøûþÿÿûþýÿÈ # ëéëêìííïðñóôõ÷÷ø÷÷üþþÿÿûþýÿË # äóðíìêéêëëìëêêçæåèöüûþþÿþýÿÌ # éùëìîïðòóóðòññóíì÷øûýÿþýÿÎ # æçæñçèîëéùûýýÿþýÿÎ # çóîéíúûûüþþýÿÎ # çúïèîúþÿÿûþýÿÎ # çúòçîùþÿÿûþýÿÎ # çúóçðùýÿÿûþýÿÎ # çúõçñøýÿÿþýÿÎ # çúöéóùýÿÿþýÿÎ # çúöêôùþÿÿþýÿÎ # çúöéôúþÿÿþýÿÎ # çæùçõèôùþÿÿþýÿÎ # çýêòóóðòðïöéöøüþÿÿþþÿÎ # çúæçòéèëëðêéêëêö÷ùüþÿþþÿÎ # çéíïåòóòñîííîöüüúûÿÿýþÿÎ # çûôæìûýýüýþ÷ýúþÿýþÿÎ # çúõçôüúùùûüûøøûþýþÿÎ # çüôè÷þþýüûø÷ûþýþÿÎ # çûõèôþÿÿ÷þøþÿýþÿÌ # çûóèïþÿÿ÷þúþÿýþÿË # çøæìïäôúþÿÿûùþÿýþÿÈ # çøèòâæðúþÿÿöþúþÿÿýþÿÅ # çùîõùï÷þÿÿõþüüþÿÿýþÿÁ # çôòêöþÿÿþþüúûÿÿûýþÿº # çõñæôüýýüúûýÿÿûýþÿ¯ # úîíëêéèèöñçøüúúüþþÿÿúýþÿ° " óìëíîïóõööèùþÿ ÿúýþÿ¿B " óæåæèçéèçéïüþÿ ÿúýþÿÉM " þúùùø÷öõôñøýÿ
ÿúýþÿÅT " þýüüúüþÿ
ÿúýþÿÃu " ÿýýþÿ ÿúýþÿÇœ " ÿøþýüýþýüýýþúýþÿÉ£ " ÿýþýþþþýûûþüûûöúüþýþÿÈ›< ! ÿþüûûþúûûðüûýýüûüýÿýþÿȨ… ! ÿþíýþýýüýýüüýüþýþþȸª ! ÿïþúûúûúúûüÿýþþȹ› ! þýþþÿþõýþÿýþÿȵžB þýþþ ýþøýþþ½–“^ À
õ ) ä
/=LUZ`k|“«ÁÐØÇ: # õ—¤ªµ¿ÏÝîùþþõÿô] " ýûýÿÿõûº”Œˆ„}B
! ÿüŠ ! ÿû‘!
ÿû•% ÿû•& ÿû•& ÿû•& ÿû“& ÿû“% ÿû“% ÿû‘#
ÿü! ! ÿûŽ ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿûŽ ÿû ÿû‘! ÿû“" ÿû–$ ÿûœ' ÿûª. ÿûÅ9 ÿûàE
ÿûëO ÿüðj ! ÿûø‘ ÿûþ« ÿüº ÿüÒ7 ÿüïV ÿüþj ÿý~ ÿý§ ÿûëÖš û&@JD>>=â<;::;;<=>ABCDEEFFGIJKKLNQRSSRQQþP ý3FEEéFEDCA>:73.($! ù %,18 ÷
þ ? ÔCntpllkjihhfghilqtx}‚„…†ˆŠŒ“•˜¢¥¦§¥¤£¢££ ÔXxvwwvwwvtpjc^XQF?92*&# !#$(--/15=??@?CMXdr ÷, ö
û ? Ýe¤¢¢¡ žš™˜˜šž¤ª¯¶½ÀÄÅÅÈÌÏÕÝàåêðöøøù÷ø÷øúú Ô„³®¯°¯°±®«§ž“Œƒxh]TJ@841048>CGIMR[\\[\dr†™¯ ê(B1,'"$(%%&#
û ? ø ,@žþÿÿþýúüûûúúùùøüöôõøøùûúûûü ò
èåãáàÞÜÛÛßÙÔÐÌż´°«¢š—•’Ž‹‹ŒŒ‹Š‹ŽŒŽ•›¢¬µÁ Ñ
3\WPMJE?==<:7788533420/010/0232346789;=?BDG û
þ
þï
. À øQSUVXYZ[[Zî[^afmry~€~nT; ! ä?FKOPQONMLLNPQSTUTTSSRPmYSC # ä
&05:?>>=:<<>FHLA 7 ø $ ¥ý§¨ªªþ«ªªï¬°´¶º½¾¾½Í´¦w ! ä‚—ž¡¡œš™š £¥¨©©¨§§¦¤³©¦† # ä '4@P`lx}}zwwz~‰‘™„ 6 ÷#2B- $ üþÿþ þýùüýÿ¶)4 ! ùÈØæëëêççùéìñõùüÿÿûýþÿÍ # ä "('&$$-=Qc|•¥µº·³±°³»ÂÏÞëÊ 6 ÷ (8MfI $ üýþþÿÿúþ¦P1 ðÌÓÙÜÝÞáãçìïóùûþÿÿúþŒ" âIJKMPTZ`ht{…”™œž¢§¶ÁÉÓÝày ! â "#%')+-/12469 dN d^ dn d~ dŽ dž d® d¾ g hõ i i i% i5 iE iU ie ø&
6 þ88Û677899;<=?@@?@>=:7541/+(%#"!! $, õ:KjdJHGECBBCDCùBA@@??==ü>==>>?> â!;Q|}vy}ƒˆŒŽŽŒ‰†ysojd^ZXVUTTUTýQO ÷($0@Hp[VVþWVVUVéXZ\^afiloswyz{{zyxvtpn ÷:KG@BK|QTTSRúQRSTU ÷3LXKCLƒPT TþaTT ÷2M]NCN}RT TþmTT ÷.JSKEUoSTTS TþSTTþmTT ø-IOJEdcTTòSUX\Y[YWXVUTSTTüSXZTTýlUTT ÷,HKGEs`STTæS^YV[Z]^^a^]YTSTTafd[XVTSRRúhTSST ò)FGFDz_XTSS^aSSRþSRRSï`g`\]]_bdfhvhea_ è%ECFFv^\`SRTNPRSSRQONNOQQïP]QPRSTUUTW_TSTV Ö$ECGJn]Xuš¥¨ª¨§¦§¦§©ª©§ –†vhi—¨£œ“‡~ukgg]\\ Ó CDHSnZa`|¬ª{kigghjnrtwy|€ˆ•£§‚xy|ƒˆ’š£©¬« ñAEH[uRSRKjš”X??>ë?BEILO?>>?BCEHJKMMNO ï@EI]{RTSROT nD@ @?@? ø@FJ]wSTT÷SQUx¤‹R?@@ øAGKckSTT÷SRMh•¨wD@@ ùAINr^TTöSPTzŸ_C?@@ ùAKO„WTTõSRNb‡§‹\??@@ ùBLOUTTSöQMj“§‡^F?@@ ùBMP‰VT TòSTZ`pŽ¤“sRBA?@ @ ùEMVxVTTSñZccXQM]£¦Ÿ{T?@ @ úHNdjTTéV^abdfefmf\YWVSSUkƒ¤‚B@ @ ùJMreSTTþWXXïYi^WY[]adggf_Œ”A@ @ ùLMxeSTTSü]aSTTSRûOl¨R@ @ ùJNvdSTTûSaXSTTúRQ¤r>@
@ ù!KQq`STTúU\aUTSSTúSQŽA@
@ ú.KVqXTTëSWbh]_adeei^STTSPt‰F@
@ ú>N\ySTTôSZaUWXYXX\YTTúSPvˆF@
@ úEQ]QTTøVTTV_UTSSTûSP•}@ @ úCQ]}RTT÷U]USRbYSTTSúP^§f?@
@ ßAQapSTTU[]\cYYZcbZYWVUTSQSQQ‘F@ @ ùDQlcSTTèVY^lacdcmm^]]^_bc…–™R?@ @ ú&LP{\TTüWfRSSòR[bSUVWX^pV@
@ ú/QO„[TTüVhRTTSaö\XXW^ V??@
@ ú,RO[TTùSUTWhSUUT÷X]eedg§R?? @ ú+PTvZTTÚVagi}omkgb_\YXYYXd«kVUTRQNLIFCA>>=>>? ù5PapVTTÚSTUWiYTTUVX[^`cdbfš¢©¬®¬¨ ™“Š‰††„}v ù CQnrSTTûU[]UTTSëR^XVVWWY\afnv‰ŠŽ’••” ùNRuvSTTûSRZXTTêU`jefggdb_[XVSdUQPPNO ùQRttSTTûW\STSSéTSZ]WWVVUUV[^]_sgeedb` ùNTrkSTTûZ]ZYWWþXVVTþUSSøZ[VSRgVSS ú"MWu]T T[èZ[\^_`^_`_`_^]][[VTTRdVTT û3PZT
TSTóVUTVVUVWYZVSTTüSbVTT úBS[…PTTSTSTý^VTT úFT]‚RSSTþVTT úAZs‰hddõeddb_]YVTSRRST Þ
@Uryouz{{zwtrppsv{~|uoib^\[ZZ[[YûXVUTSS ÷ HUZVTSSRRöTUWZ\]_``__è`cgnt{…‡†ƒyuroopsuvvu ñ9<58BNHEGILMNOOPæQRRSSTTSSRQQPQRVY\chmsuvvt ö_F91+% 4 Ö,†…„ƒ‚†‡‰‹’•–••“Š„zwqi`\VUQOMHKHIMX ö7Œ›ª›š™˜—
—÷–•““’’‘ø’“”•’‘‘ âQŸ¹»·º»¾ÁÃÄÅÅÄÂÁ¿¼·´±®«§¥¤£¢¡¡ü Ÿž ÷7HAi“š³ª¨¨§ó¨©ª««°²´µ·¹»»øº¹¹·¶´³ ÷gw|—œº¥§§¦¥¦§ ÷Z‚†ˆ˜¾¥§ §þ¯§§ ÷W‚‰˜ž»¥§ §þ·§§ ÷Rƒ‘™£´¦§§þ¦§§þ·§§ øN~•š¬®§§ò¦§©¬ª«ª©©¨¨§¦§§ü¦©«§§ý¦¶§§ ÷L|}—š´¬¦§§ò¦ª¨««¬¯®ª§§÷¯²±«ª¨§¦¥¥ú´§¦¦§ òHzz—™¸©¦¦¥¬®¥¥þ¤¥¥¦ï®²®«¬¬¯±²³¼´²¯ ìEwz—›¶¬«¬ ž™šœœœ›™™ü›žŸ 󟥞 ¢¢££¥«¤¤þ¦ ì@v™ž³¬©µÇÍÏÐÏÏÎÎÏÏÐÐéÎÉ·¬£¢ÃÐÌÇÀ¸²¬¥£¤žžŸ ð8r†›£³ª¯¨³ÑѲ§¦¥¥å§ª¬®°²µºÄÍз°±²´·ºÁÆÌÐÒÒÐ ñ3p‰œ§¸¦¦¤š§ÄšŠŠ‰ëŠŒŽ‘’”Š‰ŠŠŒŽ‘’““”• ï1oŒ¨»¦§¦¥Ÿ™¼É©‹ ‹Š‹Š ø/pŽž¨¹¦§§÷¥¡¯Ì½—Š‹‹ ù.t’Ÿ¬³§§÷¦¤œ¦Àϯ‹‹ ù,w˜ ´¬§§õ¦¥ œ°È¿ŸŠ‹‹ ù({ž¡¿¨§§õ¦¤¤¸Ï½ŠŠ‹‹ ú$}¡¡Å§§ô¦¥¢š§ÁκŸŠ‹‹ ù$¡¢Â¨§§¦ó¥¨§¬½ÌÁ—ŒŒŠ‹ ‹ ù+ˆ¡¥¹¨§§¦ñª±°©¢› ³ÌÎʲ˜Š‹ ‹ ú/’¡²§§é¨¯°±³²²·²¬ª¨§¤ ©µÉ¶Œ‹ ‹ ù1š¡µ°¦§§©ªðµ©ª«¯±²²°¤¹ÂŒ‹ ‹ ù3¡¸°¦§§¦ü¬¯¦§§¦ú¥ ¨Ï–‹ ‹ ù3¢·°¦§§û¦¯©¦§§ú¤šË«Š‹
‹ úEš£µ§§û¬¯§§¦¦§û¦¼´‹ ‹ úc›¦µ©§§ë¦©°³¬¯±±²´¦§§¦Ÿ©»‹
‹ ú¡ªº¦§§ô¦«¯¨©©ªª©¬ª§§ú¦Ÿªº‹
‹ ú¥«½¥§§ø¨§§¨®§§¦¦§û¦œÁ³‹ ‹ úŒ¥«¼¥§§÷¨§¦¦°ª¦§§÷¦¥¥¡ŸÎ£Š‹
‹ ߇¥¶¦§§¨«¬¬°ªª«±°ªª©¨§§¦£ œ—¿¾‹ ‹ ú0¤³¯§§è¨ª¶¯°±°·¶®¬¬®¯ª¸¼ÀÅ—Š‹ ‹ úS›¤»«§§ü©²¥¦¦ó«¯¦§¨©¨¤Ç¶«™‹
‹ úd¤£¿ª§§ü¨³¥§§¦¯ö¬©©¨£É™ŠŠ‹
‹ ú]§£¾ª§§ù¦§§¨´¦§§ö¦©¬²²°©Î–ŠŠ ‹ ú\¥¦¹©§§ó¨¯³´Á··µ³°®¬ªªï¨§Ñ§š˜˜—–”“‘Ž‹Š‰‰Š ù
m£µ¨§§ù¦§§¨´©§§ã¨©«¯°±¯ªÇÊÏÒÓÒÏÊÆÁ½»º¹¹¸¶´¯ ù#‰¤´¶¦§§¬þ¨§§¦í¥¢¦ Ÿœœž £¨º»¾ÀÁÁ ù,Ÿ¥¸¸¦§§¦ý«©§§ü®´±²²ñ°®«¨¦¥£¬¢Ÿ›™š ù%¤¦·¸¦§§ü©¬¦§§ö¦§¦¦§¦ª¬©¨¨ô¬¬º²²±±¯® ù+ž¦¶³¦§§ôª««©¨©©§¨¨§§¦øª«¨¦¥³¨¦¦ úE›¨¸¬§ §«èª««®®®¯®®¬««¨§§¦²©§§ ûl ª¾§
§¦§¨þ§¨¨ú©ªª¨¦§§ü¦°©§§ ú‡§«Á¥§§¦§¦§ý¨§§ û©«¿¦¦§þ¨§§ ú„«·Ã±¯¯°ø¯®¬©¨§¦¦§ ø‚§¶»µ¸»»üº¹¸¶¶û·¹»½¾¾ø¼¸µ²®¬«ªªþ«ªª©ü¨§§¦¦ ù=‘ªª§¦¦§ø¨ª««¬¬¬ì®±´¸»¿ÁÂÂÀ½º¹¶µ´µ·¸¸ ïswjm{ƒƒ…‰”—šœœùžŸ¡£¤¥§§¦¥ò¤¥¦§©«®±´·¸¹¸· ô§yfZOB4$
3 ÖRâäàÞßÞßàáãæçëíñóôööôîäÛÓÍŨ ™“ˆ‚|{yw}‹ ú]îþýýþ
þõÿýüûúúùø÷÷öö÷üöôô ü‹ñþýýþ øXm`®úþýþþ
ýþþ ÷š¾®Åÿþüþÿ"ÿ ÷ˆÁ·Ìÿþüþÿ ÿüþûþÿÿ ÷‚¾¸Ôÿþýþÿ ÿüþøþÿÿ ÷{¼·àÿþýþÿÿþþÿÿüþøþÿÿ ÷w¹·ìÿýýþÿÿúþýüýüýýþÿüþýýÿÿüþùþÿÿ øq·´óÿýþÿÿèüýþüüûûüûûüýþÿÿþûúúýýþþÿÿüþùþÿÿ ÷l´²ôÿýþýþþûúùüýüüýþøûøúûûüûúúùùöùúûü ñd°¸öÿýþû÷òìèèéêêåéèèéìîñóôöóëìîïñòóôõõô÷øùù ób®ÅøÿýþûðñòóôôéóðíèãàÝéôòîìèåãáßßáãæç òUªÒüþýýùîéòøðííþîïïúñóõ÷ñïïð÷ñóôõö÷öô ðK¥Øþþýÿÿûíæëôêæççæçèþéææçèþéèèþé ðJ£Ûÿþýÿÿþüóàéòíç çæçæ ùF¦ßÿþýÿÿ÷ý÷êåòñéæçç ùE®çÿþþÿÿøþûîçêöïçç ù@¶óþýþÿÿõþüõèçïòëçæçç ù9½üþýþÿÿõþúðèèôòêææçç ù5¾þþýþÿÿôþýøëçìòñëçæçç ù9Åþþýþÿÿþöüôêåéòóîéçç ùBÓþþýþÿÿþþÿÿòýúûûøìåçðôõðêç ç ùHåþþýþÿÿûþüûûúúòøúüüýüøñççäéñç ç úLîÿýýÿÿþþýýðüùûýýüûûúù÷ôäâôç ç úKïÿýýÿÿûüûþÿþþûöåôéç ç úNîÿýýÿÿüþúýÿÿúûæðîæç
ç úlðÿýþÿÿúþýûþþÿÿûþïéïç ç ú›ôþýþÿÿùýûùüûûúúýùüÿÿûþòßñç ç ûÈûþýÿÿûýûþþýýýüýÿÿúþòàñèç
ç ûØÿþýÿÿþûÿþûþÿÿþÿúýìêïæç
ç ûÏÿþýÿÿþùûýÿÿûýÿÿ÷þýýöäòìæç
ç úÍÿþýÿÿþþüü÷úüýýûúýýþþ÷ÿþûòëßêóç ç úKÚÿþþÿÿùþýýüøûúúøøûüüûûúïééüòêæç ç úðÿýþÿÿüþùþÿÿüþüûþþùûëïñîêç
ç ú”ûÿýþÿÿüþùþÿÿõþûûüýýúéðêçç ú‡ûÿýþÿÿþýýùþþ÷ýüúú÷çòéææ ç ú‰úþýþÿÿóþûúùõøøùúûüüýýùùèõíêêééèçæ ù§úþýþÿÿþüýùüþþýüíûúúøêíðóôööõôòññððññýðï ú5Õüýýÿÿûþüüþÿÿ÷þ÷íìëèçäááöäååëììííì úBïÿýýÿÿüþüýÿÿýþûøø÷öõ÷ôïðïìêçæ ú8ðÿýýÿÿûýûþþÿÿüþýüýýþüýû÷ùù úEìÿýþÿÿýýüýýþþýþþÿøýüþÿÿùýÿÿ úníþýþÿÿþþüüûüüýüþÿÿýúþÿÿ ú¦õþýþÿ
ÿ
þûýüýþÿÿýûþÿÿ úËýþüþÿÿþÿüþûþÿÿ úÌÿþüþÿ ÿþÿ ùÂþýüýþþ ÿ ý%Çþþýþ ý
þÿ ûYÚÿþÿÿ þýüýþý ñ*ª®›ŸµºÁÉÐÙáæéëë÷íîñóõùûýþþý™ 4 ú é CEC>:61*%"
Ô (¾ÞÚÖÒÎɾ»¸¶³±®¬««ª¦¢žš–‡ysojc\XUT^p… ûJáÿÿêþýüüûúù÷õôóòñðîííìîòö újïÿ%ÿ ù?b¬úÿ%ÿ ùeÙí÷þÿ%ÿ üvôÿ(ÿ üuóÿ(ÿ üròÿ(ÿ ükðÿ(ÿ ügïÿ(ÿ ücîÿ(ÿ ü`íÿ(ÿ ü[ëÿ(ÿ üVéÿ(ÿ üTèÿ(ÿ üRèÿ(ÿ üPçÿ(ÿ üMæÿ(ÿ üKæÿ(ÿ ü Kåÿ(ÿ ü
Låÿ(ÿ û Låÿ(ÿ ûMåÿ(ÿ ûQåÿ(ÿ ûSæÿ(ÿ ûUæÿ(ÿ û^èÿ(ÿ ûqîÿ(ÿ û ˆöÿ(ÿ û ›üÿ(ÿ û
"¤ÿ)ÿ û *ÿ)ÿ û6¾ÿ)ÿ ûDÔÿ)ÿ ûOéÿ)ÿ ûVóÿ)ÿ ûbõÿ)ÿ û |÷ÿ)ÿ ú &žúÿ)ÿ ú +½ýÿ)ÿ ú
.Ðþÿ)ÿ û6×ÿ*ÿ ûFÞÿ*ÿ û_éÿ*ÿ ûvõÿ*ÿ û†ýÿ*ÿ û Žÿ+ÿ û
&œÿ+ÿ û 0²ÿ+ÿ û 6Ìÿ+ÿ ÷ j‚”Ëþÿ'ÿÎ ù*EFC@>?CGKLKKLNOacM. ) ý=?A AñCIOTXTF53689?6 # öNLJGEDBA@??þ@AAû?NB9 # lækjkmnpsvwxyxwvtqkgc_[czE6 # öUVXZ[\]^_``_^_÷`bcfqP6 # T
STû_yA5 # TüSTSTTþSTTû_yB6 # TSõU]^b]]^\TSTTû_yC6 # ñTW_\]b`bb`bbYZTTû_xD9 # TðZWXY[[]^a^VXZTWTTû^xE9 # ú\XXWWXXõYWVUTT^^]STTû_xF9 # ëX[^bdffed`_^\^`gk_TSTTû_vG; # ë[YVTQNMLLNOQTVX`fZRVTTû_tG< # 䧟˜’ŠŠ‰ˆˆ„ypjifSZaVTT_rH= # ôQV]dnx€‰Ž‘’““ò•œœhhj_WS_pI= # ?@?ê>=<<;=?DIq›bd_XUSaoJ? #
@òAnU`]`[TbmK? #
@òBw†QaVTSTdlK? #
@ùC…‚OcUTTûekLA #
@ùCMfVTTûfjLA #
@ùB™~MhVTTûgiMA #
@ùB¡|MhVTTûhgNA #
@ùB§{MgWTTûieNB #
@ùB¨}SeVTTûjcOB # @ý?><<ö=>>C§|\eVTTûj`OB # @êY‰“’Œ†~w¬tZl^VSTl_OB # @è?F’•€†ˆ‰‰ŠŒ’ndpj\TSo^OB # @úlŸ^NNMMñNPSQWZc_SSs^PB # @øB—ŠYYVUVVòTSSTTWbTSu^PB # @èC¦wT\bghea^]\^_`n^Sw]PB # @ûE¥qPSSRñTVY\^`bq_Sy]QD # @úC¦xNSTTS÷TlTSz\QD # @úC„MSTT÷VcUS|[QC # @ùe XOQSTTöSa]SR}ZRB # @÷?K›ƒraQSTTöWcTTR~ZRA # @ø?l›º„OSTTôST\^STR€YR@ # @úBF”QSSóU[e_STTRYR> # ?@ô’b]ZZ\fcYSTTúRƒYR: # íog^VQLIM”oS\cc^VTSTTùQ…ZR; " ”ö—›Ÿ¦ª®´fQSSTùQ‡ZSC " ôQRW\`gil{WRT TùQˆZSG " ú^\]]^``ûobUSTTùQ‰ZSF " ôTUWYY[[Yc]RT TùQ‰ZSE- " TSýWTSSTùQ‰ZSG= " TìU]b[TZ^[Y[VXWPˆZSH@ " TäSWYWWVVYcfe`dgcgiglbRˆ[TH= ! TäS\heca`jcdgc]cXZ^d\ZP‡[THB2 ! TûSTUUWWìSXWWZaYY``[_Q†[TMJ@ ! STSïWfcebhff_Q…[TQN< ! ôrkgaZWSQPPQRRïWTVUVVWUQ„[TIG= ároopsw|‚…††ƒ~wqjda`^_`^…dSC;8 Î ù$Fm…Ž / ï+Gh~Š„wlho|†ŽŒm ) êgt~~yrpsz€…†…„„……’’„R ) ý‘’““é’‘ŽŒŒ”—˜”‰wz…‰’ # ÷œ›™˜—––••þ”••–—û–Ÿ™… # ý²±°°ù±²³´µ¶··ò¶µ´²¯¬ª¨¥©·™| # ÷§¨©ª««¬¬¬ù®¯µÃ { # § ¦§û·˜{ # §ù¦§¦¦§¦§ §û·™{ # §¦ö¨°¬®¨§§û¬·š| # ñ§©®¬°®¯¯®¯°©ª§§û¬·š~ # §ð«©©ª««¬¯¨©«§¨§§û¬·›€ # í«©ª©¨©©ªª©¨§¦¦«¦§§û¬·œ€ # 먪¬®°²²±°®®¬®³µ®§¦§§û¬¶œ‚ # ë¡ Ÿžœ›œ›œŸ¢¤¥§±ª¦¨§§û¬µž… # úÎÉÿ¼ººî¸µ²«§§©¢ª¯¨§§¬´ž† # õ–™¢©¯µ»¾ÀÁÁòÂÇdz´®©§¬³ž‡ # Š‹Šþ‰ˆˆï‰Š‘«Å§°®©¨§²Ÿ‰ #
‹òŒ©» ®¬®¬§®± ‰ #
‹ùŒ°¸¯¨§§û¯± ‰ #
‹ùŒ¸´œ°¨§§û¯±¡‰ #
‹ùÀ³œ²¨§§°ý¢‹ #
‹ùƲœ³¨§§û±°¢‹ #
‹ùŒË²³¨§§û±¯£‹ #
‹ùŒÏ²ž³©§§û²®£‹ #
‹ùŒÐ´¢±¨§§û²£‹ # ‹ýŠ‰ˆˆ‰øŠÎ´©±¨§§û²¬¤‹ # ‹ê›»ÁÁÀ½¹´¯Ò¯¨¶¨¦§³«¤‹ # ‹ùŠÁÁµ¸ººò»À®¯¸µ¬¦§µ«¤‹ # ‹èŠ¨È žœ››œŸ¡¨«°®¦§·«¥‹ # ‹èŒÄº£©¨§¨§§¦¦¥¦§¨°§¦¸ª¥‹ # ‹è࣫°³³²¯¬¬®®·¦¹ª¥‹ # ‹ûŽÎ¬¡¦¦¥ñ¦¨ª¬¯°¹¦ºª¦ # ‹úŒÍ°Ÿ¦§§¦ø¶¦¦»ª¦Œ # ‹úŒ¿¶›¦§§÷¨°§¦¼ª¦‹ # ‹øŠ£ÉœŸ¤¦§§ö¦¯§¦¼ª¦‰ # ‹÷Š’Ƴ«§£¦§§ö©°§§¦½©¦‡ # ‹øŠ¨ÇÛ¹ ¦§§ô¦§¬¦§¦¾©¦„ # ‹úŒŽÂ´¡¦¦ó§«±®¦§§¦¿©§ # þŠ‹‹ôÁ¶«ª¬³±ª¦§§ú¥Àª§v # íª¥ž™–“‘“Áª£«°±¨§¦§§ù¥Á©¦t " ÀöÂÄÈÍÐÓצ£¦¦§ù¥Âª¦, " šõ ¢§¨¨´¢¤¦§§ù¥Âª¦†3 " þ¬««¬ú«µ¯§¦§§ù¥Â©¦ƒ7 " ô§¨©ªª««ª°¥§ §ù¥Ã©¦‚O " §¦ý©§¦¦§ù¥Ã©¦„i " §ù¬®ª§ª¬ªª¨ù¥Âª§†m " §ä¦©ª¨¨§¨©¯°°°²¯²²±´¯¦Âª§…i% ! §ä¦¬²°¯®³°°±¯¬¯©ª¬°«ª¥Âª§…rX ! §þ¦§§é¨©©¦©¨©ª¯ª©®«¥Áª§ˆ}s ! ¦§¦ï©±°±¯²±±¥Á«§‹€i ! ø¶³±ª¨¦¥¥¦ý©§¨¨ö§¥À«§…zj, þ¶µµñ·¹¼¿ÀÁÁÀ¼¹¶²¯¬¬ö¬À¯¦}ea8 Í ø 6cÇÖÄ / ïAhšºÎDz œ§·ÉÔÒ¢ ) ñ ²À¸°«¯¸ÁÈÉÈÆÄÄûÆÅÅ{ ) äôö÷ø÷öôòñïîëèæåäãâÞÙÄÉÑÕÜèÁ # þÿüþÿÒ # þýþýýþÈ # ÿþûýüþà # ÿþüýþà # ÿþ
ÿûþýÿà # ÿûþüüûüüþÿûþýÿà # úÿýûüüûûúüýüþÿÿûþýÿÅ # ýÿþýýüûùýüüþýþÿÿûþýÿÅ # þüýýþûûüüþÿÿûþýÿÅ # úùúûøüûûùøûþÿÿûþýÿÈ # ëéëêìííïðñóôõ÷÷ø÷÷üþþÿÿûþýÿË # äóðíìêéêëëìëêêçæåèöüûþþÿþýÿÌ # éùëìîïðòóóðòññóíì÷øûýÿþýÿÎ # æçæñçèîëéùûýýÿþýÿÎ # çóîéíúûûüþþýÿÎ # çúïèîúþÿÿûþýÿÎ # çúòçîùþÿÿûþýÿÎ # çúóçðùýÿÿûþýÿÎ # çúõçñøýÿÿþýÿÎ # çúöéóùýÿÿþýÿÎ # çúöêôùþÿÿþýÿÎ # çúöéôúþÿÿþýÿÎ # çæùçõèôùþÿÿþýÿÎ # çýêòóóðòðïöéöøüþÿÿþþÿÎ # çúæçòéèëëðêéêëêö÷ùüþÿþþÿÎ # çéíïåòóòñîííîöüüúûÿÿýþÿÎ # çûôæìûýýüýþ÷ýúþÿýþÿÎ # çúõçôüúùùûüûøøûþýþÿÎ # çüôè÷þþýüûø÷ûþýþÿÎ # çûõèôþÿÿ÷þøþÿýþÿÌ # çûóèïþÿÿ÷þúþÿýþÿË # çøæìïäôúþÿÿûùþÿýþÿÈ # çøèòâæðúþÿÿöþúþÿÿýþÿÅ # çùîõùï÷þÿÿõþüüþÿÿýþÿÁ # çôòêöþÿÿþþüúûÿÿûýþÿº # çõñæôüýýüúûýÿÿûýþÿ¯ # úîíëêéèèöñçøüúúüþþÿÿúýþÿ° " óìëíîïóõööèùþÿ ÿúýþÿ¿B " óæåæèçéèçéïüþÿ ÿúýþÿÉM " þúùùø÷öõôñøýÿ
ÿúýþÿÅT " þýüüúüþÿ
ÿúýþÿÃu " ÿýýþÿ ÿúýþÿÇœ " ÿøþýüýþýüýýþúýþÿÉ£ " ÿýþýþþþýûûþüûûöúüþýþÿÈ›< ! ÿþüûûþúûûðüûýýüûüýÿýþÿȨ… ! ÿþíýþýýüýýüüýüþýþþȸª ! ÿïþúûúûúúûüÿýþþȹ› ! þýþþÿþõýþÿýþÿȵžB þýþþ ýþøýþþ½–“^ À
õ ) ä
/=LUZ`k|“«ÁÐØÇ: # õ—¤ªµ¿ÏÝîùþþõÿô] " ýûýÿÿõûº”Œˆ„}B
! ÿüŠ ! ÿû‘!
