From 97540de56ca8a975ed31d86879d0e5c4cf169173 Mon Sep 17 00:00:00 2001 From: runge Date: Sun, 21 Mar 2010 00:05:51 -0400 Subject: [PATCH] classes/ssl: Many improvements to Java SSL applet, onetimekey serverCert param, debugging printout, user dialogs, catch socket exceptions, autodetect x11vnc for GET=1. x11vnc: misc/scripts: desktop.cgi, inet6to4, panner.pl. X11VNC_HTTPS_DOWNLOAD_WAIT_TIME, -unixpw %xxx documented, and can run user cmd in UNIXPW_CMD. FD_XDMCP_IF for create script, autodetect dm on udp6 only. Queries: pointer_x, pointer_y, pointer_same, pointer_root. Switch on -xkd if keysyms per key > 4 in all cases. daemon mode improvements for connect_switch, inet6to4, ultravnc_repeater.pl. Dynamic change of -clip do not create new fb if WxH is unchanged. --- classes/ssl/README | 67 +- classes/ssl/SignedUltraViewerSSL.jar | Bin 108090 -> 112002 bytes classes/ssl/SignedVncViewer.jar | Bin 84103 -> 88016 bytes classes/ssl/UltraViewerSSL.jar | Bin 105068 -> 108926 bytes classes/ssl/VncViewer.jar | Bin 81177 -> 85036 bytes classes/ssl/onetimekey | 20 +- ...ghtvnc-1.3dev7_javasrc-vncviewer-ssl.patch | 620 +++- .../ssl/ultravnc-102-JavaViewer-ssl-etc.patch | 638 +++- x11vnc/ChangeLog | 13 + x11vnc/README | 3218 +++++++++-------- x11vnc/cursor.c | 3 + x11vnc/help.c | 84 +- x11vnc/keyboard.c | 6 +- x11vnc/misc/Makefile.am | 2 +- x11vnc/misc/README | 11 + x11vnc/misc/connect_switch | 276 +- x11vnc/misc/desktop.cgi | 1134 ++++++ x11vnc/misc/inet6to4 | 400 ++ x11vnc/misc/panner.pl | 117 + x11vnc/misc/ultravnc_repeater.pl | 131 +- x11vnc/remote.c | 50 +- x11vnc/sslhelper.c | 49 +- x11vnc/ssltools.h | 35 +- x11vnc/user.c | 14 +- x11vnc/x11vnc.1 | 92 +- x11vnc/x11vnc.c | 25 +- x11vnc/x11vnc_defs.c | 2 +- 27 files changed, 5094 insertions(+), 1913 deletions(-) create mode 100755 x11vnc/misc/desktop.cgi create mode 100755 x11vnc/misc/inet6to4 create mode 100755 x11vnc/misc/panner.pl diff --git a/classes/ssl/README b/classes/ssl/README index 0767ce9..b244cf1 100644 --- a/classes/ssl/README +++ b/classes/ssl/README @@ -137,6 +137,15 @@ Both TightVNC and UltraVNC Java viewers: number, default: 50 Milliseconds delay + PASSWORD + string, default: none + VNC session password in plain text. + + ENCPASSWORD + string, default: none + VNC session password in encrypted in DES with KNOWN FIXED + key. It is a hex string. This is like the ~/.vnc/passwd format. + The following are added by x11vnc and/or ssvnc project @@ -173,16 +182,47 @@ Both TightVNC and UltraVNC Java viewers: oneTimeKey string, default: none - set a special hex "key" to correspond to an SSL X.509 cert. - See the 'onetimekey' helper script. Can also be PROMPT to - prompt the user to paste the hex key string in. + set a special hex "key" to correspond to an SSL X.509 cert+key. + See the 'onetimekey' helper script. Can also be PROMPT to prompt + the user to paste the hex key string in. + + This provides a Client-Side cert+key that the client will use to + authenticate itself by SSL To the VNC Server. + + This is to try to work around the problem that the Java applet + cannot keep an SSL keystore on disk, etc. E.g. if they log + into an HTTPS website via password they are authenticated and + encrypted, then the website can safely put oneTimeKey=... on the + URL. The Vncviewer authenticates the VNC server with this key. + + Note that there is currently a problem in that if x11vnc requires + Client Certificates the user cannot download the index.vnc HTML + and VncViewer.jar from the same x11vnc. Those need to come from + a different x11vnc or from a web server. + + Note that the HTTPS website can also put the VNC Password + (e.g. a temporary/one-time one) in the parameter PASSWORD. + The Java Applet will automatically supply this VNC password + instead of prompting. + + serverCert + string, default: none + set a special hex "cert" to correspond to an SSL X.509 cert + See the 'onetimekey -certonly' helper script. - This is to try to work around the problem that the Java - applet cannot keep an SSL keystore on disk, etc. - E.g. if they log into an HTTPS website via password they - are authenticated and encrypted, then the website can - safely put oneTimeKey=... on the URL. The Vncviewer - authenticates the VNC server with this key. + This provides a Server-Side cert that the client will authenticate + the VNC Server against by SSL. + + This is to try to work around the problem that the Java applet + cannot keep an SSL keystore on disk, etc. E.g. if they log + into an HTTPS website via password they are authenticated and + encrypted, then the website can safely put serverCert=... on the + URL. + + Of course the VNC Server is sending this string to the Java + Applet, so this is only reasonable security if the VNC Viewer + already trusts the HTTPS retrieval of the URL + serverCert param + that it gets. This should be done over HTTPS not HTTP. proxyHost string, default: none @@ -238,15 +278,8 @@ TightVNC Java viewer only: UltraVNC Java viewer only: - PASSWORD - string, default: none - VNC session password in plain text. + None. - ENCPASSWORD - string, default: none - VNC session password in encrypted in DES with KNOWN FIXED - key. It is a hex string. This is like the ~/.vnc/passwd format. - The following are added by x11vnc and/or ssvnc project ftpDropDown diff --git a/classes/ssl/SignedUltraViewerSSL.jar b/classes/ssl/SignedUltraViewerSSL.jar index 5a562ff074af1154e01570ad0f96c8d4fffa37fe..e32079fc301aaf58b71936f654acdf09dc0e1dd1 100644 GIT binary patch delta 42397 zcmZs?V|XQD*QgoWwrzFCwr$%scha$TY;Gsf;#)y7hxFXj5zA!?>Qcp0)c8CaCXP6k>t5o&!5DsGrsn z5O;qWTOECbNt_Z2|4()?HQQ&d@ORylGa zF!P=7U8fwa+g5Xq1M)<#Wii~uM0IhzaJum4`0Sb$svs(jGJoJ zc%oHCERvF*I&Yi&0X{yXW|btSbK<5=Ow7ZaB1?Z1UqTaW30E#!zn?e->kk>KMi3;$(bd^^u+fWLin`DGu(Tsc@UQEU zP&x&>;i`;@1i6bItoLed2U(#5=4fp@psvK4FRBNPND4z9b>N^w`Mz!1A}WEBUei*# z3l-i3Dn0fkQM~EI8+JC$*NCblfYm}{DRI3~f;odP1H>4~21`@a+XBzu$l@ELU(e6g zE4=j1O!_IV#_c0Ev2nJ9deq(c@LQ&m`+pOM^&;=>q(p7!qCTZKiYA$%jmY6r{oycWi96dKs1d;a{-Wvk9*VQNFgvyG zbUTXOpk(rkv6IgKtbh3!8**Jr=XxnvMu*Kh{RR!|_DiZjcqrPEE!rnaYC=}J zG05tB#z5Ot3?;hg97crhg!U5jd368&%?L};H<+r3odT|fLFQ-KkBL(S@wmFJj;v-e#`Wuz zI}sD1l$qMqlBczJ0o|V_akG!vjJVFwO@k|Q-(5Ppa9bZot8}59`^#5_RpepeTwi4s z@u9%LaNxnf{$Kn^QHG)d$R||kV1=KiEdyNULvJz}z`+ZXN$%9p2Vo2LkWeBc$@X}I z2kM=jcRj>B8>~czGJ4na{GBC+ujl;*WA(R zn)MCcSkxaZX{}foU@TZ6pDKI{EzWfbLx<|mpcdEl9D%LVP^$zVAo5fcL7#I~tZS$( z-)f}q>aVB&2w{BZ>W*hp!W805EvhjQoq@g3K|{7l>`SArw7_o2{4GO5zVq9vAh(0G z#3-crQ*1aO_?^(Oae7hq*=u2QNc3?nsEYCKObRknMf-jSFlG9El5Cg*SU)=>WG_Su zr?^{xESHnCt{T}Z$f)|*fG3HTotwugacn5A%4}?Ssc2ElRyAaLA%QBMo*n~Mq$-yj zl9LJYMA}G^%&o138i$05bg@w+{R*Lr}-FXJL)z+GOAFZdAeY|iSW`mldjB-?U zN8#iU$OfiW6r&S`*Ho36&E{;md&qY$<#%kTeJj49$|9WgJQF^y98+|&_dgYy=Q6&@ z<7i93VZI%zl+eg9B`znDG1~F*Nkzvbh*fWPJ>X{moVfsKyf#XEWL6~cXDLS1)W%r# zlI$skfAVN*;~tMe=W+1EYR6(HPV{ov2zY46@49`jC5pywr@j+PJhdZsFLUna@(WPZ zjTCX?h%JaAX2clV_^FrAWMu9oyyaKUh1c!^Yk ziN(IMFgr_!zpqDp`k?8#bMQN?3z^dl7PNHgc-aKANka))#oBFtR1c%}&DdFY`uA0g zbH?;b2<8Nw55an#?1l0R6imVU%DI%wtLqE_9vM54r)fF>_22!?95E{2vj-@;@)l24 zY9*YgLHOM6%9D3=3PAnK4`y*t#{%j4wd2i zSJbm1kgITAo>qae$qJaAP98b*?u@QZ0klGsTW7i?7p%v`tk!-;q-ZBphy}jpHBbyj zHp4vGmUZXAG)@%N?*&w>j~3VAS~&TXBoE69n_&(r0sWb!#y)g!gY<5G@pS|SIKv#gR-$_FAjqt;50V|(MKg$*tb2d845 zWgfy%x^P=;(?+c3Z5}6dWW0%ZGyK|VTS-w>E$TcLm8M9Q3=J-$q;G=ymz3Ro5IAYT z;7BGOX|LJ{Kf~p_H?AH6>)-d;Kf8~4fR}^#c3SXdQ%ciLQiyLssfAiaQ4)*+0X3;M zX@HiMiDILwYIu9DnrF&j7-Us^ub-sH4e+m+BxrXpqaSNwuJPYzG2mKhmu61}`-qj=IQu9^aavUpMQ7Sp z^)`Tb4wIC;XEK>HSK5r8^Jo<|O}z_(U?sFpH`Dw{iR3z%m3)4~!5 zqn(9?og~>Sx2@S}N~Js|29xQ!T65yn%LbK7b9e&kszr8KcTXlUonP4=BlAovqY(0C zkKCndO3DH&$=CQ-?u$2};_&6WidKsdjb60dhc6MF%HjHlkU(N&+>?1?rLqs$ZNQyK zpF0mPnv(UFi@+9lrd!G%dTAPoON%*Vh}O~H`x4FqgvuRC>CM(_m%wgUB{p_tD`sps zEC?#{jm@CzVty|^_>A(E!;ac+L+fDM>WKvPB=_y)j9N9AEd|1MhY730ZbZ@PbYE_* zHnQn%%~^Rpi2huB%KjcCd1RrjP{4an3Zjla3MwU;2Z@>e5p!zXFel8d?RR*MyGl9k z-dWjc33glbj5JxSXa%5n7I6R#sevXO&gGsY{YPI@h4w~WnOV9(WqYTcnC|WKdJITQ z`rc|pLkep_C1R^VvCJ$_WCLl5jz_J#d&4@p3G|Xvg0hrYxsV^|HLx5v4`|@9_>GjN znRgsv%HJ_yUqxBPgShe}-ECzP^24esjkZ8Ol!Q3kY@}-)&`rs6y|+m;C)i^$R`dO_ zLiDt70Sd_vmPXM`$S_#)){MM268lL=?;O&h6!o4eFbpd&?(_^(K>6nZ^=~BUbBeJu zjJ~}$)^m4~!y$bMP2A|kM}S0p=vcuF$*1M)Uc2gaqMDVBLbWr|*T%x`Q86yAE#J)Z zlulio!gt+e0Nj`_R9pI`Ih+w5I`1Xj5A>-`;%{akw>75L47J8dc*kZ?Iu`K2ZsZB* zBe|^Q48hSmt<_L5S=q`K>isLA%&ikPd-Lx-MQjklYTj!PId93O@+UnggxGyxa4@C4EeC3If;tBKO%(|wK zF=`PDa8UmsJjS{%0a&|(`V&)r&fO!^e+c#`#Qcd?>YTMl6z~XR0HXd4n{jR&ApdtC zVSB)H622aWT^q9~yG%lYai4pfG@W8iQ?f2?950Tu9kZ7H^Q782JZMJ3UpJrYyAs`L zfgeG9dYNkKy_a^Jh>l^p_s5iC`u$twRw{aeqCZ17!vf!_tK`I60z9taD>Qi92p|}rB=~mAeyxd_ zb0Kc_fq(Zk&sq3&?(h2{KUl=Q7Ls`f`Y7-8`F2paWYRHvjld1PMl{;{FsV zAnI_KJ+q?