ÿû•% ÿû•& ÿû•& ÿû•& ÿû“& ÿû“% ÿû“% ÿû‘#
ÿü! ! ÿûŽ ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿû ÿûŽ ÿû ÿû‘! ÿû“" ÿû–$ ÿûœ' ÿûª. ÿûÅ9 ÿûàE
ÿûëO ÿüðj ! ÿûø‘ ÿûþ« ÿüº ÿüÒ7 ÿüïV ÿüþj ÿý~ ÿý§ ÿûëÖš û&@JD>>=â<;::;;<=>ABCDEEFFGIJKKLNQRSSRQQþP ý3FEEéFEDCA>:73.($! ù %,18 ÷
þ ? ÔCntpllkjihhfghilqtx}‚„…†ˆŠŒ“•˜¢¥¦§¥¤£¢££ ÔXxvwwvwwvtpjc^XQF?92*&# !#$(--/15=??@?CMXdr ÷, ö
û ? Ýe¤¢¢¡ žš™˜˜šž¤ª¯¶½ÀÄÅÅÈÌÏÕÝàåêðöøøù÷ø÷øúú Ô„³®¯°¯°±®«§ž“Œƒxh]TJ@841048>CGIMR[\\[\dr†™¯ ê(B1,'"$(%%&#
û ? ø ,@žþÿÿþýúüûûúúùùøüöôõøøùûúûûü ò
èåãáàÞÜÛÛßÙÔÐÌż´°«¢š—•’Ž‹‹ŒŒ‹Š‹ŽŒŽ•›¢¬µÁ Ñ
3\WPMJE?==<:7788533420/010/0232346789;=?BDG û
þ
þï
. À øQSUVXYZ[[Zî[^afmry~€~nT; ! ä?FKOPQONMLLNPQSTUTTSSRPmYSC # ä
&05:?>>=:<<>FHLA 7 ø $ ¥ý§¨ªªþ«ªªï¬°´¶º½¾¾½Í´¦w ! ä‚—ž¡¡œš™š £¥¨©©¨§§¦¤³©¦† # ä '4@P`lx}}zwwz~‰‘™„ 6 ÷#2B- $ üþÿþ þýùüýÿ¶)4 ! ùÈØæëëêççùéìñõùüÿÿûýþÿÍ # ä "('&$$-=Qc|•¥µº·³±°³»ÂÏÞëÊ 6 ÷ (8MfI $ üýþþÿÿúþ¦P1 ðÌÓÙÜÝÞáãçìïóùûþÿÿúþŒ" âIJKMPTZ`ht{…”™œž¢§¶ÁÉÓÝày ! â "#%')+-/12469ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/resources/tutorials.xcf 0000664 0001750 0001750 00000210101 13157571677 024046 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ 0 B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 ± Ù P£ Ê >
Tutorials ÿ
h ' F gimp-text-layer *(text "Tutorials")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 202.000000)
(box-height 62.000000)
(box-unit pixels)
¥ Ê > Á Á Í Ê > Ý º
8 ± € € € Á þþ ! þÞÿÿþ] ! þçÿÿþf ! óñÿÿü²T5 LÿÿöÌ )=vÛÿÿþp ! ûúÿø0 þLÿÿþÌ ú•ÿÿy ûÿÿs þLÿÿþÌ û
Úÿ‚ øx
ÿì þLÿÿþÌ ügÿŒ ù±´ ÿ¡ þLÿÿþÌ ü ÿ• øvÿ´ ÿR þLÿÿþÌ ýП ÷=ûÿ´ h þLÿÿþÌ ý?C ú æÿÿ´ þLÿÿþÌ % ýÛÿÿþ´ þLÿÿþÌ
þF€€þ` þ€€þl ý/ÚÿÿýÚ€
þLÿÿþÌ
ü"_ÁÿÿþÀ ûiˆÙÿÿþØ ý0øÿÿ þLÿÿþÌ ýÔÿÿþÀ ýÇÿÿþØ ûŒÿÿý»
þLÿÿþÌ
þŽÿÿþÀ þuÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þvÿÿþÀ þ[ÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þXÿÿþØ þ€ÿÿþ´ þLÿÿþÌ
þtÿÿþÀ þbÿÿþØ þ€ÿÿþ· þVÿÿþÎ
þ`ÿÿþà þˆÿÿþÙ þwÿÿþÈ þjÿÿþâ
þ9ÿÿþ1 ýìÿÿþí þ^ÿÿþä þ„ÿÿýù ýúÿÿýÑ ûcéÿÿþ2 þCÿÿþ3 ýßÿÿþW
þŒÿÿ÷ê’u¡Úÿ—ÿÿüñ¡ ý ðÿÿþÛ û*XÇÿÿûí4
ý
Þÿÿûüÿÿüö®X þÿÿ þþÿ ÿþ•
ý£ÿÿõ×6 ÿôªV ý «ÿÿ$ ú NsS" üP û4hX ÿ € € € µ þ ; ú3Äý¶% 9 þ¸ÿÿþŸ 8 ý÷ÿÿþä 9 þ¨ÿÿþŒ 9 ú “Ù‡ ‡ €þ` ôBr¡ÐôСrB
ü-Šâ ù.°éÓy ü3ŽÖ ÿþÀ ÷%Èÿï¶}˜àÿÿýÂ" ürÐÿÿ ýXüÿÿþP ù#}Øÿÿô þ úgôÿ¾ ù1åÿÿóf üE·üÿÿü Püÿÿû¦ mÇÿÿþô þ ú–ÿÿ± ý*ìÿÿþ ûM^‚òÿÿú$ðFÃÿÿùz t[„ôÿÿþô þ ú=þÿû" ù3ùÿÿþ: þÿÿýÐf ûL¿ þ‹ÿÿþô þå úÔÿÿ¡ þ©ÿÿýÖ þUÿÿþ¤
þaÿÿþô ý ÿ þvÿÿþM þBÿÿþ€ þ5ÿÿþ/
þAÿÿþô þÒ þÜÿÿþ, ýÚÿÿþÖ þ4ÿÿþ
þ@ÿÿþô þ! ýýÿÿþ þ‚ÿÿýû þ4ÿÿ þ@ÿÿþô þ0ÿÿþû
þaÿÿþ/ þ4ÿÿ þ@ÿÿþô þZÿÿþ þFÿÿþ\ þ4ÿÿ þ@ÿÿþô þ€ÿÿþ+ þ+ÿÿþs þ4ÿÿ þ@ÿÿþô þjÿÿþE þÿÿþK þ4ÿÿ þ@ÿÿþô þ>ÿÿþ^ þ ÿÿþ! þ4ÿÿ þ@ÿÿþô þ þÿÿþŒ þ(ÿÿýô þ4ÿÿ þ@ÿÿþô ýÎ þèÿÿýâ þCÿÿþË þ4ÿÿ þ@ÿÿþô ýzÿ þ£ÿÿþ> þ_ÿÿþo þ4ÿÿ þ@ÿÿþô ýéÿ ýñÿÿþ˜ ú¯ÿÿÏ þ4ÿÿ þ@ÿÿþô üÿÿ þmÿÿýï ú üÿþ8 þ4ÿÿþ
þLÿÿýü üÿÿ ý0‹ ýÌÿÿýÈ ûÿÿš þEÿÿþ
þ_ÿÿþ øìÿF,rç< ý Æÿÿþ útÿÿ– þqÿÿþW
þ”ÿÿþB þ¢ÿÿýøE ñƒýÿÿ¼e C˜ÿîR übêÿÿüâJ üZòÿÿýÊ0 úìüÄJ ô=¼îÿÿüûÿߦ ý¡ýÿÿüõÖ0 ü'Ùúÿÿýð† ý( ú!TrG + € € € ™ ý
9 ú"n»ú 5 ûZœÞÿÿþ 4 û ÓÇöÿÿþ 7 ý ÿÿþ 8 þ5ÿÿþ 8 þ ÿÿþ 8 þÿÿþ 8 þÿÿþ 8 þÿÿþ 8 þÿÿþ 8 þÿÿþ % õe©ÉéóÏ«~
þÿÿþ ôf§ÐèÅp(4F ò|êÿË‚C[ªÿÿàA þÿÿþ ó7Ñÿ×€9W›þÿÿ“ û¦ÿÿw ú}ÿÿù þÿÿþ û ïÿq ûHùÿ› ÿýü úíÿÿŽ þÿÿþ üÆÿÞ ü†ÿ¢ ÿþ úÅÿÿô þÿÿþ û ÿÿ¶ ü êª ÿþ$ þªÿÿþ þÿÿþ úQÿÿé ý˜² ÿþÍ þ¨ÿÿþ= þÿÿþ þeÿÿþN ýD¹ üŽˆ þ¨ÿÿþY þÿÿþ þ=ÿÿýùT ý8 üCÖÿÿþh þÿÿþ ý
æÿÿüþ¡ úyÞëâÿÿþh þÿÿþ þaÿÿüñq ø8¦úÎa¨ÿÿþh þÿÿþ þŠÿÿýÕB ú=¾ÿ×B þ¨ÿÿþh þÿÿþ ýuûÿÿý¡ ù ÿý‚ þ¨ÿÿþh þÿÿþ ý1Îÿÿýà/ ûÒÿÿ~ þ¨ÿÿþh þÿÿþ ütñÿÿýé& ÿýÄ þ¨ÿÿþh þÿÿþ
ü™üÿÿþœ ÿþz þ¨ÿÿþh þÿÿþ ý=J ý?îÿÿýè ÿþJ þ¨ÿÿþh þÿÿþ ýh¹ ý(äÿÿþ9 ÿþ€ þÂÿÿþh þÿÿþ ühø þÿÿþP ÿþ× ýîÿÿþr þÿÿþ ühÿY þ2ÿÿþ ÿþM ûLÝúÿÿ÷” 0ÿÿþ) ûhÿ× û:ÿÿÔ ÿ÷ü t•×ùw{ÿÿ÷øšö eÿÿþP úhÿÿ† ûŽÿ÷0 ÿûÑ. =ÿÿú„ QçÿÿýÒ2 þhÿÿý® ú'þø_ þÇÿÿü×~ ö¦ýÿÿûc Êùÿÿîï® h÷©ÀñþÙ©Õÿÿ½& ú7ec ûjJ ô @ctL l l l l e 2 X P Icon ÿ
% ‚ X P ¦ Ps P P‹ P— X P 2W H{ H‹ H› H« H» HË HÛ Hë Hû LA Oó P P P# P3 PC PS Pc Û ý|vr!r ú& h£©§!§ æ8 V ||||~}||~||~}|}„||}}û~}}~}}ú~}}„~ Ö: R›qIIOIIMJIJNIILKIO[IILMJLOKKNMKMNKJ]P Ö!; P›qIIOIINKIJNIIMKIP\JKNOLNQMMPOMOPML^Q Ó($0@ PœsNNTNNRONOSNNQPOUbQQUURTWSSWUSUVSRcW Ó:KG@B PœqJKPKJOLJKOJJONMS`OORSQSUQQUSQSTQQbV ê3LXKC PœqIIOIIMJIJNIINNëVaNORSPRUQQUSQTUQPbU Ó2M]NC PœrJKPKJOLJKPKOPV‹±µª¨©rSZXTTWVTVWSSdX Ó.JSKE PœsMMSNMROMOUe“o[¥´’†Å_—†^X\ZXZ[XWh] Ó-IOJE PœqIIOIIMJILu«È©aœžgR_·}„ÌÀš`ZXVXYVUfZ Ó,HKGE PœqIIOIINKP€´“n³—¦iTa¹²‘|±{ZXZ[WWg[ Ó)FGFD PœsMMSMMRR‹»‡UT…ºÁ°oYfªe`j›¾ˆ^_`\\k` Ó%ECFF PœrKKQKKQP„·xRSZ”±ŽlY`«x^`]ÃŒ^_`]\k` Ó$ECGJ PœqIIOII^\T•§^RV[^_hXYaf\]_l°žfug`\[j_ Ó CDHS PœrKKQKMœ¸x·XYYX^j[\_`^`hµ‰ªÉ’c__mc ÓAEH[ PœsMMSN]³ž©¸É¥^\\]sƒsdaco»Å¼¨«±ibboe Ó@EI] PœqIIOKu¶aXviUZb˜ÉÕÊÐɘfbd¤‚fy¿}``nc Ó@FJ] PœqJJQP—¥XRTZVW^žÔ±Žv†²Öœefddgej´ ebpf ÓAGKc P{Z[ai¹“cbchegŽÑžsxlmv§Òtqqssv¦Ä{p{r ÓAINr PœuOQWlÀ±…k^`\b²¼lgrefixıqjk~–µÉ¿{iul ÓAKO„ PœqIKRSt–¯¼ƒ[Waɤ_cn`aej®Çogs¼½¡ˆsgerh ÓBLO PœrLNUQRZr¸™^[dÊ¥afqdehl¯Éskwĸ|ojiul ÓBMP‰ PœrMOV`™¶ÂŽ`[b²½lgrefjyırln’²ÁŤrjwm ÓEMVx PœqJLSa¼©vf\]Y\ˆÎ–iqddm¢Ðnklos{º®nivk ÓHNdj PœqJLSSœª[UX^Z[b¥Ø‹t‚¯Ú¥mnmmppx–kkwy ÓJMre PœtOQXTtºsZs~__doŸÌ×ÍÔÍ¡vpryxtŒÄƒvn„¿ ÓLMxe PœsLOVRV¤¡—¼Åz]bbcy‘“ˆ|nlo{¸É³“ª·Ÿªt…Ê ÓJNvd PœrKMTPQ‚ȵŒ¾¤dabagrfgkllo‡Ì¾´ÄÖÒÉÍ£†Å Ó!KQq` PœsMOVRTc€kŠ½Š`cdcithimonqw¢Äš—ÎÂ“Ã¡Ä Ó.KVqX PœtNPWSU[ZˆÃ‘__dn{ruij|Žzruu¨Ïο…utªÍÖ Ó>N\yS PœrKMTPQWX„¿–c]e¦Ê§xfo¶Ñªrry§Îļ€rox¬ ÓEQ]Q PœrKMTPQWVW€¶p‹»¼´wen»³¿“„¹Ñ·«tnm|q ÓCQ]}R PœtORYTV\[Z\u®¹Æ®¥wip¸Ÿ¢ËÂÃÒ¾¢ŸÍ“qozp ÒAQapS PœrKMTPQWVVX^h˜ªt¹¹ž’”ãx±ŸžÃ£¸ÇÒ‘nlww ÒDQlcS PœqJLSOPVUUX]Z^igš´½º½Ç›mut¯ªrt‹pkj¾ Ò&LP{\T PœuSU[XY^]]_d`bfgjp{oqtrnqÓtsrusp…ËÉ Ò/QO„[T PœyZ[a]_dccdifhklkpzoorsrt–Ä€wvuwwy¼Ð Ò,RO[T PœqIKRNOUTTV\XY^^]coabfgfh˜Î®•}jjk{Õ«j é+PTvZT PœqIKRMOUTSU[WY]]ëcnaaefdgq† ¸Ä}ii‰Õ–h è5PapVT PœtOPWSTZXXZ`[]aaëfrdehihjlnwʉllŠÖšk è CQnrST PœqIJQLNSRRTZUW[[ëam^_bcbdˆ¶»À¸yfftαg ÑNRuvST PœqIIPKLRQQSYTVZZY_k]]ab`b‹ÉŒvmcdde¢ÑŠ ÑQRttST PœrJKQLMSRRTYUW[[Z`l]^ab`cp¼”ecbddam½Ñ ÑNTrkST PœtNNTOPUTTV\WX]\[am__bcbdg™·pnŒ€fbb€¦ Ñ"MWu]TT PœqIIOIJPNNPVRSWWV\iYZ]^\^`o¸œ±É¸j]\kc û3PZTTØ PœqIJPJJPNNPVQSWWV\hXY\][]_]ŸÅ ˆË‹][j` ÑBS[…PTT PœsNNTNNTRQSYUVZYY^j[[__]_b_lzk¬«o^^mb ÑFT]‚RSS PœqIJPJINLLNSOPTTSYfUVYZXZ\YYd£¼l\YX}y ÑAZs‰hdd PœqIIOIIMKJLRMNRRQWdSTWXVXZWWaœ¼ˆ^WoÀÎ Ð
@Uryouz PœqKKQKKOLKMSNOSSQXdTUXXVYZWWZZŒ»Ÿj¨»Ä Ð HUZVTSS PœrMMSMMQNMNSNOTSRXeUUXYVY[WW[ZZx¯½¸À Ñ9<58BNH PœqIIOIIMJIJNIJNNMSaOPSSQSVRRUTRTj—ƒ}ÌÛ ýˆ{!{ ù_ n³»¹º º ó,† _²«››››œ››÷œ››œ››œ¡››ûœ››œ››úœ››¡œ ó7Œ Z®’sswssvssåwssvusx‚ssuutuwtuxvuvwtt‚x ÖQ Y®’sswssvtstwssvusx‚ttwwuwyvvyxvxxvvƒz Ó7HAi“ Y®”vw{wvywvwzvvyyw|†yy||z|~{{~}{}}{{‡~ Ógw|— Y®’ssxssvtstwsswvuz…wwzzyz|yy}{z{{yy†} ðZ‚†ˆ˜ Y®’sswssvssüwsswwë}†ww{zy{|yy}{z{{yy†} ðW‚‰˜ Y®’ttxttwttåxtxy}¦Ãƽ¼¾“{||~}|}~|{ˆ ÓRƒ‘™ Y®”vvzvvyvvw|‰¬€¹Æ«¢©Óž„°¢„€‚€Š‚ ÓN~•š Y®’sswssvssu•¾Ô¼…³µŠ{„Ç›¡Øϱ…€€~}}‰ ÓL|}—š Y®’sswssvtxŬĩ¯»Œ|†ÉªÃª›ÂÀ™€~Š‚ ÓHzz—™ Y®“uuyuuyy¥Ê¢|{ ÉΊÐнˆ…Œ²Í¤„„…‚‚… ÚEwz—› Y®“tuyutyx ǘz{€Ã¨Ž…´¿—„…‚žÑ§„„‚ý… Ó@v™ž Y®’sswssƒ{®¼ƒz}‚„„‹€†‰‚ƒ…µŠ•Š…‚‚Ž… Ó8r†›£ Y®“ttxuv²Èª—dz€€…Ž‚‚…†„†ŒÀÆ¥¾Ö¬ˆ……ˆ Ó3p‰œ§ Y®”vvzw‚Å´½ÈÕºƒ‚‚ƒ”©ª ”‰‡ˆ‘ËÓ̽¿ÃŒ‡‡’Š Ó1oŒ¨ Y®’ssxt”Æ…–©Œ}€‡°ÖÞ×ÜÕ°Š‡‰¨º ‹™Îœ††ˆ Ó/pŽž¨ Y®’ttyy¯¹~z|€~~„µßé–¢ÄೊŠ‰‰‹ŠŽÆ·Šˆ’Š Ó.t’Ÿ¬ Y¯š€†ŒÉ¬ˆ†ˆ‹‰‹©Ü¶•˜–¼Üª•““••—»Ò›’š” Ó,w˜ ´ Y®•xy~ŽÏჅ‚‡ÅÌ‹“ŠŠŒ—ÒÓŽŽ°ÇÖÏ›– Ó({ž¡¿ Y®’stz{”ÁË ~†Õº…ˆ‘†‡ŠÂÕ’Œ•ÌÍ·¤•ŒŠ”Œ Ó$}¡¡Å Y®“uw|yz€’Ȳ„ˆ×»‡‹“‰ŠŒÂÖ•˜Òɪ›’ŽŽ– Ó$¡¢Â Y®“vw}…±¿ÇЩ…‚‡ÃÌ‹”Š‹™ÒÄ”‘¬ÅÐÓº”— Ó+ˆ¡¥¹ Y®’tu{†Ì¼–Š‚ƒ€ƒ¤Ú¯“‰‰¸Û¨‘’•›Ë‘Ž— Ó/’¡² Y®’tu{{³½}ƒ‚‡ºáÁ§• Â㻑‘“’™Ð°˜™ Ó1š¡µ° Y®”wy{”É”“œ……‰‘µØàØÞÙ¸—“”™™–¨Ò¢—‘¢Î Ó3¡¸° Y®“uw}y|¸¶¯ËÒ™„‡‡ˆ™¬¬¥œ‘’›ÉÖÆ®¿È¶¿–¢Ö Ó3¢·° Y®’tv|yyžÕƧ͹‰‡‡†‹•ŠŒ’¤ØÎÆÒàÝÖع¤Ó ÓEš£µ Y®“vw}z{†¥Ì¥…ˆ‰ˆŒ–Œ’‘“˜¸Ò²°ÚÑ¬Ò¸Ò Óc›¦µ© Y®”wx~{|€¤Ñ¬……‰‘š“—Žœ©š”–—½ÛÚϤ——¿Ùà Ó¡ªº¦ Y®’tv|yy~¡Î¯ˆƒ‰»Ö¼™‹‘ÇÜ¿””™¼ÚÒÌŸ•’™ÀÁ Ó¥«½¥ Y®’tv|xy~}~ÇÀ‘¦ËËŘŠ‘ÌÅ΢ÊܵŸÉ¿–’œ“ ÓŒ¥«¼¥ Y®”xz|}€€ƒ•ÀÉÔ´Á»˜’ɶ¹×ÐÑÝι·Ù®”’š“ Ò‡¥¶¦ Y®’uw|yz~}~„‹°¾•Éʵ¬Ò¹™Ä¶¶Ò¹ÉÔݬ’˜— ð0¤³¯§ Y®’tu{xy}}䃀ƒŒ‹±ÆÍÊÍÔ³—•Ã¿•—§ª”Ž©Í ÒS›¤»«§ Y®–{|~ƒ‚‚„ˆ†‡‹‹’›’“–”‘“žÑ––•–•“£ØÖ Òd¤£¿ª§ Y®˜†ƒ„ˆ‡ˆ‰‹ŒŽ’š‘’”•”–¯ÒŸ˜˜——˜šÌÛ¨ é]§£¾ª§ Y®’stzwx|{|}‚€„„òˆ‘‡ˆ‹‹ŠŒ±ÚÁ¯ŽŽû›Þ¿ Ò\¥¦¹©§ Y®’stzwx|{|}~€„„ƒˆ‘†‡ŠŠ‰‹“£·ÉÒœ¦ß®Œ á
m£µ¨§ Y®”wx~{{€€„‚ƒ†‡†‹“‰‰ŒŒò‘—«×¥Ž¥à±Ž Ñ#‰¤´¶¦§ Y®’ssyvv{zz|€}~‚‚†„…ˆˆ‡‰¤ÇÌÏÉ™Š‹•ÚË Ñ,Ÿ¥¸¸¦§ Y®’ssxuuzyy{|}€…ƒ„†‡†‡¦Õ¨—‘‰ˆ‰Š¸Û¦ Ñ%¤¦·¸¦§ Y®“ttyvv{zz{€}~‚†ƒ„‡‡†ˆ’Ë®Š‰ˆ‰‰‡ÍÛ Ñ+ž¦¶³¦§ Y®”vw{xx}||}~‚ƒ‚‡……‡ˆ‡ˆ‹±È’§žŠ‡‡ž» èE›¨¸¬§§ Y®’sswstxwwy}z{~~ë‚Œ€ƒ„‚„†‘É´ÃÖÈŽƒƒŽˆ ûl ª¾§§Ø Y®’ssxssxwwx}z{~~}‚‹€ƒƒ‚ƒ…ƒµÓ¶¥×§ƒ‚… ч§«Á¥§§ Y®”vvzvvzyyz||€„„„ƒ„†„šŽÀ¾‘„ƒ† û©«¿¦¦Ø Y®’sswsswuuv{wx||{€Š}}€‚€€‰¸ËŽ‚€œ˜ Ñ„«·Ã±¯¯ Y®’sswssvtsuyvwzzy~ˆ{|~}€~‡³Ë¤„~‘Ï٠Ђ§¶»µ¸» Y®’ttxttwutuzwx{{z‰||~§Ë¶¼ËÒ í=‘ªª§¦¦ Y®“vvzvvyvvåzwx{{z‰||}~~€—ÁÌÉ§Ï íswjm{ƒƒ Y®’sswssvssæwstwwv{…xx{{y{}zz}|{|Œ¯ ›×Û ý™‘Œ!Œ ú§ ËÒ"Ò óRâ gÉÍÂÂÃÂÂÃÂÂòÃÂÂÃÃÂÃÆÂÂÃÃÂà ÃýÆà ó]î bŽ©©«©©ª©©å«©©ªª©¬²©©ªª©ª«ªª««ª««ªª²¬ ó‹ñ aŽ©©«©©ª©©å«©©ªª©¬³©©««ª«¬««¬¬«¬¬ªª³ ðXm`®ú až««®««««å««¬«®µ¯¯®¯°®®°¯®¯°®®¶° ðš¾®Åÿ aŽ©©¬©©«©©ì«©©««ª®´¬¬®®®®¯¯®®ýµ¯ ðˆÁ·Ìÿ aŽ©©«©©ª©©ü«©©««ó¯µ¬¬®®®¯¯®®ýµ¯ ð‚¾¸Ôÿ aŽ©©¬©©«©©å«ª¬¬¯ÇÚÜ×Ö×½®²°¯¯°°¯¯°®®¶± ð{¼·àÿ až««««¬««å®¶Ëº±ÔÛÌÆÊãijÎƳ±²²±±²±°¸² Ów¹·ìÿ aŽ©©«©©ª©©ª½ÖåÖ´ÐѸ®´ÝÂÅçáе²±°±±°°·² Óq·´óÿ aŽ©©«©©ª©¬ÃÛ̺ÚËÎÕ¹¯µÞËÚËÁÙØÁ²±²²±±¸³ Úl´²ôÿ ažªª«ª¬ÈÞƯ¯ÅÞáÚ¼±·ââ×·´¹ÐàÇ´´³ýºµ Ód°¸öÿ aŽ©©¬ª©««ÄÜ¿®±ÌÚÊ»±µÑØÀ´µ´ÄãÉ´´µ³³ºµ Ób®Åøÿ aŽ©©«©©²±®ÍÕ³®°²´´¹±²¶¸³´µ»ÚÒ¸¿¸µ´³ºµ ãUªÒüþ aŽ©©¬ªªÏÝÊÀÜб²±±´º³´µµò¶¹ØÝÈØæÍ·µµ¼· ëK¥Øþþ aŽªª«²ÚÐÖÝåÔ³³ë¾ËËÆ¿·¶·¼ßäà×ØÚº··½¸ ÓJ£Ûÿþ aŽ©©«ª½Ü³°¾Ê¹°²¶Îæëæéæϸ·¸ËÕŹÁáö¶¼¸ àF¦ßÿþ aŽ©©¬ÍÔ¯®¯²°±´ÑëÛË¿ÇÛìÒ¸¸¹ø»ÜÓ¹·½¹ ßE®çÿþ aƱ±´¸Þ̵¶·¹·¸ËêÓ¿Á¼¼À×êÌ¿¿÷ÀÁÖäþÿ Ó@¶óþý aÅ¿¬¬°ºáÚź´µ³¶Ü໹¿¹¹»ÁãÛ¾¼¼ÄÐÝæáûÀ¼ Ó9½üþý aŽ©©®½ÍØßų±µåÕµ·½¶·¹»Ú徺ÀàáÓÈ¿º¹¿º Ó5¾þþý aŽª«®¬±¼ÝÏ´²·æÕ¶¸¾¸¸º¼Ú濼ÁäßÌý»»À¼ Ó9Åþþý aŽª«®´Î×ÜâÊ´³¶Û໹¾¸¹»ÁäÛ¿½¾ÍÜãåÖ¿¼Á¼ ÓBÓþþý aŽ©ª´ßÖ¾·³³²´Èèλ¾¸¹½Ôé̾½½¿ÀÄàÛ¾¼Á¼ ßHåþþý aŽ©ª®Ðײ°±´³³¶ÕíÚÊÀÆÚîÖ½¾¾¿øÃãн½Á ÓLîÿýý až«¬¯®½Þ½²½Ãµµ·¼ÒçìèëèÔÁ¾ÀÂÅÂÀËäÈÁ¾Çâ ÓKïÿýý aŽª«®¯ÓÒÎßãÁ´¶¶·ÂÍÎÉľ½¿ÄßæÜÎØßÔÙÁÈç ÓNîÿýý aŽª«®ÄåÜÉàÔ·¶¶·ºÀ¹º¼½½¿ÉèâÝäìëçèÕÉä Ólðÿýþ aŽ«¬¯®®µÃºÈàɶ·¸¸»Àº»½¾¾¿ÂÕäÒÑéäÎÎäÔã Ó›ôþýþ aŽ«¬¯®¯²²Èã̵µ¸½Ã¾Á»¼ÄÌÄÀÁÂØêéãÉÁÁÙèì ÓÈûþýÿ aŽª«®°±Æáη´¸Öæ×ú¾ÝêØÀÀÃ×éäáÇÀ¿ÂÙÙ ÓØÿþýÿ aŽª«®°°±ÃÝÙ¼Éààݹ¾àÜâÎÈàêÓÆßÙÁ¾¾Ä¿ ñÏÿþýÿ až¬°®¯²²ä³¾ØÞäÑÙÖÁ»¾ßÓÕçããêâÖÔèο¿Ã¿ ðÍÿþýÿ aŽª«®¬®°°ä±´¹Ï׿ÞßÒÍÎäÕÂÜÔÓäÖßåêξ½ÂÁ ÒKÚÿþþÿ aŽ©ª¬°¯°±³²´¹¹ÐÜáßàåѽÁÀÛÙÀÁËÍ¿½¼Ëá Òðÿýþÿ aÅ¿®±°±³²³´¶µ¶¸¸º½Â½¾À¿¾¾ÅãÎÀÀ¿ÀÀ¾Èçæ â”ûÿýþÿ aÅÀ±±´³´¶µ¶·¹¸¹»»º½Â½¾¿¿ùÀÏäÆÂÂÁÁûÂàéË é‡ûÿýþÿ aŽ©ª«¬¯®¯°³±²µµë¸½··¹º¹»ÐéÚÏļ»¼ÃëØ» ð‰úþýþÿ aŽ©ª«¬®®û°³±²´´û·½¶·¹¹òº¾ÈÓÞäĺ»ÉëϺ ï§úþýþÿ až«¬¯®°°û±´³³¶¶û¸¾·¸ºº»ô¼ÁÌæÉ»»ÉìÑ» è5Õüýýÿÿ aŽ©©¬««®®¯²°±³³ë¶¼µµ·¸·¸ÈÝßâÞ¹¹¿èÛ¹ ïBïÿýýÿÿ aŽ©©¬ªªû®±¯°²²òµ»´µ··¶·ÉæÊÀ½¸¸û¹ÔéÉ ï8ðÿýýÿÿ aŽ©©¬ª«û®±¯°²²ëµ»´µ·¶¶·½àθ¸·¸¸·¼àé ïEìÿýþÿÿ až«««¬®®û¯²°±³³ëµ»µµ··¶·¸Ðݽ¼Êĸ··ÄÕ áníþýþÿÿ aŽ©©«©©¬«¬°®®±°°³¹²²´´òµ¶¼ÞÑÛæݺ´´º¶ è¦õþýþÿÿ aŽ©©¬©©¬««¬¯®°°ë³¹²²´´³´µ´ÒäÓÈæÉ´³ºµ èËýþüþÿÿ aŽªª«ª¬¬°®¯±±û´º³³´´òµ¶µ»ÁºØ×¼µ´»¶ ÑÌÿþüþÿÿ aŽ©©«©©ª©ª«®¬¬¯®®±¸°°²²±²³²²·Ôߺ³²±ÃÀ ÐÂþýüýþþ aŽ©©«©©ª©©ª««®°·¯¯±±°±²±±µÐßÇ´°¼áè ý%ÇþþýØ aŽ©©¬ª©«ª©ª«¬®®°·¯¯±±°±²±±²²ÉßÒ¹Ößã ûYÚÿþÿÿØ aŽªªªª¬«ª««¬®®°·¯¯±±°±²±±²±±¿ÙàÝÉá í*ª®›ŸµºÁ aŽ©©«©©ª©©æ«©©¬¬«®µ¬¬®®®¯®®¯¯®®¸ÎÅÂæ› þ" ü-:Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿS üÿøûÿÿ8 ÷ÿïûÿÿýüß 6 ýèõÿÿýýûÿ 5 ýâúÿÿüþüÿ 5 ýÎöÿÿüøìÿ 4 ö žÇßðùúïÐ $ röm˜²¦¡ª¾ªÿ $ §ö—¨¯–v–zÿ $ |û}||~||ï~||~||~ƒ‚±§‘z{’{ % äIJLIINJIJNIIOIIO]|»¢‹x„Ž_?6 # äKLNJINJIJNIIOIIPa¦Õ³‘~ŽUB9 # äRSTPOSONOSNNSNNToÔúéÕȽ‚UE6 # äPQRNMQMKKOJKPKJQ‡çöõêÙ»sP6 # äOQRNMQLJJNIIOIIO ÷øîéסyA5 # RæTPOSOMMPJKPKJU¸öùíáÏUyB6 # WæYUTXSQQTNNSNMbÖ÷õïà¾{ yC6 # äTUVRQUPNNQKJOIIwéûñçÚM xD9 # äUVXSRVQPORLKPJIšðøòçÒ˜^xE9 # äZ[\XW[VTTWQQTOR¼ùøëâÊw _xF9 # äZ[\XWZVTTWQPTNiÙöøìÛ»] _vG; # äYZ[WVZUSSUPOSM„òùïêÛ¨P _tG< # ]æ^ZY]XVVYSRUU¦öúîãÕ¢P _rH= # `æa]\_ZYY[VTX`Ê÷õïâÅV _pI= # ^æ_[Z]XVVYSQUoáúóêÛ¶–X aoJ? # `æa]\_ZXXZUSWíöóêÕ§˜X bmK? # næokjmigfhdcg³ùøìåÏ’X dlK? # gçdbea_^`[ZlÍõùîÝÀ|X ekLA # cæd_^a\ZY\VTxèùòìݨnX fjLA # fægcad_^]_YZ•ñûñå×iX giMA # gæhdbd`^^`Z_½õ÷ðäÎvgX hgNA # fçb`c^\\^XiÚùôéÞ¿^eX ieNB # äsrqlid^\\_X„êöôëاReX jcOB # 俼»¹ªqcjab]£øùíçÕ‡RhX j`OB # 䛃†œ½sz¦adÀôùïàÉlNgX l_OB # ä‰hi„¹w¬Ä¹’uÞøôîßµ\MfX o^OB # äjj‰¹›¸v†¸µìúòæØSOhX s^PB # ä”klŽÍÄ‘a`r·óøñçцRPhX u^PB # ä{hiv œh^]hÈù÷êàÈqNMfX w]PB # äihidcg_]]‰áööíÛ·iNMfX y]QD # kælgfhcas¸öúîèÛŸiSQhX z\QD # 䈛Ÿ‹qe`^tÈõùïâÒ…bNMfX |[QC # þ×ÕÕèÃŽ`\jÕùôîáÂpaMLeX }ZRB # äš|Ž½ÑŒdæøóéÚ¾wgVUkX ~ZRA # äqpqmv¶Æt¢ñ÷ñêÔÄ¥p\[nX €YR@ # dç`^ƒÓƒ¹øøìâѦ•eLKeX YR> # cç_]qÊ¡×õ÷îܽi[_LJdX ƒYR: # fågcbuͱðûñêÝm]dQPgX …ZR; " `åa]\‰Õ¾ñùñäÔ±º€`KJeX ‡ZSC " ã`^`\nººÏ÷õîã̉¾~]IIdX ˆZSG " ã ~{’ÀÅ”àøõéÛ»„±c_KKeX ‰ZSF " ãÈÔÖÊ}ïöòëØ£šžWaNNgX ‰ZSE- " ãlx{m]]«ùùíäÔœ®|Q\IIdX ‰ZSG= " Zå\XVgÉôøïß˲»bQ\IJeX ˆZSH@ " â\]^ZYwåúòëÞ²slRU`NNgX ˆ[TH= ! â[WYZ|£îøòæÖ¦YKIP\IJeX ‡[THB2 ! âUWn¼ÓöøïæЕ]IIO[IIdX †[TMJ@ ! âVWj¸ÕøøêÝÃhPKKQ]KKfX …[TQN< ! áwXYdÀèöôìÚ®XRMMS^MMgX „[TIG= ᣑÂ÷úíåÙ‘MOIIO[IIdX …dSC;8 T úmrpo 8 øcˆzqp_ 6 ÷X…®ytso 6 öY•®ŽuutoU 5 öYŒŸ€uum_U 4 ö ouplqqhC $ {÷u™¨…gVbW % ºö¹¤©¯–|rt % ›ûœ››œ››ïœ››œ››œŸ±§‘z{’{ % sûussvssívsswssx‡»¢‹x„Ž_’ # uævtswtstvsswssxƒ®Ì¥‰z‰€U™… # zæ{xw{wvwzvwzwv{‰ØỞˆgU™| # xæzwvyuttwsswssx›åÔ¼¢‰v\à { # xæzwvyuttvsswssu¯ïÍ´„l[·˜{ # zæ{xx{wvvxttxttyÀçÇ–~c*·™{ # ~æ|{{zy{wwzvvØÛÁ©wX ·š| # |æ}zy}ywwyutwssŽçÔ¹¡‰nA ·š~ # }æ~{z}zxxzuuxsr©æÌ´›‚c¬·›€ # €æ‚~€}{{~yx{vtÄäÆ«”{V ¬·œ€ # æ‚~€}{{~zy{wƒØÙÂ¥wN ¬¶œ‚ # ç~}€}{{}xwzu™ìѸ¡‡vN ¬µž… # ƒæ„€‚}}{z|z±ëË°™‚„V ¬´ž† # …憃‚„}|ÏâÄ«“{“^ ¬³ž‡ # „æ…€ƒ~}{z}‰âÚ½¤Œ}ž` ²Ÿ‰ # †çƒ‚„€|{~¡æÏ· …ƒª` ®± ‰ # æ‘ŽŽŒ‹Š‹ˆ‡‡½éÈ®™€„¯` ¯± ‰ # ‹æŒ‰ˆŠ†…„…‰ÏÞÄ©{…±` ¯±¡‰ # ˆç…„†‚€‚}|åÖ¼£Št…±` °°¢‹ # ä‹Š‹ˆ‡‰…„ƒ„€€£éϵœ„sˆ±` ±°¢‹ # 䌋Œ‰‡‰†„ƒ…Ääȯ–~rŠ±` ±¯£‹ # ä‹ŠŠ‡†ˆ„ƒ‚„…ÝÝÀ¦zp‰±` ²®£‹ # ”擉…ƒ‚„€™çÒ»¢ˆvr‰±` ²£‹ # äÎÌËɾ“ˆŽ†‡°î̲œƒqxŒ±` ²¬¤‹ # 䳡£³Ì”™¼ž†…ÅãǬ”~qv‹±` ³«¤‹ # 䦡ɗÀÒÊ«ÞÙ¿§wsvŠ±` µ«¤‹ # 䪎Ž¥É²É–¢È½èѸ ‡uux‹±` ·«¥‹ # 䮎Ž¨ÙÒ«‡†’Àæ˲š€uyy‹±` ¸ª¥‹ # ä›–·³Œ„ƒ…ÍâÄ©’}vwvŠ±` ¹ª¥‹ # 䌉ˆ‹…„„ß×À¥‹{wvŠ±` ºª¦ # 䎋Š‹ˆ†’ÀïжŸ†y†zzŒ±` »ª¦Œ # 䥳µ§“‰…„’Ëèʯ—€x…wvŠ±` ¼ª¦‹ # þáßßèÑ©†ƒ‰Ùà©’zx…vu‰±` ¼ª¦‰ # 䳞›ªÍܧˆ—åÖ¼£Š†‹}|±` ½©¦‡ # ä“’“—ÇÔ”±è͵žƒœ¸’‚±` ¾©¦„ # ‰ç†„¡ÝœÂçƬ—‚—ˆutˆ±` ¿©§ # ˆç…„’Ö²×Û¨Ž{y€„utˆ±` Àª§v # Šå‹ˆ‡–Ø»ëÔº¢‰|†ƒ‡yxŠ±` Á©¦t " †å‡„‚¤ÝÃèÍ´š‚‘Æ„tsˆ±` ª¦, " ã…„…‚ÊÆÔãŬ”}ƒÍ›‚ssˆ±` ª¦†3 " 㶜š«ÏÒ¥âÛ¿¥zǃtt‰±` ©¦ƒ7 " ãÔÞàÖÀ›£ëѸ †v«´~…vwŠ±` 馂O " ㎗šƒ€¶íÊ°š‚…¿šyssˆ±` 馄i " å‚~‡ÍàÅ«’ªÊ…y‚ssˆ±` ª§†m " ‚䃀ä×½¥Œx†y{„vvŠ±` ª§…i% ! â~€š¯çηž…€{tsxssˆ±` ª§…rX ! âž}}ÉÖæɯ˜€„ssxssˆ±` Áª§ˆ}s ! âž}~ŒÂÖßĨ{rxtty‚tt‰±` Á«§‹€i ! á—‡ÇåÔ½£Šwsyvvz„vvŠ±` À«§…zj, Ḫ§¥Èïδ…rqwssxssˆ±` À¯¦}ea8 T úUSM?? 8 øGot[SP? 6 ÷Bnœ‡[UTP 6 öFœtVVUSU 5 öIwŠcVVPCU 4 ö lj^QTTL. $ Œ÷€™¨ƒbOXN % Òöеª¯—|rt % ÂûÃÂÂÃÂÂïÃÂÂÃÂÂÃ⳨‘z{’{ % ©ûª©©«©©í«©©«©©¬¯‘º¢‹x„Ž_èÁ # ªû«©©«©©í«©©«©©¬™“nvq}UÿÒ # ä®®¬¬®¬««««««®¦§Z! *;UþÈ # 䬫«ª©©«©©«©©¬£¡< .üþà # 䬫«ª©©«©©«©©§£— $ýþà # ®¬é®«ªª¬©©«©©£ž}
*ýÿà # °û±¯®¯í®«««« ¡P # ýÿà # ¯û°®¯¬¬íª©«©©˜ +) ýÿÅ # °®é¯¬¬ªª«©¦œ‰
þýÿÅ # ²±ê°¯¯°¬®«ž k
& þýÿÅ # ²æ³±°²°¯®¯¬®«›L
9 þýÿÈ # ²æ³±°²¯¯®¯¬¬¨œš( +H þýÿË # ´ç³²³±°°±®®§›Š
W\ þýÿÌ # µç´³´²±±²¯®¯¤¤f
ƒh þýÿÎ # µç³²´±±°±®®œ¨C &§l þýÿÎ # ¶´úµ²±±²¯¯ñž”%JÁl þýÿÎ # ½ç»º»¹¸¸¹·¶¯¢{
mËl þýÿÎ # 亹¹¸·¸¶µ´µ³²¨ž\
Ël þýÿÎ # 丷·µµ¶´³²³°® Ÿ6'¢Ël þýÿÎ # ¹ç·¶·µ´³´²®˜“
G°Ël þþÿÎ # øº¹¹·¶·µ´´î²« t
f·Ël þþÿÎ # 亹¹·¶·µ´³´± §S ‚·Ël þþÿÎ # ¿æ¾¼º·µ´´µ²ŸŸ4+š·Ël þþÿÎ # äâààÞ×½·ºµ¶®¡‘ M¦¸Ël þþÿÎ # äÒÇÇÑà¾ÁÖĶ«žs sª¸Ël þþÿÎ # äÊ»ºÇßÀØãÞ̧£Fª·Ël þþÿÎ # äÌ»¼ÉßÑÞÀÇݲ$8¡¬¸Ël ýþÿÎ # äϼ½Ëèä̶¶º¨ X¬¬¸Ël ýþÿÎ # äÄ»»ÀÓѹµ´¦£c x¬«·Ël ýþÿÎ # »æº¸¸¹¶µ´ªžC "™««·Ël ýþÿÎ # ¼æ»¹¸¹·¶º±˜"
>ª¸Ël ýþÿÌ # äÉÑÒʾ¸¶µ¶¨‚
a±¬«·Ël ýþÿË # þìëëèã˶´¨¨\
µ«ª·Ël ýþÿÈ # äÑÄÃËàéÊ·¡¥:2¦¸¯®ºËl ýþÿÅ # 俾¾¼ÀÝå½¥ _м²±»Ël ýþÿÁ # ¸ç¶µÆ꺢s ~Ì·ªª¶Ël ýþÿº # ·æ¸µµ½æÀ S Š±´ª©¶Ël ýþÿ¯ # 㹸¹·¶¾å¶ .2¤²µ¬·Ël ýþÿ° " ¶´èÈæ¨ `×´ª©¶Ël ýþÿ¿B " 㶵µ´»ÞÒ©j wàÁ²©©¶Ël ýþÿÉM " ãÓÃÁÌáã°§K
›Ù´³©©·Ël ýþÿÅT " ãåêëæÙÁ£œ,1¿Ð¯³««¸Ël ýþÿÃu " ã»À»´¬¡‹
aÓÁ¬²©©¶Ël ýþÿÇœ " ²å³±°© h žÝ´¬²©©·Ël ýþÿÉ£ " ³ä´²±¢¥: ž¹¬³ª«·Ël ýþÿÈ›< ! â²°±±Á¥— E¨©©¬²©©¶Ël ýþÿȨ… ! âÄ°°ºÙ²z
h²©©¬²©©¶Ël ýþþȸª ! âð°¸Ç¤\ |¬ª©¬²©ª·Ël ýþþȹ› ! á¿°±´¿:$•¬ªª³ªª·Ël ýþÿȵžB áÓËÉÄ°• AŸ«©©¬²©©¶Ël ýþþ½–“^ S ù*C+ 7 ÷dÓéÛºh 6 ö»þÿÿþëR 5 ý6àÿÿýe 5 ýdñÿÿý÷S $ ü”ýÿÿýË& $ <ý[Óÿÿüý $ ãýåûÿÿýø % ÿýêD % ÿýÒ % ÿüþŸ % ÿýô^ & ÿýÚ, & ÿüý· & ÿüø~ & ÿüïH & ÿýÔ+ ' ÿý° ' ÿüüš ' ÿüö‰ ' ÿüò~ ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' Ô&@JD PœrLLRLLPNLMQLLQPOVbQQTUSUWTTXWTVWVTr Ô3FEE Pœz\\a\\`]\\`\\__]cn^_bcacdaaecacdaapi Ô
PœsMNSNMROMNRMMQPNUaPPTTQTURRVUSTURRbW ÙR›qIIOIIMJIJNIILKIO[IJMNKMOLLPOLNOLL]Q ÙS…hilihkihilhhjjhmshhkkjkljjmljkljjsm üY™¡žžþŸž ž Ÿž ü B:7!7@ ÔCntp Y®“uuyuuxvuvyuvyyw|†yy||{|~||~}|}~}{’³ ÔXxvw Y®™…ƒ‚‚„„ƒ‚†„„††…†ˆ……ˆ‡…†‡……Œ Ô, Y®“vvzvvywvwzvvyxv|…xx{{y{}zz}|z||zz‡~ öZ®’sswssvssåwssutsx‚stwwuvxuvywvwxuu‚y Ù[°¡‹ŒŽŒ‹Œ‹ŒŽ‹‹Œ‹“‹‹ŒŽŒŒŽŒŽŒŒ“ übª³±!± ü H@=!=@ ñe¤¢¢ aŽªªªª¬ªªü¬ªª¬¬ë¯µ¯¯®¯°¯¯°°¯¯°¯®¼Ð ñ„³®¯ aÅÁ²²´²²³²²å´²²³³²µ»³³µµ´µ¶µµ¶¶µµ¶µµ¼¸ ñ(B1, aŽ««««¬««í««¬¬«¯µ¬¬®®®¯®¯®®ú¯µ° öbŽ©©«©©ª©©å«©©ª©©¬²©©««ª«¬ªª¬«ª«¬ªª²¬ édÆƸ¸º¸¸¹¹¸¹º¸¸¹¹¸º½¸¸¹¹ûº¹¹º¹¹ý½º ük½ÊÉ!É ü QIE!E@ ü?Úÿ"ÿ ü?Úÿ"ÿ ü?Úÿ"ÿ ü>Úÿ"ÿ ü=Ùÿ"ÿ û9Æðñ!ñ ûUv}!} û
"À ⢧¬¯ÑõøðáÏxMQLLS^LLgX nT; ! äegiwÛùóìß¾l\`\\al\\oX mYSC # äQRS|æöôè×£QNSNMT_MNhX FHLA # äJKM|îüõëÒ‡IINIIO[IIdX # iëjxáüøðÀƒhikihmrhi|ŸY ( žø”áüüæ œžžü œX ( 7ùZÖüö°F7 7ý= + újËüØ 9 úLt—•L 9 ú?.+FL 9 üUKD ; üNW3 ; ýNU = þU º â·»¿¿ÔæÈ®–suyuuzƒuuŠ±` Í´¦w ! 䈉ŠÞÞÀ§yy„…‘±` ³©¦† # yæz‘äÒ»¡ˆurvzvv{„vv‹±` ‰‘™„ # tævÜι¢‚srswssxssˆ±` #2B- # ŒìˆÇÒǶŠ‰‹ŒŽŒ‹Ž“‹Œ›³a ( ±ø›ÅØØÆ–±±ü²¬a ( =ùWºØÓšD= =ýD + ú\¯Ø»p 9 úFd‚3 9 ú6(%A3 9 üJC= ; üNP3 ; ýNU = þU º âÓÕ×Ϫz
e¨¬ªª³ªª·Ël üýÿ¶)4 ! 䶷¸¨ªR †²³²²´¹²²¼Ël ýþÿÍ # 䬚Ÿ20›«««®³««¸Ël ÏÞëÊ # 䩪ª•ƒ" S¦©«©©¬±©©¶Ël 8MfI # ¸ë¹–†fbQ6¸¸¹¸¸º½¸¸ÂÌm ( Éø£”ššŽƒÂÉÉýÁo ( EùP†š—rCE EýK + úFšˆW 9 ú3H]`3 9 ú- 03 9 ü530 ; ü:>" ; ý:* = þ* º ÿüò| ' ÿüò| ' ÿüò| ' ÿüò| ' ÿüò{ ' ñþôÿÿþóññûðßn ' }ùžòÿýÓ‰}}û|l3 ' ùHäÿæfû ' ú(ÝûŒ
/ û ؽ/ û $ ïÀd
##÷!