_c50v}9}y-7rX&O!G8RS-#sN|u#)*)QumaBoi4IZ|a?ZVjohYOn_Ght` z32#J@K=tU_^93{{qu(P1NZJf<85iGYVnF)&vneE@c8(O)N-#hS_2=?%`P1DwolvMY zQo#3!x&23WKmfS$@^Hq}Mn-5_NWDuy+Mzv>v9*nU5{bCB*Mwf%qSm&u@^XMNFC`MX zG`k0mV|5KqyNUrESy2=Ve|WA(M(Gq9>fBU%bLQ-O-L(xwafv{GmBCNbpW15AaUOpV zFCjLVlZEW~+W^3Q2{YOcB?}i|p&T-Pz`?q$Yu~3J^YotWq3z_Om(>pwG*>XsF^OiGvTM`d*tjwRpdD2tFa%i!uUot2)6sqSlX%J9XR0W!Osps>x0s z&R!Y$Hl3L{qKTQ|vN3{fKy$d0<~PyGFtQ=-7X`1qBAfTL(n(*){5r<q0VC1MLm=Ha^h?PwlXI-=B+ZvSqxM?V?uH$5;c%D+7O#$ zFqn;NRPaU=dHeSzYIXEF4;VV75{0cNTO~Ki*-yXOucS@2Rrwxcn_?q0UBH@^+|l99 z@S!3mX@65~)Dk=OS)@fT?(?#!WvE)L)j`2ma679j%|1nxBSz2lUwov~RHFdns{gJ7 z@NYbaP^EPg@LwQ@K9R*w!biQ?9i=OM_iy`E5?J_$lf84hv#5Yb8U~&*pj%8;>znbi zd}_5`O9Ne3T}wguwHtapaHl{Qhi3ZP)8=AhIZo5XZ?@sX(OxWTqv+P8jQT?JBWi!El9(ACC7?P5b@_SKGLk2gtjnwPl zMWR49LzBsgy9|&4(<6$mgF|f#FvY?ru`z>dq@QZUS)<=PL#Wy{Bt@M`Q%$RK`|-7d zK;>DzjEw)HhDom7(UjS2yv!`XzW#ZnSyDXp^NhbT4k9KrS_^8Bvh>kPzQuhx&@!A0 zrRD+|-!Uzp+%a%bR}ULwdmF-PPqUX%J(_6e&vVfxPAMsb1@SZcgFO#CSlj~}(D;^L>Cg6Pzn)`fVjLihj7+rt!?ShZfVtrYM~Bf@kc(

Ro1%!+N%QkB_C&fA7>r%)%P}(xgqi<<#qqByf@WPzIpFGfp8^- zpHx4IOI2P@4-;zk*BO8*qzSZycyNQ5;F)A>=)umEUZ|l|sb1oK09@rfhrOd26W$tM zLYc^J>2K_iGyJnvHBHPCVNhNu$klb@xgWQ zKqQFW_e}el;fFkhzB?Fr8y8;yuX$K{beEv2ARK~g? zRO^kbHSEQ5(9EepeRTyHTFxJmx=%KCUQG!&p|&&1n!UYi<6&@5Eq9g zolEpbS}3gTj?!e!=P%t-rEg!|ROYZHN4MIevzHY{dVeukU0aYQ)NVw#0+w~H0!0vT zR@f9gd9cWo8F>^kR0?Q}l~fSR=|*(z4vA`u3OCICWc#ZZ#xuJw*Q9x zJjwV94$_iN#?QKked8v2PC1OrxaV7Wy)sK#T%JA(obwl)^XL6|-e&EGNF0zx7<2g^ z>@GTTM=>l9o~ykFViK1EAI_bh<79%m12jQE*RvU@%tva62PKgc4kZ6TvkLEFQes4^ zMxfwf95P1SE86P>TYY(_&Omh2O=SGh!y+RTRqZ1_nA1_V$K1oLbQ{&pWy;Kkh3^5w zQV9B$%$B*m+}2vsc1UG?2{g}I!m!w$pIjXa9OKoN95Zs_^AaCY*=!qg=0SvE1zZj} zJlbVVo6Z@mPRCo!HX^H!Omarp@|;q=nVDx$zj3B3@xU}iOk`Z9LA0;6h-GmNUV1ul zv#fL|zK)D_l@iRy08O*1w~X4a5Z0)3qgv7L9mTQ)Zo8&qA6q(1hVP=?Xtw-1ZL`-ks|^>x7!C$5z`Es>mmGtF z4%avmu8XWZGxjeA8cl=9+9H^k3iD)B{ZSMrHZF~=5v<{EhMnQAnAiJ|7*zJsgLE73 z@oLRfzV?3a!j}PUgq)r;8J<}c5t1zo_QyhCtqX`JP_rVkyTjPUo8zQO zRB;W}i2ZjW^vB$AFRRWW0Jz2tFU=1ju$^pWNBEI1)Fn2gfJ=5=5vN(HSJvIXoeI@n zg>CB=sF_pmzIoy|+c6>OYo4dvJ~WfPFX))FW{{Ai!wuUG*_zzyzKi6B%#f%xaH@rU z4}r|sDQ81GG~J3&D)ex-CcW{!y^6m;i3^9ayEjSvE zlu^l$+08&Db}j?}a3QI}9`*-uhPru({{HwJHiJJm2j(2qdc>?ptTl#zg+JJpBKRZtJ88p8>ANr0h>PtN2A*32ZpXznK= z%Vhsy_9txHk?=y|-y!CA=K!YNQQ8M#p6FBhooe5->=khpffrsWP>xSeG;Ne1J=nG= z)y-f)jNVxx&&tganSxqggTSVs%_JY$%*lQphExg-opG(dDZ@J<^8{n zw;7q03;I71yjgTGq5;S|rb3^?1b)Dil`2X{?MLGSyPgDN0#9Hm= z|5^gCNyzu#wX_K?DF0oXoksrO(b zWWe|+5)2*^2ha50HrUQEy6}#5K&KR!|Y7y(}DuI!%NP(@@|ARnTN%%-& z?U)$EA*)b=BlBxnP;bMeMI4>Ui#yL*$}|oTYT%%G_+*g~N!vgt$RfCP)Dw89B&O_EeXD5wD={cmQ1-AXPq_%)#y2uVt@6pp@H;jCYVGhnp zuVzD8?ALCtV~_UTzfB$+$gF zYKu_5&w?n;ip5yF<2_Z^=CInJw*`41q(Hnw7%z5=&{qfnkk?#8t*m;FxT551O>VRe z?&|O3Bb@K^B5u*u??WRDyx6DKoE9k>lq|*I(i+(1lxatqHzG;pU zBlnZn9e5)H_F^KsJIeQkB7f7GJqc}9InpWpElF+#*8OS9DYLiQz>mS_mCh#W*lq0b zQ~9;u)>Nzq&^{5ods_h#sCdh1UAY;{t_L!G^JDn7y0LW{_hb&gRx{tMYr6=kqcVHT z$yA^4S>(p`n~U&?DEh&#tRN^=K4Gmc$Ip2|n;N>(#1dbcy7pO%#y;yNhY?f~*6hc9 zU3#ypuSV6T;7JfkU7r-OFhxf>le^E%sDEM*UAgZDfN(-~4_qxQ|NY(}TV+~yBqBZM z{%dh;p$LA_O-B0ye=+atvsGf% zrrsBcK~?HhNQuQf0%PKVUXismTcbzuyO+M7xWQJsk#k_6l-#0rbyi>gGB4ck%*7v& ze{1Q@0DjLbWza`vztC8mJa4Pdq#46oHlrpBA%un&#@SM%IKmKM(vk|C;WU$^gy!B5 zf9SNc36a46HmrIesZ<^&nhup)w&Fk&1w+f($E;RmUN!l#9;Vj_y(GbZ62)^8jlvZJ zg%e#{(g@AY3TDXyJpwL3AnM71hd0)tV*#bt1X$pXyBE)7`w=~{N5!|?f+?Jt%Vm$3 z5~(5|*=6A}$ySE4A3hHG8=H;!EEZGu9?o5gO^`RvPY9chk|zahAuS9cb5yJq5iwIS zlPFBaO$prn9V@_96#UVv>qwqSYhY@}R*0XT>?$9@#^fmJsB@thXRBDD$IqdRRcJ&B z3Lt@@KI$}$?T?1-->7yq46_g(UqtAdB&PQ?fF8)hf@Fa9;cEDF*d}vWH@;WcaF;Ni zJnA(Pi)=4S{RfhB!W{dw)y47;a@1Z?_jE-KE7`BUy_*!aGMD~vanqwpYFJfD7!_8S z^ESxnqKPGo#PXs}izcg=V@-=TyRp2K7{HK2((UaZgjM-WAoUh~>c3ig&I;|84Cye&UV7w=ay(HLJ&PlrF$E z-iiOb4Px^P_CJv*Za}yK90m+56yblSx5vc{fOl_9Pqe=d`h7Vph%NNtZjtg!Sb8Y6 zB1wzsS_sUwEy0rL?K2rPiB}ObFmyXHukkSk3`IZ4+PO4&mrnyf_fSdZPX8XbTX8!g zAp5d%KIYv9oaS#Be|j3M-mQ6TAKkx+xOb|n11J@_t$YCNPoSrJ+KFBm3 z0FQ;*!*~)J65p^)`D3qC&>zX`3Zcpn zT*iw>Q`W=CKp(15(wRMw!StRhj53=~@}N3H{;J9-LRG_Dq&1$fe$?q*PXz8=QAEZa zhkAVjYQ2>Rx{>;QR}8ntl{Q-!H+70E0N==wni%>k{d$b0n87NuSCbe>{LSCKiQ+o_ z+CrHyc~Oha>TXts#yb)_uBj9~mT|nUZj)4h=o#eg%57pL2)7anqYx zHgLOLW$^9FvV7~1OVW}_z@tA3PM^k%=?r~Zm*iXVECTf4-Z);ibkig^1D#C+U`TDS zBfWxtt@L1f@rJ9*e1v{0E7|KOu4z!BdGs%hyJ$p)5X&KD4vj#6zM>A_d4r8}YQ*<#iU#I9IrOco^$ z^@BmK&;%p4f1m%MhwXgfgXqi%pqt=Z>nN9|S*Hr`vKUN;Mi@i!UA7=}ZQ?86ZhLux zUY*LTtYA(72X2()1e-=cI;k@APX`edpgA+(HSaDgg!xxwb1zo|yF>A8k=vt>CRhuUOG9e!iXI zkL9CF8w?6Q;69{X56r|pdPda*vf8{2mFxpg#*KJD$)S1fyeq~fw!