# æ
I
!&)+,++)&$ & ú
ù í € € € € , ( – K
% X P Background ÿ
QJ X P Qn ) 5 X P QÊ i! }8 ‘. ¥ ¹¤ ÍÒ â: õ¼ õÌ õÜ ùÍ üø ÿú ! = { ñ þÇÍ5Í úÕÎÍçæççþæç
çþæççþæçç üÕÍÜç6ç ýÎÜççþæç ç ýÇÍççþæççþæçç þÍç9ç ýÍæç8ç þÍç9ç þÍææþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ þÍååæåèæååææåæåææååæåææåææååææååüæåæååüæååææå ýÍäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå þÍääþãääþãääùãääãäãääþãääãäþãääþãää þÍã9ã þÍã9ã þÍââûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ þÍââáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þÍááþàááàýáàááüàáàááûàááàááüàáàááþàáá þÍà9à þÍà9à üÍààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùÍÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûÍÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þÍÝ-ÝþÜÝÝþÜÝÝ þÍÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þÍÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þÍÚ(ÚþÙÚÚ þÍÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üÍØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þÍØ9Ø þÍØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þÍ×9× þÍÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þÍÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øÍÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üÍÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýÍÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûÍÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þÍÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ÍÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ ;Í ;Í ÍÌüÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýÍÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þÍËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þÍÊ9Ê üÍÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þÍÉ9É þÍÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ þÍÈ ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç7ç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç ýÍçææûçææçææþçææþçææøçæççææçææçþæçç æ üÍåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå þÍååäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä þÍääþãääþãääã
äãäøãäããääãääþãääþãää þÍã9ã þÍã9ã üÍâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ ûÍáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÍá áþàááàáþàááúàáàáàááúàáààá þÍà9à þÍà9à ýÍàßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà ûÍßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þÍÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þÍÝ9Ý þÍÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þÍÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þÍÚ9Ú þÍÙ
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù öÍØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þÍØ9Ø ûÍØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þÍ×9× þÍÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷ÍÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ùÍÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þÍÔ9Ô þÍÔ+ÔþÓÔ Ô üÍÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ üÍÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þÍÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷ÍÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ùÍÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ ûÍÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ ;Í ;Í ÍÌÍÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ùÍËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË ûÍÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þÍÊ9Ê þÍÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þÍÉ9É óÍÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ þÍÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ þÍÇ ÇþÆÇÇ ûÍÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç%çþæçç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç þÍææüçæçææüçæçææûçææçææçæøçæçææççææþçææþç úÍåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå üÍääååøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå þÍä äþãä
äþãääþãääþãä äãäýãä þÍã9ã þÍã9ã ýÍãââùãââãâãââãâãøâããâãâãââþãââãâãâþã ûÍáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÍááþàááþàááþàá
áàüáààááþà þÍà9à þÍà9à òÍßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÍÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÍÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÍÝ9Ý ûÍÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÍÜ9Ü þÍÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÍÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÍÚ*ÚþÙÚ Ú ûÍÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÍØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÍØ9Ø ùÍ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÍ×9× þÍÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÍÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÍÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÍÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÍÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÍÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÍÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÍÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ ;Í ;Í þÍÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÍÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÍË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÍÊ9Ê þÍÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÍÉ9É þÍÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ûÍÈÈÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ þÍÆ9Æ ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ?Í ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/resources/change_log.xcf 0000664 0001750 0001750 00000202634 13157571677 024122 0 ustar atagar atagar 0000000 0000000 gimp xcf file ô P BœBœ T B gimp-image-grid (style solid)
(fgcolor (color-rgba 0.000000 0.000000 0.000000 1.000000))
(bgcolor (color-rgba 1.000000 1.000000 1.000000 1.000000))
(xspacing 10.000000)
(yspacing 10.000000)
(spacing-unit inches)
(xoffset 0.000000)
(yoffset 0.000000)
(offset-unit inches)
gamma 0.45454999804496765 ± ” Eþ > Change Log ÿ
g ' G gimp-text-layer +(text "Change Log")
(font "FreeSerif")
(font-size 50.000000)
(font-size-unit pixels)
(hinting yes)
(antialias yes)
(language "en-us")
(base-direction ltr)
(color (color-rgb 0.000000 0.000000 0.000000))
(justify left)
(box-mode fixed)
(box-width 277.000000)
(box-height 62.000000)
(box-unit pixels)
§ > Ç p | ˆ > ç < E ` € € € § þ # ô"k¦¼¿œxU1 ý—r û!rÉ× ü‚×ÿ ÿóÞ˜V9ˆÿ™ >‰ÕÿÿþØ üuîÿÿöð½ˆSEm–Áþÿÿú£ hÖóÿÿþØ ýÎÿÿüÂ* ý7Èÿÿþ ý
¾ÿÿþØ ý5æÿÿý• üaûÿÿþ· þlÿÿþØ ý.ôÿÿýøb þnÿÿþÂ þYÿÿþØ ýÝÿÿþQ ûžÿÿÌ þXÿÿþØ þ¹ÿÿþÈ û×ÿÖ þXÿÿþØ þMÿÿþF üjÿá þXÿÿþØ þÌÿÿþÃ ü
òë þXÿÿþØ þJÿÿþ@ ý“õ þXÿÿþØ þÿÿþð ý!~ þXÿÿþØ ÷Q‘ÒïÁ‘ úe âÿÿþÎ þXÿÿúØ jøÿÿýêC ù|êÿ 'ÿÿþ þXÿÿ÷Ø šÿÿïÂìÿÿýö ø¦ÿÿw Uÿÿþ‹ þXÿÿõ؆ÿ7 lüÿÿþ øÿÿü jÿÿþi þXÿÿüûüo þ•ÿÿþê þåÿÿü ÿÿþG þXÿÿý÷K þ,ÿÿþ þ ÿÿü$ ‘ÿÿþ; þXÿÿþØ ýüÿÿþ. øÒÿÿÍ ‰ÿÿþL þXÿÿþØ þåÿÿþJ ø!Žˆ uÿÿþ^ þXÿÿþØ þØÿÿþX þaÿÿþp þXÿÿþØ þØÿÿþX þDÿÿþ‘ þXÿÿþØ þØÿÿþX ý
ùÿÿþÏ þXÿÿþØ þØÿÿþX ú=¾ Áÿÿýý þXÿÿþØ þØÿÿþX ø ÿý yÿÿþP þXÿÿþØ þØÿÿþX ö Òÿÿ~ óÿÿþ½ þXÿÿþØ þØÿÿþX ùÎÿÿÄ þˆÿÿþ6 þXÿÿþØ þØÿÿþX þzÿÿþz ýìÿÿý½ ýI þXÿÿþØ þØÿÿþX þéÿÿþJ ýDüÿÿþ û‚ÿc þXÿÿþØ þØÿÿþX þÿÿþ€ þsÿÿý„ ûÿ‰ þbÿÿþâ þãÿÿþ` þÿÿþ× ýyýÿÿýÚG úmîÿ‘ þrÿÿþô þöÿÿþn þìÿÿþM ýNòÿÿü1 ù%{Úÿíc þŸÿÿþ) þ/ÿÿþ› þ¢ÿÿþü ü ŸüÿÿøüØ®‰˜´Öÿÿý üZôÿÿý¿' ý%Ãÿÿøó_ ìÿÿ ü&–ßÿÿüÒ~( ýq÷ÿÿúç1 1åÿÿùõF (Çÿÿ õ&e€•ª§ŽtZ& # û7ec ÿ € € € € ÷©ÉéóÏ«~
ðG›è
H‰ËðÁ‰ öQ“ÂïÞ®~M
öË‚C[ªÿÿàA ûM¡ïÿÿû !ÃÿÿýÙ* ñ³ÿÞ‘u¤úÿÿó¼aXXþ, ú}ÿÿù ü(íúÿÿø AïÿòÎõÿÿýÝ ú8ïÿÁ ý.îÿÿþ€ úíÿÿŽ ý£ÿÿögù´7 þÿÿþb ú ÛÿÿS þeÿÿþÀ˜˜þL úÅÿÿô þ$ÿÿýþu þ¬ÿÿþÍ ú˜ÿÿû ýÁÿÿþŒ
þªÿÿþ þ
ÿÿþg þDÿÿþò ú ýÿÿÂ þRÿÿþÆ
þ¨ÿÿþ= ÿþ4 þ ÿÿþ þ;ÿÿþŸ ùýÿÿø þ¨ÿÿþY ÿþ4 þÿÿþ/ þlÿÿþº þÏÿÿþ8 þ
üCÖÿÿþh ÿþ4 ÿþ4 þ€ÿÿþÖ þ¬ÿÿþ* ÷2 yÞëâÿÿþh ÿþ4 ÿþ4 þbÿÿýô ú–ÿÿ÷ ÷X8¦úÎa¨ÿÿþh ÿþ4 ÿþ4 þ-ÿÿþ\ ûÆÿÿÊ û}ÿ×B þ¨ÿÿþh ÿþ4 ÿþ4 þ¼ÿÿþÆ úýÿÿO ü¢‚ þ¨ÿÿþh ÿþ4 ÿþ4 ý$æÿÿþn û`ÿÿ› þµ þ¨ÿÿþh ÿþ4 ÿþ4 ý(Öÿÿöu 6âÿ´ þ– þ¨ÿÿþh ÿþ4 ÿþ4 ô{þÿÿúÆÛþèW þs þ¨ÿÿþh ÿþ4 ÿþ4 õ–ósdy„^/ þQ þ¨ÿÿþh ÿþ4 ÿþ4 û Ï! þ- þÂÿÿþh ÿþ4 ÿþ4 û¦þ1 þ ýîÿÿþr þÿÿþ4 þ ÿÿþ4 û‘ÿØ ûLÝúÿÿ÷” ÿÿþ9 þ ÿÿþA óøÿÿÃ|Y7( ø t•×ùw{ÿÿ÷øšö Aÿÿþ‚ þVÿÿþf þ:ÿ ÿùùíТf ÿûÑ. =ÿÿú„ Æÿÿýâ. ý,ØÿÿýÜ1 ýÈÿ
ÿý×8 ûÿ×~ õ¦ýÿÿûc Üþÿÿúèe âÿÿýæ1 üvõÿ ÿýê þ ûjJ ñiã2Aeˆœ¥®·ÁÍÙíÿÿþ£ * ûœü=
û#}úÜ ) ûÿ‡
üú ( û–ÿÿ%
ýuÆ ( ú2þÿø
ýÈ„ ( þ|ÿÿþG üsæ ( þpÿÿýìF û §ô3 ) ýüÿÿðþÂp/ '=qÇþåG + ýKòÿÿýþúÿÿüò|
- ü*²ûÿÿüû” 1 ôr¢¾ÙÖ¯ˆa: ‰ € € € á þ þ / ý[ùÿ ÿýý¡ 0 û&‹ùÿÿûú•. 4 þÿÿþ” 7 þ9ÿÿþ: 7 þ ÿÿþ 7 þ
ÿÿþ
7 þ ÿÿþ 7 þ ÿÿþ 7 þ ÿÿþ 7 þ ÿÿþ ö ZŽÁñݱ†* þ ÿÿþ ùcöÿîÙúÿÿüøu þ ÿÿþ õ
¡ÿ© Oçÿÿþ° þ ÿÿþ ûÑÿ‰ ý-ýÿÿþS þ ÿÿþ ûuÿÞ þ¥ÿÿýâ þ ÿÿþ ûðÿw þRÿÿþd þ ÿÿþ û”ÿÿ7 þÿÿþ¡ þ ÿÿþ ûûÿþxttþóÿÿþÝ þ ÿÿþ ÿþ þ ÿÿþ ÿþì(
(þ þ ÿÿþ ÿþ þ ÿÿþ ÿþ6 þ ÿÿþ ÿþ_ þ ÿÿþ ÿþ‡ þ ÿÿþ ÿþ¶ þ þ ÿÿþ üX‘ ÿÿýû
ü(å þ ÿÿþ ûÜ’ ÿÿþ‘ üÑ‚ þ ÿÿþ ú]ÿK ÏÿÿýþI û«î þÿÿþ
ùèù Iÿÿü÷u û¼ÿu þ#ÿÿþ û Óÿ¾ þÂÿÿôÈW)2‡ðÿ¡ þ=ÿÿþF
ù`èÿÿw ý2íÿÿþüÿÿý° þœÿÿüÄ, ù(Ræÿÿþ0 ý Èÿÿüú“ ûA£ýÿÿþüôôþýÿÿýè üŒæÿÿüþ«% þfÿÿþ£ ùJt[2
3 € € € ‡ ôBr¡ÐôСrB öQ“ÂïÞ®~M
÷%Èÿï¶}˜àÿÿýÂ" ñ³ÿÞ‘u¤úÿÿó¼aXXþ, úgôÿ¾ ù1åÿÿóf ú8ïÿÁ ý.îÿÿþ€ ú–ÿÿ± ý*ìÿÿþ ú ÛÿÿS þeÿÿþÀ˜˜þL ú=þÿû" ù3ùÿÿþ: ú˜ÿÿû ýÁÿÿþŒ úÔÿÿ¡ þ©ÿÿýÖ ú ýÿÿ þRÿÿþÆ þvÿÿþM þBÿÿþ€ þ;ÿÿþŸ ùýÿÿø þÜÿÿþ, ýÚÿÿþÖ þlÿÿþº þÏÿÿþ8 ýýÿÿþ þ‚ÿÿýû þ€ÿÿþÖ þ¬ÿÿþ* þ0ÿÿþû
þaÿÿþ/ þbÿÿýô ú–ÿÿ÷ þZÿÿþ þFÿÿþ\ þ-ÿÿþ\ ûÆÿÿÊ þ€ÿÿþ+ þ+ÿÿþs þ¼ÿÿþÆ úýÿÿO þjÿÿþE þÿÿþK ý$æÿÿþn û`ÿÿ› þ>ÿÿþ^ þ ÿÿþ! ý(Öÿÿöu 6âÿ´ þÿÿþŒ þ(ÿÿýô ô{þÿÿúÆÛþèW þèÿÿýâ þCÿÿþË õ–ósdy„^/ þ£ÿÿþ> þ_ÿÿþo û Ï! ýñÿÿþ˜ ú¯ÿÿÏ û¦þ1 ! þmÿÿýï ú üÿþ8 û‘ÿØ ! ýÌÿÿýÈ ûÿÿš óøÿÿÃ|Y7( ý Æÿÿþ útÿÿ– þ:ÿ ÿùùíТf ñƒýÿÿ¼e C˜ÿîR ýÈÿ
ÿý×8 ô=¼îÿÿüûÿߦ üvõÿ ÿýê ú!TrG ñiã2Aeˆœ¥®·ÁÍÙíÿÿþ£ * ûœü=
û#}úÜ ) ûÿ‡
üú ( û–ÿÿ%
ýuÆ ( ú2þÿø
ýÈ„ ( þ|ÿÿþG üsæ ( þpÿÿýìF û §ô3 ) ýüÿÿðþÂp/ '=qÇþåG + ýKòÿÿýþúÿÿüò|
- ü*²ûÿÿüû” 1 ôr¢¾ÙÖ¯ˆa: — Š E " X P Icon ÿ
7 = X P a EÎ EÚ Eæ Eò X P ½ , =þ > > >. >> >N >^ >n >~ B EN E^ En E~ EŽ Ež E® E¾ Ú ý»À ¿¼ ¹¼¿ üÀ¿¿ÀÀþÁ  ûÿ¿ÁÕØØþÛÞÞþÜ ûÿ¾Äéïïþòööýõë û¿Ãçïïýñõööýëî ûÀÃåïïýñõööüõâö úÿ¿Áãïïýðõööüîßû ú ¾Àáïïþõööäþþ ú!;¿ÀßïïþôööûõÜëÿ ÷($0@¾ÀÝïïþôööûòÙðÿ ÷:KG@B¿¿ÝïïþóööûðÚôÿ ÷3LXKCÀ¿ÜïïþóööûïÞ÷ÿ ÷2M]NC¾¿Üïïþóööúõíâùÿ ÷.JSKE½ÀÜïïþóööúõîçúÿ ÷-IOJE¼ÀÜïïþóööúõñíûþ ÷,HKGE»¾Ûïïþòööúõóñôó ÷)FGFDµ¾Ûîîþñööüõôò ÷%ECF ¶¾Úîîýñõööþõ ÷$ECG ¶¿Ûííþñõõ ÷ CD ¶ÀÛììþðôô ÷AE ·¿Üììþðôô ÷@E µÀÜëëþðôô ý@ ü¸ÁÝëëþðôô ýA ü¶ÀÞëëþðóó ÷A $¸Àßëëþïòò þ û ¶Áßêêýëïññ þ û ¸Âàêêþîññ þ û ºÂáêêþîññ þ ûºÂâééýêïðð þ û¸Âáèèýéîïï þ û»Ãâèèýéîïï þ û3»Ããççþéï ï þ û3ºÃãççþéï ï þ! û3»Ããææþéî î þ. û3»Äâææþèî î þ> û.¼Ããææþéî î þE û.¼Äãææýéîííþé þC û3½Äãææýéíììüêǘ ýA û3»Åâååýèíëëü§[S ýD û3¼ÅáääýèìëëûÉ^kŸ ö&LP 8½Æáääýéìëëúæ[œ² ö/QO L¼Æáããýèìëëùê¸R}¯² ö,RO \¼Æàããýéìëëúèåçèêë
ëùÙyc§²² ö+PTv u½ÆàââíèëêéÓŸ†¡°ÀÊÑÕÙÞäèééêøç™LŠ±²² õ5Pap ¾ÇßââãèëçŸ^MXWQLPUZ]afjqz…—ª¼Ë«[y°²² õ CQnr ˆ½ÇàââäèêTa„•–’Œ†‚€}xtoje`ZURWPm§²² õNRuvS™½ÆßááåçÔk\„’”–˜š›žŸ¡¡¢£¤¥¥ž”Š†£²²þ© õQRttSf½ÅÞááåå¨Nq…‡‰ŒŠ†‡‹Ž“šœž ¢¥§¨ª¬®°±±ý²¥ õNTrkSª½ÂÝàààÙyUy}‚pVS[biu{‡•™Ÿ¡£¥§©«¬®°± õ"MWu]Tª½ÂÜàààÌ]\suwyc[blyy}|uou|†™›ž ¢¤¥§ª¬ õ3PZTT½ÂÛààà¼R]kmoe.F]`]W;]€†‰„xrk`bgox|€„‡ õBS[…PT¾ÁÙààà³P]efhhFXdbYD-Qiy„…‡†‡‰†|wxxy õFT]‚RSÿ¾ÁØààï³P\ddeebYMFBHWhehhógfgs}‚ŠŽ‘“• õAZs‰hd ¿¿Ößßõ¹QYd_UMLIC??íADFKQTVY[`adhlz„‰ ô
@Uryouz»¾ÒÞÞàÈ_Sec\QKJNTY]aefgilnpqsvtonjeio ó HUZVTSSÁ½ÏÝÞÞûÖ}Lce
eófhiknprtvxrl ó9<58BNHº¼ËÜÝÝúÞ±QUcee÷fghjlnpsuÚ ý»À ¿¼ ¹¼¿ üÀ¿¿ÀÀþÁ  ûÿ¿ÁÕØØþÛÞÞþÜ ûÿ¾Äéïïþòööýõë û¿Ãçïïýñõööýëî ûÀÃåïïýñõööüõâö ú,ÿ¿Áãïïýðõööüîßû ú7 ¾Àáïïþõööäþþ úQ¿ÀßïïþôööûõÜëÿ ÷7HAi“¾ÀÝïïþôööûòÙðÿ ÷gw|—¿¿ÝïïþóööûðÚôÿ ÷Z‚†ˆ˜À¿ÜïïþóööûïÞ÷ÿ ÷W‚‰˜¾¿Üïïþóööúõíâùÿ ÷Rƒ‘™½ÀÜïïþóööúõîçúÿ ÷N~•š¼ÀÜïïþóööúõñíûþ ÷L|}—š»¾Ûïïþòööúõóñôó ÷Hzz—™µ¾Ûîîþñööüõôò ÷Ewz— ¶¾Úîîýñõööþõ ÷@v™ ¶¿Ûííþñõõ ÷8r† ¶ÀÛììþðôô ÷3p‰ ·¿Üììþðôô ÷1oŒ µÀÜëëþðôô ý/p ü¸ÁÝëëþðôô ý.t ü¶ÀÞëëþðóó ÷,w $¸Àßëëþïòò þ( û ¶Áßêêýëïññ þ$ û ¸Âàêêþîññ þ$ û ºÂáêêþîññ þ+ ûºÂâééýêïðð þ/ û¸Âáèèýéîïï þ1 û»Ãâèèýéîïï þ3 û3»Ããççþéï ï þ3 û3ºÃãççþéï ï þE û3»Ããææþéî î þc û3»Äâææþèî î þ û.¼Ããææþéî î þ û.¼Äãææýéîííþè þŒ û3½ÄãææýéíììüéÀˆ ý‡ û3»Åâååýèíëëüš?0 ý0 û3¼ÅáääýèìëëûÁBCm öS›¤ 8½Æáääýéìëëúå{6k~ öd¤£ L¼Æáããýèìëëùê3R{~ ö]§£ \¼Æàããýéìëëúèäæèêë
ëùÖc:72171Et~~ õ,Ÿ¥¸¸¦™½ÆßááåçÏR5V^`bdfgiklmnoqqrrld]Yq~~þv õ%¤¦·¸¦f½ÅÞááååš-EUWZ[[XY\_bgjkmoqstvyz|}}ý~s õ+ž¦¶³¦ª½ÂÝààà×b0LOQSSH76;@EMRZdgjlnpqsvwyz|} õE›¨¸¬§ª½ÂÜàààÇB5GIJL?9>ENTORQLIMRZgijmnprtvx õl ª¾§§½ÂÛààà´46ABD? +:<:7%?*6>=7* 3BLRTWXWXZXUROPQQ õ©«¿¦¦ÿ¾ÁØàààª26<<==;6.)(,6@?@ABAABJQTZ\]_ac õ„«·Ã±¯ ¿¿Ößßõ±34<83.-,(%%í')+-23589<=@BFOVY\ ô‚§¶»µ¸»»¾ÒÞÞàÃD/=<70-,.268:==>@ACEFHJIFEB@CH ó=‘ªª§¦¦Á½ÏÝÞÞûÔg);=
=ó>??ACDGIJKHD óswjm{ƒƒº¼ËÜÝÝúÞ¥20;==ø>?ABCEGHÚ ý»À ¿¼ ¹¼¿ üÀ¿¿ÀÀþÁ  ûÿ¿ÁÕØØþÛÞÞþÜ ûÿ¾Äéïïþòööýõë û¿Ãçïïýñõööýëî úÀÃåïïýñõööüõâö úRÿ¿Áãïïýðõööüîßû ú] ¾Àáïïþõööäþþ ú‹ñ¿ÀßïïþôööûõÜëÿ ÷Xm`®ú¾ÀÝïïþôööûòÙðÿ ÷š¾®Åÿ¿¿ÝïïþóööûðÚôÿ ÷ˆÁ·ÌÿÀ¿ÜïïþóööûïÞ÷ÿ ÷‚¾¸Ôÿ¾¿Üïïþóööúõíâùÿ ÷{¼·àÿ½ÀÜïïþóööúõîçúÿ ÷w¹·ìÿ¼ÀÜïïþóööúõñíûþ ÷q·´óÿ»¾Ûïïþòööúõóñôó ÷l´²ôÿµ¾Ûîîþñööüõôò ÷d°¸ö ¶¾Úîîýñõööþõ ÷b®Åø ¶¿Ûííþñõõ ÷UªÒ ¶ÀÛììþðôô ÷K¥Ø ·¿Üììþðôô ÷J£Û µÀÜëëþðôô ýF¦ ü¸ÁÝëëþðôô ýE® ü¶ÀÞëëþðóó ÷@¶ $¸Àßëëþïòò þ9 û ¶Áßêêýëïññ þ5 û ¸Âàêêþîññ þ9 û ºÂáêêþîññ þB ûºÂâééýêïðð þH û¸Âáèèýéîïï þL û»Ãâèèýéîïï þK û3»Ããççþéï ï þN û3ºÃãççþéï ï þl û3»Ããææþéî î þ› û3»Äâææþèî î þÈ û.¼Ããææþéî î þØ û.¼Äãææýéîííþè þÏ û3½Äãææýéíììüé»} ýÍ û3»Åâååýèíëëü’- ýKÚ û3¼Åáääýèìëëû¼1 6 öðÿ 8½Æáääýéìëëúäp5@ ö”ûÿ L¼Æáããýèìëëùê¦ (>@ ö‡ûÿ \¼Æàããýéìëëúèãåèêë
ëùÓV :@@ ö‰úþý u½ÆàââìèëêèʇdqŠŸ±½ÆÎÔÛâçèéé÷êæ~-?@@ õ§úþý ¾Çßââãèëæ†1#+27>DLVcz–®Á•)&?@@ õ5Õüýý ˆ½Çàââäèê˜$&-.,+(''&$"! # !;@@ õBïÿýýÿ™½ÆßááåçÌC$(*+-./023455689961-,8@@þ; õ8ðÿýýÿf½ÅÞááåå‘"#%&'&')+-/1235689:<=>??ý@: õEìÿýþÿª½ÂÝàààÕT ! "$(-/134568:;<=>? õníþýþÿª½ÂÜàààÄ0 " ""! "%).0134678:; õ¦õþýþÿ½ÂÛààà¯! "#%$! !%'(*, õËýþüþÿ¾ÁÙààü¢ ë !#$$%&&%$$% õÌÿþüþÿÿ¾ÁØààà£
!#&'()+, ôÂþýüýþ ¿¿Ößßà¬
#%' ý%Çþþýü»¾ÒÞÞñÀ2
ñ ûYÚÿþÿÿûÁ½ÏÝÞÞûÒZö ó*ª®›ŸµºÁº¼ËÜÝÝúÞž ù® ý"9; ;<= >=< ýJÄå åæ üýÿ#ÿ üžýÿ#ÿ üüÿ#ÿ ü‚ûÿ#ÿ ütúÿ#ÿ ügúÿ#ÿ ýXùÿ#ÿ ýKøÿ#ÿ ýDøÿ#ÿ ýAøÿ#ÿ ý?øÿ#ÿ ý>÷ÿ#ÿ ý=÷ÿ#ÿ ý<÷ÿ#ÿ ý;÷ÿ#ÿ ü<÷ÿ#ÿ üCøÿ#ÿ ûJøÿ#ÿ ûRùÿ#ÿ ûZùÿ#ÿ úaùÿ#ÿ úiúÿ#ÿ úpúÿ#ÿ ùxûÿ#ÿ ùûÿ#ÿ ù †ûÿ#ÿ ù
üÿ#ÿ ù
•üÿ#ÿ ù
›üÿ#ÿ ù
¢ýÿ#ÿ ù
§ýÿ#ÿ ù
ªýÿ#ÿ ù
ýÿ#ÿ ù °þÿ#ÿ ù ³þÿ#ÿ ù
¶þÿ#ÿ ù
ºþÿ#ÿ ù
¼þÿ#ÿ ú ¿þÿ#ÿ û
Áÿ$ÿ û Ãÿ$ÿ ü
Äÿ$ÿ üÅÿ$ÿ üÇÿ$ÿ ý
Ãÿ$ÿ üºþÿ#ÿ ü¯þÿ#ÿ ü£ýÿ#ÿ ü—üÿ#ÿ üŠüÿ#ÿ ü{ûÿ#ÿ üdúÿ#ÿ ýH÷ÿ#ÿ ý2íÿ#ÿ ý%Ûÿ#ÿÀ ü¼º ; øÁÀ¾À¿º 7 öÚÓÃÀÀ¹¾À¿ 5 õöüéÕÁ¿½ÀÀ¹ 4 ôþÿþúâËÀ¿™¿½ ù* # ù²±ˆOŒßêêûèɽi ûƒYR: # ú²˜W~Öêêûèɾo ú…ZR; " ù¢feÂãçêêûèɾw ùQ‡ZSC " ïqCVx‰‘›¥°¹Äλ°f öw QˆZSG " ã‚wrmga\ZXVVX[\\A>>?= Q‰ZSF " ±å°®«©¦¤¢ž˜„zpdXMFB>9?= SE- " û®¯°±²²ñº¾½¶¢yG?5B>9G= " ÷Š’’˜§±±²²ï¹ÈØÆ¿ÐÜÓ“L? G?5@ " þy{{æ~|Š¦®°±ºÐÙ§’ŠªÎÛÒ€C>“L? ! â—š›Ÿœœ¥§©°ËÑž•œÂÏ·Ú±O? €C>2 ! â‘“•˜šœžŸ¢µÓš™‡”£¨¢ÄÇ]@>±O?@ ! â{‡Š’”–˜šºÓž«“–¦•¤¥Ëd@ Ç]@< ! áe`gr~ŠŒŽ”¸ÐŸ˜‡Ÿ…’‡´›·V?@Ëd@ áwxogceu†ˆŒ²Ì¤œž¼§›–¿L>@ V?8 À ü¼º ; øÁÀ¾À¿º 7 öÚÓÃÀÀ¹¾À¿ 5 õöüéÕÁ¿½ÀÀ¹ 4 ôþÿþúâËÀ¿™¿½ ù$Fm…Ž * ÿîýîÔÀ½¶À¿™lho|†ŽŒm ) ÿïþ÷ÝÄ¿½À½¶„……’’„R ) ÿëüãÅ¿¼Ä¿½”—˜”‰wz…‰’ # ÿ÷ýáÿªÅ¿¼••–—û–Ÿ™… # ÿíüÞÁ¿áÿª²¯¬ª¨¥©·™| # ÿîúÛÀ½ Á¿¬¬®¯µÃ { #
ÿ÷÷Ô¿½ÛÀ½ §§û·˜{ #
ÿ÷þîǾªÔ¿½§§û·™{ # ÿþ÷üÛ¿¸îǾª§§û¬·š| # ëüù÷õòîìëêéêìîÞÀ»ªÛ¿¸§§û¬·š~ # ëïëèæäâáßÞÜÛÙ×Ó»¸ÞÀ»§§û¬·›€ # ûñïîíììòëêéçåâÙÁ» Ó»§§û¬·œ€ #
õôñæÁ» ÙÁ» §§¬¶œ‚ # õñçÀ· Á» §§¬µž… # ôñåÀ· À· §¬´ž† # ôûóãÀ³ ÷· §¬³ž‡ # ôûóâÀ³ ÷³ §²Ÿ‰ # ôûóàÀ® þ³ û®± ‰ # óüÞÀ û¯± ‰ # òûñÜ¿¨ û¯±¡‰ # ñüÛÀ§ ü°¢‹ # ñûðÙ¿ ü°¢‹ # ñûð׿¡ ü¯£‹ # ðûïÖÀ™ ý£‹ # ïûîÔ¿• ý£‹ # ïûíÓ¿‰ ý¤‹ # ïûíÒ¿‡ ý¤‹ # ïûíоv ý¤‹ # îûíϽj ý¥‹ # îûì;h ý¥‹ # îûì̽a ý¥‹ # úäãâçìííûë˼f ý¦ # ùfXXy±åììûêʼY ý¦Œ # ø=DB65ˆåëëûêʼY ý¦‹ # ø{||uO7¤ëëûéʽ] ý¦‰ # ~ûk1sãëëûéʽ] ü©¦‡ # ~ûxL>¦ëëûéʽc ü©¦„ # ~ú|T4‘çëëûéʽi û¿©§ # ù~}Z-zÝêêûèɽi ûÀª§v # ú~g2iÒêêûèɾo úÁ©¦t " ùp?Kºâçêêûèɾw ù¥Âª¦, " ïH"9cmv€Š–£¯½É¸¬Q öw ¥Âª¦†3 " ãVMHD?:765679>AB" ¥Â©¦ƒ7 " }å|zxvtrpnh_WOG>4,%! ¦‚O " ûz{|}~~ñ—œ–€T& ! „i " ÷_cefku}}~~¾°ª¹Ä¶r* & m " âRSTTVU_tz|}Œ°Á”y•¸Ä¶]" r* % ! âeghjljkrtuªº‹ŒƒŠ¬¸¢Ã’. ]" X ! â_`acfgiklnŒº™‰ˆw‚•®«< ’. s ! âPXZ]^`cdei–¼Œ˜}‚„“ƒ‘’°A «< i ! á@=BIQZ\]_d—¹‡vŒuv ‰œ5 °A , áJLFA?@KWX\‘¶‘ˆ‹§”ˆ„ª~* 5 a8 À ü¼º ; øÁÀ¾À¿º 7 öÚÓÃÀÀ¹¾À¿ 5 õöüéÕÁ¿½ÀÀ¹ 4 ëþÿþúâËÀ¿™¿½ 6cÇÖÄ * ÿîýîÔÀ½¶À¿™ œ§·ÉÔÒ¢ ) ÿöþ÷ÝÄ¿½À½¶ÄÄûÆÅÅ{ ) ÿëüãÅ¿¼Ä¿½äãâÞÙÄÉÑÕÜèÁ # ÿ÷ýáÿªÅ¿¼ÿÿüþÿÒ # ÿ÷üÞÁ¿áÿªýýþýýþÈ # ÿøúÛÀ½ Á¿þþûýüþà #
ÿ÷÷Ô¿½ÛÀ½ ÿÿþüýþà #
ÿ÷þîǾªÔ¿½ÿÿûþýÿà # ÿþ÷üÛ¿¸îǾªÿÿûþýÿà # ëüù÷õòîìëêéêìîÞÀ»ªÛ¿¸ÿÿûþýÿÅ # ëïëèæäâáßÞÜÛÙ×Ó»¸ÞÀ»ÿÿûþýÿÅ # ûñïîíììòëêéçåâÙÁ» Ó»ÿÿûþýÿÅ #
õôñæÁ» ÙÁ» ÿÿþýÿÈ # õñçÀ· Á» ÿÿþýÿË # ôñåÀ· À· ÿþýÿÌ # ôûóãÀ³ ÷· ÿþýÿÎ # ôûóâÀ³ ÷³ ÿþýÿÎ # ôûóàÀ® þ³ ûþýÿÎ # óüÞÀ ûþýÿÎ # òûñÜ¿¨ ûþýÿÎ # ñüÛÀ§ üýÿÎ # ñûðÙ¿ üþÿÎ # ñûð׿¡ üþÿÎ # ðûïÖÀ™ ýÿÎ # ïûîÔ¿• ýÿÎ # ïûíÓ¿‰ ýÿÎ # ïûíÒ¿‡ ýÿÎ # ïûíоv ýÿÎ # îûíϽj ýÿÎ # îûì;h ýÿÎ # îûì̽a ýÿÎ # úãâáæìííûë˼f ýÿÎ # ùWHIn«åììûêʼY ýÿÌ # ø !~åëëûêʼY ýÿË # >ú?;&"œëëûéʽ] ýÿÈ # @û6gâëëûéʽ] üþÿÅ # @û<%+Ÿëëûéʽc üþÿÁ # @ú?) ˆçëëûéʽi ûýþÿº # ù@?,oÜêêûèɽi ûýþÿ¯ # ú@3\Ïêêûèɾo úýþÿ° " ù8 ;µáçêêûèɾw ùÿýþÿ¿B " ï"'U`ku€›©¹Æµ©Q öw ÿýþÿÉM " ì*%#! "&+/1
ùÿýþÿÅT " ?æ><;:9874/*&"
ÿÃu " û=>??@@ñUgtq\3
Çœ " ÷.0335;??@@ïQvœ”Ž›¥‘R
£ " â&'(())/:=>?S‡¢{kc|š¥’<
R < ! û./0122é78:Fstlršˆ¤n <
… ! â)*+,./0234Zšrrcmx|w’Š"
n ª ! â!$&()*,-.0lŸvhlnzmyz& Š" › ! á !%'().o›vpbtakb†r|
& B á #$(j™yqsŒ|rnŽi^
“^ À ü6 ; úã¹v) 9 ÿûýÇs 8 ÿüúJ 7 ÿûýÙe 5 ÿûþí 4 ÿüö• 3 ÿüû˜ 2 ÿüö 1
ÿýíi 1 ÿüã^ / ÿüþÌ/ / ÿüþ .