*)8j0^S6Hd%cT zEl;V4?ilrzhN~W^oTnIYPy=)i5UM|fKsoD(lIIf=F9%N5)UMBzaQjwssB5OS&ad_w zzRV9OO>KlTFO*O!zI5|^lw?tyTjtL-3c%814xZ#98)uu(c2t5;?fu&)?7nk$Gp*@- z=k7Mg^H?}5@gVT0&=MbM$l4f~Hlrl!+t}A_$Ey*AUyB!8Ji!Ji4yKx-3K&(J67=Fv z1aK6Z_@ex6swb%N8RFRPoEfF^#*{*J>|tL{(ooTl;4kvG?V*91imdPK;7U<-MpirR z!oUpegxYGMqFi-K=E8utO^$qYqYi+Yx~#}1^ zb=T}U#g)x*T?^hhTf(eax&*>-Td*nC#@eEHW?F5J+H?3gO4W^yLO(f=@-;0=ExR6> zVogQB6ojP)9kGvFs|=W6L83oY|GDdIVAB{BQx}eua-#*Xd+Caf*LPb4*$7P-QO%@P zjH$(ligpu%ctmo=LU^LYT;a?|O;e*N=`f|)6>|q1TrrLhxEMz9HDa4}7-kEVazPBP z;4^i7{*612+VtTfLgzhR(B@sA=CEgn*j+!0>SBI?W4#Uops5YN?(G(Q*n=0fy0Ygr zxdOp3KU4wVKiTL#@Ka*MY!zs3Qd#~kgDYHuJPwp-PmqR6=;yx$XW334qyS!exK140 zCOV;}7CUD6w`Z#s;rz8AV3LgM6-{5IS=gx5Z531hcTRaOm)fep; z=mQDa{~%P+{eZSu&KMK>O93H)iy>!zA5KmRB_F%Xj!D?SUTn^IK2F*5hH+CNb2!UY z1;0Hym?uJZL~R298ixBv%?XLS!*XMfCdDpFn65)umElWFcwDNo#21||}HYM|k6|k|?R8?5Ra*)lvHEjQ>zoMr(<&#&lPMu{aRUgyHrd)iBWLJn?gnL)fOt!vy z7LX^5joQ=^i5_FS^+BAgE_w#fU^p(hl-p86!Zk(bZFhiX|(^xK7sU(k1^Y-5B-edJy7 z8T;?;TYfJQe6U6Ot0~?itz;i)*{%wj<=-HWHUmt#D|~tx{=&Cbd|}692I#>1OE2y& z-Q=>yJa(uBnp)Ho^#6B=1*|QkZXX;B4C8+ev81HE&;m4f|5d!OzMPtR#Ig31zU5--`+Xbce?36_muAQlN*X{=$`5oz-yd7{rk>F2?$N!?Fx zb`2V9McQFvaoX0yf0Zmjq(Yf!qbGsT)Nw@@QGjV?0GY7hY^|uHfP9qOMa--<5vBDn zi|mtGc*B}^iF(J=PRYG}8IKlcweFfx$GTJI;jH+}Ew_VVVn+}L7rR_e|0o%?l~3CMD^Zz$8Q`Sb*v0FMhGTMQ5l8oR}`IuKeF4Ks`eT* zXPR0zv?7QJEyGqZ7-s7vS=CrV5P$K@W4dtslyi;UPpn?cKDPQbQ4zmgMJbR}JmM!1 z<$6|B48^YJS^^;hn-nrQFY-*Y8%XFof)ZstWg5}z=7FlD zXu&m%6)ARfiN-gVd0BT>BNZQ8l|$*&?b;E%u)Qja+guShe2ruR_mWN1j-fl##tSeU z$!aw8G5MBk`bYi)X-p)4MFEA2^dmG`=}tYhR8 zyN!}k&QnyjClsvPU({|67|Wh=bp-Uq%b~C8$Z=LIiXD5Yej5Zmp0jUHaTA8f{pB^~ z`w(9iJ3uaGhq#wrF0%Q7%AQSJupnK$*aEhSl@of4BQe9JZY)Z9C!}Y<$N*ti8>P<5 zc{g4KEBt4C*zk=ttOVNOqetSeRZ`^3k5X3I_3vuEYaRf?zRe09 zsn#iUG$O|JA`f%uG-v|GGmWn5Z?C517k!xGV6qbsMwsL%+ZEmol_3 zG{hBThI`Ev4u*R5hwI}0QWpa}&7Xi@G2@EZ7)P&u%}~Nua&G+KT(NSr%pjWYqk zEbl}7dWX_C;u#>hSbq=oh`_UAjnig`<~GsQvOQu zb8Khq_Db+`BK>ZyOYL!ARkhCtiLyulp8w1U?Gy1oYBQk(Gx76Zk*)v#GZOeOPysku z%pFYK-P5!T|Fy~Rf_AnG`T4gO`JNCFJP;(?wijzn(Dn3~u}gkIG(o?kU3&O+@i*i# zb2f+VWa4$+57|?Wp()0-XQ!@;sA2Y!-J`zY_OKgOEL4c@axRr_U$3s)&aOQM37!hx z@^0S#6fgjvkJTsOTOb7m5ykIAV*@~360QP3aHJ}pLNl4sh8SFPA6aqc-O=14~s$$w53G3&@2z zf*bx@(CiD}2i)^v*0fKV$u`!Pg{c@4#z7V|Xbyh2P3Jo7di{${R9WlH6JSU|R~(K{ zZnzHQ(a+7nxhdhzvzFlZ1Ytb(8M+93pFseOB-^udp7=`cbNH}rcshPY_--or4>5GL z^(VH4U6!-Hz7mrjM+@5Pm$9CoX({P&OFy=`e9E?;HR2A5JOFef`Fxiq$~gP%`8R^S z&e$opHWfOKRHv|F>Zp}A0m=PFZEHs7)FCVe%6qy*77zc#74gI4F)X4PnzG~ue_}dZ z-f(e7pIw3a?z_T}QaUUa(p;~j3~9b;S6%14{CcD6*uU!8!xf6I_tq(8O=vV)OAkODYtuE)r!Eg7hmM(GkXw4ZJ4!BNI$LfUhuQ#FP2-#!l|J zKJV}ovOir2VTY_uB}E3~IjgZDlXvz25s!Pkk&Dn^5K0;r2AxU%e7UFdwYj(bf`fG% z8pbh^_JEs|465Vx=9#op*dK?iljsJ9&__-w_pQ>wvvY`%u}$TA ziO4ECPY!G8L?5V?7r0_!Q`DWR&MuypIh^KZ2U-i${@C5908Z|8&$OTTDaK+6#ydhm z{``!jD;M~el_&O(jw95ymAXqO@@3kalGkyWELP<;Y`Y%VFn_5$A2vw$%BE<6AgZHs zmrF5j3YmKc(gbvp)*DL|?+b7WW6@Ow)YoqU5WYF111I#_hKrS*mqRQxUR;d`CnH`N*CE7k~owA2osG4hilCS9H?9-wWj zlWC4!Vm2|J{O^i}F_?XS4ZbMK*}Q)vSc}cJNF1o~1r#?}GCP${Qs|LVl3V|tg|$I0 zG$b`85B|kKbiI>1kZ%X|)Qhcmox{0+oWG@6AuC%O@cXD;@Kq~iQJ4GU-KWFSfi3^cPyiKB$Ylt58lGKw#xMc zN}z%Y`1C$yH)RX`swngHY+&)1WkQ!FGAgqaq;Aw014S4DWgMT_ugm5t^ZKaG4J##G zB+^;)L7KYxao4CUa9_~>!5gQ=pM%x{% za$U|%1&P4{sckvO$xLC$GftTYIp(BKtM-m`+QTRFRbgL+{LVC{`s4)utCxon3LBK+>D7>x8h1Ar8v zArWA(x75(?O~zyW4Ak$Eh@7XKbOwoerFuJJ(V<^^9G)A0sKNv3-z1s>s>sSr3{bp)#G;rWw@aYMtp-qLN$!yV6Ryr$TY z{iF6!HO`=|;cslbbY&2Ru`u7C0VU(qEfx{zx8v%D4(n2@E$dv=SEhz_qYs&u$CALo zSrHfZwkk(EQ~9&^TvO+8&!pyIcWystDPOZ1ye_LLmrp;vGy8=&as~dRDg9|NJh)HR z%O6Tooa*}>d7RU!m|h|5EN=gL0Z9vlb0_Xy9oFM-e=Pm4lbD1&%yuGC00swp)g3IZ z{tdojhZ0)MVNR7H6VXWpCAxPe3z4uo6ctR~Vk(iG_^oKk43$ipQ^zf}Bw|yI3``DY zg#r^(ep!mp2FpVFSwQ~xH0&fw1GgtXjv<8&+g9eHUyFt56B6>Sq$CGPS0tEG+62iY zXF^P&>R$QY+y!zZp4$zpfN%QB)!DTK=%iYS6uH&^pf-_F$D+jxMv7E};n!2=yl(HeWg5 z#8ap7Z>X9m!BSM%~hU{_^c zvp|h~iC3*}Kn%5_^Hgzn^gka`9uAD8^rSa3co~mxnYe@)qsNo-#geWX1?llK>`woK zSKXNB=l6>YNsgZYzY^RS!#iZn*n7K@SZWeb|W_=$EUW2Eqp#y|hK{!&MihWXlpU`aIet+EZ zpxXIc#>aX67LR96ubAWduD1POQrFHlE<6Is=A@hMfc^vk0|qj-=SA*H;j+FCZmkgo z(>`~_&)x93-GTAAN$ZNW0%#!h3UpvdtfMQJW~Atalw&GDVVQ zoDREJEIMC5%G6YwJq|MS1Q`Up&)U^22~Yb6({tZ>{`hoL9q^`ghm9+jB*YDN1I*FUF*N4F=7e>cBy{?Xf%^oS|fW5?Qzdm`!fq_H-w$)FU zM}|PpE9vgBFE64!u==+c1fq&VG8n%oPM%DCaSws@5OLQ`VpLZVdX&?I0Agu2bZ9=H zhY2~(M&mj-$iww!$8%ojJZM&EtZh zbaEiW0z5E7Na584slh4@pDO^~7Phhr4;5f}8sf-7>#pgL=^Xx6kKUa?Y=gN4SC%!< z1y4eG<+5uZ5YfY+;*f$k!CVI$7j)U71H!!WDT35%h>K0R>W~1X_%i>5R07!%+jrEh zEX+Nt5np=LoLY&1)IAKWxH@g-8zfaG;K9s-&mHf~BjDNl!!6M!4Bwo7j^yv>3u zHXyg`@O&EBf9?|jw0=POTX(1%=hg;1J@cspo}T;k5wp4sTEK`XE$J7t)}TLlDX*l<>Fo#Zg0rb8Eh!y2HO4Nx3s7pUJVb9b|6+kIzY< zG5?551S-J#%_Ra*eAvzxbQ+9sRe$)(_f>G1!1pB)6zg5N5Agid1sQu-^oREIj+81K z-1f`}d%$;Lbx9b?88UP)6Pd-dsD_}rOx=*VM6eKdO_wYzPDtV)r)_jyi6W)*c3oA< zXRx??Zpdf&o_JY0-|)+11bUpWS{fU^xbF#V7y~jOk)SZDi7KW<4g5WLGp&h=rb3C` zDu~La#5+jx=^u~bx|#NpC_Qy6rYH-%Sls-<#z z>H@3+NzF5wGyUza-P#P()z!6lMvmQp;x*~+ou{gXB=-2rcDxCd_)ZyVUcAP^Rj86h z5C+Z4_sp+pTyH--snZr*$aJ`qerJoBUSL{6I7~r)VShCQPj4WGenX5$9h$fMvohlu z<|gorcTN56%Y{n}lA%yOohH#uGqVo+2qCd2(_iO$ryeo%MM|LVOQ)E25ph`Q$8>x;)E^GoD9Rbh6;@#>m>H~2oww+IWdg#e{T@oEdR^xX6Bd< z-Q~o^E9tYqW4mj(ett{^iW=vUtGoMH`tTltgmJ?N)r3!>{+yJrt~X69KU}VPF6w@z zAEoxnn(b3F1`OI*$a1w%9lR3SiRA(gClgI`m5hJP4xXe^qXQJ(dC(l`O}8*^keHB{ z--^DX@7d8)R%JfBd5L~f7Vq@CDR{~+&lSz>8iS;n^5yJ|2&$-|FWC9fp0v5RwLXR) z16Pot8i~>2V2VANJ|Yx&#QUjZXjuo$eBr zt7@Yr0UhxVR94!cOs2$l0lsD$ETrG|MP(SrCkZmeQgs(DHj*O*9VH96wUyivDc2Lf z>=xI0Jorl{G!4n{uFJZaOm&{WB52y~JOUUFZJByHOqHkqa^?`bk}WyM%(=__dS1*z z&$4rbgqIaj4Qh`NqR69lf3pMFeI||1s}@Va<7Er;i%xv1bpFe?>MZ{+uFk2w4lY`w zUmDxCy<^+9+1Ta|n%&s88{0N_Y}+=PHqPlemuFqA^$X@R*BtMdnypYpPoFlw!bWt$ zvWB=miy*6UYL$zked;y38I0X0pxp{I07;{KmZ?+~zZGW;q|+2z_poNiz{);Bg7W|s zw+ZS8i?ZM2c1b`Ct^%15CS#YVY%ok&duX%)*im_YqDG*-UE_TbM1O;kopa#i8mzH3 z1nxPYDO;l^@rshcJ5~!5q9O5)qHRChGh-fdvgr0S>oHp4wPY@k?=xgD*$bq;z-o(* zEhaa5;cD?YSJ%#EBG@A*M3KqP?j|X#PA)DOw1FBM^1SsLd*x^IJhOoiCD4(UMh7_F zNl|>lJ>FoI0aYD9yQqFK8dtKA!b|id@{lB#SOQ?LGD8|CGQxZTXXTfz7v*&_Lg=Fu zZm9PGI=^_^uyF5*UxJB$RL@e#?>jZFa8w#Yvd4~2w3HhrHFDXR#`jRquPP~&KC_ZK zn&cU26;W3byep`^b>&!hB$nv2kKN30d~8%W=g$5nz;XdW%|Y+yuHf+4!eA^hF z;Y)HtdEN!+M=OEjCpTm%gIs1;8WoA25_%0qM~WiK#hWRvjrq?pBx-^*SUb5~q&K$a zC}5j52AF3eyHgogC-}>?)6-3eem&;gqJ}4WbF+EpVAhIdzNsvWN;d40r<@3TOTM->$C_c0+RK5(WCm5{fL%AI$4_k|zikeeEO`nKC4|L=?RT>J zHWZ*zR0q~jdY5&JM5C9rjlt4b+Dz4^bU^|UWOqpHtYa5&qsgsbi=4-Zi7`%33S(ESysi#cK%8M&&zO`GPC-MCa)!daF2GCYYI02Q~dC z*y$L!q2_!PDLh?E{=>vqU|`KeOLPJ)Q5~nx<_8Sb%h}(W^Q=+EsqvQ;n)%Xqgua0l zzM)*uM98ID;$zcz$U8b_h)W1Z?fgn`43vW>_AfXor)^FVEDv7O8Pc94@Xy|wnCzw` z+e9)E`gGyNvQiN!Ookpkc0`C#>;)X@p+~IveXI5}j<&}+&a2P2z`p-V9Z&|{mja_L zG6-TvBV8uA(@fEAGe?^(RHDp{&QOzYDUdTcCMEKVC>=PMk95r&w*hT@$By_TPnKNaHmWo0Zl@QaU+ z_#{ri6Jxr3+J$?_3XC}qR`~-0_*Eh#V2?x;LUu+1raEIRF$N#YZi2lwCXYG>x+xBdJu_Vw^Oa`|cT|Q~x{au} zE!T&Ma&j^aX+3{ghnPf1XF>IO9L z;662@WoMtQ!GS`uC@n%tKVI!=ecwHlpNAsvV|z`SOiLxral4S8`KJX+`1DB+j;b;S zBh9}&?6I%lWLGsL%qC@2Z7?h2UcZTHz)x9(YS>0myfK-KYA8_rYF<06qO6u(62uC} z!2%}HB(Ro-R(ysM_kUK(&#AfkKbn~;-~FWB8wg+UEdnjnrW5Vjnz~1r<&VJYu7T{D zL@-*^S>2p-G3uwVtYum)Pw0(R1eHw5toW`Phv>a0Y2_LyK22({fB6V`y`*RePvgqZ z;*BzP*gc@p|6S(nxn&j2C8Ac-XlR4W~aQEAB~PVW|u2^Wq*a8(A_UL77+gzjv|DU zCl#WxHLLTFu0KBLIuPRbP$UWY2#Y_$d$gQ6xLVQ9NHv#qU-b)Jo#Zl+dKZxEfR7E2tidf?JH zQ9?(x50v{$qD=5G1t+rqI9-zS;CVCk^sHF7i}m*vJ?V+$o?q?i%nf{KvTMP#-!l2H z;D-4pEB+8+Dm-C+X*KFSOu2Of@cjKm5=i##0o`I!Yn;>DCD7xBhZTrruhm*P|J|`n&9gVNokL z!P(VerH2TP3l?I0$BJ9wO4hh{DIE?^FEFRCHdnJE=zq4n=zF=ili(i9fsTA`+5xdc zc7?-RZEj9htce+^7q>eSSm}I}5tQOlZIVUAQaeRSK}IFYzNGc1e>Z!3k#-z48H-w#qg z=_6^>Uq+&nNRYMk7oR3n1oXTxMtJrl(WOvE+_&dE>hzifiWZ^p-(TD2R_CsGxY<(4 zBE1FVuVZ=aFB|5>#Qt)AsegBe6exdRTCJ*ep67PM^e{uDd&gu@-<6?xs0P^r)6P6S ze`K)lU`vR7y^9usa73CmWHWytCjy*(N}FjOBurrF{n|qvqp!wgdrp`vuYMO^EWXU- zrt$KBlI6=y(NV(gA+DgEMs@94WzD}2{d@;&WWJJke*O|s?DYju3rVAJkoQgU9@Y%| zlCC?e+v9nvTn%15mv&j7)`KAX!l_#M?^zsbvj>{x>z+|G4)>H+0(9{wG& zdLR%NZcOeyhu1T-6AX}%D0%9wZ&8yXWTrM5CN1$Pg)L$#(zDgx27%PFZdE{>{fHV3piohYIAuh9Zi$`# z3AS;<;vb1-2Qu%W`O~~HZ(a&8aYvXEtLD7>7DVH1Fd9nM>L3$Y0+KtPrP42Gnb&+% zyguXzCIlDR#6PEWquIYx-YC)4XPZ>Xfm+=ta1iU1gu}$5q$&^JsS&QCvfL+0wNzbF~5>rYJRea zT;H}XY-HxP53aNM&`m^r9F9E157I@ry~dKd3=e5ad4h^u&8AV*p!6;{0;0ymc^n1$ z9h6vid1sP^Fb_qrb8L(4tTsIYdKUH{&+$#BgkNl5z#i@oro5>L@}1AP3ArnIBo0nT z<^4;W-Oa?!*{>?36p>5XQXXRP}0YSuOo*Nu{^#25wpH2Ksi{FS>?l zAOqUCZiTde)Ny@THGs=+Iqm{)tz&$vY&b45v_NeJPux`j{gtFxo3XFtRXe830yVzr zz_oJHhBLn<{V%rrb~O>xWn$^;;uWWRs`(GBAKR!1SDLFaF%WjhsOQISZj4haFiY_o zl#iNu3(9eUQ{(F}b~$Nf$2mTP7ALks&`WWPt-;!FG%t%B7}ep zBn9}sJZY#sU0&!D%sf;A8_3xRYX~36jVH-oM9~{&oA9Y`%P=$F)?xIZhr1k{p7toh zMf}|M4=B>3jkgj&>x#7qGD=kSv5RTs*y(PfTr_^ z7hR3p=7wq3>i&$2fEnv{wwy%c3fkd;KVKGbe4 zq?Knf_vybB#I+7chVJ!uws6DKX%K4z=8mCrd~FlyWYb^SshgR!8MVbU_d>pT&*J5b zb(-Go6{GNii;b{#(N026v|$3XTF?ywH`CVO>Cr)%2Ka06?tptY#^0$<0wA?b4&jI~ zORzihIt*=FU_9$H$howu6MM_}xRT96LSP#O#k_XI$kjun-~mL_ZX>`%{kcRvvg|Da z5PgQQ-zu*?R6Y;bVjui&6)Vtu*&cQ?