ÿýÚ/ .
ÿýøW .
ÿýýb .
ÿüú^ -
ÿüøZ -
ÿûõV ,
ÿûóR ,
ÿûðN ,
ÿúíJ +
ÿúëF +
ÿúèB +
ÿùæ> *
ÿùã: *
ÿùá6 *
ÿøÞ1 )
ÿøÛ- )
ÿøÙ) )
ÿøÖ% )
ÿøÔ )
ÿøÑ )
ÿøÎ )
ÿøÉ )
ÿøÃ )
ÿø½ )
ÿø¸ )
ÿø¸ )
ÿù· *
ÿù· *
ÿú· +
ÿú· +
ÿú· +
ÿû¶ ,
ÿû¶ ,
ÿû¹ ,
ÿøç›zZ< ) ÿùýòåÁv ( ÿüýœ ' ÿüøq & ÿýÐ1 & ÿýñ\ & ÿýú & ÿüþŽ % ÿý÷t & ÿýîN & ÷&@JD¿½ÈÛÝÝÞðˆKLPQSTVY\_abddeeúfgikm ÷3FEE¹¾ÅÚÜÜèÝèÙ¢xng`ZTPNLJKOSX]`bcdeeþf ÷
¾ÀÎÑÑáÝÚÓÈþºµ¯¤—ˆzmbULJJLPTX\`bcdde ý¿½¾¾áÂÁÀ¿½º·´²°«¨¤•‹~obWMFDFJOUY\ üÿ¿ÁÃÃâÀ½¹·®¤š“‹ƒ~ytnlfb`\Q?0-38:=@C ý¿½¾¾üÂÁÀ û!* üÿ¿ÁÃÃûÀ½¹· W ÷Cntp¿½ÈÛÝÝîÞÜt+),./013689:<<==û>?@B ÷Xxvw¹¾ÅÚÜÜèÝè×–bVME>82/,)),/369:;<==þ> ÷, ¾ÀÎÑÑáÝÚÓÅÀ»¶±ªŒziZJ:.*)),/368;;<<= ý¿½¾¾áÂÁÀ¿½º·´²°«¨¤š‘„s_M?1'#%(,036 üÿ¿ÁÃÃâÀ½¹·®¤š“‹ƒ~ytnlfb`\L6# # ý¿½¾¾üÂÁÀ ü üÿ¿ÁÃÃûÀ½¹· W ÷e¤¢¢¿½ÈÛÝÝûÞÚi
ü ÷„³®¯¹¾ÅÚÜÜñÝèÕTF=4,& ÷(B1, ¾ÀÎÑÑìÝÚÓþ¸³¯§˜…p^N<)þ ý¿½¾¾çÂÁÀ¿½º·´²°«¨£˜Ž€lUA1! üÿ¿ÁÃÃèÀ½¹·®¤š“‹ƒ~ytnlfb`\J/ þ ý¿½¾¾üÂÁÀ ü üÿ¿ÁÃÃûÀ½¹· W ýÉÿ#ÿ ý ¶ÿ#ÿ ü–ýÿ"ÿ üTÖ÷ø ø ùúüüýþÿÿ ü,BDDâEFFGILOQTWY\^acfhjlnps‚¹Íàîü $ å #&(+-02479>Pbw & ê "#%&&(() ò
- ýþ ¿ âorsuvvx~€ƒªÉ¹˜ª¶’¢›¡rB>?L> ! ãhjkmprtvxz›ÃÄ™©Á±›Ž£”K? >rB> " eçghjlnor„µÂÀ°²œ‰ž”U?9B>K? # ý`cddéefghjn’º¿À¸¨£…P@>K? ?9 # åGKNRVZ]^_`bg…œ¡‘u[D>;U?9@> $ æ18;>?@BCEGHIKLKFA=< P@>>; & è
'/35599;<976 >;< 1 ý ü< 8 ü76 7 ý ¯ âEFGIJJLPQU‰³¤†—¡˜€‰‰O! ~* ! ã?@ACDFIJKMx¬®ˆ–«ˆ}u) O! " =>é@BCEF\›ªœžŠy‹u2 !) # þ9<<=ë>?@Dq£ªª¢“Šf- ) # å&)+.146889:?c†rT9# 2 $ æ !#$%''(*)%! - & ê 9 ü 8 ü ì â "b–ˆn}†kvrk1
^
4 ! ã O’q}ƒqhvU
1 " è1{‘Ž‚ƒsdqT
# þîK‡Ž‡xkH
# ï>]gQ3
$ ø
õ
) ø
ü ü
: þ : ý í ÿýÅ% & ÿüôl & ÿüý¬ ' ÿüü¦1 ( ÿûþ÷’ ) õÅÕàéòøüþÿÿúúæµj * ë*-/5CSals{„‘„iB * ñ + ü ÷ ï € € € € , ( – K
% X P Background ÿ
F¥ X P FÉ l x „ X P G% ^| r“ †‰ šy ®ÿ Ã- ו ë ë' ë7 ï( òS õU ø| ûs þ˜ Ö L \ þÇÍ5Í úÕÎÍçæççþæç
çþæççþæçç üÕÍÜç6ç ýÎÜççþæç ç ýÇÍççþæççþæçç þÍç9ç ýÍæç8ç þÍç9ç þÍææþçææþçææþçææñçæççæçæçææçææçææþçææþçææüçæçææ þÍååæåèæååææåæåææååæåææåææååææååüæåæååüæååææå ýÍäååûäååäååùäåäååäååäåøäåääåääååõäååääååäåå þÍääþãääþãääùãääãäãääþãääãäþãääþãää þÍã9ã þÍã9ã þÍââûãââãââúãâãâãââùãâãâãâããâãâüãâãââãâ þÍââáâáýâáââþáââþáââáâùáâáââáââáûâáââááþâááâ þÍááþàááàýáàááüàáàááûàááàááüàáàááþàáá þÍà9à þÍà9à üÍààßßàßüàßàßßàßûàßààßßàúßààßàßßàößààßßàßàà ùÍÞßßÞÞßßüÞßßÞÞßÞßõÞßßÞßßÞßÞßÞÞßþÞßßýÞßÞÞüßÞÞ ûÍÞÞÝÞÞÝÞþÝÞ
ÞþÝÞÞûÝÞÞÝÞÞþÝÞÞýÝÞ þÍÝ-ÝþÜÝÝþÜÝÝ þÍÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜþÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÜÜÛùÜÛÜÜÛÛÜÜÛÜöÛÜÛÜÜÛÛÜÜÛÛÜÛÜýÛÜÛÛÜÛýÜÛ þÍÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛûÚÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛ þÍÚ(ÚþÙÚÚ þÍÙÙûÚÙÙÚÙÙþÚÙÙÚÙþÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙ üÍØÙØØÙØÙúØÙÙØÙØØõÙØÙØØÙÙØØÙØØÙØÙøØÙÙØÙÙØÙÙûØÙÙØ þÍØ9Ø þÍØØù×Ø×Ø××ØØú×ØØ××ØØø×Ø×Ø×Ø×ØØþ×ØØû×Ø××ØØþ×ØØ þÍ×9× þÍÖÖþ×ÖÖþ×Ö Öþ×ÖÖþ×Ö Ö×Öú×Ö×Ö×ÖÖ þÍÕÕþÖÕÕøÖÕÖÖÕÕÖÕÕÖÕþÖÕÕÖÕôÖÕÖÖÕÖÖÕÖÖÕÖÖÕ øÍÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔýÕÔÕÕøÔÕÕÔÔÕÔÕÕþÔÕÕÔÕüÔÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓ üÍÒÓÒÒÓýÒÓÒÒþÓÒÒøÓÒÒÓÒÓÒÓÓÒûÓÒÓÒÓÓÒûÓÒÒÓÒÒ ýÍÑÒÒþÑÒÒÑøÒÑÒÑÒÑÒÑÑÒüÑÒÒÑÑÒÑûÒÑÒÒÑÑöÒÑÒÒÑÒÒÑÑÒÒýÑÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐÑýÐÑÐÐþÑÐ ÐÑýÐÑÐÐûÑÐÐÑÐÐúÑÐÐÑÑÐÐþÑÐÐ ûÍÐÏÏÐÐõÏÐÏÐÏÐÐÏÏÐÏÏôÐÏÏÐÏÐÏÐÐÏÐÏÏ÷ÐÏÏÐÏÐÏÐÏ
ÏÐ þÍÎÎÏþÎÏÏúÎÏÎÏÏÎÎüÏÎÎÏÏøÎÏÏÎÏÎÏÎÎÏþÎÏÏÎÏýÎÏ ÍÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎ ÎüÍÎÍÎÎ ;Í ;Í ÍÌüÍÌÍÌÌÍÌæÍÌÌÍÌÍÍÌÍÍÌÍÌÍÍÌÍÌÌÍÌÌÍÌÌÍÍÌùÍÌÍÍÌÌ ýÍÌËËýÌËÌÌöËÌÌËÌËÌÌËÌÌËÌËøÌËÌËÌËËÌÌþËÌÌýËÌËËÌË þÍËËþÊËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËË þÍÊ9Ê üÍÉÊÉÉöÊÉÉÊÉÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉÊÉüÊÉÉ þÍÉ9É þÍÈÈýÉÈÉÉÈýÉÈÉÉþÈÉÉüÈÉÈÉÉýÈÉÈÈùÉÈÈÉÉÈÉÉÈüÉÈÈÉÉüÈÉÉ þÍÈ ÈþÇÈÈþÇÈÈûÇÈÇÇÈÈÇÈþÇÈÈþÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆþÇÆÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç7ç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç ýÍçææûçææçææþçææþçææøçæççææçææçþæçç æ üÍåæååæüåææååþæååþæååæåæåæåûæååæååûæåæå þÍååäûåäåäååäåüäåäååþäååþäååäåïäåääååääåäååäååä þÍääþãääþãääã
äãäøãäããääãääþãääþãää þÍã9ã þÍã9ã üÍâãââãþâããâãâãâãâãñâãââãâãââããâããââãâùãââãââ ûÍáâáââáâöáâáâáâááâááâúáâáâáââáâûáâáâááâáþâáá þÍá áþàááàáþàááúàáàáàááúàáààá þÍà9à þÍà9à ýÍàßßöàßààßààßàßßþàßßþàßßüàßßààßüàßàßßàßàß÷àßßàßàßà ûÍßßÞßßÞßüÞßÞßßýÞßÞÞìßÞßßÞßÞßßÞÞßßÞßßÞßßÞÞßÞßûÞßßÞ þÍÞÞþÝÞÞûÝÞÞÝÞÞÝÞúÝÞÞÝÝÞÞÝÞþÝÞÞ þÍÝ9Ý þÍÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜûÝÜÝÜÝÝýÜÝÜÜþÝÜÜþÝÜÜ þÍÜ9Ü þÍÛÛÜÛÜÛüÜÛÛÜÜÛÜüÛÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜÛ þÍÛÛþÚÛÛüÚÛÚÛÛþÚÛÛûÚÛÛÚÛÛüÚÛÚÛÛþÚÛÛõÚÛÛÚÛÛÚÛÚÚ þÍÚ9Ú þÍÙ
ÙûÚÙÙÚÙÙÚÙúÚÙÚÙÚÙÙþÚÙÙþÚÙ Ù öÍØÙÙØÙÙØÙØØýÙØÙÙØûÙØØÙØØÙýØÙØØðÙØÙÙØÙÙØØÙÙØØÙÙØØ þÍØ9Ø ûÍØØ×ØØ×Ø×ýØ×Ø Ø×Øø×ØØ×ØØ×ØØþ×Ø Øþ× þÍ×9× þÍÖÖ×Öö×ÖÖ×Ö××ÖÖ××úÖ×ÖÖ×ÖÖþ×ÖÖþ×ÖÖ ÷ÍÕÖÕÕÖÕÕÖÖÕÖÕÖÕÖÕþÖÕÕþÖÕÕñÖÕÕÖÕÕÖÕÕÖÖÕÖÖ ùÍÕÕÔÕÔÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕÔÕÔÕúÔÕÕÔÕ þÍÔ9Ô þÍÔ+ÔþÓÔ Ô üÍÔÔÓÓüÔÓÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓ üÍÒÒÓÓÒýÓÒÓÓÒÓÒÓÒÓÒúÓÒÒÓÓÒÒÓÒüÓÒÒÓÓÒüÓÒÓ þÍÒÒÑøÒÑÑÒÑÒÑÒÒÑÒÑÒüÑÒÑÒÒÑÒÑÒÑÒûÑÒÑÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐÐþÑÐÐþÑÐÐÑÐÑÐõÑÐÐÑÐÐÑÑÐÑÐÐÑ ÷ÍÏÏÐÐÏÐÏÐÐûÏÐÏÐÏÏñÐÏÐÐÏÐÏÏÐÐÏÐÏÐÏÏÐÏüÐÏÏÐÐþÏÐÐÏþÐ ùÍÎÎÏÎÏÎÎøÏÎÏÎÏÎÎÏÏÎõÏÎÏÎÏÏÎÏÎÎÏÏùÎÏÏÎÏÏÎÎþÏÎÎùÏÎÎÏÎÏ ûÍÎÍÍÎÎþÍÎÎÍÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎþÍÎÎ ;Í ;Í ÍÌÍÌüÍÌÍÌÌúÍÌÍÌÌÍÍÌüÍÌÌÍÍúÌÍÌÍÍÌÌýÍÌÍÍÌÍûÌÍÌÍ ùÍËËÌËËÌÌúËÌÌËËÌÌËÌþËÌÌþËÌÌËüÌËËÌÌËÌþËÌÌË ûÍÊËÊËËûÊËËÊËËþÊËËþÊËËþÊËËüÊËËÊÊËÊËþÊ þÍÊ9Ê þÍÉÉÊÉþÊÉÉþÊÉÉ÷ÊÉÊÉÉÊÉÊÉÉùÊÉÊÉÉÊÉÉÊ ÉþÊÉÉ þÍÉ9É óÍÉÈÉÈÉÉÈÉÉÈÈÉÉÈÉøÈÉÉÈÉÉÈÉÉÈÉÈÉÈÉÈþÉÈÈÉ þÍÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈüÇÈÇÈÈþÇÈ
ÈþÇÈÈ þÍÇ ÇþÆÇÇ ûÍÆÇÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇùÆÇÆÆÇÆ þÍÆ9Æ þÇÍ5Í úÕÎÍçæç3ç üÕÍÜç6ç ýÎÜç%çþæçç ýÇÍç8ç þÍç9ç ýÍæç8ç þÍç9ç þÍææüçæçææüçæçææûçææçææçæøçæçææççææþçææþç úÍåæåæååæåõæåææåæååæåææåûæååæååæåüæååææåûæåæå üÍääååøäåäåääåääåûäååäååþäååäåøäååäåäåääåþäåå þÍä äþãä
äþãääþãääþãä äãäýãä þÍã9ã þÍã9ã ýÍãââùãââãâãââãâãøâããâãâãââþãââãâãâþã ûÍáââááøâáâááâáââþáââáüâáâááâúáâááâááâ÷áââááâáâ þÍááþàááþàááþàá
áàüáààááþà þÍà9à þÍà9à òÍßààßßàßßàßßàßßþàßßýàßààûßàßàßßþàßßàßàþßààß ýÍÞßßôÞßÞßÞßÞßÞßÞßßÞßýÞßÞÞóßÞÞßÞßÞÞßßÞÞßßúÞßÞßÞßß þÍÞÞÝÞþÝÞÞþÝÞ
ÞÝÞþÝÞÞûÝÞÞÝÞÞüÝÞÞÝÝÞ þÍÝ9Ý ûÍÜÜÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜüÝÜÝ þÍÜ9Ü þÍÜÜÛÜþÛÜÜîÛÜÜÛÜÜÛÜÛÜÛÛÜÛÜÛÛÜÜÛÜûÛÜÛÛÜÜþÛÜÜÛþÜ üÍÛÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚýÛÚÛÛ þÍÚ*ÚþÙÚ Ú ûÍÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙ ýÍØÙÙüØÙÙØØÙøØÙØÙÙØÙØØÙûØÙØÙØØÙúØÙØØÙØØþÙØØýÙØ þÍØ9Ø ùÍ×ØØ××ØØ×ýØ×ØØø×Ø×ØØ××ØØ×üØ××ØØ þÍ×9× þÍÖÖþ×ÖÖþ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖú×ÖÖ×Ö××
Öü×Ö× ûÍÕÖÕÖÖøÕÖÖÕÖÕÖÕÕþÖÕÕþÖÕÕÖÕþÖÕÕÖÕÖÕÖþÕÖÖÕ øÍÕÕÔÕÔÔÕÕüÔÕÔÕÕÔÕþÔÕÕÔþÕÔÔùÕÔÕÔÕÕÔÔÕÔýÕÔ þÍÔ9Ô þÍÔ9Ô þÍÓÓþÔÓÓÔýÓÔÓ ÓþÔÓÓÔÓþÔÓÓüÔÓÔÓÓ ûÍÓÒÒÓÓÒþÓÒÒôÓÒÓÒÓÓÒÒÓÒÓÒÒüÓÒÓÒÒüÓÒÓÒÒöÓÒÒÓÒÒÓÒÒÓÓþÒ þÍÒÒþÑÒÒþÑÒÒÑÒÑÒêÑÒÒÑÑÒÒÑÒÒÑÑÒÒÑÒÑÒÑÒÑÒÒúÑÒÑÒÒ þÍÑ9Ñ þÍÑ9Ñ þÍÐ ÐþÑÐÐÑþÐÑÑ ÐþÑÐÐüÑÐÑÐÐ úÍÏÏÐÏÐÐÏûÐÏÐÐÏÏúÐÏÏÐÐÏÏùÐÏÐÏÐÐÏÏóÐÏÏÐÏÐÐÏÐÏÏÐÏÏÐþÏ üÍÏÏÎÎÏþÎÏÏøÎÏÎÎÏÎÎÏÏþÎÏÏþÎÏÏúÎÏÏÎÏÎÎõÏÎÎÏÎÎÏÎÎÏÎÎ ûÍÎÎÍÎÎþÍÎÎèÍÎÎÍÍÎÍÎÍÎÎÍÎÎÍÍÎÎÍÎÎÍÍÎÎýÍÎ ;Í ;Í þÍÌÌÍÌþÍÌÌþÍÌÌýÍÌÍÍüÌÍÌÍÍÌÍýÌÍÌÌþÍÌÌúÍÌÍÌÌÍÍ þÍÌÌüËÌËÌÌþËÌÌËóÌËËÌÌËÌÌËÌËËÌÌûËÌÌËÌÌðËÌÌËÌÌËËÌÌËÌËËÌ þÍË ËþÊËËþÊËËþÊË ËþÊËËüÊËËÊÊýËÊ þÍÊ9Ê þÍÊÊÉüÊÉÊÉÉÊÉþÊÉÉùÊÉÊÉÊÉÊÊÉþÊÉÉüÊÉÉ þÍÉ9É þÍÈÈÉÈÉÈÉùÈÉÈÉÈÈÉÉ÷ÈÉÈÉÈÈÉÉÈÈÉÈùÉÈÉÉÈÉÈÈþÉ ûÍÈÈÇÈÈþÇÈÈþÇÈÈþÇÈÈÇûÈÇÈÇÈÈþÇÈÈ þÍÇ9Ç þÍÆÆüÇÆÇÆÆþÇÆÆÇÆþÇÆÆþÇÆÆÇ Æ þÍÆ9Æ ýGùÿ4ÿ þÿ7ÿ þÿ8ÿ :ÿ þGÿ9ÿ þùÿ9ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ?Í ³çþæççþæç ïçþæççæþçææþçææ÷çææççæççææþçææþçææüçæçææþçææþçææýåæååûæåææååæøåæåæååæååþæååþæååæøåæåææåæååæúåæåææååüæåæååôäåääååääåäåääåüäååääøåäåääåäååþäååþäååþäååþäååøäåääåäãääþãääþãääãäþãääþãääþãääãä €ãüâããâ âãâóãâããâãââããâãââüãâãââãâãâãâùãâãááâááâþáââýáâááýâáââþáââõáâááâáâááâááâøáâáâáâáââûáàáàááþàááþàááüàáàááþàá
áûàááàá áþàááþàáá €àßþàßßàßàßþàßßàßþàßßàüßààßßþàßßàùßàßßààßßþàßßàþÞßßÞßÞûßÞßÞßßÞßþÞßßþÞßßøÞßßÞßÞßÞÞþßÞÞþßÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝÝÞ÷ÝÞÞÝÞÝÞÝÞÞþÝÞÞþÝÞÞÝýÞÝÞÞýÝÞÝ7ÝþÜÝÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜûÝÜÝÝÜÜûÝÜÝÝÜÜÝÜÝBÜøÛÜÛÛÜÛÜÛÛúÜÛÜÜÛÜÜÛýÜÛÜÜÛÜþÛÜÜöÛÜÜÛÜÜÛÜÛÜÜÛÜýÛÜÛÛüÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛñÚÛÛÚÛÚÛÚÛÚÛÚÛÚÛÛüÚÛÚÛ ÛÚûÛÚÛÛÚ>ÚüÙÚÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙîØÙØØÙÙØÙØØÙØØÙØÙÙØØþÙØØñÙØÙØÙØÙØØÙÙØÙÙØØîÙØÙÙØÙØÙØÙÙØØÙØØÙØBØþ×ØØò×Ø××ØØ×ØØ×Ø×Ø××Øü×Ø×ØØþ×ØØ?×ýÖ×ÖÖü×Ö×ÖÖþ×ÖÖ×ýÖ×ÖÖþ×Ö
Ö×Öþ×ÖÖÕþÖÕÕüÖÕÖÕÕþÖÕÕÖöÕÖÕÖÕÕÖÕÖÕÕûÖÕÖÖÕÕìÖÕÖÖÕÖÖÕÖÕÕÖÖÕÖÕÖÕÔÕÕþÔÕÕÔÕþÔÕÕÔÕÔøÕÔÕÕÔÕÔÕÕùÔÕÔÕÕÔÕÕÔÕúÔÕÕÔÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓúÔÓÔÓÔÓÓðÔÓÔÔÓÔÓÓÔÓÓÔÓÓÔÓ
ÓÔÓþÔÓÓþÒÓÓñÒÓÒÓÓÒÓÓÒÓÒÒÓÓÒÒÓÒûÓÒÓÓÒÒÓûÒÓÒÓÒÒÓýÒÓÒÒÓúÒÓÑÒÑÒÒþÑÒÒþÑÒÒþÑÒÒþÑÒÒõÑÒÑÒÑÒÒÑÒÑÒÒÑÒûÑÒÑÑÒÒýÑÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐùÑÐÐÑÐÐÑÑÐþÑÐÐøÏÐÐÏÐÏÐÏÏôÐÏÐÏÏÐÏÐÐÏÐÏÏÐÏþÐÏÏüÐÏÐÏÏþÐÏÏþÐÏÏûÐÏÐÐÏÏ÷ÐÏÏÐÎÏÎÏÎÎÏÎÏüÎÏÎÏÏþÎÏÏþÎÏÏÎÏýÎÏÎÎÏÎÏÎÏÎùÏÎÏÎÎÍÎÎþÍÎ ÎþÍÎÎÍÎÍÎþÍÎÎûÍÎÎÍÎÎþÍÎÎýÍÎÍ~ÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍýÌÍÌÌþÍÌÌÍÌþÍÌÌüËÌÌËËÌþËÌÌËúÌËÌËÌËËýÌËÌÌþËÌÌËÌþËÌÌüËÌËÌÌôËÌÌËÌËËÌÌËËÌÌýËÊËËþÊË ËþÊËËÊüËÊËÊÊËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉÊÉþÊÉÉüÊÉÊÉÉþÊÉÉüÊÉÊÉÉþÊÉEÉÈÉÈÉÈÉþÈÉÉÈÉÈýÉÈÉÉüÈÉÈÉÉøÈÉÉÈÉÈÈÉÉüÈÉÈÉÉýÈÉÈÈþÇÈ
ÈþÇÈÈþÇÈÈûÇÈÈÇÈÈüÇÈÇÈ ÈþÇÈÈüÇÈÈÇ
ÇþÆÇ1ÇûÆÇÆÇÆÆÇÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆþÇÆÆûÇÆÆÇÆÆþÇÆDÆ ?ÍÀçæçæþçææüçæçææçýæçææûçææçææþçææçæþçææüçåæååùæåæåææååüæååææå÷æåæåæååæååþæååþæååþæååþæååüæåæååþäååþäååäåäþåääåûäååäååþäååüäåäååäåòäååäåäååäååäãääþãääãäúãäãäãääþãääøãäãääããää ‡ãâøãâãâããâããüâããââóãâãââãâããâãâããâãâãâãâúãââáâáá
âáûâáâáââþáââúáâáâáââáúâááâáââáùâááââáââáüàáàááþàááþàááàýáàááàáúàááààááùàáàáààáá ‚àßþàßßýàßààßþàßß÷àßßàßßààßßàýßàßßüàßàßßùàßàßàßÞÞûßÞßßÞÞúßÞÞßßÞÞßõÞßßÞßÞßÞßßÞÞßþÞßßÞßüÞßÞßß ÞüÝÞÝÞÞÝüÞÝÝÞÞþÝÞÞúÝÞÞÝÝÞÞüÝÞÝÞÞÝÞþÝÞÞ?ÝÜþÝÜÜÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜþÝÜÜúÝÜÜÝÝÜÜûÝÜÜÝÜ@ÜÛÜøÛÜÛÛÜÜÛÜÜÛÜûÛÜÜÛÜÜùÛÜÛÜÛÛÜÜöÛÜÛÜÛÜÛÜÛÜÜÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛýÚÛÚ>ÚÙÚÙþÚÙÙþÚÙÙþÚÙ
ÙþÚÙÙþÚÙÙþÚÙÙØÙØÙØþÙØØÙüØÙØÙÙØîÙØÙØÙØÙØØÙØØÙÙØÙØÙÙØÙNØþ×ØØø×ØØ×Ø××ØØþ×Ø
Øþ×Ø Ø?×üÖ×Ö××ýÖ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖ××Öú×ÖÖ××ÖÖþ×ÖÖ×ûÖÕÕÖÕÕÖÕÖÕþÖÕÕÖÕÖÕÖÕýÖÕÖÖÕþÖÕÕüÔÕÕÔÔýÕÔÕÕýÔÕÔÔÕþÔÕÕÔÕÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕýÔÕÔ~ÔÓþÔÓÓþÔÓÓüÔÓÔÓ
ÓÔÓúÔÓÔÓÔÓÓþÔÓÓóÒÓÓÒÒÓÓÒÒÓÒÓÒÒúÓÒÓÒÒÓÓÒÓÒúÓÒÓÒÓÒÒÓÒôÓÒÓÓÒÒÓÓÑÒÑÒÒÑÒÑÒýÑÒÑÑòÒÑÒÑÑÒÑÑÒÑÒÑÑÒÒÑÒùÑÒÑÒÑÒÑÑþÒÑÑüÒÑÒÑ~ÑýÐÑÐÐÑÐüÑÐÑÐÐþÑÐÐÑÐþÑÐÐÑýÐÏÐÐüÏÐÐÏÏõÐÏÐÏÐÏÏÐÏÐÏÏÐûÏÐÏÏÐÐÏÐÏùÐÏÏÐÏÐÏÏÐÏÐÏûÎÏÏÎÏÏþÎÏÏþÎÏÏÎ÷ÏÎÎÏÏÎÎÏÎÎ ÏÎÏÎÏ ÎÍÎÍÎþÍÎÎþÍÎÎþÍÎÎ €ÍÌþÍÌÌþÍÌÌÍÌÍÌÍÌÍùÌÍÍÌÌÍÌÌóÍÌÍÌÌÍÌÍÌÍÌÍÌÌúÍÌÌÍÍÌÌþËÌÌËÌËÌËÌüËÌËÌ ÌËÌËýÌËÌÌýËÌËËÌËÌÊ ËþÊËËÊËüÊËÊËËþÊËËþÊËËÊ
Ë?ÊÉþÊÉÉúÊÉÊÉÊÉÉÊÉøÊÉÉÊÉÉÊÉÉþÊÉÉÊÉþÊÉDÉþÈÉÉþÈÉÉþÈÉÉøÈÉÈÈÉÈÉÈÈòÉÈÈÉÈÉÉÈÉÈÈÉÈÉÉÈùÉÈÉÈÈÉÈÈýÉÈÉÉþÈÉÉÈûÇÈÈÇÈ
ÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈþÇÈÈùÇÈÈÇÈÈÇAÇÆþÇÆÆþÇÆÆùÇÆÆÇÆÇÆÆþÇÆÆüÇÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆ@Æ ?ÍçþæççþæçUçþæçCç æûçææçææþçææþçææùçæççæçææüçæçææþçææçæçøæåææåææååüæååææåôæåæååæååæåæååþæå
åæåþæååõæåæäååääåäååäûåääåääüåäåääåäåäþåääüåääååùäååääåääãäþãääøãääãääãääûãäããääãäøãäãääããääþãää ãâòãâããââããââãâãââãúâããâãââþãââãâþãââãâþãââãâáâüáâáââùáâáââáââáâùáâáââáââáâøáââááâáââöáâáàáàáààááüàáàááþàááàáþàááþàááàáþàáá àßàßàßþàßßþàßßðàßßàßßàßßàßßàßàß ßþàßßàßìÞßßÞßßÞßßÞßßÞßßÞßßÞßßüÞßÞßßüÞßÞß ß÷ÞßÞÞßÞßÞßßþÞßßýÞÝÞÞþÝÞÞûÝÞÞÝÞÞÝÞþÝÞÞÝÞþÝÞÞüÝÞÞÝ?Ý ÜûÝÜÜÝÜÜúÝÜÝÜÝÜÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜþÝÜÜþÝÜÜùÝÜÝÝÜÝÜ@ÜÛÜÛÜýÛÜÛÛõÜÛÛÜÜÛÜÛÜÛÜÜúÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜÛÜÛøÚÛÛÚÛÛÚÛÛúÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛúÚÛÛÚÚÛÛþÚÛÛþÚÛÛ?ÚÙþÚÙÙþÚÙ ÙþÚÙ ÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØþÙØØúÙØØÙÙØØüÙØÙØØÙØþÙØØÙØøÙØØÙÙØÙØØþÙØØÙCØ×úØ×Ø××ØØþ×ØØþ×ØØþ×ØØþ×ØØø×ØØ×ØØ×ØØþ×ØØý×Ø×?×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖø×ÖÖ×ÕÕÖÕÕüÖÕÖÕÕöÖÕÖÕÕÖÕÕÖÕÕÖ