%7qb7#N}kT>N@Z->Ii|HKkR+~!(}hNvCSh` zB5e%8hiTdK!QTgc`SMu#1thyw74bMO^IynV19qY{JCmrj{km!Y7MF4YKRPPuC+j{p8pu(S?lf z@4BnRLm-W|f-vhCLt~W8vq1-&rSgjB0IVYWBIRAf%F(T(EDxB_aX{9XM?|i@ygG(7 zGezdd;tg_!l1?9H_bKg?-3$P1QuWzWGcI{oXnwHPnv7v|@UX}onk#V}=IWtj158;| zi!Qm-u+#z0??{6N<(Y^gu|DLO2C;SXhr-IB_&e<(T3=Q&7zxa5=2g zDCf^Si@Q4>J^c5?CSoA7rdgu#0EOSd5Y*P`Z>5tMGoU9`+hp#doOo%t>chs{H|805 zIf!SdDQWzC0Q$B{El38Fj?)e>cT#ot%x3%Ex9u_30iZQuw7_bwWxcO8{HMM#^XjZ+ zZ})D2?+Y_byVP&`Ky|NLtqFanSbbvCl^{{P{2Aah-NFsSQ%(N;s5223lR(MSh!F{( zQhz{W26^pg6h!DTh-ntj<$DG^&yG6mq?T%J^GdwV zk2-Jtl2dHcVQu0em~v{#_z@1i63ATtVshEGWVgZm=o1(p^FxZd<$B}hplr*ye(Pj? z_~eY)+90OfRFod!XJbzl_*t*DC2ax=7-6}q3b8kkM}cRJHZQQg7yKT{T>o# z#d{lc0bRkCtdUN*{s-lPmJ=DgPeb(0;2v!)aA+T%2x9g?76^^FkIWPl-+abClvf;~H-kxwaud{_8pSU}u#TeU zRd{x7)eSp7&~#It=9S5bbO%ENnfU5_j;a~PL2}F#rye;#tg2zmc3r_}+60b&y#qLT zn6O>aUwY<>u^LCjB=#BG9_-wXM9sZNz80~_Dw_jm&MXbrNTdSB{_RYi7s(8Ss2xgp-r(o>5TC=ryWN z{}^ujHEcnfr?=@(Z8|pO;LcV9qd*{TM|e0>#%xIDeU+&ZtX^6(Oyjez$2Du524ri~ zP|&rRZk(g~m!}K+EISnpst8j29ML9df1aV0xwXOzSWQt78lU`{2tMx0J6m~Ggq{Ih z>}mw4lLn)>m5vpNsygqC=tpH8Qq7uOPO$OF#9f`YQ~HgV z1j>ChjZ_CG9|_AWChiO6+i{jc7P8)iep`*kX_I&s&TgAJU!fP(@)w+J11At ze>bL{rm@HNc1;^}A7~Bh|!e z|8#sUKt(isYj438)`z4tBqao)mnXV5F@2hw&|<`-1#YIpS7hu?aa zto_&GwxWu#A~#~BbpfkUGNlUg52__qqWP@=^%j|zKb6-zPI4GACFcP8>T?XkQWSdO zlTzVbJRaGc)t#MWC?atuk+b*`(Z`}%spS3sTYQ13rU>vMesHjcUvSg zA*>q_3o@FZpe47IVCpC=W6SL5WwiV-OlBRL6OjCVxn)G@<|b9=robPXTL_t?Vkc8O zrT}}Divm>THz7p?=0}7lbrjawQX|Dj2GD$e)j5iSaG=z53<&^9g_hn$o0*XzPh$te zHKi^nU;K3l+1~{3RTg@&g**+5V#7WLgcGz6A#I6|2w6}fZ3DtMoB}Ysp$>8I+9@-G z4ApFgQKOljc91gBa6X1bUEun7wInM7)VcvX#jmteg=+(16=248*gt!->^gr+IWKHq zYKu7)j;rYH2!4QWRY}W#?9Hi8&gE#%u2yn^1aS%y9W`sALwSObSH*C4kUH8SU=EmF zSa%SlfC5BOgr*3sgNogl40ri1-*%9ffvB7ZIBl>@fqLYbbxE3wBCQtPF8-Mnc=ePDeX##iwTsh)?mJ zpl{6e^&TraK6Imz^Jw*#N=r6mJbH7Bdl#Qc-UW@zr!wPK3cDo|FvV-UJWz4z1JsOt z8nY;V*kx5~A2&)*r?%JyR_m0FSzc(a|0--$`!Ir84sDb(VjQ}lS+D-2Pp^7AVrbFG zD3U7mbkYSGE7`6q_0`tk7X>7P{ggF?riu5OO~C^bvNxa4@eszvyL!0~6d z+$1RdvKgbpIGc&b=JEJ?!>mKCD$Uy_z^4o+#oM-QysL%d=*PzKL%_9Nht?+5X0wci z;wI&0%j_{X;TWvrk7KV*w3h_O_AOh+#4d-!EV0Rs+!SW~;!lUu5%>K~&p!oVpC#DqSg7DIt;5 zD2f>YRDH;-EsNZTt^stBW8~RuGWVq^iP3F{&FS`k!NBXIKQq|{T1p3gD==ZmctiaV z=4ORJW+n#N=M0Po7WzQlZ^9G&@V1hxO{_XGtuqxV%6yTxrm>+s@2-|#TyyDLBeI}H zN4?=Vaqqqf}M<5FeV@-2%k&&L)=v{$unU(Tv-q!ttLWC{TYkjK`niUBC04+?h^ zU;Rig*eT=Azr+I&X(w+@O5RCoQ$_lJJjkrc--RE~-nG9&=Oy+HPCoDeB|agX=^;qz zLR3Zmi%aNYtEY*oVD}mFUbpTMo7F@-N0^})yi>|?X5*dJyYP=41O$)_>5f^!f z(zp#~wp19$j5KH1dzEq%T!4L)H>zw0Z2;|b(HA)!mjKxjNqEuguT${w-?CUj#j9wX zn?&seVviOm%cl-Fl%uyJFDFjZG4$ld9vXA;6M~4?72cKD>bM35LFTZ-j0m)AYZrN^ z5ZBal(0mkezm#mP5IGBmQkE%?iX3{eXia|aUKuxJZ3HPQI$&b9gLo{|SJ87!Xsoia zzBB14a!*hu|981n1dn+p<60*qw)vB*xXyswn+ItNP^uYwb*p`CR;lBC$)={?f6UqI zKpW#|)~VB0%0@GWJu+RtV+krTWTW(9F(Ie%Ym3T6;t*$erHhU<@AggV)H{hW^9mB> z2^BhK%jm{=b!!T`?JWq;$}w5pca0$|$jEk&IT_Ff@qbQRezpwGErrIn;N-2+7pX{? z9tU7yAod_--cGw%A4NgKG`wsX%1#rS{KtcPPu)W~>k4Vn#qmIN;t1+C^Nr*QuM5rF z5{x_S76Fu`+A6mh+$(WI2VhC@&$dJgX1DIQg+E)FLgzqO&!2;W)@X&5=w4x21F=3# z)PEP4XbhQT@I%FEQJN$&{G`!>W7K5JDUjb|;z9su7wxli;nZq`5AbuLIO!ak7Cj7B z*#D&x?t68*Zgn&v*5yBa;JM6;F>f+FowK_6tPa-gv1l8&oq;#3ls+K8Sv-y=B zG_}l{_>Dcv!3TVvK|rHix*aXr$RBo*&$3$4Dq6@JTFm^KLVwgDh)R?P8tm|uHIaeM zcEjdcXt-5qdDU4inRX*hOKyTXEqhuQoZZ^7{hk*{8|T>v%%DXRM`nw9z=mry9WJ(8 z4u)|olVf%{!!5<;A#)=0joUSsOBHWHaMCr@LF7G|W=_HboMb*NzJ50q7qL|_LRDKZ z)39A@bn;65k|XOcl(yvLJzBhlHTd|_uGQ-??12n8pQa;TgwHy6>toCKeVz=%`Qgr-~H;4?wXse=tbnl_tLSH#?(#@T5cpY1cSIYb`xwC$&yPCD-C+YITVWs5G%53R%D zli?o<5RS)F&)ZR{AnM$#WZxGjem+rM?=}HUz$QQ4?^@VUc-~33Iea<&*^`|ZtW?_B z+rV8lgD{0=crv3WUu ze6W=7M$zC{t{%3$C9$D_^~ACLz5Z*74{JV0f%jA_trO3;QsGy6C(=myvP(uMQJkiZ zC`i``zG_L!rM8oxR&8}K_QJPauckoPoq4Os=_hv!iC1OzzHJMHv3gs-u_t49nN#@f zvb5W(H(bRH7I%x>Z%yxL;|mhkgbk*!a^^zOZQ3X-N8Of4N}DE`O2-4dr=J;RBv^<` zC=HU=SOF~xoaNzQx2FhRB_W0xjrhpuWzgXPdy7G}no5-C1$~2<5G8kowN$pRvS4u@ zZr4)u0oPL_P^E`LShFrFewpOH#@Fcmmsg?cC7VW1tk9Ccnf7g=Oiws$6=>h(i5#cu z2QcInuB<%XHS873x?;9o?nhu*70dYb7c7hF_kFu3u3D|#z3B@BfBlc2EES}#b)Z-H zT}_e0@C)2`!;h%G@?EORUCXdn2`fAG6I*$dB~Ctr#ggxnDP`)FZdqx}b&GCv(C2a$ z;R-hkZkFLI3c@np-PIk(I{M#Vm`m9EY#~z(2#e)8;|Yq8HNtI&mKB-5PcKN9 z|J44K)ttysh@EJ$i*u`ser{L4C@AH9 zvN{rB*&dpva6>RO51H0_LCycE1;%SWYVwz5AZ7|#TZw?y<<7oFlk|VX4DkX%$#snX{nw-Q|1=bBKq`pf{}Um# zebPge{-5(G{ojqKZHN)VkQq9@eg-+sE7RWNVFb;Gk5UBD(pE&`}8Dvafg{uC;zkp@f`0Van|?& z>Z4_N!lRP;afdHZI0vD;pWK1qX94Nn@Hc>-3BT0-ibT#AA192LcqPd9Zh)2bI zA5c@dJXv&;LnY}Yg_!Epd?@;02f~93I_e`ZV|EA(pNNH+aY#*-Q?AWn#Iyva$O9-x zVC5}>F^rjzZQG(O{XIJLN5CbWx&??DxQw0+^0?{e2MGk9IBxu4Cr1KKg51H{~xYP~h6n%NHpBH>zOrHc`=L_^BsEsoA!N7wxV+ zzi*7raB+TKrMhD;MN0UCJoi?$Ea?sY*%|mle10L%B*#K#?jZmzhqzZrzT0wZKjRrs zD2f~Sz-Y*Tm5ANuqO-SJ38dzjV~eZqpEEh%0Q}Kb*bWLN1HTgi;;m>&sCt<(AfcoD zrfq%`Yvtdaw0c9;*D)Ac+}6k2pYAu?6{?b$_bd1Hd0~R%Wsc)~d|N?fO#)z@EK zlGmo4Ez8pz-yS#IBAEp$mnf;zYappVwNt33Bt!$1W)J8O4uifbH1d_V6vDY??cYg-=o z!9QJFC|!x;$T{dwFrVMr2%iIy1`Sdsl6D$lz8#p8nVJyN03?lVR*8q6!`96+{AkO!jKFPuU zaF?pUP2e-fdq@9ZX4<;i)unm()IQ_lh5RBKa$#andnTpyF55(A29#R!WXULr{Os8-L+GqXi>h^# zKdiw)O0KsrQIYl}rB~X+*tQbvYH;hOztG4hd$MP|L(QN!?n0 zVMCN+fBQAf-V(}=EmYEUoWU%i9fp>oOoOZ1*dTK$wpsjptgDF0;WBV$#;C^VM0G%@ z0*yIWAX0}m66^)X2de+CAPaILJ2g{1ecCl8>FaW;H%Nf@xNdKlAU^bxY@gq#bA)83 zLn{7(z5WylaT)2fy0LR7!pNp_t|bklA%nK6e)~`2Pp3NPH3doQEhV zYL0pM{HZ#6A0BIugsGUNJ((z>!r|PP8+mRszmBb8uyo>>oIztV<<%VHm?2c!I!T7c ziAN?^S^eLpY?by}(nJS?acGN4k3AV!)t*n zxZ0qZkn}Xm#lp;-KQv43o1XFFQ zMaKR@v<}pYzpi1I$#94wT>aM7KLS5A@t_QZNQcPg#Q`n-{aK~|OM(t$Ih?c{M0a{a zUM(?I&+cb8hWQSGAgrN*k9%T2QfSfYYlM;Jg#67nWywsZQrE%aujlU&tCj~6+bMcc zCh>;wi3Y1$wFMG}BUAx=uhkW`O@kr*9CO1G*E_Z9gk;Wf4TI#|naxr+sr(XoErNnP zJSVfV#%YiPMQN5&hXu?Jl@7BU^WUn!rC-H+(?u*0XD{>rU~L_sJt>|#-sxQ0L3$sO zK>j_*n~2{No7~578o)ABAy0Q~ll971apWAPxrdQ3q|9OzNfJYqCGCTJLw?6r*1%n< z%o2mVJze&Hnl6tBfb>3SCjSTgqDwK$_)}qqxDEYTEcgdcyIjGfMP~b+)(1 zQE7wzs3M278#{1G>U-cHB$U%?OglJ_Ro3J>Z2W_OiGG0uJ`B!PMo|!bUnMUpwtb4u z3R*2X%Q60!u?Hvn$tm;RyO{ zc3SBx%^zV#+uoC%(;HHxCphgNTO$sS=+dC?+K-#RZ>vCzrg8}*dT{YMUubHP#k`YQ zt=wT+nj#bPjm_dq|HEME7aBGAPi)W<=KmaW9qn*h{=(! ztKW;{dW6TJnm*}QHo9o3se(H@HuE`mMv;>jDReARo)kIr<@?@K=-E4|)0JW?^UR!o z$YU*dYH^(m`wBP$bI0|V)!~-TipPQeDG^K#jDS2snx9y>kneL4UrvboeiE{`^w8(v zaxx(T>~6{s&2emh5Zo;ixt1#QIb`8p4|(xvVh}0P%P#34Dm`A&7k*5lCaJccS}313 z4}==+2zo_y9OZ;WHGqD!V43>xaPBfm>ri&7hIllm)AEq@f*`{K!`+X@MGfR;4F7mZ zGDP%kJUX~TO`N^s=LxkTd)!5QAgKdsfvXUb=tji&r5g2OyR4UKpkP=^bG^8gOX!tE z?v+e3Q9q0ik<2kX|I2^E1hPazk-U{Z#}1Qq*CcSYR7})h?|gt-Hkc+;rTy)c9y z6t9e#GKbk|q9j*UOnls#uoXbY`h!t3Ewkoobnp5&8%R)&`3pA3(46{UI1+-1bmbJ!tY5)u8@CJjW-7r8+%EsJZ0pK+QYMI{SyNPx+x9=#apG&0Qx_1 znFvt^TS5{O^epg0-^R~9gG$>ZhuKq4NuQT7FACLq=|+|r?;a}Hu4wL^PR96xCxbIS zf)_OhBIvlKrIfVzjN`#S(o+~yIBOV>N~O=8_41Ts(&6DS{jprK{= zQkHvz{)*8~w8TR}$0Mx}MH>r*#fSW<`Ce-`via?hn^wI+Gid7fpV&tIo!B;Y$M
u8iNtKq(#Z=J3C$(U);dO0;A79mxrrrEC_| zZB`T=7Pa^5z4+p6b^2Gd&1DUOvs(zdm8!r3&HUXm2GN@>zBwxdE_EvrY&GzxwwEs2 zT?i^Rgm*b!T$x+LRU2F$l)HojqXGYRpu)n<#B}cd{{lEQSs{dcDlqLy*l`iBCfdYaz(UfY`+Gfd2AE(5} zfD4fblZYeALBN9w4Ur{-RTxB9b&)krN*q_r$^1`j`$@Z7$_N=DNJmgrZ2V_oVIgoo z^lu>U&S+=nPSs@H#orTIS+9=^4^N%{J6bw_qh~))2W0*;X+Ci|NTuL_R+nM{__`;8 zrAPs$>Z zI81jlJ}(8}d1z0(MJvi>ojc$eAs^u%U=DLJ&yk4n9#pMj8-S-ARzq>+lnBin15*KL z++C4yp$!#HcSawEHHgi!Fh?Q}@qP%d%1)gt^KO8$9K$rQqA0>M&O^-c++*lY4xnzb zkI|@=Gpv-jvcsoLFVw9JMx;6)B``vmu+{1qmq;=+QQdZ@fxq5+^*wC88FUg&kBC?cvH+cZUH093QX)0H+5CfZ8K7Vq6_p zS1#ODmwRtOt)=nmeM${V!w!7*@RK3a;Q>te+Fppkur$EQBSJ~BH4)aKRcaQ4hyDfM zn`6~!9$dpz*tojcZWEpC_UKjGIYfTrF^J-dYu;z40m~cijm8sbypfg!2W?w>04~-U+1!C zqxXX7FIGXxP$(4a-AjxjWcrBUl+GnQ8a*3;M`pDG?0qsnF1_-3N<}dU%J!@=T%we3 zUTKD6(N=7sWHQf!i#-^N7XDw3wZ}8FWKy{Es%p}KWJM+Y!;?=m9n#Y$1OR)!FzpZf zm_Xin^h_Im{vaDR)PYwpnaJNexU9zCJH;xK-Z2$j^lNJMp4upG#Z{zjNz5s z!lmQseV6`O34b^tdF$cqrOly5A}7`lQ|DM(BC-l~g)$H(#RjAH3acFi{LOvc?-1aO zsKy%MUGmO?{J$Mj9)a{+!p@5iKWTL*FIi%^3%A*AR$N8}n`qFgshLOlF9wyWFAgd@ z)HLHwQpy{_-xt-ku_sm7?17f&+F(z!rBBr*;$?qkbr7pbmy_2=dFOGbG-nP>M|JX(u8SpFehaDQ zx||}r?y!AzEGQfsl$0Bfz+SMM;ZSkpmM|UsV?zTfcrVU^VmtAcjMQgHvWL7vUD9U{ zUI7=uRji2Wi?LiQ*YF(a-Ec56D%cJwXXr_#sp_g33pXX$(NBx*ZvE0bHBx#Cb7`mN z)Uh4FzsuIzk#>(;7e`hQ38nd4ypV1Qz@i)xwTYyMrNsS+O z>5+L)fHRPw!v3fnx_Eg|lsQ&~r34w^>|_XXf~nFiSTd~;wzt4_jexzNT41-5D#np@ z(tevV$N1P;T-vLFuV7 z^40AWMjI%lNdQ*3K^pH$$AOjw>Wl|}YLF$@)8-huNl5juqWf!2!mMBIzg;DgThfE} z2Txp5JF-?bx}wj4q4<)Vbwz|4iZ%O=LP$!4q6fvHgLx+YNIo(VIZOq)Bc_HO(DW2| z>S}Zl^G^%7@fQpy?Ldo2ksMaus^|ggB04V%P8jVhaA4MnsutPF%S^jm11WHjWOvFW zfwDOm1uhETqCiO7=c5Hn!apz}2?SCN;>uvO9UWoPgyQI^O-XZ#Rc*aelipYy#LCR$ zovC-hRw@-K7+-W*JW&&0@VV?J1_BRxtu23L`lm~9(5DHy1+E%e!pJoJgb9es#|Ls5 zoA2#*w5LT2+yfwQhu)C=aq|Cp3UFuL@8OLl0C?u6d!B1{dpyJ90PyUX2&nKB=00^2 z$%mced;BWlf&>?YV)Dv8XQ|lZkNv%S#0f;bj9sLy2%e~cLRIC zm|X`i=-w@OK+GM7F|O{hMct;dMXO1UHLuSJ@a~#;60lP&Ds&eqo*s3Ia>h#QCu*_o zFV3S(#kA%1aBI%h!qYkdRzpq;xKd5T5CQzo8tS^UY3f zxPCK^EmD0U@Vm+0P<3O|kq?$8wz;#()Kt_#JHHF6@nOO#;lnqd{e4WR>5>0xgpO*s zwz(KwB&`b@P&!r;aPOrJnRL`eU0EVw1)Ba)Nf-|rxYJh&aDe!