ÕÖÕäÖÕÕÖÕÕÖÕÖÕÖÕÕÖÕÖÔÔÕÕÔÕÔÔÕÕÔÕÕÔùÕÔÕÕÔÕÔÔÕ÷ÔÕÕÔÕÕÔÔÕÕüÔÕÔÕÕüÔÕÔÕÕÔÕüÔÕÕÔ ÔÓûÔÓÓÔÓÓþÔÓÓþÔÓÓúÔÓÔÓÔÓÓûÔÓÓÔÓÓÒÓòÒÓÓÒÒÓÒÒÓÓÒÓÓÒÒûÓÒÓÓÒÒüÓÒÓÒÒÓÒþÓÒÒÓÒÓúÒÓÓÒÑÒÒüÑÒÑÒÒþÑÒÒÑ ÒêÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑÒÑÒÒÑÑþÒÑÑýÒÑÒÒ €ÑÐþÑÐÐþÑÐÐþÑÐÐûÑÐÐÑÐÐüÑÐÑÐÐþÑÐÐþÏÐÐÏÐÏÐûÏÐÏÏÐÐÏÐ ÏÐúÏÐÏÐÐÏÏþÐÏÏýÐÏÐÐöÏÐÏÏÐÎÏÏÎÏÏùÎÏÎÏÎÎÏÏýÎÏÎÎúÏÎÎÏÏÎÎþÏÎÎûÏÎÎÏÎÎøÏÎÏÎÏÎÏÎÎÏÎûÏÍÎÍÎÎÍ
ÎüÍÎÍÎÎüÍÎÍÎÎþÍÎÎÍÎþÍÎÎþÍÎÎüÍÎÎÍ ‚ÍûÌÍÍÌÍÍÌùÍÌÍÌÌÍÌÌþÍÌÌþÍÌÌÍþÌÍÍÌÍÌþÍÌÌÍáÌÍËÌËËÌËÌËÌËÌËÌÌËËÌËËÌÌËËÌËÌËËÌÌúËÌËÌËÌÌËòÌËËÌËÌËËÌÌËËÌËËÌýËÌËËþÊËËüÊËÊËËÊËþÊËËÊËýÊËÊÊùËÊÊËËÊËË?ÊýÉÊÉÉÊ ÉÊÉþÊÉÉþÊÉÉþÊÉBÉþÈÉÉÈùÉÈÈÉÉÈÉÉüÈÉÈÉÉ÷ÈÉÉÈÉÉÈÈÉÉøÈÉÉÈÉÈÈÉÉÈÉÈüÉÈÇÈÈþÇÈ
ÈüÇÈÇÈÈûÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈ
ÈúÇÈÈÇÈÇ?ÇÆþÇÆÆÇÆþÇÆÆþÇÆÆüÇÆÇÆÆÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ?Æ ÿ ?Í?çþæç}çæçæþçææøçæçæçææççüæççææþçææþçææçûæåææååæåþæååæþåææåæðåæåæååææååæååææååæûåæåæååþæååþäååýäåääåþäåå÷äååääååäååäåäþåääýåäååäþãääûãääãääùãäããäãääüãäãääüãäãää ãâõãââãâãâãâãââúãââããââöãâããââãâãââãýâãââøãââãâããââãõâáââáââáâáââáâþáââáþâááâôáââáâáââáâáââáâáâüáâáââáþàááàáþàááüàáàááþàááøàááààáàááþàáá ‡àßðàßàßßàßßàßààßßàßßþàßßþàßßöàßßààßßààßßàßòàßàßßàßàÞÞßÞÞßßÞßøÞßÞÞßßÞßßÞßúÞßßÞÞßßôÞßßÞßßÞÞßßÞßßûÞßÞÝÞÞþÝÞÞøÝÞÞÝÞÝÝÞÞûÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞöÝÞÞÝÞÝÝÞÞÝ>ÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜÝÜÝÜÝDÜúÛÜÜÛÛÜÜûÛÜÜÛÜÜùÛÜÛÛÜÛÜÜþÛÜÜþÛÜÜþÛÜ
ÜøÛÜÛÜÛÛÜÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚþÙÚ ÚþÙÚ ÚÙôÚÙÙÚÚÙÚÙÙÚÙÚÚÙùÚÙÙÚÙÚÙÙüÚÙÚÙÙüØÙÙØØÙØýÙØÙÙØþÙØØÙýØÙØØÙØðÙØØÙØÙØÙØÙØÙØÙÙØØüÙØÙØ?Øþ×Ø Øþ×ØØü×Ø×ØØþ×ØØþ×ØØô×ØØ×ØØ×ØØ××ØØþ×ØØü×ØØ×>×Öþ×ÖÖõ×ÖÖ×ÖÖ××Ö×ÖÖ×
Ö×Ö× ÖÕûÖÕÕÖÕÕïÖÕÕÖÕÕÖÕÖÕÕÖÕÖÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕûÖÕÕÖÕÕüÖÕÖÕÕÖÕþÔÕÕÔþÕÔÔþÕÔÔÕýÔÕÔÔÕüÔÕÔÕÕûÔÕÔÔÕÕþÔÕÕýÔÕÔÔþÕÔÔþÕÔ~ÔÓûÔÓÓÔÓÓüÔÓÔÓÓþÔÓÓüÔÓÔÓÓÔÓüÔÓÔÓÓþÔÓÓùÒÓÓÒÒÓÒÒþÓÒÒÓÒ÷ÓÒÒÓÓÒÒÓÒÒ÷ÓÒÓÓÒÓÓÒÓÓýÒÓÒÒþÓÒÒüÑÒÑÒÒÑÒúÑÒÒÑÒÑÑÒþÑÒÒöÑÒÒÑÒÒÑÒÑÒÒÑÒôÑÒÑÑÒÒÑÒÑÒÒÑÑþÒÑ ÑüÐÑÐÑÑÐÑúÐÑÐÐÑÐÐüÑÐÑÐ ÐüÑÐÑÐÐþÑÐÐþÑÐÐöÏÐÏÐÐÏÐÏÏÐÐýÏÐÏÏÐÏøÐÏÐÏÐÏÏÐÐýÏÐÏÏüÐÏÏÐÐÏÐÏÐ÷ÏÐÏÐÏÏÎÏÎÎÏÎÏ÷ÎÏÎÎÏÎÏÎÏÏþÎÏÏþÎÏÏùÎÏÎÏÎÎÏÏùÎÏÏÎÏÎÏÏÎÏÎüÍÎÍÎÎÍÎúÍÎÎÍÍÎÎöÍÎÍÍÎÍÍÎÍÎÎûÍÎÎÍÎ ÎÍÎ €ÍÌþÍÌ ÌôÍÌÍÍÌÍÌÌÍÌÍÌÌþÍÌÌÍÌÍÌÍÌõÍÌÍÌÍÍÌÌËËÌÌýËÌËËÌËÌËýÌËÌÌËöÌËËÌÌËËÌËÌÌËýÌËÌÌËÌþËÌÌËÊËÊËþÊËËúÊËËÊÊËËøÊËËÊËËÊËËþÊËËþÊËËÊËAÊýÉÊÉÉþÊÉÉùÊÉÊÉÉÊÉ ÉüÊÉÊÉÉþÊÉÉþÊÉÉþÊÉIÉ÷ÈÉÈÉÈÉÈÈÉÉÈÉÈÉíÈÉÈÉÉÈÉÈÉÈÈÉÈÈÉÉÈÉÈÈúÉÈÉÈÇÈÈÇýÈÇÈÈüÇÈÇÈÈþÇÈ ÈÇÈÇýÈÇÈÈþÇÈÈ?ÇûÆÇÆÇÆÆþÇÆÆþÇÆÆþÇÆ ÆþÇÆÆþÇÆÆüÇÆÇÆCÆ ?Í+çþæç ƒçþæç Þçþæççþæçç æþçææûçææçææûçææçææþçææþçææþçææþçææþçææúåæååæåå÷æååæåæåæååýæåææüåæåææåæåõæåæååæåæåæååæåäå÷äåäåääåäååäýåäååþäååäåäýåäååýäåääãäþãääüãäãääãäãäþãääþãääóãääããääãäãäãääãþäã~ãüâããââüãâãââãùâãâããâããâãâñãâããâããâãââãâãââãâáòâáââááââáââááââáûâáâáââøáââáââáâ âáâáþàááà
áþàááøàááàááàááàáþàááþàáá àßàßýàßààþßààßàøßàßßàßàßßöàßàßßààßàßßàößààßàßàßàßßÞùßÞßßÞÞßßãÞßßÞßÞßÞÞßßÞßÞßÞÞßÞßÞßßÞßÞßÞßßúÞßÞÞßÞÞüßÞßÞÞþßÞÞþÝÞÞøÝÞÞÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞûÝÞÞÝÞÞþÝÞÞúÝÞÞÝÞÝ6ÝþÜÝÝÜûÝÜÜÝÜÜøÝÜÝÜÜÝÝÜÜþÝÜÜÝÜþÝÜÜþÝÜEÜÛÜÛÜþÛÜÜúÛÜÜÛÜÛÛÜöÛÜÜÛÛÜÛÜÛÜÜìÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛÜÜÛÜÛÛþÚÛÛþÚÛÛûÚÛÛÚÛÛÚÛÚúÛÚÛÛÚÛÛ?ÚÙþÚÙÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÚÙÙüÚÙÚÙÙüÚÙÚÙÙÚÙýØÙØØÙØÙØøÙØÙØÙØÙØØÙØþÙØØÙØþÙØØýÙØÙÙØÙúØÙÙØÙØBØû×ØØ×ØØþ×ØØþ×ØØö×ØØ×Ø×ØØ×ØØ×Øþ×ØØ×ýØ×ØØý×Ø×?×ýÖ×ÖÖþ×ÖÖþ×ÖÖ÷×Ö××Ö×Ö×ÖÖþ×ÖÖþ×ÖÖ÷×ÖÕÖÖÕÕÖÕÕÖÕÖÕíÖÕÕÖÕÕÖÕÕÖÕÖÖÕÖÖÕÖÕÕÖýÕÖÕÕÖ÷ÕÖÕÖÖÕÕÖÕÕõÔÕÕÔÕÕÔÕÕÔÕÕþÔÕÕþÔÕÕóÔÕÔÔÕÔÕÔÕÕÔÕÔÔÕøÔÕÔÕÔÕÔÕÕýÔÕÔ~Ô ÓÔÓþÔÓ
ÓþÔÓÓþÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓþÔÓÓûÔÓÒÒÓÓúÒÓÒÓÓÒÒúÓÒÒÓÓÒÒûÓÒÓÓÒÒÓúÒÓÒÒÓÒÒõÓÒÓÓÒÒÓÒÓÓÒÒòÑÒÒÑÑÒÑÒÑÒÒÑÒÑÑýÒÑÒÒúÑÒÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒòÑÒÑÑÒÑÒÑÒÑÒÑÑÒÒ ÑÐÑ ÐÑ ÐþÑÐ
ÐüÑÐÑÐÐþÑÐÐüÑÐÐÏÏÐÏûÐÏÏÐÏÏÐÏûÐÏÏÐÏÏúÐÏÐÐÏÐÐüÏÐÐÏÏöÐÏÏÐÏÐÏÐÐÏÏÎüÏÎÎÏÏÎÏøÎÏÎÎÏÏÎÏÏûÎÏÏÎÏÏÎþÏÎÎÏöÎÏÎÏÏÎÎÏÎÏÏþÎÏÏÎÍ ÎþÍÎÎþÍÎÎÍúÎÍÎÎÍÎÎùÍÎÍÎÎÍÎÎþÍÎÎüÍÎÍÎÎ ƒÍÌúÍÌÍÌÍÌÌÍÌÍûÌÍÌÌÍÍÌÍÌþÍÌÌÍÌõÍÌÌÍÌÍÌÍÌÌÍÍýÌÍÌÌËÌþËÌÌËÌËÌüËÌÌËËüÌËÌËËþÌËËÌûËÌËËÌÌËÊËþÊËËþÊËËÊ÷ËÊËÊËÊËÊËËþÊËËþÊËËüÊËÊËËÊË?ÊúÉÊÉÉÊÉÉÊúÉÊÉÉÊÉÉÊÉþÊÉÉûÊÉÉÊÉÉþÊÉAÉþÈÉÉÈÉþÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉôÈÉÈÉÈÉÈÉÈÉÈÉÉúÈÉÈÈÉÈÈþÇÈÈûÇÈÇÇÈÈþÇÈÈÇÈûÇÈÈÇÈÈ@ÇÆÇÆÇÆøÇÆÇÆÆÇÇÆÆþÇÆÆþÇÆÆþÇÆÆÇÆþÇÆ>Æ ?ÍkçþæçRçæþçææûçæççææùçæçææçææþçææþçææþçæ æçþæååýæåææ
åþæååýæåææåúæåææåææåùæåææåæååäåéäåääååääååääåäåäåäååäåääþåääñåääåäåäåäåäååäååäþãääãäûãääãääþãä äþãä äñãääããääãääãäãäã €ãâØãâããâãâãââãâãâãââãâããâããâãâããââãââãââãâããâõãââãââããâãââúáâááâááýâáââþáââáñâáâááââáââáâááââáâþáââûáâááââáþàá áôàááàááààááàá áþàááàáüàáàááûàááàáá €àøßààßààßààßàßûàßßàßßàßüàßàßßàößàßàßßàßßààüßààßßÞßÞßþÞßßÞüßÞßÞÞßÞýßÞßßùÞßÞÞßÞßßýÞßÞÞýßÞßßÞÝÞþÝÞÞüÝÞÝÞÞÝÞÝþÞÝÝÞþÝÞÞÝÞüÝÞÝÞÞ?ÝÜþÝÜÜÝÜûÝÜÜÝÜÜþÝÜÜúÝÜÜÝÝÜBÜúÛÜÛÜÜÛÛüÜÛÛÜÜÛÜÛÜûÛÜÛÜÛÛþÜÛÛýÜÛÜÜýÛÜÛÛÜÛüÜÛÚÛÛÚÛþÚÛÛÚÛÚÛúÚÛÚÛÚÛÛÚÛþÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙùÚÙÚÙÚÚÙÙþÚÙÙ÷ØÙØØÙØØÙØØúÙØÙØØÙÙõØÙÙØÙÙØÙÙØÙÙØÙýØÙØØûÙØÙÙØEØø×Ø××ØØ×ØØù×Ø×ØØ×Ø'Ø?×ýÖ×ÖÖû×ÖÖ×ÖÖþ×Ö Öþ×Ö
Öþ×ÖÖþ×ÖÖ×ÖÕþÖÕÕýÖÕÖÖýÕÖÕÕÖùÕÖÖÕÖÖÕÕôÖÕÕÖÕÖÕÕÖÕÕÖÖÕþÖÕÕþÖÕÕõÖÕÖÖÕÕÖÕÖÕÔÔÕþÔÕÕøÔÕÕÔÕÕÔÕÕøÔÕÔÔÕÔÔÕÕÔ÷ÕÔÕÔÕÔÕÕÔÔÕýÔÕÔÔûÕÔÕÕÔ~ÔøÓÔÓÔÓÓÔÓÓþÔÓÓûÔÓÓÔÓÓþÔÓÓùÔÓÔÔÓÔÓÓûÔÓÔÔÓÓüÔÓÔÓ ÓÒÓÒþÓÒÒÓôÒÓÒÓÓÒÒÓÒÒÓÒÒþÓÒÒþÓÒÒÓÒÓôÒÓÒÒÓÒÓÒÒÓÑÒÒÑÒÑÒÑ÷ÒÑÒÒÑÒÒÑÒÒÑÒÑÒÑÒöÑÒÑÒÒÑÒÑÑÒÒüÑÒÒÑÑþÒÑ~ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐÑÐùÑÐÐÑÐÑÐÐÑÐþÑÐÐÏÐÏÐýÏÐÏÏòÐÏÏÐÏÏÐÐÏÏÐÏÐÏÏÐÏÐÏþÐÏÏþÐÏÏÐÏöÐÏÏÎÏÏÎÏÎÏÏñÎÏÎÏÎÏÏÎÎÏÎÏÎÎÏÏÎöÏÎÎÏÎÏÏÎÎÏÏõÎÏÎÏÎÏÎÎÏÎÏÏÎÏÍþÎÍÍýÎÍÎÎþÍÎÎÍÎûÍÎÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎùÍÎÍÎÎÍÎÎ €ÍÌûÍÌÌÍÌÌÍÌÍÌÍÌÍþÌÍÍôÌÍÌÍÌÍÌÌÍÌÍÌ ÌþÍÌÌËÌËÌöËÌÌËËÌÌËËÌÌËðÌËËÌËÌÌËËÌÌËÌËËÌÌúËÌËÌËÌÌüËÌÌËËþÊËËþÊË
ËÊ
ËüÊËÊËËþÊËËÊËúÊËËÊËÊ?ÊÉþÊÉÉûÊÉÉÊÉÉÊÉúÊÉÊÉÊÉÉþÊÉÉþÊÉÉÊÉÊÉÊúÉÊÉÉÊÉ?ÉùÈÉÈÈÉÈÉÉýÈÉÈÈÉÈÉÈÉöÈÉÈÉÈÉÉÈÉÈÈÉûÈÉÉÈÉÉöÈÉÈÉÉÇÈÈÇÈÈþÇÈÈþÇÈÈøÇÈÈÇÈÈÇÈÈþÇÈÈûÇÈÇÈÇ>ÇýÆÇÆÆûÇÆÆÇÆÆÇÆþÇÆÆÇÆûÇÆÆÇÆÆþÇÆÆþÇÆÆþÇÆCÆ ÿ ?ÍFçþæçwçæüçæçææþçæ æûçæççæ æõçææçææççæçææþçææåæýåæååæåæåùæååæååææåþæååæåöæååææåæåæååùæåæåæåææåýæäååäüåäåääåþäååøäåäåäååääåäåýäåääýåäååäåäþåääùåäãäããä
äþãääüãäãääþãääûãäããä äþãää ‚ãâãâãâûãââãââãâòãâããâãâãâããââããâóãââãââãâãâããââáâáâþáââáâáýâáââûáâáâááâúáââááââáâáûàááàááþàááþàááþàá
áþàááüàáàáá €àþßààûßàßàßßàýßàßßãàßàßààßààßààßßààßàßßààßààßßàßßàßàßÞßýÞßÞÞßüÞßßÞÞßÞûßÞÞßÞÞßûÞßÞßÞÞßûÞßÞÞßßÞÝùÞÝÞÝÞÝÞ ÞüÝÞÝÞÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞ?ÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜÝÜþÝÜÜÝBÜþÛÜÜþÛÜÜûÛÜÛÜÛÛÜöÛÜÜÛÜÛÛÜÜÛÛÜÛÜüÛÜÜÛÛüÜÛÜÛÛÜùÛÜÜÛÚÚÛÛþÚÛÛÚÛþÚÛÛÚÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛ@ÚÙÚÙÚÙÚýÙÚÙ ÙûÚÙÙÚÙÙþÚÙÙüÚÙÚØØøÙØÙÙØØÙØØÙòØÙÙØØÙÙØØÙØØÙØØÙØÙñØÙØØÙØØÙÙØÙØÙÙØDØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØ×ýØ×ØØù×Ø××Ø×ØØù×ØØ×ØØ×@×Öþ×ÖÖþ×ÖÖþ×ÖÖø×Ö×Ö×Ö×ÖÖþ×Ö Öþ×ÖÖÕþÖÕÕøÖÕÖÕÖÕÖÕÕþÖÕÕûÖÕÕÖÕÕþÖÕÕÖÕûÖÕÕÖÕÕþÖÕÕÖÕÖÕþÔÕÕÔÕüÔÕÔÕÕúÔÕÔÕÔÕÕ÷ÔÕÔÕÔÕÔÕÔÔóÕÔÔÕÕÔÔÕÔÔÕÔÕÕ €ÔúÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓùÔÓÓÔÓÔÓÓúÒÓÓÒÓÒÒýÓÒÓÓÒòÓÒÒÓÓÒÒÓÒÓÒÓÒÓÓÒÓÒôÓÒÓÒÓÒÓÒÓÒÓÒÒûÑÒÑÑÒÒÑúÒÑÑÒÒÑÑøÒÑÒÑÒÑÒÑÑþÒÑÑÒôÑÒÒÑÑÒÑÒÒÑÑÒÒÑÒÑÒ ÑÐþÑÐÐþÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐþÑÐÐüÑÐÐÑÑÐûÑÐÐÑÐÐþÑÐÐÏûÐÏÐÐÏÏþÐÏÏÐþÏÐÐûÏÐÐÏÐÐüÏÐÏÐÐÏþÐÏÏåÐÏÏÐÏÏÐÏÐÏÏÐÏÏÐÏÐÎÏÎÏÎÏÎÏÎÏÏùÎÏÏÎÏÎÏÏ÷ÎÏÎÎÏÎÏÎÏÏõÎÏÎÎÏÏÎÏÏÎÏÏþÎÏÏÎÏûÎÏÎÍÎÎþÍÎÎûÍÎÍÍÎÎúÍÎÍÎÍÎÎøÍÎÎÍÎÎÍÎÎþÍÎÎÍ ÎþÍÎÎ €ÍÌÍüÌÍÍÌÌûÍÌÍÍÌÌÍÌÍýÌÍÌÌøÍÌÍÌÍÍÌÍÍÌþËÌÌùËÌËÌËÌËËüÌËÌËËùÌËÌËËÌËËüÌËÌËËÌþËÌÌþËÌÌËÌþËÌÌËýÌÊËËÊýËÊË
ËÊýËÊËËûÊËËÊËËþÊËËùÊËÊËÊËÊ>ÊÉóÊÉÊÊÉÊÊÉÊÉÉÊÉÉþÊÉÉúÊÉÉÊÊÉÉüÊÉÊÉÉþÊÉAÉÈ÷ÉÈÉÉÈÉÉÈÉÉÈÉÈÉþÈÉÉüÈÉÈÉÉþÈÉÉøÈÉÈÈÉÉÈÉÉÈõÇÈÈÇÈÇÇÈÈÇÈ ÈþÇÈÈþÇÈÈÇÈûÇÈÈÇÈ
È÷ÇÈÇÈÇÇÈÈÇ<ÇüÆÇÇÆÆÇÆþÇÆÆÇÆÇýÆÇÆ
ÆúÇÆÆÇÇÆEÆ ?Íçþæç ™çþæç&çþæç óçæþçææþçææûçææçææúçææççææûçææçææüçæçææþçææþçææúçæçææååæüåææååþæååóæååæååæååæååææåæåþæååýæåææåùæåæåæäååþäååþäååþäååöäååääååääååöäååääååääååäåùäååääåääþãää÷ãäãääãäãääüãäãääúãääããääãòäãäãäãääãääãäã~ãøâãâãâããââýãâããâãùâãâãâãââþãââã
âýãâããâþáââþáââþáââüáâáââüáâáââüáâáââáðâáâáâáâááââáâáàá áþàááàýáàááþàááüàáàááàáàá €àßàßüàßßààßàßàûßàßàßßàøßààßßàßààüßàßààßàßþÞßßûÞßßÞßßÞßûÞßßÞßßÞßþÞßßÞößÞßÞÞßßÞÞßßþÞßßþÞßßÞþÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞûÝÞÝÝÞÞÝÞÝÞþÝÞÞ@ÝÜþÝÜÜþÝÜ
ÜøÝÜÝÝÜÜÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜGÜÛñÜÛÛÜÛÛÜÛÛÜÜÛÛÜÛÛÜÛÜõÛÜÜÛÛÜÛÜÜÛÜÜýÛÜÛÛýÜÛÜÜ÷ÛÜÛÜÜÛÜÚÛÛüÚÛÛÚÚÛþÚÛÛþÚÛÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙ
ÙùÚÙÚÙÙØÙÙýØÙØØùÙØÙÙØØÙÙþØÙÙØþÙØØÙüØÙØÙÙùØÙØØÙÙØØ÷ÙØØÙÙØØÙØØþÙØCØþ×Ø
Øþ×ØØþ×ØØþ×ØØò×ØØ×ØØ×ØØ×ØØ×ØØø×ØØ×Ø×Ø×>×Öó×ÖÖ×Ö×ÖÖ××Ö×ÖÖþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖ÷×Ö×Ö××Ö×ÖÖþ×ÖÖÕÖÕÖÕúÖÕÖÕÕÖÖùÕÖÕÕÖÖÕÕÖÕÖþÕÖÖýÕÖÕÕþÖÕÕúÖÕÖÕÖÕÕÔÕÔøÕÔÕÔÕÔÔÕÕüÔÕÔÕÕùÔÕÔÕÕÔÕÕïÔÕÕÔÔÕÔÔÕÔÕÕÔÕÔÔÕÕþÔÕÕ €ÔýÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒùÓÒÓÒÓÓÒÒûÓÒÒÓÒÒÓÒÓþÒÓÓÒþÓÒÒÓÒÓ ÒÑÒüÑÒÑÒÒûÑÒÒÑÒÒüÑÒÑÒÒøÑÒÑÒÑÒÑÒÒþÑÒÒþÑÒÒ ‚ÑÐüÑÐÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐùÏÐÏÐÐÏÐÐíÏÐÏÏÐÏÐÏÐÏÏÐÏÏÐÐÏÐÏÏÐüÏÐÐÏÏøÐÏÏÐÐÏÐÏÏÐïÏÐÏÐÏÎÏÎÏÎÎÏÎÏÎÏÎÎûÏÎÏÎÏÏþÎÏÏÎÏÎôÏÎÏÏÎÎÏÏÎÏÎÏÏùÎÏÎÎÏÎÏÏýÎÏÎÎþÍÎ ÎûÍÎÎÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÎÍÎÎÍÎ ÍüÌÍÍÌÌÍþÌÍÍÌøÍÌÍÍÌÍÍÌÌöÍÌÌÍÍÌÍÌÌÍÍöÌÍÌÍÌÌÍÌÍÌÌìÍÌÍÍÌÌÍÌÌËÌËÌÌËÌÌËÌËËüÌËËÌÌË÷ÌËÌËËÌËÌËËýÌËÌÌËÌËÌúËÌËÌËÌÌðËÌËÌÌËÊÊËËÊÊËËÊËËÊËþÊËËùÊËËÊËÊËËþÊËËüÊËËÊÊËþÊËËþÊËË?ÊÉüÊÉÊÉÉýÊÉÊÊ ÉþÊÉÉþÊÉÉÊÉþÊÉÉúÊÉÊÉÊÉEÉÈîÉÈÉÈÈÉÈÉÈÉÉÈÉÉÈÉÉÈÈüÉÈÈÉÉÈýÉÈÉÉÈÉüÈÉÈÉÉÈÉüÈÉÉÈÈüÇÈÇÈÈþÇÈÈûÇÈÇÇÈÈÇ ÈÇÈþÇÈÈþÇÈÈÇÈ@ÇÆüÇÆÇÆ ÆþÇÆÆûÇÆÆÇÆÆÇýÆÇÆÆþÇÆÆþÇÆÆÇ?Æ ?ÍÀçýæçææçýæçææúçææçæççòæçæçææçæçææççæ
æþçææåþæååùæååæååææúåææåæååþæååþæååøæååæåææååæþåææåäùåääååäååûäåäåääúåäååäååùäåäååäååéäååäåääåäåäåäåäåäåääååääòãääããääãäããäãääãäøãäããääãääþãääþãääãä ãâøãââãââãââöãââãâãâãâããýâãââãâãâþãââþãââúãââããââ÷áâááââááââáâáøâááââááââóáâááââááâáââááâþáââáþàááþàááþàááúàáàáàááàáþàááþàááüàáàáá „àþßààüßààßßþàßßàþßààüßààßßàßúàßßààßßàýßàßßþàßßÞþßÞÞßþÞßßøÞßßÞÞßÞßßÞþßÞÞþßÞÞßþÞßßÞÝÞÝÞüÝÞÝÞÞõÝÞÞÝÞÞÝÞÞÝÞÞþÝÞÞþÝÞÞþÝÞÞAÝÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜöÝÜÝÜÝÜÜÝÝÜÜÝýÜÝÜÜÝ?ÜÛÜûÛÜÜÛÜÜúÛÜÜÛÛÜÜúÛÜÛÛÜÛÛýÜÛÜÜþÛÜÜìÛÜÛÜÜÛÜÛÜÜÛÜÜÛÜÜÛÜÛÜÜþÚÛÛøÚÛÚÛÛÚÚÛÛþÚÛ#ÛþÚÛÛ?ÚýÙÚÙÙþÚÙ ÙúÚÙÙÚÚÙÙþÚÙÙÚÙÚÙþÚÙÙØþÙØØúÙØØÙÙØØÙòØÙØÙØÙØØÙÙØÙÙØØùÙØÙÙØÙØØùÙØÙÙØÙØØûÙØØÙØCØþ×ØØþ×ØØü×Ø×ØØ×Øþ×ØØþ×ØØý×Ø×@×Öþ×ÖÖú×ÖÖ××ÖÖ×Öü×Ö×Ö Ö×Ö×Öø×ÖÖ×ÖÖ×ÖÖÕÖÕÖúÕÖÖÕÖÕÕëÖÕÕÖÖÕÕÖÖÕÕÖÕÖÕÖÖÕÕÖÕÕþÖÕÕþÖÕÕÖûÕÖÕÖÕÕþÖÕÕüÔÕÔÕÕüÔÕÔÕÕûÔÕÔÕÔÔúÕÔÔÕÕÔÔÕþÔÕÕþÔÕÕùÔÕÕÔÕÕÔÔÕýÔÕÔÔüÕÔÕÔ ÔÓûÔÓÓÔÓÓùÔÓÔÔÓÔÓ ÓÔÓÔÓûÔÓÔÔÓÓþÔÓÓ ÒþÓÒÒþÓÒÒúÓÒÓÒÓÒÒþÓÒÒÓÒÓ÷ÒÓÓÒÒÓÒÓÒÒÓóÒÓÒÓÒÓÒÒÑÒÑÒÑÑÒþÑÒÒÑÒýÑÒÑÑÒÑÒþÑÒÒõÑÒÑÒÑÑÒÒÑÑÒÒ €ÑÐþÑÐÐþÑÐÐÑÐüÑÐÑÐÐùÑÐÑÐÐÑÐÐþÑÐ ÐüÑÐÑÐÐúÑÐÏÏÐÏÏýÐÏÐÐøÏÐÏÐÏÏÐÏ
ÏýÐÏÐÐÏÐÏþÐÏÏþÐÏÏþÎÏÏûÎÏÏÎÏÏÎÏÎÏÎþÏÎÎÏúÎÏÏÎÎÏÏÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎÎÍÎþÍÎ Î ÍýÌÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌüÍÌÍÌÌÍÌúÍÌÌÍÌÍÍÌÍÌüÍÌÌÍÍúÌÍËÌËÌÌúËÌÌËÌËËûÌËÌÌËËÌËÌöËÌÌËËÌÌËËÌÌþËÌÌËþÌËËòÌËËÌÌËÌËËÌËËÊËËüÊËÊËËûÊËËÊËËúÊËËÊÊË ËþÊËË@ÊÉüÊÉÊÉ
ÉûÊÉÉÊÉÉþÊÉÉÊõÉÊÉÉÊÉÊÉÉÊÉBÉÈýÉÈÉ
ÉþÈÉÉÈûÉÈÉÈÉÉüÈÉÈÉÉÈÉþÈÉÉÈÉýÈÇÈ
ÈöÇÈÇÈÇÈÈÇÇÈÈÇöÈÇÈÈÇÈÈÇÇÈÈÇÈþÇÈÈ?ÇÆüÇÆÇÆÆûÇÆÆÇÆ
ÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆ@Æ ÿ ?ÍÀçæþçææþçææþçææûçæççæ æþçææçæþçææýçæççæþçææýåæååæúåæååæååæýåæååôæåææåæååæåæååæåæùåæåææåææþåääåùäåäåääååþäååôäååääåääååäååäøåäåääååääüåääååäûãääãääþãä
äûãääãä äãäþãää €ãôâãâãâããâããâããúâããââããþâããâöãââããâãâãââþãââãâþãââãýâãââùãâááââááâûáââáââþáââáøâáâááâáââáýâáââáâþáââúáââáâááþâááþàááüàáàááþàááþàááàúáàááàááüàáàááàáúàáàáàáá àßàüßàßààßþàßßþàßßûàßßàßßàüßààßßàýßàßßþàßßëÞßÞßßÞÞßÞßßÞßÞßÞßÞßÞßßóÞßÞßÞÞßßÞÞßÞßßÞýßÞßßþÞßßÞýßÞßßÞüßÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞûÝÞÞÝÞÞÝÞþÝÞ Þ+ÝþÜÝÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜúÝÜÜÝÝÜÜþÝÜÜþÝÜÜüÝÜÝÜÜÝFÜÛøÜÛÛÜÛÜÛÜÜýÛÜÛÛÜüÛÜÛÜÜ÷ÛÜÜÛÜÜÛÜÛÛÜþÛÜÜÛÜùÛÜÜÛÜÜÛÛþÚÛ
ÛþÚÛÛûÚÛÛÚÛ ÛþÚÛÛþÚÛ
Û@ÚûÙÚÙÚÙÙþÚÙÙûÚÙÚÚÙ
ÙþÚÙÙþÚÙÙÚ
ÙØþÙØØûÙØÙÙØØûÙØØÙØØ÷ÙØÙØÙØÙØÙÙïØÙØÙØÙØØÙØØÙÙØÙÙØ>Ø×Øþ×ØØþ×ØØ×Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØû×ØØ×Ø Ø?×Öþ×Ö Öþ×ÖÖþ×ÖÖþ×ÖÖú×Ö×Ö×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖù×ÖÖÕÖÕÖÖìÕÖÖÕÖÕÖÕÖÖÕÕÖÖÕÖÕÕÖÕÕøÖÕÕÖÕÖÕÖÖÕÖ÷ÕÖÖÕÖÕÕÖÕÕýÔÕÔÔÕüÔÕÕÔÔÕùÔÕÔÔÕÔÕÕþÔÕÕôÔÕÕÔÔÕÔÕÔÔÕÔÔûÕÔÕÔÕÕõÔÕÕÔÔÕÔÔÕÕÔ~ÔýÓÔÓÓãÔÓÓÔÓÔÓÓÔÓÔÓÔÔÓÔÓÓÔÔÓÔÓÓÔÓÓÔÓÓ÷ÔÓÔÓÓÔÓÔÓ ÓÔÓÔüÓÒÓÒÒÓýÒÓÒÒýÓÒÓÓÒþÓÒÒÓüÒÓÓÒÒùÓÒÓÒÒÓÒÒÓýÒÓÒÒþÓÒÒÓýÒÓÒÒÑýÒÑÒÒÑÒöÑÒÑÒÑÒÑÒÑÒÒÑÒÑüÒÑÑÒÒþÑÒÒøÑÒÒÑÒÒÑÒÒüÑÒÒÑ~ÑÐ÷ÑÐÑÐÑÐÑÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐóÑÐÐÑÐÑÐÐÏÐÏÐÏÏÐÏþÐÏÏÐÏúÐÏÐÏÐÏÏþÐÏÏùÐÏÏÐÏÐÏÏûÐÏÏÐÏÏÐûÏÐÏÐÏÏÎÏùÎÏÎÎÏÎÏÏüÎÏÎÏÏþÎÏÏóÎÏÎÏÏÎÎÏÏÎÏÎÏÏÎÏÎþÏÎÎþÏÎÎüÍÎÍÎÎþÍÎÎûÍÎÎÍÎÎíÍÎÎÍÎÎÍÎÎÍÎÎÍÍÎÎÍÍÎÎúÍÎÍÎÍÎÎ ÍÌ÷ÍÌÍÌÍÍÌÍÌÌüÍÌÍÌÌøÍÌÌÍÌÌÍÌÌþÍÌÌþÍÌÌøÍÌÌÍÌÍÌÍÍÌøÍÌÍËÌÌËÌÌËþÌËËÌòËÌÌËÌÌËÌËÌÌËËÌÌüËÌËÌÌüËÌÌËËúÌËÌËËÌÌËúÊËÊËÊËËþÊËËþÊËËþÊËËúÊËËÊÊËËúÊËËÊËÊ>ÊÉöÊÉÊÉÉÊÊÉÊÉÉûÊÉÉÊÉÉÊÉþÊÉÉÊ÷ÉÊÉÊÊÉÉÊÉÉþÊÉAÉúÈÉÈÉÉÈÈþÉÈÈøÉÈÉÈÈÉÉÈÈýÉÈÉÉüÈÉÉÈÈõÉÈÉÉÈÉÉÈÉÈÉÉþÈÉÉþÈÉÉûÈÉÈÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÈÇÈÈ@ÇÆþÇÆÆþÇÆÆôÇÆÆÇÆÇÆÇÆÆÇÆÆüÇÆÇÆÆûÇÆÆÇÆ ÆþÇÆBÆ ?Í
çþæç"çþæç Œçæûçææçææçæþçææûçææçææþçææþçææþçææþçææöåæåæåæåææååöæåæåæåææåææåæåæõåæåææåææåæååæåûæåææååäýåäååþäååþäååäüåääååüäåäååùäåäååäååäåøäåäåääåääþãä-äþãääúãäãäãää €ãýâãââãâã÷âãâãâããâããâñãâããââããââãâãâããâãüâããââüãâãââáâáþâááâáâáâüáâáââüáâáââáâþáââáâøáâáàáààááúàááààáá÷àáààááàáààáþàááþàááýàáà~àßüàßàßßþàßßüàßàßßöàßàßàßààßààßüàßßààþßààßàýßÞßßÞßüÞßßÞÞùßÞÞßÞßÞÞûßÞÞßÞÞßøÞßÞÞßßÞßßþÞßßþÞßßþÞßßúÞßßÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞþÝÞÞÝÞÝÞøÝÞÞÝÞÝÝÞÞÝþÜÝ"Ý
ÜþÝÜÜþÝÜÜÝÜüÝÜÝÜÜþÝÜHÜÛÜýÛÜÛÛüÜÛÜÛÛøÜÛÜÛÜÜÛÜÜúÛÜÛÜÛÜÜøÛÜÛÛÜÛÜÛÛÜÛÜÛýÜÛÜÜÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚÛþÚÛÛÚÛÚÛýÚÛÚÚþÙÚ+ÚýÙÚÙÙÚÙüÚÙÚÙÙûÚÙÙÚÙÙþÚÙÙÚûÙÚÙÚÙÙøÚÙÚÙÙÚÚÙÙîØÙØÙØØÙÙØÙØÙØØÙØØÙÙØÙüØÙÙØØþÙØØÙýØÙØØþÙØØùÙØÙØÙÙØBØþ×ØØù×Ø×Ø××ØØþ×Ø Øö×Ø×ØØ×ØØ×ØØû×Ø××ØØþ×ØØ@×Öþ×ÖÖþ×ÖÖö×Ö×Ö×Ö×Ö×ÖÖû×ÖÖ×ÖÖ×÷Ö××Ö×ÖÖ×ÖÖ×ýÖ×ÖÖþÕÖÖÕöÖÕÖÖÕÕÖÕÖÕ ÕýÖÕÖÖÕÖÕùÖÕÖÕÕÖÕÕÖûÕÖÕÖÕÕþÔÕÕöÔÕÔÔÕÕÔÕÔÕÕÔÕüÔÕÕÔÔýÕÔÕÕûÔÕÕÔÕÕûÔÕÕÔÕÕÔüÕÔÔÕÕ ÔóÓÔÓÔÓÔÓÓÔÔÓÔÓÓÔÓþÔÓ
ÓÔÞÓÔÓÓÔÓÓÔÓÓÔÓÔÓÓÔÓÔÓÓÔÓÓÔÒÒÓÒÒÓÒÒÓÒÒüÓÒÒÓÓÒÓòÒÓÓÒÓÓÒÓÒÓÒÒÓÒÒÓÒÓÒÓòÒÓÒÒÓÒÒÓÒÒÑÒÒÑÑûÒÑÑÒÑÑÒÑÒãÑÒÑÑÒÑÒÑÑÒÑÑÒÑÒÒÑÑÒÒÑÑÒÑÑÒÑÒÑÑüÒÑÑÒÒ ÑýÐÑÐ ÐþÑÐÐÑÐÑÐüÑÐÑÐÐüÑÐÑÐÐÑÐþÑÐÐÑÏüÐÏÐÏÏþÐÏÏûÐÏÏÐÏÏóÐÏÐÏÏÐÐÏÏÐÏÐÏÏ
ÐÏþÐÏÏÐÏÐÏþÎÏÏÎÏÎÏþÎÏÏÎýÏÎÏÏÎúÏÎÏÏÎÏÏúÎÏÏÎÏÎÎÏÎÏ ÎþÍÎÎ÷ÍÎÎÍÎÎÍÍÎÎÍÎÍÎþÍÎÎþÍÎÎýÍÎÍ~ÍÌÍÌøÍÌÌÍÍÌÍÌÌÍÌúÍÌÍÌÌÍÍÌþÍÌÌþÍÌÌÍÌþÍÌÌûËÌËËÌÌùËÌÌËÌËÌÌËÌþËÌÌýËÌËËøÌËÌËÌËËÌÌþËÌÌüËÌÌËËþÊËËþÊËËÊöËÊÊËËÊÊËÊËËûÊËËÊËËÊËÊËûÊËËÊËËAÊüÉÊÊÉÉþÊÉÉÊÉþÊÉ ÉÊÉÊÉúÊÉÉÊÊÉ@ÉþÈÉÉþÈÉÉþÈÉÉöÈÉÉÈÉÈÈÉÈÉÉüÈÉÈÉÉÈðÉÈÉÉÈÈÉÈÉÉÈÉÈÉÈÉÉÈùÉÈÈÇÈÇÈÈÇÈÇúÈÇÈÈÇÈÈûÇÈÈÇÈÈÇÈÇüÈÇÇÈ
È?ÇÆþÇÆÆþÇÆÆþÇÆÆÇþÆÇÇùÆÇÇÆÆÇÆÆûÇÆÆÇÆÆþÇÆÆþÇÆ@Æ ?Íþæç äçþæç Øçæþçææþçææçæçæüçæçææþçææþçææåúæåæåæååûæåææååþæååæùåææååæåå÷æåæåæåææååæåæüåææååøäåäååääååþäååä åüäååääåäåäåäûãääãääûãäããääþãääãøäãääãäãää €ãþâããâòãââãââãâããâãâããâþãââüãâãââãýâãââþãââáâýáâááâüáâáââáâþáââáâðáâáâáâááââááâáâááþàáá÷àááààááàááüàáàááþàááàáþàá áþàáá àßàßüàßßààßüàßàßßüàßàßßûàßààßßàþßààßþàßßýàßààßþÞßßüÞßÞßßþÞßßüÞßÞßßÞûßÞßÞßßõÞßÞßÞßÞßßÞßßÞýßÞßßüÞßßÞÞûÝÞÝÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞýÝÞÝ>ÝÜþÝÜÜùÝÜÜÝÜÝÜÜÝÜûÝÜÝÝÜÜûÝÜÜÝÜÜÝÜüÝÜÝÜÜþÝÜCÜÛýÜÛÜ ÜþÛÜÜýÛÜÛÛúÜÛÜÛÛÜÜþÛÜÜûÛÜÜÛÜÜÛÜõÛÜÛÛÜÚÛÚÛÚÛÛþÚÛÛþÚÛÛþÚÛÛÚ ÛþÚÛÛþÚÛÛþÚÛÛ+ÚþÙÚÚÙûÚÙÙÚÙÙþÚÙ ÙþÚÙÙüÚÙÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙØþÙØØþÙØØþÙØØÙûØÙØØÙÙØöÙØÙØØÙØÙØÙÙúØÙØÙØÙÙýØÙØDØþ×ØØþ×ØØþ×ØØ×Ø×ýØ×ØØþ×ØØþ×ØØþ×ØØü×ØØ×>×Öþ×ÖÖû×Ö××ÖÖþ×ÖÖû×Ö××ÖÖ×ýÖ×ÖÖþ×ÖÖ×Öþ×ÕÕÖÕùÖÕÖÕÕÖÕÕÖüÕÖÕÖÖûÕÖÕÕÖÖÕþÖÕÕÖýÕÖÕÕÖúÕÔÕÔÕÔÔÕþÔÕÕÔÕÔÕÔýÕÔÕÕÔüÕÔÕÔÔÕÔþÕÔ~ÔýÓÔÓÓÔÓÔ ÓþÔÓÓþÔÓ
ÓþÔÒÒüÓÒÓÒÒõÓÒÒÓÒÒÓÒÓÒÓÓüÒÓÒÓÓÒþÓÒÒÓøÒÓÓÒÒÓÓÒÒÓïÒÓÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÒûÑÒÒÑÒÒþÑÒÒÑþÒÑÑþÒÑÑÒþÑÒÒÑÒüÑÒÒÑ~ÑÐþÑÐÐþÑÐÐÑÐÑøÐÑÐÑÐÐÑÐÐþÑÐÐýÏÐÏÏþÐÏÏïÐÏÐÏÐÐÏÐÏÐÏÐÏÐÏÐÏÏÐÏÐüÏÐÐÏÏÐÏõÐÏÏÐÐÏÏÐÏÏÎÎÏÎÏøÎÏÏÎÏÎÎÏÏþÎÏÏÎÏÎÏéÎÏÎÏÎÏÎÏÎÏÏÎÏÏÎÏÎÎÍÎÎÍÎÎÍÎþÍÎÎùÍÎÎÍÎÍÎÎÍýÎÍÎÎùÍÎÎÍÎÍÎÎûÍÎÎÍÎÎýÍÎÍ €ÍúÌÍÍÌÍÌÌÍûÌÍÌÍÌÌÍÌõÍÌÍÌÌÍÌÌÍÍÌÌþÍÌÌùÍÌÍÌÌÍÌÌþÍÌÌþËÌÌþËÌÌüËÌËÌÌËÌúËÌÌËËÌÌþËÌÌùËÌËÌËËÌÌËÌøËÌËÌÌËÌËËþÊËËþÊËËþÊËËûÊËËÊËËþÊËËþÊË ËüÊËÊËË@ÊùÉÊÉÊÉÊÉÉþÊÉÉüÊÉÊÉÉÊÉùÊÉÊÉÉÊÉÉüÊÉÊÉÉúÊÉÊÉÊÉBÉÈøÉÈÈÉÉÈÉÈÈÉíÈÉÈÉÈÉÉÈÉÈÈÉÈÉÈÉÉÈÉÉþÈÉÉÈúÉÈÉÉÈÉÉþÈÉÉýÈÉÈ ÈþÇÈÈþÇÈÈþÇÈÈúÇÈÈÇÈÇÇ ÈþÇÈÈþÇÈ ÈÇþÆÇ'ÇÆþÇÆÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆÇÆøÇÆÇÇÆÆÇÆ
ÆþÇÆÆþÇÆCÆ ÿ ?Íýçæç îçþæçDçþæç †çæþçææïçææçææçææççæçææçææþçæ
æûçææçææûçææçææçæûåææåææåæýåæååúæååææååøæåææååæååþæååþæååæþäååäåäûåääåääýåäååüäåäååþäååäåúäååääååäå äþãääþãääþãääãäþãääùãäãäããääþãääüãääã~ãâãâþãââûãâãâããâùãâãââãââûãââãââãâãâãâüãâãââþáââáâþáââáâüáââááâïáââááââáââááââááââûáâáàááüàáàá
áþàááûàááàááúàáàáàááþàááüàááà~àóßàßàßßàßàßààßßüàßàßßàßûàßààßß÷àßàßààßàßßàß÷àßßààßÞÞßßûÞßßÞßßýÞßÞÞòßÞßÞßßÞßÞßßÞÞßßÞßÞïßÞÞßÞßÞÞßßÞÞßßÞÞßßÞüÝÞÝÞ
ÞøÝÞÞÝÞÞÝÞÞüÝÞÝÞÞ?ÝýÜÝÜÜÝÜüÝÜÝÜÜþÝÜÜüÝÜÝÜÜùÝÜÜÝÜÝÜÜúÝÜÜÝÝÜÜûÝÜÝÜÝÝEÜ÷ÛÜÜÛÜÛÛÜÛÛÜþÛÜÜþÛÜÜûÛÜÛÜÛÛýÜÛÜÜþÛÜÜþÛÜÜÛÜþÛÜÜýÛÜÛÛÚüÛÚÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛÛþÚÛ Û=ÚþÙÚÚõÙÚÙÚÙÚÙÚÙÚÙÙøÚÙÙÚÙÚÚÙÙþÚÙÙûÚÙÙÚÙÙþÚÙÙüÚÙÙÚÚÙÚÙþÚØØüÙØÙØØÙüØÙÙØØÙØûÙØØÙØØúÙØØÙØÙÙØþÙØØùÙØÙØÙØÙÙGØ×Øþ×ØØþ×ØØþ×ØØþ×ØØþ×ØØû×ØØ×ØØþ×ØØü×ØØ×>× Öþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖü×Ö×ÖÖ×
Öþ×Ö ÖýÕÖÕÕþÖÕÕýÖÕÖÖÕÖÕúÖÕÖÕÖÕÕýÖÕÖÖÕûÖÕÖÖÕÕÔøÕÔÕÔÕÕÔÕÕÔÕþÔÕÕÔÕÔÕÔþÕÔÔýÕÔÕÕþÔÕÕúÔÕÕÔÕÔZÔþÓÔ!ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓ ÓþÔÓÓìÔÓÒÓÒÓÒÓÓÒÓÒÓÒÓÓÒÒÓÒÒÓþÒÓÓÒúÓÒÒÓÓÒÒþÓÒÒÓýÒÓÒÒëÓÒÓÒÒÓÒÒÑÒÒÑÒÑÒÑÒÒÑÑÒÒÑÒ÷ÑÒÑÑÒÒÑÒÑÑ÷ÒÑÒÒÑÒÑÑÒÒþÑÒÒùÑÒÑÒÒÑÒÒ €ÑÐÑøÐÑÐÐÑÐÑÐÐÑÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐöÑÐÑÐÐÑÐÐÑÐÐÏþÐÏÏþÐÏÏÐþÏÐÐÏðÐÏÏÐÏÐÏÏÐÏÐÏÐÏÐÏÏþÐÏÏÐÏüÐÏÐÏÏþÎÏÏÎÏþÎÏÏþÎÏÏÎÏþÎÏÏÎÏûÎÏÏÎÏÏýÎÏÎÎÏòÎÏÎÏÏÎÏÎÏÎÏÎÍÎÎÍúÎÍÎÎÍÎÎúÍÎÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎ ÍÌûÍÌÍÍÌÌþÍÌÌïÍÌÌÍÌÍÍÌÍÌÍÌÌÍÌÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌùÍÌÌÍÌÍÌÌýËÌËËÌËùÌËÌÌËÌËËôÌËËÌËËÌÌËËÌËËÌþËÌÌõËÌÌËÌÌËÌËÌËËüÊËÊËËûÊËÊÊËËüÊËÊËËüÊËÊËËûÊËÊÊËËýÊËÊ>ÊýÉÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉCÉÈÉüÈÉÈÉÉûÈÉÈÈÉÉÈþÉÈÈÉÈÉÈñÉÈÉÉÈÈÉÈÉÉÈÉÉÈÉÉüÈÉÉÈÈûÇÈÈÇÈÈþÇÈÈûÇÈÈÇÈÈþÇÈÈþÇÈÈÇÈýÇÈÇ@ÇÆÇÆþÇÆÆûÇÆÆÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆüÇÆÇÆ>Æ ?Í=çþæççþæç/çþæç8çæçæþçææþçææüçæçææþçææüçæçææüçæçææþçææûçææçææûåææåææåæåæåæûåæååææåæþåææåþæååúæååææååæåäüåääååäåþäååäåþäååäåäåþäååäåøäåääååäååþãääþãääþãääãäþãääþãääòãääãäãäãääãäãääúãääãäã €ãýâãââúãâãâãââþãââãýâãââãýâãââãâûãââãââãâãôâãââááââááâááþâááâûáââáââáâüáâáââþáââáûâááâááâáâþàááøàáàáàáàááûàááàááàáþàááþàááþàááþàááúàáàááà~àßúàßßààßßþàßßûàßààßßùàßààßàßßàóßàßààßßàßààßààûßàßàßßþàßßýÞßÞÞýßÞßßÞüßÞÞßßýÞßÞÞþßÞÞßþÞßßÞßûÞßßÞßßÞÝÞüÝÞÝÞÞûÝÞÞÝÞÞþÝÞÞüÝÞÝÞÞÝþÜÝ ÝþÜÝÝÜÝÜÝÜþÝÜÜÝ ÜÝÜüÝÜÝÜCÜÛÜÛûÜÛÜÛÜÜüÛÜÛÜÜþÛÜÜÛÜÛþÜÛÛîÜÛÛÜÜÛÜÛÜÜÛÛÜÛÛÚÚÛÛûÚÛÛÚÛÛþÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙÚÙþÚÙÙþÚÙÙÚ ÙüÚÙÚÙÙþÚÙÙûÚÙØÙØØÙØÙüØÙÙØØÙØýÙØÙÙØüÙØÙØØÙþØÙÙØÙýØÙØCØ×Øþ×Ø Øþ×ØØþ×ØØø×Ø×ØØ×Ø××Øþ×Ø Øü×ØØ×>×Ö×Ö×Öþ×ÖÖ×Öþ×ÖÖ×Ö×þÖÕÕÖÕøÖÕÖÕÖÕÖÕÕÖ÷ÕÖÕÕÖÕÕÖÕÕÖþÕÖÖúÕÖÕÖÖÕÕ÷ÖÕÕÖÕÖÕÕÖÖúÕÖÕÕÖÕÕÔÕþÔÕÕÔÕûÔÕÔÔÕÕúÔÕÔÔÕÔÔÕÔÕÔÕÔÕûÔÕÔÔÕÕ ÔÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓÔÓþÔÓÓþÔÓÓþÔÓÓÔÓÒ÷ÓÒÒÓÒÒÓÓÒÒøÓÒÒÓÓÒÓÒÒüÓÒÒÓÓùÒÓÒÒÓÓÒÒþÓÒÒÓøÒÓÒÒÓÓÑÒÒÑ÷ÒÑÑÒÑÒÒÑÒÒÑÒÑÒÑÒüÑÒÑÒÒÑõÒÑÒÑÑÒÑÒÒÑÒÒ ÑÐÑÐþÑÐÐÑÐþÑÐÐþÑÐ ÐûÑÐÐÑÏÏóÐÏÏÐÏÏÐÏÐÏÐÐÏÏÐÏúÐÏÐÐÏÐÐüÏÐÏÐÐÏÐÏýÐÏÐÐÏÐÏÎÏùÎÏÎÏÏÎÏÏÎúÏÎÏÏÎÏÏüÎÏÎÏÏÎÏÎÏúÎÏÎÏÏÎÎÏùÎÏÏÎÎÏÎÎþÍÎÎþÍÎ ÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎ
ÎÍÎ ‚ÍýÌÍÌÌûÍÌÍÌÍÍÌûÍÌÌÍÌÌüÍÌÍÌÌþÍÌÌüÍÌÍÌÌþÍÌÌÍ÷ÌÍÌÍÌÍÌÍËËÌùËÌËËÌÌËËÌËÌþËÌÌýËÌËËþÌËËÌËÊËþÊËËõÊËËÊËËÊËËÊËËþÊËËþÊËËøÊËËÊËËÊËËýÊËÊ?ÊÉþÊÉÉóÊÉÉÊÉÉÊÉÊÉÊÊÉÉÊ ÉÊ ÉüÊÉÊÉAÉÈÉÈÉþÈÉÉþÈÉÉúÈÉÈÈÉÈÈÉýÈÉÈÈøÉÈÉÉÈÉÈÉÉÈÉùÈÉÈÈÉÈÉÉ ÈÇÈþÇÈÈÇÈùÇÈÈÇÈÇÈÈþÇÈÈÇÈûÇÈÇÇÈÈüÇÈÈÇ?ÇõÆÇÇÆÆÇÆÆÇÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆùÇÆÇÆÇÇÆÆÇAÆ ?Í
çþæç Ûçþæç Öçæþçææþçææþçæ æþçææçæùçæçææçææþçææåûæååæååüæååææåæåýæåææåþæååæåæåùæåææåäååäþåääåõäååääåääååääïåääåäåäåääåäåäåäååþäååùäåääåäååùäãääããääþãääúãäãäãääùãäãäããääþãääþãääãäãä ãýâãââüãââããâãâúãââããââûãââãââþãââãâãûâããâããâáùâááââáââáâáâáùâááââáââ÷áâááâááâááâáúâáââáââøáâáââáàááþàááþàááàýáàááüàáàááþàááþàááþàááþàáá €àßüàßàßßþàßßüàßàßßàßøàßàßàßàßßàßàßûàßßàßßüàßÞßßÞßþÞßßÞßþÞßßþÞßßÞýßÞßßÞßÞþßÞÞüßÞÞßßûÞÝÞÝÞÞüÝÞÝÞÞþÝÞÞþÝÞÞþÝÞÞþÝÞÞÝÞþÝÞÞÝÞõÝÞÝÞÞÝÞÝÞÞÝ?Ý ÜÝÜþÝÜÜÝ ÜþÝÜÜþÝÜÜþÝÜÜÝCÜÛúÜÛÜÜÛÜÜÛÜþÛÜÜÛýÜÛÜÜÛýÜÛÜÜýÛÜÛÛÜôÛÜÛÜÜÛÜÜÛÛÜÛÛþÚÛÛüÚÛÚÛÛÚýÛÚÛÛþÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛþÚÛÛÚþÙÚ4ÚÙÚÙÚÙþÚÙÙ÷ÚÙÙÚÚÙÙÚÙÙÚöÙÚÙÚÙÙÚÙÙÚÚýÙÚÙÙûÚØØÙØØþÙØØüÙØØÙÙØÙ
ØÙ÷ØÙÙØØÙÙØÙÙþØÙÙØþÙØCØü×Ø×Ø Øý×Ø××Ø×Ø×
Øþ×ØØ×Øþ×ØØ?×Öþ×ÖÖþ×ÖÖ×Öþ×Ö Öþ×Ö Ö×Öü×ÕÕÖÖÕÖÕÖÕþÖÕÕûÖÕÖÖÕÕÖýÕÖÕÕÖÕþÖÕÕÖÕüÔÕÔÕÕþÔÕÕûÔÕÕÔÕÕÔÕüÔÕÔÕÕûÔÕÔÔÕÕÔ÷ÕÔÕÕÔÔÕÔÕÕýÔÕÔ ÔûÓÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓþÔÓÓüÔÓÔÓÓÔÓÒÓûÒÓÓÒÓÓÒÓýÒÓÒÒÓÒÓúÒÓÒÒÓÒÒûÓÒÓÒÓÓùÒÓÒÒÓÓÒÒÓÒûÓÒÒÑÒÒêÑÒÒÑÒÑÑÒÒÑÑÒÑÒÑÑÒÑÑÒÒÑÑÒÑ÷ÒÑÒÒÑÒÑÑÒÒÑúÒÑÒÒÑÒÒ €ÑÐÑÐþÑÐ ÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐúÑÐÏÐÐÏÏÐÏõÐÏÐÐÏÏÐÐÏÏÐÐýÏÐÏÏúÐÏÐÏÐÏÏÐÏùÐÏÐÏÏÐÏÏûÐÎÏÏÎÎòÏÎÎÏÎÎÏÏÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎýÏÎÏÏüÎÏÎÏÏþÎÏÏöÎÏÏÎÏÎÏÎÏÎÎýÍÎÍÍÎþÍÎ
ÎþÍÎÎþÍÎÎÍûÎÍÎÍÎÎýÍÎÍ~ÍÌöÍÌÌÍÌÍÌÌÍÌÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌôÍÌÍÍÌÍÍÌÍÌÍÌÌþÍÌÌþÍÌÌËÌËÌòËÌÌËÌÌËËÌËÌÌËÌÌËþÌËËüÌËËÌÌüËÌËÌÌòËÌÌËËÌËÌÌËËÌÌËËÊËþÊËËøÊËÊÊËÊÊËËûÊËËÊËËüÊËÊËËþÊËËÊË?ÊÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉûÊÉÊÊÉÉúÊÉÊÉÊÉÉþÊÉÉþÊÉEÉüÈÉÈÉÉÈÉþÈÉÉùÈÉÈÉÈÈÉÉÈýÉÈÉÉÈÉûÈÉÉÈÉÉüÈÉÉÈ ÈûÇÈÈÇÈ ÈûÇÈÈÇÈÈþÇÈÈüÇÈÇÈÈúÇÈÈÇÇÈ È?ÇÆþÇÆÆþÇÆÆþÇÆÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÇÆDÆ ÿ ?Í éçþæç Öçæþçæ æüçæçææçæçæûçæççææþçææþçææøçæçæåæåææüåææååþæååúæåæååææùåæåæåæååüæåæååûæåææååüæåæååöæååääåäåäååþäååäøåäåäååäååëäåääååääååääåäåäåäåäååþäå åüäãäããäãäãäþãääãäüãäãääãäûãääãää „ãûâãââããüâããââüãâãââþãââöãâãâããââãââãâúãâãâãââþáââýáâááþâááâáúâáâááââüáââááâùáââáâáââáëâááââáàááàáàáàááàááàááþàááþàááþàááþàá áþàááþàáá €àýßàßßàßàßöàßßàßßààßààßàßþàßßòàßßàßßàßàßßààßß÷àßàßßàßßÞÞýßÞßßüÞßßÞÞýßÞßßþÞßßûÞßßÞßßüÞßÞßßûÞßÞÞßßýÞßÞÞðßÞÞßßÞßßÞßÞÞÝÞÝÞÞÝúÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ Þ@ÝÜþÝÜÜþÝÜÜûÝÜÜÝÜÜþÝÜÜþÝÜÜøÝÜÜÝÜÜÝÜÜÝÜþÝÜEÜÛþÜÛÛÜÛðÜÛÜÜÛÜÛÜÛÛÜÛÛÜÜÛÛÜÛúÜÛÛÜÛÜÜÛÜòÛÜÛÛÜÛÜÛÜÛÛÜÚÛ ÛþÚÛ
ÛþÚÛÛþÚÛÛüÚÛÚÛÛ?ÚÙþÚÙÙûÚÙÙÚÙÙúÚÙÙÚÚÙÙùÚÙÚÙÙÚÙÙûÚÙÙÚÙÙøÚÙÙÚÙÙÚÙÙÚÙØþÙØØÙØÙûØÙØÙØØõÙØÙØÙØÙØØÙØØüÙØÙØØÙôØÙÙØÙØØÙÙØÙØ?Øþ×ØØî×ØØ×Ø×Ø××Ø×ØØ×ØØ×ØØü×Ø×ØØþ×ØØû×ØØ×ØØ×Ø?×ýÖ×Ö Öþ×ÖÖü×Ö×ÖÖþ×ÖÖû×Ö××ÖÖ×þÖ×× Öù×ÖÖÕÕÖÕÕýÖÕÖÖÕþÖÕÕÖüÕÖÕÖÖÕûÖÕÖÖÕÕõÖÕÕÖÕÖÕÖÖÕÖÖÕþÔÕÕÔüÕÔÕÔÔÕÔÕûÔÕÕÔÕÕúÔÕÕÔÕÔÔûÕÔÕÔÕÕöÔÕÔÕÕÔÕÔÕÔCÔþÓÔ=Ô ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓûÔÓÓÔÓÓøÔÓÓÔÔÓÔÓÓþÔÓÓÒøÓÒÒÓÓÒÓÒÒíÓÒÒÓÒÓÒÓÓÒÒÓÒÓÒÓÓÒÓÓÒÓóÒÓÓÒÓÓÒÓÓÒÓÓÒÒÓÒüÓÒÑÒÒÑÒ÷ÑÒÑÑÒÒÑÑÒÒñÑÒÑÑÒÑÑÒÑÒÒÑÒÑÒÒÑøÒÑÑÒÑÒÑÒÒÑÒ ÑÐþÑÐÐþÑÐÐûÑÐÐÑÐÐþÑÐÐþÑÐÐþÑÐÐÑÐþÑÐÐÏÐÏñÐÏÐÏÏÐÏÐÐÏÐÐÏÏÐÐýÏÐÏÏÐ÷ÏÐÏÐÏÐÏÏÐÐÏÐýÏÐÏÏþÐÏÏÐÏÎÏÎûÏÎÏÎÏÏûÎÏÏÎÏÏýÎÏÎÎûÏÎÏÎÏÏÎÏþÎÏÏþÎÏÏýÎÏÎ ÎþÍÎÎüÍÎÍÎÎûÍÎÎÍÎÎûÍÎÍÍÎÎÍÎüÍÎÍÎÎÍÎ ‚ÍÌûÍÌÌÍÌÌûÍÌÌÍÌÌüÍÌÌÍÍÌÍÌýÍÌÍÍÌüÍÌÍÌÌþÍÌÌüÍÌÌÍÍýÌÍÌÌËþÌËËùÌËÌËËÌËËÌËÌþËÌÌËÌËÌËþÌËËÌþËÌÌËÌþËÌÌúËÌÌÊÊËËþÊËËþÊËËùÊËÊËÊÊËËþÊËËøÊËÊËÊËÊËËúÊËËÊÊËËþÊËËÊËüÊËËÊ>ÊÉþÊÉÉþÊÉÉþÊÉÉùÊÉÉÊÉÊÉÉþÊÉÉþÊÉÉþÊÉ ÉþÊÉÉúÊÉÉÊÊÉGÉÈÉúÈÉÈÉÉÈÈÉþÈÉÉúÈÉÉÈÈÉÉÈüÉÈÈÉÉÈÉÈúÉÈÉÈÉÈ
ÈþÇÈÈûÇÈÈÇÈÈÇÈþÇÈÈõÇÈÇÇÈÈÇÈÈÇÈÈþÇÈÈÇÈ@ÇÆþÇÆÆþÇÆÆþÇÆÆþÇÆ
ÆþÇÆÆÇÆþÇÆDÆ ?Í “çþæç Åçþæçdçùæçæçæçææçæçæçæþçææçæþçææûçæççææåæåæúåæååæååèæåæååæåæåæåæåæåææååææåæååæåþæååøæååääååääåüäåäååäúåääåäååþäååäøåäååäåäååäåäþåääãäþãääþãääþãääþãääãýäãääþãääþãää €ãâþãââãýâãââüãââããâõãâããâãââããââûãââãââãýâãââþãââûãââãââþáââþáââáâüáâáââøáââááâáââüáâáââýáâááúâááâáââõáâáâáââááàá áþàá áþàááþàá áþàááþàááàá €àßàßàßûàßßàßßöàßààßßàßàßßàßþàßßþàßßÞýßÞßßÞßþÞßßÞßúÞßßÞÞßßÞßéÞßßÞÞßßÞßßÞßÞÞßÞÝÞÝÞÝÝÞÞþÝÞÞþÝÞÞüÝÞÝÞÞÝ
ÞþÝÞÞÝÞ%ÝþÜÝÝÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜþÝÜÜùÝÜÜÝÜÝÜFÜÛÜçÛÜÛÜÛÜÛÛÜÛÜÛÛÜÛÜÜÛÜÛÜÛÜÛÜÜÛÜÛÜÛÜüÛÜÜÛÛÜóÛÜÜÚÚÛÚÚÛÚÛÚÛÛûÚÛÛÚÛÛþÚÛÛÚÛÚöÛÚÛÛÚÛÛÚÛÚ>ÚýÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚÙüÚÙÚÙÙþÚÙÙþÚÙÙØÙúØÙÙØÙØØüÙØÙØ
ØÙøØÙØØÙØÙØØüÙØÙØØøÙØØÙÙØØÙÙØüÙØÙØ@Ø×Øþ×ØØþ×ØØ×Øþ×ØØþ×ØØþ×ØØ?×Öþ×ÖÖþ×Ö Ö×Ö×Öþ×ÖÖþ×ÖÖù×Ö×ÖÖ×ÖÖÕþÖÕÕòÖÕÖÕÕÖÕÕÖÖÕÕÖÕÕøÖÕÖÕÕÖÖÕÕþÖÕÕùÖÕÕÖÕÖÕÕÖõÕÖÖÕÖÕÖÕÕÖÕÕûÔÕÔÔÕÕÔþÕÔÔûÕÔÕÔÕÕþÔÕÕúÔÕÔÕÔÕÕúÔÕÔÕÔÕÕüÔÕÔÕÕûÔÕÕÔÕÕ €ÔÓûÔÓÔÔÓ ÓùÔÓÔÔÓÔÓÓþÔÓÓþÔÓÓþÔÓÓÒðÓÒÓÓÒÓÒÓÒÒÓÓÒÒÓÒÒöÓÒÓÒÒÓÓÒÓÒÒþÓÒÒÓýÒÓÒ
ÒúÓÒÒÑÑÒÒÑÒþÑÒÒ÷ÑÒÑÒÑÑÒÑÒÒþÑÒÒÑþÒÑÑÒþÑÒÒûÑÒÑÒÑ ƒÑÐþÑÐÐÑýÐÑÐÐþÑÐÐÑÐþÑÐÐþÑÐÐþÑÐÐþÑÐÐþÏÐÐÏþÐÏÏÐýÏÐÏÏöÐÏÐÏÏÐÏÏÐÏÏûÐÏÐÏÐÐÏþÐÏÏþÐÏÏ÷ÐÏÐÏÐÏÐÐÏÏþÎÏÏÎÏÎÏüÎÏÎÏÏúÎÏÎÏÏÎÎÏöÎÏÎÎÏÏÎÎÏÎÎþÏÎÎÏÎþÍÎÎÍÎÍÎþÍÎÎöÍÎÎÍÍÎÍÎÍÎ
ÎþÍÎÎ ÍüÌÍÍÌÌÍÌþÍÌÌÍÌÍøÌÍÌÍÌÌÍÌÌÍÌÍÌÍúÌÍÌÌÍÌÌËþÌËËýÌËÌÌËÌËÌþËÌÌþËÌÌïËÌËÌËËÌËËÌËËÌËÌËÌÌýËÌËËõÌËÌÌËËÌÌÊÊË ËþÊËËÊËþÊËËþÊËËúÊËÊËÊËËþÊËËüÊËËÊ>Ê ÉþÊÉ ÉþÊÉÉþÊÉÉùÊÉÊÉÉÊÉÉþÊÉÉþÊÉ?ÉÈýÉÈÉÉûÈÉÈÉÈÈýÉÈÉÉüÈÉÉÈÈúÉÈÉÈÉÈÈõÉÈÉÈÈÉÈÈÉÉÈÈÉûÈÉÈÈÉÉÈþÉÈÈþÇÈÈüÇÈÇÈÈôÇÈÇÇÈÇÈÇÈÈÇÈÈûÇÈÈÇÈÈþÇÈÈÇÈþÇÈÈüÇÈÈÇ?ÇýÆÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÆÇÆ>Æ ?Í|çþæçAçýæçææþçææþçææþçææüçæçææþçæ
æþçææ÷çæçææçæçææýåæååþæååæøåææååææååæåæõåæåææååææåææåæåäýåäååäýåäååäýåäååùäååääåääåþäååäåþäååäþåä
äãäþãääãäúãäãäãääúãäããäã~ãýâãââùãââãâãââã÷âãââããâãââãüâããââüãâãââõãââããâãââãââþáââúáââááââþáââüáâáââüáâáââþáââþáââáâùáââáâáââûáâáàááþàááþàááþàááþàááþàá á €àýßàßßàßùàßàßààßßþàßßàßàøßàßààßàßßàýßàßßðàßààßàßàßßÞÞßÞÞßßÞüßÞÞß ßúÞßÞßÞßßÞßÞßÞþßÞÞßÝúÞÝÝÞÝÞÞþÝÞÞþÝÞÞõÝÞÞÝÞÝÞÝÞÝÞÞüÝÞÝÞÞ@ÝÜøÝÜÝÝÜÜÝÜÜþÝÜ ÜþÝÜÜ÷ÝÜÜÝÜÜÝÝÜÜüÝÜÝÜÜüÝÜÝÜCÜþÛÜÜÛÜÛþÜÛÛÜÛÜÛÜÛíÜÛÜÛÛÜÜÛÛÜÜÛÜÛÜÜÛÜÛÛÜýÛÚÛÛþÚÛÛüÚÛÚÛÛþÚÛÛùÚÛÛÚÛÚÛÛûÚÛÛÚÛÛøÚÛÚÛÚÛÚÛÛþÚÛÛ?ÚÙ÷ÚÙÚÙÙÚÙÚÙÙÚ
ÙþÚÙÙþÚÙÙþÚÙÙÚýÙÚÙÙþÚÙÙûÚÙÙÚÙÙýØÙØØþÙØØýÙØÙÙþØÙÙñØÙÙØØÙØÙØÙØÙØÙØØþÙØØþÙØØÙýØÙØØþÙØAØ×
Ø×Øþ×ØØþ×ØØþ×ØØþ×Ø Ø×Ø@×Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖ×Öþ×ÖÖþ×ÖÖþ×ÖÖþ×ÖÖü×ÖÖÕÕþÖÕÕÖÕþÖÕÕþÖÕÕýÖÕÖÖÕþÖÕÕùÖÕÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÔÕÕÔüÕÔÔÕÕþÔÕÕÔÕÔùÕÔÕÔÔÕÔÔøÕÔÕÕÔÕÔÕÕÔÕÔþÕÔoÔþÓÔÔüÓÔÔÓÓþÔÓÓþÔÓÓ÷ÔÓÓÔÓÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓþÔÓÓýÒÓÒÒÓüÒÓÓÒÒíÓÒÓÒÒÓÒÓÓÒÓÓÒÓÓÒÒÓÒÒþÓÒÒÓÒòÓÒÓÓÒÓÒÒÓÒÓÒÓÑÑÒýÑÒÑÑÒÑöÒÑÒÑÑÒÒÑÑÒÒþÑÒÒùÑÒÒÑÒÑÒÒþÑÒÒÑÒ €ÑÐþÑÐÐüÑÐÑÐÐþÑÐÐüÑÐÑÐÐûÑÐÐÑÐÐùÑÐÐÑÐÑÐÐþÑÐÐóÑÐÑÐÐÑÑÐÐÏÐÐÏÏÐÏþÐÏÏÐûÏÐÏÐÏÏÐÏþÐÏÏþÐÏÏÐýÏÐÏÏÐþÏÐÐÎùÏÎÏÏÎÎÏÏöÎÏÎÎÏÏÎÏÎÏÏòÎÏÏÎÏÎÏÏÎÏÏÎÎÏÏÎÏÎÏÎþÍÎÎÍÎþÍÎÎþÍÎÎÍÎüÍÎÍÎ ÎþÍÎÎÍþÎÍ €ÍüÌÍÍÌÌýÍÌÍÍÌÍþÌÍÍüÌÍÍÌÌÍÌÍÌìÍÌÍÍÌÌÍÌÍÌÌÍÌÌÍÌÍÌÍÌÌËÌûËÌËËÌÌþËÌÌËÌ÷ËÌÌËÌËÌÌËËÌüËÌËÌÌüËÌËÌÌùËÌËÌËÌËËþÊËËüÊËÊËËþÊËËûÊËËÊËËÊËþÊËËþÊËËþÊËËþÊËËÊË@ÊÉÊÉþÊÉÉþÊÉÉÊÉùÊÉÉÊÉÊÉÉþÊÉÉûÊÉÉÊÉÉþÊÉÉþÊÉEÉýÈÉÈÈÉÈÉÈøÉÈÉÈÈÉÉÈÈÉÈûÉÈÉÉÈÈÉÈÉÈþÉÈÈÉÈþÇÈÈþÇÈÈþÇÈÈüÇÈÇÈÈþÇÈÈùÇÈÇÈÇÇÈÈ@ÇýÆÇÆÆþÇÆÆüÇÆÇÆÆûÇÆÇÇÆÆÇÆþÇÆYÆ ÿ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçææþçææüçæçææçæùçææççÍ åþæååæåþæååæýåæååæåþæååûæåæÍ ÷äåääåäåäååäåäåúäåäååääýåäååúäåääÍ äùãäãääãääþãääþãä äþãääãäãþÍ .ãþÍ .ãþÍ âûãâããââãâãâøãâããââãââúãâãâãâ âþÍ áþâááûâáââááâþáââ÷áâáââáâáââáûâáâÍ áúàáàáàá
áýàáààöáàááàááààá áûàááÍ .àþÍ .àþÍ ßûàßàßààùßààßààßßþàßßùàßàßàßààßþàßßþÍ þÞßßûÞßÞÞßßüÞßÞßßþÞßßÞ÷ßÞßÞßÞßßÞÞßùÞßÞÞßÍ ÞþÝÞÞúÝÞÝÞÝÞÞüÝÞÝÞÞþÍ þÜÝ,ÝþÍ ýÜÝÜÜÝÜþÝÜÜüÝÜÝÜÜþÝÜÜþÝÜÜýÝÍ .ÜþÍ ÜÛÜþÛÜÜöÛÜÛÜÜÛÜÛÜÛÛþÜÛÛÜùÛÜÛÜÛÍ ÛþÚÛÛüÚÛÚÛÛþÚÛÛÚÛþÚÛ ÛûÚÛÚÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙÚûÙÚÙÙÚÚýÙÚÙÙüÚÙÍ ØÙØõÙØØÙØØÙÙØØÙÙúØÙØØÙØØöÙØÙÙØØÙØÙØØÙØýÙÍ .ØþÍ ×Øö×Ø×Ø××ØØ×ØØû×ØØ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖü×Ö×ÖÖþ×ÖÖþ×ÖÖû×Ö××ÖÖ×Öü×Ö×ÖÖû×ÖÖÍ ÖÕûÖÕÕÖÕÕüÖÕÖÕÕþÖÕÕþÖÕÕõÖÕÖÕÖÖÕÕÖÖÕÕûÖÕÕÍ öÕÔÕÔÔÕÕÔÕÔÔÕÔùÕÔÕÕÔÕÔÔÕÔÕÔÕøÔÕÔÕÔÕÍ .ÔþÍ .ÔþÍ ÓþÔÓÓþÔÓÓûÔÓÓÔÓÓùÔÓÓÔÓÔÓÓÔÓûÔÓÓÍ ûÓÒÒÓÒÒüÓÒÓÒÒùÓÒÓÒÓÓÒÒÓýÒÓÒÒþÓÒÒþÍ þÒÑÑÒýÑÒÑÑíÒÑÒÒÑÑÒÒÑÑÒÒÑÒÑÑÒÒÑÑÒþÑÒÒûÑÒÑÍ .ÑþÍ .ÑþÍ ýÐÑÐÐüÑÐÑÐ ÐùÑÐÑÐÐÑÐÐøÑÐÐÑÐÐÑÐÐþÍ ÐùÏÐÐÏÏÐÏÏÐÏÐþÏÐÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ þÏÎÎÏûÎÏÏÎÏÏüÎÏÎÏ ÏüÎÏÏÎÎúÏÎÏÎÎÏÏþÍ üÎÍÍÎÎûÍÎÍÍÎÎþÍÎÎþÍÎÎþÍÎÎþÍÎÎÍüÎÍÍ /Í /Í üÌÍÌÍÍÌüÍÌÌÍÍÌþÍÌÌýÍÌÍÍýÌÍÌÌøÍÌÍÌÌÍÍ ÌûËÌËËÌÌþËÌÌËÌùËÌÌËÌÌËËÌûËÌËÌËËüÌËÍ ËúÊËÊËÊËËúÊËÊËÊËËþÊËËüÊËÍ .ÊþÍ ÉûÊÉÊÊÉÉþÊÉÉþÊÉÉþÊÉÉþÊÉÉüÊÉÊÉÉþÍ .ÉþÍ úÈÉÈÉÈÉÉþÈÉÉÈÉüÈÉÉÈÈÉÈÉùÈÉÈÉÈÉÈÈÉúÈÉÈÉÍ ÈüÇÈÇÈÈüÇÈÇÈÈÇÈÇÈÇÈþÇÈÈùÇÈÈÇÈÍ .ÇþÍ ÆþÇÆ ÆûÇÆÆÇÆÆþÇÆÆüÇÆÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ çþæççýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æçæþçææþçæ æùçæçææçæ
æçþÍ úåæååæååæúåæåææååæåþæååþæååöæåæååæåæÍ þäååûäååäååýäåääåòäåäåäåääååääåääåäåüäåÍ äþãääþãääùãäããäãääþãääþãääûãääÍ .ãþÍ .ãþÍ âúãâãâãââãâûãââãââþãââãâüãâÍ âá÷âááââáââááûâáâáââþáââöáâáâááâááââûáââÍ ýáàááàáüàáàááþàááàáþàááþàááþÍ .àþÍ .àþÍ ßà ßþàßßàßàßôàßàßßààßßàÍ ÞßûÞßßÞßßÞßÞßðÞßÞßÞßÞÞßÞÞßÞßÞßßþÍ
ÞþÝÞÞúÝÞÝÞÝÞÞþÝÞÞþÝÞÞþÍ ÝþÜÝÝþÍ
ÜþÝÜÜþÝÜÜÝùÜÝÜÜÝÝÜÜþÝÜÜþÍ .ÜþÍ ÜÛÜþÛÜÜþÛÜÜýÛÜÛÛÜÛõÜÛÛÜÛÜÛÜÜÛÜÜüÛÜÍ ÛþÚÛÛþÚÛÛþÚÛÛ÷ÚÛÛÚÛÛÚÚÛ ÛþÍ .ÚþÍ ÙüÚÙÚÙÙþÚÙÙþÚÙÙÚÙþÚÙÙþÚÙÙþÚÙÙýÚÍ øÙØØÙØØÙØØ÷ÙØÙØÙØÙÙØØÙøØÙØØÙØÙØØÙØþÍ .ØþÍ ü×Ø×ØØþ×ØØþ×ØØý×Ø××ýØÍ .×þÍ Öþ×ÖÖþ×ÖÖû×ÖÖ×ÖÖþ×ÖÖþ×ÖÖü×Ö×ÖÖþÍ øÖÕÕÖÕÖÕÖÖÕðÖÕÖÕÕÖÖÕÕÖÕÖÕÖÕÖÖÕÖúÕÖÕÖÕÖÖÕýÖÍ ÖÔÕÔÕÔÕÔÕÕÔÔÕÔÕÔÕÕÔÔÕÕÔÕÕÔÕÕÔÔÕÔÕÔÕÔÕÔÔÕÔÕÔÔüÕÔÍ .ÔþÍ -ÔýÓÍ ÔýÓÔÓÓþÔÓÓùÔÓÔÓÔÔÓÓûÔÓÓÔÓÓþÔÓÓýÔÍ ùÒÓÒÓÒÒÓÓÒ÷ÓÒÓÓÒÓÒÓÒÒþÓÒÒÓûÒÓÓÍ úÑÒÒÑÑÒÒÑÒÑøÒÑÒÑÒÒÑÒÒþÑÒÒÑúÒÑÒÑÑÒÒûÑÒÒÍ .ÑþÍ .ÑþÍ ÐÑÐÑøÐÑÐÐÑÐÑÐÐþÑÐÐüÑÐÍ þÐÏÏûÐÏÐÐÏÏþÐÏÏïÐÏÏÐÏÐÐÏÏÐÐÏÐÏÏÐÏÏûÐÏÐÍ þÏÎÎÏÎÏúÎÏÏÎÏÎÎÏýÎÏÎÎþÏÎÎÏÎûÏÎÏÍ ÎþÍÎÎþÍÎÎþÍÎÎûÍÎÍÍÎÎþÍÎ
ÎþÍ /Í /Í þÍÌÌøÍÌÍÌÍÌÍÌÌþÍÌÌóÍÌÌÍÌÍÌÌÍÍÌÌÍÍþÌÍÍûÌÍÌÍÌÌþÍ ÌöËÌÌËÌËËÌËÌÌúËÌÌËËÌÌËýÌËÌÌþËÌÌüËÌÍ ËÊ ËÊüËÊÊËËþÊËËþÍ .ÊþÍ ÉþÊÉÉþÊÉÉþÊÉÉûÊÉÉÊÉÉÊÉüÊÉÍ .ÉþÍ ÉñÈÉÈÉÈÈÉÈÉÈÉÉÈÉÈÈÉþÈÉÉüÈÉÈÉÉÈÉüÈÉÍ ûÇÈÈÇÈÈÇÈþÇÈÈþÇÈÈÇÈþÇÈÈþÇÈÈþÍ .ÇþÍ
ÆûÇÆÇÇÆÆþÇÆÆþÇÆÆþÍ .ÆþÍ *ÍþÇ (çúæçÍÎÕ +çüÜÍÕ ,çýÜÎ -çýÍÇ .çþÍ -çýæÍ .çþÍ æþçæ æþçæ
æüçæçææþÍ åþæååþæååæåûæåææååþæååöæåææååæååææýåÍ üäåäååûäåäåääåþäååäåäåûäåäÍ äã
äþãääþãääãäüãäãääùãäãääÍ .ãþÍ .ãþÍ â÷ãâãâãââãââüãâãââãþâããýâãââãþÍ úáâáâáââþáââþáââáâ÷áâáâááâáââòáââáâáâáââáâÍ áùàááàáàááüàáàááþàááþàááàýáÍ .àþÍ .àþÍ þàßßþàßßýàßààßàßàøßàßßàßàßßàßýàÍ ßþÞßßþÞßßþÞßßùÞßßÞßÞßßÞßÞßøÞßÞßÞßÍ ÞþÝÞÞûÝÞÝÝÞÞþÝÞÞþÝÞ
ÞþÍ .ÝþÍ þÝÜÜþÝÜ ÜÝÜÝöÜÝÜÜÝÝÜÜÝÜÜüÝÜÍ .ÜþÍ üÜÛÛÜÜöÛÜÛÜÜÛÜÜÛÜÜÛ÷ÜÛÜÛÜÛÛÜÛÛþÜÛÛüÜÛÛÜÜþÍ ÛþÚÛÛþÚÛÛÚÛüÚÛÛÚÚÛþÚÛÛüÚÛÚÛÛþÍ ÚþÙÚÚþÍ ÙþÚÙÙüÚÙÚÙÙùÚÙÙÚÙÚÙÙþÚÙÙþÚÙÙþÚÙÙþÍ ØþÙØØòÙØÙØÙÙØØÙØÙÙØÙÙØûÙØÙÙØØöÙØÙØØÙØÙØÙÙýØÍ .ØþÍ Øþ×Ø Øþ×ØØþ×ØØü×Ø×ØØþÍ .×þÍ Öþ×ÖÖô×Ö×Ö×ÖÖ××Ö×ÖÖþ×ÖÖü×Ö×ÖÖü×Ö×ÖÖþÍ ãÕÖÕÖÖÕÕÖÕÖÕÕÖÕÖÕÕÖÕÕÖÖÕÖÖÕÕÖÕÕÖýÕÖÕÕøÖÕÕÖÖÕÍ þÕÔÔþÕÔÔýÕÔÕÕþÔÕÕöÔÕÕÔÕÕÔÕÔÕÕþÔÕÕþÔÕÕýÔÍ .ÔþÍ .ÔþÍ ÓüÔÓÔÓÓÔ÷ÓÔÓÔÔÓÓÔÓ ÓûÔÓÓÔÓÓþÍ ÒþÓÒÒüÓÒÓÒÒÓÒñÓÒÒÓÓÒÒÓÒÒÓÒÒÓÒÒûÓÒÒÍ òÒÑÑÒÑÒÒÑÒÒÑÒÑÒÒÑÒÑøÒÑÒÒÑÒÒÑÑÒÑÒþÍ .ÑþÍ .ÑþÍ ÐþÑÐ ÐúÑÐÑÐÑÐÐþÍ ÏüÐÏÐÏÏÐÏÐÏÐÏÐÏþÐÏÏþÐÏÏúÐÏÐÏÍ ÎøÏÎÎÏÏÎÏÎÎýÏÎÏÏüÎÏÏÎÎÏüÎÏÎÏÏÎúÏÎÏÏÎÏÏþÍ
ÎþÍÎÎüÍÎÍÎÎþÍÎ ÎÍ /Í /Í þÍÌÌþÍÌÌþÍÌÌþÍÌÌþÍÌÌèÍÌÍÍÌÍÌÍÌÌÍÌÌÍÍÌÍÌÌÍÌÌÍ þËÌÌøËÌÌËÌÌËÌÌûËÌÌËÌÌ÷ËÌÌËÌÌËËÌÌóËÌËËÌËÌËËÌÌÍ ËþÊËËøÊËÊËËÊÊËËþÊËËÊýËÊËËùÊËÊËËÍ .ÊþÍ ÉþÊÉÉùÊÉÉÊÉÊÉÉÊÉûÊÉÉÊÉÉþÊÉÉüÊÉÍ .ÉþÍ ýÉÈÉÉÈþÉÈÈÉþÈÉÉûÈÉÉÈÉÉüÈÉÈÉÉüÈÉÈÉÉÈþÍ ÈûÇÈÈÇÈÈÇÈúÇÈÇÈÇÈÈÇÈûÇÈÈÇÈÈþÍ .ÇþÍ ÆÇÆþÇÆ ÆÇÆûÇÆÆÇÆ ÆþÍ .ÆþÍ )ÿýùG ,ÿþ -ÿþ .ÿ .ÿþG .ÿþù /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ þÍÆÆþÅÆ
ÆþÅÆÆÅýÆÅÆÆúÅÆÅÆÆÅÅÆÅýÆÅÆÆþÅÆÆÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅüÄÅÄÅ ÅýÄÅ þÍÄ9Ä ýÍÄÃÃþÄÃÃþÄÃÃÄÃþÄÃÃÄÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄ òÍÂÃÃÂÂÃÂÃÃÂÃÃÂÂÃúÂÃÂÃÃÂÂÃþÂÃÃÂÃÂýÃÂÃÃÂöÃÂÃÂÃÂÃÂà ýÍÅÂ8 ýÍÊÂÂþÁÂÂþÁÂ
ÂþÁÂÂþÁÂÂÁÂüÁÂÁÂÂÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ïÍÆÆÅÆÆÅÆÆÅÅÆÅÆÅÅÆÆÅ ÆþÅÆÆúÅÆÅÆÅÆÆöÅÆÅÆÆÅÆÅÆÅÅ þÍÅÅøÄÅÅÄÅÅÄÅÅûÄÅÅÄÅÅþÄÅÅþÄÅÅúÄÅÅÄÄÅÅþÄÅÅûÄÅÅÄ þÍÄ9Ä ýÍÄÃÃÄÃþÄÃÃûÄÃÃÄÃÃÄÃûÄÃÃÄÃÃûÄÃÃÄÃà üÍÂÂÃÃÂýÃÂÃÃÂþÃÂÂöÃÂÃÂÂÃÂÂÃÂÂÃøÂÃÃÂÂÃÃÂÂöÃÂÃÂÂÃÃÂàýÍÄÂ8 üÍÉÁÂÂÁýÂÁÂÂôÁÂÂÁÂÂÁÂÁÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂÁÂüÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ)ÁþÀÁÁ þÇÍ5Í úÍÆÆÅÅÆÆöÅÆÅÆÅÅÆÅÅÆÆúÅÆÅÆÅÆ ÆÅüÆÅÅÆÆÅÆúÅÆÆÅÅ þÍÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅ ÅþÄÅÅúÄÅÄÅÄÅÅ üÍÄÃÄ7Ä ýÍÃÄÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃà õÍÂÃÃÂÃÂÃÂÃÂÂÃÂÃÂþÃÂÂÃüÂÃÃÂÂÃÂ÷ÃÂÂÃÂÂÃÃÂÂúÃÂÂÃà ýÍÄÂ8 ýÍÊ ÂþÁÂÂÁ ÂþÁÂÂþÁÂÂÁÂþÁ üÇÍÂÁ7Á Î8Á ûÕÍÎÂÁ5Á úÕÎÍÉÃÁ3Á þÇÍ5Í ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ ;ÿ þùÿ9ÿ þGÿ9ÿ :ÿ þÿ8ÿ þÿ7ÿ ýGùÿ4ÿ ÆýÅÆÅÅäÆÅÅÆÆÅÆÆÅÅÆÅÅÆÅÅÆÆÅÆÅÆÆÅÆÆÅÆÆþÅÆÆÅÆûÅÆÆÅÆÆÅÆÅÄøÅÄÅÄÅÄÄÅÅüÄÅÄÅÅþÄÅÅùÄÅÅÄÅÅÄ>ÄÃþÄÃÃøÄÃÃÄÄÃÄà ÃþÄÃÃþÄà ÃþÄÃÃþÄÃÃÂýÃÂÃÃÂþÃÂÂàÃÂÃÂÃÂÃÂÂÃÃÂÃÃÂÃÂÂÃÃÂÃÃÂÃÃÂÃÃÂÂÃÃÂÃýÂÃÂDÂþÁÂÂþÁÂ
ÂþÁÂÂûÁÂÂÁÂÂêÁÂÂÁÂÁÂÁÂÁÂÂÁÂÂÁÂÁÁÂÁÂÂþÁÂÂýÁÂÁ ¿ÁþÀÁ=Á?Í øÅÆÅÆÆÅÆÅÅùÆÅÅÆÅÅÆÆüÅÆÅÆÆûÅÆÅÅÆÆÅýÆÅÆÆÅðÆÅÆÅÆÆÅÆÆÅÅÆÆÅÆÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅÄ Å÷ÄÅÅÄÅÅÄÅÄ?ÄÃþÄÃÃþÄÃÃþÄÃÃøÄÃÄÄÃÃÄÃÃÄøÃÄÃÄÃÃÄÃ
ÃþÄÃÃÂýÃÂÃÃÂüÃÂÃÂÂÃúÂÃÃÂÃÂÂþÃÂÂúÃÂÃÂÂÃÃïÂÃÂÂÃÂÃÂÂÃÂÃÂÃÂÂÃÃýÂÃÂCÂþÁÂÂþÁÂÂÁÂþÁÂÂþÁÂÂþÁ ÂûÁÂÂÁÂÂÁ ÁþÀÁ àÁ?Í þÅÆÆÅÆÅõÆÅÆÅÆÆÅÅÆÅÆÆðÅÆÅÅÆÆÅÅÆÅÆÆÅÆÅÆÆûÅÆÅÅÆÆöÅÆÆÅÅÆÆÅÆÅ
ÅþÄÅÅøÄÅÅÄÅÅÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅþÄÅÅþÄÅÅ?Ä ÃÄ ÃÄûÃÄÃÄÃÃþÄÃÃÄÃüÄÃÄÃÃýÂÃÂÂûÃÂÂÃÂÂþÃÂÂÃÂÃÂÃÂÃûÂÃÂÃÂÂþÃÂÂúÃÂÂÃÃÂÂüÃÂÃÂCÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂþÁÂÂûÁÂÁÁÂÂþÁÂÂÁþÀÁsÁþÀÁÁþÀÁ]Á?Í ÿ ýÅÆÅÅÆöÅÆÅÆÅÆÆÅÆÅÅÆþÅÆÆþÅÆÆøÅÆÆÅÆÆÅÆÆÅÆþÅÆÆÅÆÄÅûÄÅÄÄÅÅþÄÅÅþÄÅÅÄýÅÄÅÅþÄÅÅþÄÅ
Å?ÄÃþÄÃÃÄýÃÄÃÃþÄÃÃþÄÃ
ÃÂýÃÂÃÃÂÃÂÃÂðÃÂÃÂÃÂÂÃÂÂÃÃÂÃÃÂÂþÃÂÂþÃÂÂÃýÂÃÂÂþÃÂHÂþÁÂÂþÁÂÂþÁÂÂüÁÂÂÁÁÂýÁÂÁÁ?Í øÆÅÆÅÅÆÆÅÅÆýÅÆÅÅÆüÅÆÅÆÆÅÆÅýÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÄÅÅþÄÅÅÄ÷ÅÄÅÄÅÅÄÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄ ÅýÄÅÄ>ÄÃþÄÃÃþÄÃ
ÃÄÃþÄÃÃþÄÃÃþÄÃÃÂÃÂøÃÂÃÂÂÃÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂÃþÂÃÃýÂÃÂÂöÃÂÂÃÃÂÂÃÃÂBÂûÁÂÂÁÂÂÁÂÁÂôÁÂÂÁÂÁÂÂÁÂÁÂÂûÁÂÁÁÂÂÁ Á?Í ÅÆæÅÆÅÅÆÅÆÆÅÅÆÆÅÆÆÅÆÆÅÆÆÅÅÆÅÆÆþÅÆÆþÅÆÆÅÆüÅÆÆÅÅ÷ÆÅÆÅÅÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅÄÅþÄÅÅ?ÄÃúÄÃÄÃÄÃ
ÃþÄÃÃþÄà ÃþÄÃÃÄÃþÄÃÃùÄÃÄÃÃÄÂÂÃÂÃÂÃÂ÷ÃÂÃÂÃÃÂÃÂÂÃýÂÃÂÂþÃÂÂõÃÂÃÂÂÃÃÂÃÃÂÂþÃÂÂÃýÂÃÂ?ÂõÁÂÂÁÂÂÁÂÁÁÂÂþÁÂÂÁÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂ÷ÁÂÁÂÂÁÂÂÁpÁþÀÁ ŒÁ?Í ÿ ÆûÅÆÅÆÅÅÆÅÆøÅÆÆÅÆÅÅÆÆÅþÆÅÅþÆÅÅÆëÅÆÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÄÅÄÅÅúÄÅÅÄÄÅÅþÄÅÅÄ ÅþÄÅÅ@Ä ÃþÄÃÃÄÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃÄüÃÄÄÃÃùÄÃÃÂÃÃÂÂýÃÂÃÃÂÃÂÃÂþÃÂÂýÃÂÃÃÂþÃÂÂöÃÂÂÃÂÂÃÂÃÂÂþÃÂPÂþÁÂÂôÁÂÁÁÂÁÂÁÂÂÁÂÂþÁÂÂþÁÂÂþÁ êÁþÀÁ ÁþÀÁÁ?Í ÆýÅÆÅÅÆþÅÆÆÅÆÅÆûÅÆÆÅÆÆÅþÆÅÅÆûÅÆÆÅÆÆÅÆÅþÄÅÅûÄÅÅÄÅÅþÄÅÅÄÅþÄÅ
ÅûÄÅÄÄÅÅÄùÅÄÄÅÅÄÅÅ?ÄÃþÄÃÃôÄÃÄÃÃÄÃÃÄÃÄÃÃþÄà ÃþÄÃÃüÄÃÄÃÃüÄÃÄÃÃþÄÃÃÂÃÂÃýÂÃÂÂùÃÂÂÃÂÃÂÂÃÂÃõÂÃÂÃÃÂÂÃÃÂÃÃÂÃýÂÃÂBÂÁÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂþÁÂÂÁÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÂÁ ÿÁ?Í ÆüÅÆÅÆÆÅÆøÅÆÅÆÅÆÅÆÆþÅÆÆùÅÆÅÅÆÅÆÆùÅÆÅÆÆÅÆÆûÅÆÅÅÆÆýÅÆÅÅüÄÅÄÅÅÄÅÄÅÄÅþÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅüÄÅÅÄ>ÄÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃÄÃøÄÃÃÂÃÂÃÂÂþÃÂÂþÃÂÂüÃÂÂÃÃÂÃýÂÃÂÂõÃÂÂÃÃÂÃÂÂÃÂÂÃþÂÃÃÂþÃÂTÂÁÂüÁÂÁÂÂþÁÂÂþÁÂÂþÁÂÂúÁÂÂÁÁÂ
 –ÁþÀÁgÁ?Í ÿ ÆþÅÆÆüÅÆÆÅÅÆÅÆýÅÆÅÅýÆÅÆÆÅÆÅüÆÅÅÆÆþÅÆÆÅÆÅþÄÅ ÅþÄÅÅ÷ÄÅÅÄÄÅÅÄÅÅþÄÅÅþÄÅÅûÄÅÅÄÅÅùÄÅÅÄÄÅÄ>ÄýÃÄà ÃþÄÃÃþÄÃÃþÄÃÃüÄÃÄà ÃþÄÃÃõÂÃÃÂÃÂÃÃÂÃÂÂþÃÂÂüÃÂÃÂÂþÃÂÂ÷ÃÂÂÃÃÂÃÃÂÂÃûÂÃÂÃÂJÂÁýÂÁÂÂþÁÂÂþÁÂÂüÁÂÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂôÁÂÁÂÂÁÂÁÂÂÀÁ æÁþÀÁÁ?Í ýÆÅÆÆüÅÆÅÆÆÅÆÅøÆÅÅÆÅÆÅÆÆøÅÆÅÆÅÅÆÅÅÆüÅÆÅÆÆÅÆ÷ÅÆÆÅÆÅÅÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅþÄÅÅ?ÄÃóÄÃÄÃÃÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÃÄÃûÄÃÃÄÃÃÄÃþÄÃÃøÂÃÂÂÃÂÃÂÂüÃÂÃÂÂþÃÂÂÃöÂÃÂÂÃÂÃÂÂÃÃòÂÃÂÃÂÃÂÂÃÂÂÃÂÃÃÂÃýÂÃÂÂþÃÂWÂþÁÂÂþÁÂÂþÁ Á?Í ÅÆþÅÆÆþÅÆÆíÅÆÆÅÆÅÅÆÅÆÆÅÆÅÆÅÆÅÆÆþÅÆÆÅÆýÅÆÅÅÆÅÆýÅÆÅÅþÄÅÅþÄÅ
ÅÄýÅÄÅ
ÅûÄÅÄÄÅÅþÄÅÅÄÅ@ÄÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄûÃÂÃÂÃÃÂþÃÂÂÃýÂÃÂÂûÃÂÂÃÂÂÃúÂÃÂÂÃÂÂþÃÂÂÃÂüÃÂÃÂBÂÁÂüÁÂÁÂÂÁÂþÁÂÂÁÂûÁÂÂÁÂÂþÁ  Á?Í ÿ ýÆÅÆÆùÅÆÆÅÆÅÆÆÅÆúÅÆÆÅÅÆÆýÅÆÅÅÆÅúÆÅÆÅÅÆÆþÅÆÆþÅÆÆöÅÆÅÆÆÄÄÅÄÅÅþÄÅ
ÅúÄÅÄÅÄÅÅùÄÅÅÄÅÄÅÅÄÅÄùÅÄÅÄÅÄÅÅüÄÅÅÄ?Ä ÃþÄÃÃÄÃÄÃþÄÃÃÄÃþÄÃÃÂÃÂÃÂþÃÂÂþÃÂÂýÃÂÃÃÂÃøÂÃÂÃÂÃÃÂÂüÃÂÃÂÂþÃÂÂþÃÂ@ÂûÁÂÂÁÂÂþÁÂÂþÁÂÂûÁÂÂÁÂÂúÁÂÂÁÁÂÂþÁÂÂþÁÂÂþÁ ÁÁþÀÁ<Á?Í ÅÆÅÆþÅÆÆÅòÆÅÅÆÆÅÆÅÆÅÆÅÆÅÅÆÅúÆÅÆÅÆÅÅÆþÅÆÆÅþÄÅÅþÄÅÅþÄÅÅøÄÅÅÄÄÅÄÅÅüÄÅÅÄÄÅþÄÅÅÄÅþÄÅÅ ÄþÃÄ ÄÃÄÃûÄÃÃÄÃÃüÄÃÄÃÃöÄÃÃÄÃÄÃÃÄÃÃøÄÃÃÄÃÃÄÃÃüÄÃÄÃÃÄÂÃúÂÃÃÂÃÂÂüÃÂÃÂÂþÃÂÂþÃÂÂÃÂÃÂñÃÂÃÂÂÃÂÂÃÂÂÃÂÃÂÂÃDÂþÁÂÂþÁÂÂÁ
ÂþÁÂÂÁÂûÁÂÂÁÂÂ~ÁþÀÁ €Á?Í ÆÅüÆÅÅÆÆêÅÆÆÅÅÆÅÅÆÆÅÆÆÅÅÆÅÅÆÆÅÆÆÅÆþÅÆÆöÅÆÅÅÆÆÅÆÅÆÆýÅÄÅÅþÄÅÅþÄÅ ÅöÄÅÄÅÄÅÅÄÄÅÅÄÅþÄÅÅ2ÄþÃÄ
ÄÃþÄÃÃüÄÃÄÃÃúÄÃÃÄÄÃÃüÄÃÄÃÃÄÃþÄà ÃüÄÃÄÃÃþÂÃÃÂÃþÂÃÃùÂÃÃÂÃÂÃÃþÂÃÃÂüÃÂÂÃÃÂÃÂüÃÂÂÃÃAÂÁýÂÁ ÂûÁÂÁÁÂÂþÁÂÂùÁÂÂÁÂÁÂÂÁ
ÂþÁÂÂþÁ Á?Í ÿ øÆÅÅÆÆÅÅÆÆÅÆþÅÆÆûÅÆÆÅÆÆûÅÆÅÆÅÅþÆÅÅøÆÅÆÆÅÆÅÆÆÅñÆÅÆÆÅÆÆÅÆÅÅÄÅÄÅ ÅþÄÅÅÄÅûÄÅÅÄÅÅþÄÅÅüÄÅÄÅÅÄþÅÄ>ÄÃüÄÃÄÃ
ÃüÄÃÄÃÃþÄÃÃþÄÃÃüÄÃÄÃÃ÷ÄÃÄÃÄÄÃÄÃÃþÄÃÃüÂÃÂÃÃÂÃýÂÃÂÂøÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃýÂÃÂÂÃÂÃFÂþÁÂÂþÁÂÂþÁÂÂ÷ÁÂÂÁÁÂÁÁÂÂüÁÂÁÂÂÁÂþÁÂÂþÁ Á?Í ûÅÆÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅÆÅÆùÅÆÅÆÅÅÆÆùÅÆÅÅÆÅÆÆ÷ÅÆÅÅÆÅÆÄÅÅûÄÅÄÄÅÅþÄÅÅþÄÅÅüÄÅÄÅÅûÄÅÅÄÅÅÄÅýÄÅÄ+ÄþÃÄÄÃþÄÃÃþÄÃÃÄÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃþÄÃÃÄÃÂþÃÂÂùÃÂÂÃÂÃÂÂõÃÂÂÃÂÂÃÂÂÃÂÂÃþÂÃÃÂÃÂÃûÂÃÂÃÂ@ÂþÁÂÂþÁÂÂòÁÂÁÁÂÂÁÁÂÂÁÂÁÂÂþÁÂÂïÁÂÁÂÁÂÁÂÂÁÁÂÁÂÂÁÂÂûÁÂÂÁÂÂÁþÀÁ úÁ?Í ÆùÅÆÅÅÆÅÆÆÅÆøÅÆÅÆÆÅÅÆÆÅ÷ÆÅÆÅÅÆÅÆÅÅøÆÅÆÅÆÆÅÆÆþÅÆÆÅÆøÄÅÄÅÄÅÄÅÅüÄÅÄÅÅþÄÅÅþÄÅÅþÄÅÅôÄÅÅÄÄÅÄÅÅÄÅÄ>ÄÃþÄÃÃûÄÃÃÄÃÃþÄÃÃþÄÃ
ÃúÄÃÄÃÄÃÃþÄÃÃúÄÃÄÃÃÂÂ÷ÃÂÂÃÂÂÃÃÂÂÃÂÃÂùÃÂÃÂÂÃÂÂþÃÂÂþÃÂÂÃôÂÃÂÃÂÃÂÂÃÂÃÂEÂûÁÂÂÁÂÂþÁÂÂúÁÂÂÁÁÂÂüÁÂÁÂÂþÁÂÂüÁÂÂÁnÁþÀÁ Á?Í ÿ þÅÆÆÅùÆÅÅÆÆÅÆÆüÅÆÆÅÅÆþÅÆÆþÅÆÆúÅÆÅÅÍ ÄÅÄÅùÄÅÅÄÅÄÅ ÅÄÅüÄÅÍ .ÄþÍ ÃüÄÃÄÃÃþÄÃÃûÄÃÄÄÃÃÄÃþÄÃÃûÄÃÃÍ ÂÃÂþÃÂÂþÃÂÂüÃÂÃÂÂýÃÂÃÃÂÃÂÃøÂÃÂÃÂÃÍ -ÂýÄÍ ÂüÁÂÁ ÂþÁÂÂüÁÂÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ *ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ ýÅÆÅÅûÆÅÆÅÆÆüÅÆÅÆÆÅüÆÅÆÅÅþÆÅÅÆýÅÍ ôÅÄÄÅÅÄÅÄÅÅÄÅÅþÄÅÅÄýÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅþÍ .ÄþÍ ýÃÄÃÃþÄÃÃþÄÃÃûÄÃÃÄÃÃÄÃþÍ õÂÃÂÂÃÂÂÃÂÂÃÃüÂÃÃÂÂùÃÂÂÃÂÃÂÂþÃÂÂþÃÂÂÃûÂÃÃÍ -ÂýÅÍ ÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ ,ÁüÂÍÇ ,ÁÎ ÁþÀÁ!ÁûÂÎÍÕ (ÁúÃÉÍÎÕ *ÍþÇ óÆÅÆÅÆÆÅÆÅÆÆÅÆÆÅðÆÅÆÅÆÅÅÆÅÆÅÆÅÅÆÅÅÆÅøÆÅÆÆÅÅÍ ÅÄüÅÄÅÄÄÅþÄÅÅüÄÅÄÅÅöÄÅÄÅÅÄÅÅÄÅÅýÄÍ .ÄþÍ ÃþÄÃÃþÄÃÃÄ ÃþÄÃÃûÄÃÃÄÃÃþÍ ÂþÃÂÂÃÂüÃÂÂÃÃÂÃÂüÃÂÃÂÂþÃÂÂúÃÂÂÃÍ -ÂýÅÍ ûÂÁÁÂÁÁ÷ÂÁÂÁÂÁÂÁÂÂþÁÂÂüÁÂÁÂÂûÁÂÂÁÂÂþÁÂÂýÊÍ
ÁþÀÁ ÁüÂÍÇ ÁþÀÁÁþÀÁÁÎ *ÁûÂÎÍÕ ÁþÀÁ ÁúÃÉÍÎÕ *ÍþÇ /ÿ /ÿ /ÿ /ÿ /ÿ /ÿ .ÿþù .ÿþG .ÿ -ÿþ ,ÿþ )ÿýùG € € € € , ( – K
% stem-1.8.0/docs/_static/buttons/tutorials.png 0000664 0001750 0001750 00000071500 13157571677 022050 0 ustar atagar atagar 0000000 0000000 ‰PNG
IHDR ô P ï,‡Æ sRGB ®Î é bKGD à à àØNx pHYs šœ tIMEÝ )÷jÇ¢ IDATxÚì½y˜eE•/ú‹½Ï99gVefUVVÖ\EQ”8€ Ð
´oÓØj«´ OÞµ»Û _ŸŠÚíU»õ ï*Ý8öÅ–Qhb,ª(j¦2++§ÊùŒ;ÖûcïˆX;öÉ,o‹Š¹¿/¿Ì1¡|Ú^õìÙõ<ªû÷ ihÝmÍúVàèe}/í%ñ·5YS÷/Z³tςݸ°•\ØfÿÞvgÆóË3y}5 A ‚ €u® é“s%aìð$Æ%*2@$Ãø<}O~ÿôß¾ÿ³>«'O”q_ÔyîœÏ!‰ÉÑ"šÂ ¢B ã‹»q¨XF±eÖYe}+âk•gB$½warcáh„€ ²¿†Ó¯ä¼—0-Ö×&ÏŒO§äîɉ‚æÙ¬ôƒL{Er ÞDs…Óó$@ DVl¹Äå0–1K o¶¾Òé'ÿÀ †!§?]Y·^Hd^°ñô=œ“ú8öz"¹aªëDw!´Xx úRóÔ›YÌgw wOÎp'
ÞŽÌId +ûPÀ–[>#RrGé!N^Ð’Nv9/î‘ž[Ö\ôö{2®ümêöuö™ŽD
wÃïéÎK0ÔÝ…vˆì~S™¹gºXdà~˜p˜1úœëD©k¨Ž^ñˆ”õžÖ㔊„ yû/i>|ƒ ôh ·M)µ˜Rfs, r錟g¨¬¶!ݲ”le þ]RZ"YGªeÈ"b§JÔ¢ÓÓS˜.00 ŒŒÏ Â@ ’ñõˆ¯U„€$þ ’E@ ! ¢T©é.àª,-Äž ¡¢Rô3Dò|÷Ù¾¶ð¿ó!@‡püÚŘAµZAUJ䛚€B–õõÅ÷åJCHB/ˆD¶r$A\}’ÁH„„þ^¿œLú™,œñ8QJÑA ™½ káJ. %élò'ב½X’µÃQªN²·FʤÙ$ „ŒåJI(é¶&ÆÆ€ „Œ†Hºï—6çÈh&̤W#ÁþÕcEŽva:Ä,`| ÈD)žKÖß€ä †eÁywÖ J4™HÚB‰,Iep0ÃO E¢¬(Q[ÄT*{e[1°{ËØh!Õ·¤vÜ®XŽÙ¬çUr
SŒ–Þ ÁÖ©x°TûEÒéÒzç¸Cõ{@&㔼y"ƒzªjE ?D‚/qç(Ù@Ò/ª¡ÄdÓZ Gjñ`‹˜’æÕƲ¾‡4F¬Y˜i-Íú v>ì€RòZþ”±)u];ë3')1¨ S²ÁÉxªÉD>ÛM(™"½‚Ç{6‘Ì夷 €‰LAo(ìEÍLnR†>“)0ï Œa™Ìu¢¤?Djð“=$¤³Þ’î â›QµÄ©y¯Œ”d’SŒÆèŽÂ3½¤ w‚»‘Ødak€½ü“Yô¸ £æ¥’á#Ø¡ 6™µÍ@$dÒ©iAS‹9YÖZ¬È"¡Z«aßÁilß7 (äTjqãs¡@™É”˨&ß…a<°R
ùÍŒMµQ DD„@Ô¢¸ÂP€d,dˆN=£«½S³”«12=`ÆE> P‹¤iK ÉT› ùíM!V£¹y&&£R‰C
ÈçóhmmeŠ”e™/[µÒ!¦`’ëbÅÄŠš×lK®aošÒjgIlLµbcJ@(¥£¾P7–d7›îÚ.•|¡4;qucbö6‘²”¥1Ø`&q(ÔB®®—ÚK$¹ÆR‹Öæ‚M(²<+ÚxÉClGÜ`"k#eÛú·&¬0ã Ö/=>’ôî‚´å E [Ùk‘ZcË佤µ
%¥œ¥RXªwX¿$÷º³p©~1ZJ8âGšþÊ P2¦^’dÙJ $¤0f8é¹ Þ“œ
kb” Äa:‘<7Ñ?dA0ýÉ䆴‘ky½3&¶¨’Ðã¥Å̸ciü™w ¾…Ôj ¤w÷q?HÖÜHNÆNªñd‹©à†h¢w•‡äȱÌËD>„å¶1¥öÊRŸClŽZžfü·œÁú,¹ÚxÈÄ0Û(™ó™q6€R@ZF¿Ò3ñ&NJJö,¤7F‚mtŸZFš°\rh¦wõÈÉdÄxÝ–‹ÇÞˆùì‰xz%ºIØíQ†—T‹¾ä~ÂddŒnyHØf„×ß‘¹ ó]x½]¹cí+ÏÈšAJšÓ©k9êxëD¢„ÕB¬t\ˆø‡ÌΚ‚¸‰ú¼ D! ’ó…Úy« /xF›sÄ棱|ñs(
=ò… Šæ|š hh(pS?¶û´ÕFÚý¬…=Þ€¤<Õe1 æ‰ É•¾ÃUŠœïÂI/lÂzOb?È1ÑI&“ÚŒ½Gp´ñÁï¥
>Ø»RÉvVÜu©úÜ{K³cd[w¶‘‰…žìîR[EaYýÖŽî*ÄdY*¯D2Hj' ŒÑ£¦¦`‹Uo”aEÊ› =xà%ïj®ÛîvkjëÍW:Ì=÷Ý;qd#5c=“×l†¤žÈA @ ù\¨ï• ƒÄí¿. ôÂ0Ð;ý|.@! !ŸKvöq:X$ AïЃ@êï$ÅÆD¼p D2Vnù\ˆB.´ „ Š…&— Øb`žäoÞæöB ÇmnÇQM·¢ûðíXWîÄÕ0[ë†Xô·hllrú“àS ¼óì ²Ï'[$2¬26¯³´fF,ÑÛE™ ,¥ä%ˬ³uaÎÛ“¯‰ö‡Ú
šº9ÊÛ7:ä—qr¿cáÏÐP½~„c8§F’<—ÖéHš‡ QÆ\?å³ÇíˆÎ®û†s ÔæøÆ}are•æ¸}zð(K÷eµ‚2ÆÖiÍ9Ós™È#æ„´ {õFÆ»Ñ ]Pg*P¦>;r"Íc!ç¦ÜÝ©9MÙ³+uWg ~ 6_Y Le•1ÆYršÚ`Ó‘ÅЛ‡”„Z$! Ô„@T3®íHJ¾‰@-qs a\52q¡« ¤bn»ç¸7@ê|$î6óJ¡“‰Nñ}•k_JiíbT›@·9 –uFèj“¨ ÞVQ„È#'J(¡ KW-À1Ž…cáX8ŽåÈeî~<h81Ý'Á
†õØï”,ªR;Öb7Ù^,+Ž#„@
kŽû˜D`ÀQ‡.ÀƒêxÕÉ1‰}¦Û UÑÛ
,jž…Ü‹ÙR T%Èj„©¦XѱĸÄP‹¡BaŽmH§Á;"
˜S`
«ÁÂ8ÀÈG;p-dž 8ª Ê
óÃÚQÃV±ñ@@§ƒ&m- Öôvà¤cz±ri–.jÁO Þb¥†òá[÷Œ`xbmMlZÕ…Z$qÔÊNœ¸©ÓÅ
º;šñà3ýqž¹Š›«”›$D!¢L§v¿‘Lv•2Naã„vú;˜6/i+¡«£¹Ñç1[J¥•²ÄLn9:[–Z|6žÁ‹îòö¯½NÍ~B ð Í2š›lÆœÔód#kêŸâùü@"Cs€U(äç…2ÍöC” uËByޣÑ:Tw~f lh®{S¶Œ’¿/iyuQ\õnMuõL½ñ%ÿTršzeÉqÆX‘{/šÏ™÷Û![^2Þ‘2ÏGjs©‡Èß÷sKH7×÷Ë€OVçÔnTGææõ¬ûQÆû§•p682ÀyÀnN ó ïZçe~o*†(wvC>Ä«7õâ´Vaplß»{+šs8~Cª5‰ÆB.NMB§©uu4á¸uKðŸO ÀÝîEÏâ&œsòz¬ííˆÏæ|‘\+œŸØ%Ÿ¤³±p€vˆ@ý
Š°¾/‡:„¨4Q
€J
¥2¡Ü¸ù†…:ò ‡ÿ˜œœü½jÏôôôK²Æ±pü± ¹lsE8–€Í©ã3ŒïQpÆ 4çEY! bI.q_„\
¼îØ>œpÔR<º}[v ðÔÎaœxL/ò!O—Qȅȇò¹ M
9¼rcGgðÌîT£c%¼bcÞøêÕøõ¶ƒxv降ÝGq;ra€|$$ 1Ê]¹PrAÜp™¼—"¶QœB'PÎ`]_Mr?¨2‰r±Õ²D©b²yÂ04î†âŒ~Õ >Ò´¨ `866†Z½hBÑÞގƆ u°;d¨a˜ûÁNrúIæ7ÒtÌ EHÓªø!‹5 8y¨ ô¥Z CÀÛN6½«¶•Yl‘Aë P’ oañ`N5›É󩧞Æg>s5¶lÙ‚7œv®þÔ§±víDcd½¯ Z.Oa‘å¥ dÊ3Åwû÷ïÃÝ÷܃{î¹?ü0 |ðA,Y²$ÅD«#~§‘Š8JøÀ\ŒNUp!l†3pY°w!Z¶ÚÛ+!\—½y™4K'“Kð&
+nj ZZ¶3ñ¸œ¥a”CÛ«ßËêt‹>Í¢2µ°ˆH¸»]°²Kr¢el©Õך:Õô±ö›W°`Î b4³Ðº
üzÎN¨žÉæ· ) @—œ¥@nÎyä#η”bÙ`a!‘¢ÕJ'9•2`³6:2fÑä¸sÅ‘W£ƒæ¹ + —æePo!cª?˜ø¬)p° *¦¬@‰;žˆP®ÖP‹$&fˈd òÙºw m
X¹´ »Æ5£[¥*ñüÃhoiÀ– ‡P®E„ÀÔl#ÓØ´ºËä'.‹¿× ,% :ÇñÂÆŠÐÓae7!šÙ‡ ATÊ哲åüRæ:–VPZê„ ²˜Ò%˜!Ü0 Š?;÷\ 8pàE[Ðÿñ ÿçw ,ÚX¶Â'O`¾7C²âÆ©’ø¹Üp*AÉ&a²ðò®—‚43¡d(yä iá'éÄR‰ðˆ¡I‹Ó‡ó g¢J†&î»2ZZ‡1ï‹_ú" {ì1 À/ñ üsW¾ô¥/¥q& cïKæ“fLƒ©¡ â¤@†ˆØ"ËÖðÈ0 |ðAýãʹ†<ËåšPØÄD®C£¥9)ÀH ×e@KÄŒCJàZ‚‡}8í°AÙ¢ipššk')4LX˜2åÆ5#4"3QtÖ)Ð*ã°q Ònœ_p±´iP‰å8X¼„l „4cgKFŸªcËfnHa@THh‚ù¦ C0¦²K@å´Ôx—Ü긄“}ÚÅ n»‘ÍZÈpR‡?HÏ"˜¡ ÖÌtBÇ¿%‹CR2¬† ÝoÑѲ嚥/iÀ.[!HÂ"a MËʘ^W
À‘\ÊH#Ãv§˜ä1œË3:2”;_Xx _0Ë,ÞfΑëC$ò?UÇÇùÞñwmÍ
’ðÄóCXÜÞ„ã7,ÅÀð4¦‹UÔ"ÂC[ðëmƒ šò åj„žêG> 0[®ÆÖœ :Úpü†¥xþÀaìxá0z·`r¦Œr5ÒŠ‰„Ã…NœÆО¨’†$J‘ú–
ôvGûwbv6Y@¥Š1±2ß §äiŽjfð^6!ù€óI7°T*½¨n›R©d¡Ž jF%µÈ0e¥R.m!1‹œÂb¡ã“ܦŒ»Ï `ŒÌ9*Ce`ÜÔ26¥P’+eÒ³NŠeÄÖ„
–ƒ¡ T«<ü«_YýüÀ˜ñǶ~_Ã[n¿Èa —¼ËH3ÊA ÅRï~÷»ÑÜÜŒmÛ¶¡\.Ãø&ᣑÐñøcÂÓÈ<;†+Ýš+Ä”´3ÏÙ|å‚)oØÆ„õ¾‰tvv¢³³ÍÍÍ €{ï½]t‘uý±Ç ‹›o¾9O)qøðaý³eËüð‡?ľ}ûôù³³³)JT eþíXTèÊLh Ñ< 0äËX»3Ö äÍñÛ^!?È&Yˆr¹<Î<óLÜ~ûíú”·½ímöÄö. H•æé¹c 444àŽ;îÐñûø‡ÀüǤæèÎ/74Ãæüt«ê—¿l`Ê}ÍQ6¬^0e‘,èÉŠ ! t´4 §«#SèíjŦU]XÜÖˆ±©
¹$},És^ÒÑŒKÚ 05[Åøt3%D".ÀÒÑÞÒ€æÆ<^uô2ŒL±ÿÐ$V÷´aÛÞQݨ aÅÃ(ÉQÈÄHÔy’âxzc>†UMÅGP-—!ª9P¥ŠñrªÝ›„–M¡Eº¦§&=°Ê›šS z¡PÀ7Þˆ—mÞœ:\6 ¿¥†@èìêBgg' W¿úո袋põÕWã»ßýnl@”KVÕ<_9?;ˆ4ñ…Gÿe•¦…HsFžB„ዯ Y/ÏH ü…³†Æ)Û™}Èê#¶q¸êª«ÐÙÙ‰ûï¿ gÿéÙøë ÿš-ÖœXÄ)A ƒíjÈ Ù$:ü붶6¼çÝïÎXгß%MpÂãÓ)C ALÇÉEÊaÍžè«Û¼þ9¥1 r¯ ;¥QS2˜U*›Åâ“sÁŠ‘ÅKÏxKǦºÑ-Ï)üý'RéÑɆ[Xžï<±¸(»Ì«5íü²VOqR ß›Ùø+‚·ø¡HXº¯Ô¬GÎæUÚUdŒ³C #,#–ý/œQsëÍúj×)u|D.÷º#ù\;xÇ ‘q54 A E„e-E€ûŸ|ÅJ„U=íèíjÅŽ£X‰46äpÒ1ËðŠËÐÚ˜ÇL¹ŠB>D¹ áñçaËŽC¨E„™R
OíAOg3vŒãÀð4ºÚqÖ‰kн¨ / M%áF ›ô›T©i‰G@² ÞH’& èh.¡§«aijåªå”ËL}(·¬C kuÒ€2vrÉ!Q†Z-.{ÅW`óæÍsìš3’¶Èg©ðÚUW]… x ûöíC©Xò싲„LãyîÍ›ww666†ÿ÷Ç¥—^š¹KÏlæÚùÏÅéíkÛ|˜ÌçHa" ··Ÿþô§ç¾—gwD.ü˜ç®Ò÷4/1²Š/eõ3Õs döùû¼wõçˆÕoTgÜ}ÓŽæÕoYÞºL Ê~Wò{Scïõ2ÎGb©¾CY…”]Ãó>u^¨® Q zªáhG D.XÝl6nu§.yìrÏÖõ-Âá©ŠåiɾH IDAT*5Âî šFMJÍwÊq}8iórì:0Ž]ã Æ¢ÖF »®o8a%raˆ‡·
@ ضoÛö" b ÏÄL3¥*Ö÷-ÂàØ,")õ®;
Æ0ˆLŠ›Š}«T7 ¬Y 57‚ÚÌ~ "€¡R–˜(l@ÐÒ L½`Ñòò?pÊó¹¨P(ã2±‹-Âûß÷~VÞKŸf®šG‘
nA*f±¦ÆF|à À'?ùI‹%Îgš²d5Ú vŒS8rЉ¶)EšfWPœùáª]©ø Nü¯ /vn§ô¯p˜½ˆFÖHp`˜®¢¦7–Õ+ ° °ÚÁè\…=®º¶9 ¤6¯OîÀÖ‰œR©8"yh\ò‘‚õY.ŸÏŽ¡ëZêÂkƒ³âB¤ ò©úè(k§Œ¥ÑïàtÎ\.ìÍšî_=Z(‰ë+2ÔÇv tp[Xõ©5ézõ|n1C˜5yHšnż²]NØW¼ýnÌ»޺н†–Ë51¯'¯èEÂÎc€EÅ+¬aÓý¯@ˆÄwÏ LÆþL6„ÃDª1$ÂâF³·Ú€—ÀJðþv船ÇÆLO'»ÅõÍpZfF=
a£i„3öäÉ¢±j«Z^oF;ͽŒîdÓ OX Ô#t¹[ÁG ˜ 5õ'›Ì2]^Ža uJRsc ‹Zc:×|ˆÆBë–/ÆŽÆÐÒ\@³ŒÐ|è…÷èU]xÕѽøõ¶AlÝ3’€à"+3Ÿ.c¦TÃIÇ,Ãt±‚ÃSPkA¤Ÿ…ÀäLúãùã˜)VÑÒ˜G¨ÕL˜¸:!µHêb-Aò?!‡26¬È¡5<*`¶˜GµL¨T†sëÑžoB•8™›„ *[‹8´I²:Õ±ÿ_¹ÛO?ýtˆ Hí Œ5*™›6¬¥vm%O±áñÄ?í´Ó årÉãJtè(}v,£"éÎ25¢¹UF‹
µ×^‡{﹧Ÿ~z‚hæ÷ŒñΩœŠYq`™ŽâñBépC³ ‘î-fý;™nH#5Hu²™Z…™ Üf2 yH•Ã´vO䀓,4?§ê•v‰H}=Õ‰sÊJ_÷¹ <¶xk ˜Ù‘jZh2rG³$Yâeç|€2"‡.–ÕeŽ¨êÙƒ
RÀ?„•K[±¶·ûM¢\“4º:±¬««{ÚÐÝÑ„Ùr5^°ªò¹ •j„jMj…EñµšZÐãØ|µ/öe,ﬡ6³¹Z Aµ¥b„‰j †òkÐ @§à‘'4Ad»ë²X™ˆÔ ào|c]7ß|]ãY.I€°lÙ2lÚ´ Åb±ÑHš±JdøÚiŽx¾{üú‘GðOÿôOž EÞº‘.Îj>ÎϹû¦¾{™gÖÕÁÏ u«›Îk¨ë·ÎÓzòƒoÈÃlFs>ŸlCÆ „t]ºu OsVa˜—Ërîò±©:ÞîÖœææ%¬‹«ãz¶õæ|åqžáJS¶zÛ@>¿}ÆÔ%š[
3%ižºl>@EÊœ‡DõÞs ²Eó ¡d†w8ˆË/¿ QB c6’äƒf{m9'êˆnÀ©. .»Í™Ø%ç|·jÇ¿ðÝ¡¨>ô"q‚Fùàlið*ùå#c©Aà %Ø•ú|úÙ' ¼-i_}ªFú]Ó#ߘ«ªxiÝ(²FŠS“° {ŠVîvêZö\¾ƒ&ñ)Ò5Ñœ’1fR §¸ G{ÄÓ&˜ xk-‰¼(ݺ4AM@çÌ /L˜"Qä…o®ÒÆûéö éŒÿ^Ù _¿<‰TA¼tí¼ðN°ñM#ólÝáTíS×qÀkº†â‘ºÜUÕ&7 •§=U*wQ˜|9¦tФo°È>$/wë@h$¸4%…MìÓ.ÙÊ]þ–Òeň4‚]—¬%Ëm¯ ©îû2Æ8=‡É-£›NÛ$V%‡³/DÃ=ªŒV„쨾µå¹Š°G’‘ bºÌ
KÇnÅ᥃¹)ü7ÎXÙ6O‰fƒ?1Ä.€’£Žt%s!ù_ŠT~>é* #„á(4Ç;˜ªŽàL£Ž§AБ Ü‘Î}õ»iÙ.Š|èK¿ÿÕp£ xݱËÑÝÞ„¦Æ<šó˜)Æ.ùHÄÊgpdË· ¥1jM~õ„£½9%‹š186£'}± aËŽCXÓÛWnìA. °çà¶ì8„R5JøÜ
]¤¾'¹ø¡¿Ë#¦µÈUw¢VžUP¥†b%Ä † œ OÚ“Bõˆ'|1¨Lp&Ù :îT¯;ˆ2þN~=ðÀýxüñǽ÷èëëÃyçgÅ5+•
¾ùÍof>wñâÅx÷»ßjçöíÛñ7ó7Ø¿¿uþÞ½{ñÕ¯}Õû\Þ?®¤Õ¢<ò¶mÛ†íÛ·cûöíØ¿?VZ…M›6aÓ¦M8æ˜cpÒI'!¯ ™<^ÕÖ[n¹·ß~;~ñ‹_èg?·ý9|å+_ÁO<®®.¼ímoÃ…^ˆ|>ÏÜÁæ>O?ó4n½õVÜÿýøÉO~’áq³…§T.ãæ›oƃ>ˆþþ~ô÷÷£T*aÕªUX½z56n܈÷¾÷½hmmµ”ý|r]ýžPJág¢Z„o¼?ü0víÚ…‘‘¬Zµ
ëÖÃÆqꩧbff8å”SRþFòý‰q‹ÌPf8RqEr‹Áx¼WÊì?Š2b«ð»d3Â.”r!¯žð‡ÈëJ÷ªŒ9ŠAQV6ŽÇ-L¾ªƒ4wHŠÜªŽDþqÊÁÔ»¸ råÌçmö•¢úk ù¡î ¥:(p³²x (ŠM‡¶çW¼&›ËÝBõ!m CÔq‘A‹2zCÞÁQHˆd¼®ï[ŒÑñ"~ñø~ŒO—1[ª%5i •šÄ³ûFqÖIk°yMžÞ=ªÝ±D@˜pÌê.´6åñ𳃨Eq§Hv
Lbß¡)4r8í„hnÌëï)ÁñiFG‚Ncìo…t—’Ð\˜ÁÊÞäÊ{P-•Q.¶ R®`¢ÖŠA¹
žŠN)d®H;Æ„O« ‘ vËŸŠÔ5s öÓg$ÿ¬^½ÃCCøÑü }ôQëêO<1¡†5ÖbèîîBÿ î¾ûnìݻ׺fíÚµx÷»Þm‰Õ¶íÛpþùç£Z¦Z¸oß>üË¿ü‹ÿ¹iP}|Íž½øè• ÅSO=…¶¶6œp 8û¬³qhèî¿ÿ~Ü|óÍš`çU¯z>ÿùÏcÅÊ•.¾•!ïááaÜv۸馛ñÜsÏ¥Úyûí·áïþî£Ii¾±±1|ùË_ƺõëqæ›Þ¤'óþ^Àm·Ý†[o½{öì 455ù4F.k¾yí7qÃ
7àðáÃ8öØcqꩧâ¤OÂðÈ0î½÷^üô§?ÅwÞ‰ ýèGøìg?‹×¾öµi…/8Ÿ Í!6 –á©'žÂ'?õIìرk×®Å[ÞòœrÊ)8xð |ðA|îsŸÃç>÷9 À»Þõ.œ|Ê)Ž3X¤”¼ð8½ydH#—½k*QmlÑ‹Ú5`Çsýæü.}Ž[Øí ‹KÂw ïRÛÁÊKV¨foø(Õî¨Ù}îâ\,º\ØD=©lÔÏÞ6 Vrtï!_’=¡æDÉ€|ãd׬÷Í-Þ–‹ žávþ‘p¾÷5Íe¹ Vx__xô29$…@vwÌCÏعdá(4¢Rbiïîl6lØ€{î¹ ðo} ×_½>ÿu¯{ ®¹æë™ù|>°Oþýáˆk®¹Åb't¾öµ¯¡½½ÝºþÙgŸÅ¥—^Šááa<öØc8÷Üsqå•WâüóÏOõñ<€ë¯¿ >ø ^¬Ý÷¿ûî»Åœ ?½ã¼éoÄw¾ó ÜvÛmV_ÌPSÝE®¼òJÍ.wÅW¤X Ï9ç uÔQøÚ×¾†\tÑEøÙÏ~†žžžllùÛAäÏnî?Ð\ôLMMáÊ+¯ÄûÞ÷>ýÝ 'œ€7¿ùÍ8묳pÙe—¡ZÆÔ²õXÿ<{ÞìÝ£g·L¹ÞTh6gÙbgq ·¨@¤úçS‡Ð\%QÝ{ÖgŽ£:€; :.›·,¨ïÉób¸ƒ¿$í|Ûë0GúÔ e}@s•Þ;aæ0Í Kz™æ‰ï
²”Œžàªp
̢̿'6BVª–þŒø@ óV•Òò¹ Àö}£XÔÚ€e]-Èçôu·bMoò¹˜ž5~½í z¦ «{Úð¶×Ã;߸ ç½á(¬êiÇC[ðäÎa„Iü¼µ)‡ÎÖ4BärÝ ÑÉZs¶æÎ:q
ÞöúõxËk×â-¯]‡s^¿g¼b%Úš ȇÚ[
Èçâ¸}^Ô°º'@{Ã$ÂÊ~”‹yÔ*@T°·º(´" ¨™þ«×W\‘²ºñVßeý€_?Güœ
Llÿ†ÛÎd§zòÉ'{äà ×Lê›y—7½éM~¹b.¤0 ÑÝÝîînM]Ëoõ]ü³ `ÉÚú™Ï|W_}5ŠÅ"Î8ã \wÝÿ‡¶¶¶T? sÌfü¯ÿõ-tt,g|úÓŸÆg?ûYë‰åro}ë[qñŧڦB ûØÇðž¿z®»î:¼ò•¯´¾ßpÔårù—ïÂ%—\âß‘Ã߇D„/~ñKz1‚ ïyÏ{Ø9fŽ]xá…èèè T«U|ëÛßrÆ©¾ðä—¹|ä#˜ššB__ ÞûÞ÷Ú÷IÎ9åÔSôB_©T ¹2…tR²è¼»6„õ0;s‚ìÂ<Ä Y‚-»pô¿_º_09~–õ.î<‡åý˸Wª?‚Õ¿¾syÝŒÔØjntöÞH_ÏçŒå²uåYz×nÈß' ïØcÁêØç‘¥ë|:‹Ë®OF@¶Þ•7:’:9•Ž,SDØA~8€¥¤ ‚$X@ U-MgÙ?8‰¡Ã38nÝlè[Œ£V,FSC·?´/ OAJÂÔl<Ý Æ±¬«fÊUL«˜œ©$`¶ M9œz\ ·5`h|{'ѳ¸S³U¬ènEËÊÅI‘–Æ<žÜ5ŒÁ±„°tQ³®¡Þ³¸Ç®_‚çöaÿà$rV.‰P›Ù|u
A%rIbºÚ€~lDMæÒ`8ð¼M¼“ºöwcYeFYYD¼O6”kN
º¨³¨ô½hiKÖ1»dQ’vuueX’ÌÖ¤ñ=—,Yêm„Êÿå9ë" ²IŒ\‚£–1Æc=Š üà±±†¸êª+‘Ë…†–‚8éŽÄúõëpÝu×á]ïúKíê¿á†ð§gŸÔ¢L„3N?]»=ƒ0À×ÿåëVÓ.¿ür|ä# Áùq> ¼þõ¯Ç/~ù \ÿíë±båJœ÷öÿ‚Äûß¡&()WʸþÛקÆÅ”jeÎL~òÃû.¥DZ…l(0Tq|U¡PÀÚµkñÄO þ÷¿ÿo\ñá+/l`¡ªæÍC—<¦çkÿÀ€ö.¬[»Ö :“Ê^R¨ñ#\z饸ñÆã º4à ™€¼ÁÅÔŒ|‹¡ÐYðRÕsrËÉñ r UäÀÇÚ0òØd åšÄôLB£ÝÍ‚ÐÚ”GwG&g+xņ¥èloD-"t¶7"”+5¼0< ×NŸ*¡d:VNX¹´ ¹0À+îÁ²Îtµ7¢«/ô?U½yäfŸFµD j ª–0RîÂx°‚•À4 4¹t”¼šñz€5û˜*ÍhÕÍu ýÅhO a•dõ ’£a•¥'L%& —®U ^ ÃHf¬ê¸-Ú[ÁÛÀ&î"›¸Ãi³A¢sj<1ªµ*>ó™ÏèóßúÖ·bÅŠ•VÙNbeLÕ°ùeÇàOþäOpçwêk?ù©OáG?ú
…¼Â÷ë²€ÖoHµmÆ£pþŸŸo´N?ítœžópa§dò¯_·Þó’Ò°.²
wê Áª–Û¸NˆOzzŒU,1thËW,O°/’‘¤ˆLƒH:ìyÀ³ÏnÕçl}öYÈÈ€RUOU®¶¡±gžy&†††X™I³x¤èåˆUXSå„…ðTƒ©cϬ®pª´A*:¡KÎêi¥²,tu>5›¤ÎÂàƶÉö`µ¬]2e`±²¹ª·)-ìf²$ó† ò]—üU‹ÙÁdAŠö‡»ã…Ūg ‘ņ'™Þ „ Œ‹ðªÿY!¸L¶ÔÆ>Œè™,a“ 骒I P»Ì˜
’³ò~X)åØè‡Å6T"ÀKƒTW† ^ä6«²%Ù¹†IFÁ¼•ŠEP•<õLßK²Í”f!WZI†…ä IÙeNÜ£«ZZ»|èu|óf°Jš¿Ë ®Žë¶ËL»@ 7˜[ IP©ªŸ0Ø78Ÿþj7~òÐî„S ™AF kÀ®³ï²ÏǧËxvï(
¹ #3xz÷(J•ãÓe<ôìA<¸u kz;Ð×Ý"B!$9ñq 6ô-FkS·<° m?„+ãô—· ½¹‚ ´² ”ÊÊ% \‰bзO8Ìz–»‹»^ì ®›ÌÝP<¯?ó¸`‘Ùd˜i®‹‘)TÛuäŽ/elùm×; W”×Rt\€™È]ë1¶,ª^ø×ýWìÚµKŸ{æ™gZn2ž¯c¢ñg矾õœÝ»wãÚk¯µÇ)yNoooª]ïÿû¬ñ!ò7,Coùòå]B)÷qoo/Ž:ê(}Þ1Ç ƒU«VYTmÆåË/? ´úN[²ƒ~ÌHÀáÃãúë±±1üâ?wbî¶ëóÌ3ÏL\îÜ9áÒwåÙqA‚¹ù&‰Ëƒ…¶f}n