|<)j9c4W&Di(iHZ&Z99;NePUadVW zOpSgrG@Jz^8#jc*N1q*HH8%Y~<3H=$zQ* zb>}hJh~%GwzXKXk{)-hJMtUc+VHKr!6H=U;c3S(Wno%<5l28K7kN(^Koc^$+>o$~J z!+Gb`J(S?c^!wUyYoN0?nLhrE&VzMrOL8;u*PpHnL9w4(nZBV~j}e89slQQ9ZPib~)`|EEWXGTazJjoRibGn`&fd7~JX}pguwfV^uYl zMbkEkkTAk$a?V7Z;g&k>A+2Oz(7@`Th@hX@6zX%t)9-R-1kSJe(zwv=;TdnK`H3ar zJ)c&Oyp5o)(3KFBj>QDjvHxl7E2E-}y0&NNmhO`7mX_`mP`X39JBLQP8R?cr5Tv`i zLqK3?q$H&49sQp7Tl%c`zJJYL*V*UVr`Ek@?R_pptnXPlt+v8X#Iv%#2UmBjyeD5q z{8HtJT)=)q2`?0*zOg%f3kZ)jZ)}@Sh#wgwJ$IHoG0F6i5V0O=KWB{aTTYnd*wyj) z2sHSpTH5?+KvPAfabahIehKzOCcZNa|7eF&q%ThEgbe|H{7oIZlFvjG3h0DfhsXA< zpY0ia!|w9{mDDh47{8gPmScid0DuhAYqho;G3#@*q(HP~lmZ`pqq{JxO)(#VqD zSCSUi!^f&Wz;P%$5XF1(8w2Qvp|bM{0r}-8ztIH8y39`M^;g@#f%d^46CnOl(#_rb zb6Cj$22q!xknjiX97P!&bAwB?TjargRRI~>{&A7qm!ex(xpfRnwV?yb>aE9_{OQcd z5AeA*k4*M&kE)M%-CBn$X@AbVfA?0C2quhU8+^_j@vxk*?)3IH;vo%Wm*TssJUyp# zt6e%=S*xMQ%xQ(;>u(k{7i;d+kz8Fo68c^Pyy64vQsI`{zEp*=2AZjNW!`b0;pYsVfSgQR|X&<&oSD@H5p+`c9Z@iIyf?GIn8-D*90L?E-Q}7PCZ+IOOhL=Yl}V#oNp69?)a9w7T>BqSiD@jz|ReI ztVwWm34D-$Qle5K7xJzQa&%o3(r+8>2eOH5az7E=Lhol<)mzKELAG9nM8kH=sG7#z zWIi;$1X;4*hO~!*UcIO14L8qCju8CRP@J=qwM;CHjEs5gEj(N7U&8H|_CwFw#XJwQ zG$=ox4ow+bRJo8;OK~O%J#j3HyE1VEI3Tqy!M$lZX?t~Fr4- zpHNAyXx7};B1yN1@GXIHcJolKSlwT3s&!_&wmvLJSGT(sv?_wF{WCi@#i2~mT1!qn zuw_u|e0UFiR=JU$^Oyya;NZ}zhC&PduTP*Lx^e9V2FRaQI{8?e0JVje_O#K-g1ob2 z?R{2{>gS5KuMe0hN+s^FM&q+L8&m(T8BbMRlFuKra7}aH4bh&+Qo(pKk!4P zYw`i7tKN(%@nAV9(%f zE-xSHvrKFqB=|Xgs_Y82;gY5Tr z6`Qz}`re7F#tx%=a_v=ppSn12Hf6$as4(#JY$Gr%e+b0)Wz;j{iN^bS3rFJ|UtOI# zz3~hBy?D+Ett+d}FdlIUjlLH4R6V_oxQI*oTU%9y2jwwZ`PG>H()xAH$Qxc~v;@AJv(^q%hXwZY&DTGslbua+=2X(>3>gpg?X&x%~@Q`u3PCvej5T~h1){9C_)k3$f(sHxr&r9_Qb9zgVDh)2z&Q&=R zl-85;J0TJ^g;H?zdyCEfPT_U;B0Tr<)eU+MGfxUIK@I3VS%n+CR| z9NOs5-cOG%WwMSiJhoG4h@kQK>v{sH?Vz2qZCpCrStqI|I+`*bgV(R`<@9=8yq|6mSlIi$MO191QLQ$H9YfGfL@1MapDK>{g zU-%k)o)&%fEjUsA4VOExFUKia19bI1;Br50vZW=6WIcuQ-Q+}xTSR!?ZYL^Mw#%c! zAM`9BmYSZsori}0FlE2S5X5bNbr3zD1XrOx#F$o9dM&0d9s#LLcv!8TCG43>P?#+N zeJR4mi%XU)x6an%e&x{x*%~jqSv#6OV^Rpw zg~IKqz3GaJ^P$;0E{kFEi4k8)r@LTQa>6b&BRRP zEo~QSxC&DACqI90%&3-dP%j-Gd_ObK2Z~oS2;k(CV?|yU3V$xE%NX>QoP9K>-w;b^ zugjd0Q{+BUj6_)>ll1zvV#9+p8@XIGv4G3G$z=cQ$3atlFgj68s*NSh*u+Q11)_p# zt&HZ3S2Mi<_)$-cVuN!%Pi6o@v@$PRB>f1jZfC&5SJ-`uCrCczD{mWy9-e;uB8b@w z*5Qp4^;#)}?t3Lf*{d$N5mJQ${nABQi}PggqF*b9;J4{@`<@!YH*WI6L%-M*KZ6qwB?pwQHni%lit~zvjGC-oNOjAx=5?Yq~h!lhr`k& z@00qZT~t&8-lP!2|pl7tQ4wL3JUJ1K|<&$ z;~)*@K#<^&7eZ7&ReTu1H)D%@iPYjLZgYvjq2TJeoG;79NzhD_G8QXF{5Z44O$NkZ zibo{-B>CbakmwDPzcJmf2vglnWT{JcyTnVH7p@f4@#9Mv!@e)&g%)%d*___Zj`*s# zgP4D9uOXRZ4#kLlzA^8$<^%y2v63~*t0LYu0rhLJ5W47`dfyWQ`KAjTUmiFXByT!p zq`V>-judm;WYBw=yE|Gwv0n#!*C5He(dQ#aosc~p|KW~(Y{N$g&5HVQ<_;0_R%~Vf z>zLz1xkH+plMq_|-J9wcwh`2xJ*S#-^kYZ^F?JDZZ8fB8Y5HvEP3fS?ek(-;L;Wj5 zISaAmxcqf(Vv)Frc*h9j&|J)*!cAKv1snLLY)x1Cs(ZHO5!NC|t98ZCutF0O+%6Aw zU$`e2Aqb5Zrj0QH9K-~vm)hK*b>s6XLl$g&cUTSL6NYNS!c|g3PPi|G$ST6pIt>JA zyppk)jpswznx$u^6#=PMfn?rQtSV_QW1bNq2k9L!3^qg3c{8%h zO}m&njnQ_jp=Sa&t-2LPzKAi%&G{HdUzg$VLPP|H8$U?`<%gD3J$HJ;$1F;|b}|)+ zDZW~2eR)vdq;+h1JL)cnh4m5}L&Zs?x3^GUo3N2g9+fDJYb1yva<0yvV2rw!Y4qGf z{N2|S7sRpnu3+H`-wlZjN3~ZkD^^T6S01qSy80Ueqc5nOHYIFvWGhyw_2E=>troc( zduNbXwlv{X8k&5TS&I910?*FCa7KYX^)f1;*4wedbQ3Bws3c=G9E@XW6BSduNk~zy`%LEsy}HJoqH>s@ z6{e(4DXp0+&qC;`=hO})3pe2yMs14P8u-b=-0g?) zHpgXHxkz%j`noi{U`TYG`);1+rW3O3l#mPMf#N#@2iOpaef&xUoRa}~6qkFR(+XZm z2gf|XsD1eN0CLSTUP+tio$ZJ@&4iW4F5UU}rCI2fy}~XHi$jw}5iDNG!AE)=xNG5R zr))7{uud$XHpDuJKe2xT%pJWGl^+87sQ^z80q(a>D$q0WM5rSK<_5ny5TudvkX^7v z;lxZze$R_u)h` zRAwXHs8k9hEx7{X;cu8#u$K7WH92Px1`S3EXR)C;g@23-GsVY`^wwr6|6T7_Y$}iz ziKoq$Q6rHRaR@x^JaPo3sz7zoaRp{+0}$B_Ad&83vzB zYZIixRX?h`p}u@GTCqg%4Uxe`-(<=1{Xpt*O$swxA=!d7vsPJDD_ONBo}f_m21@^j zPVOV*h~sRQ_lXcwHTPzjN{j9Vwp&;d&t302`Zdr<+_DN*pEp+ z_VRL7L<#ux=a?*PxK?S_=YVXF_;MaUG1a{>U3;NaB zHQtEd-zKC8CHUX(mb=nokk;Hz1=xycQDjWLihu7`mB(l>%u`~^pnSlzr(+Q9r3)^M zx?Poc@aU={rE#%f3kzP6i?p9_7J^)PG=;!5nX!|aHM_EpX8)}3GO$l+kTOOcgbIJ8 zv%y?fMv%7}+q)063mG4t*!!t`p*pcGuER^b(|aeCswpETeA3wE@yW*M^NqCC9a&oh z&HRLiS6;LveSpn&i_OYLw>|+`P3w`@gIG`VMWCQ3wgqSi=0#&79F|vK!IE-qpzXXx zyxs>{YwMlRv6WebiQw(F*Gt2#I#i0F6U2tzEv#>naKl8ZDSO*`rS#M_T2&m)u`WR0 zoxa1e2Fb?$es3QVIZnm5AG}WqyQNK$b$(*k#^jSR(@7AeUP8JM_Tvo+!%M_OsskhU zL$+$L-se;7nga06aOO74AcK^ZJihi^yJoXe_(LS|t!EZ0+H5Q@zPKK@y#P zguM99Oe4ZNb4D~xk&7egluHN-n~X-jDfk%b7-{VlxY>7)OD}?pcavD!7h(zwP;%Zx ztwrg?wLP_UMh>868~oWfe^c0$v(LB5zKIbfxSot4z^$*ie6PhL@g~56R#3U<+5T{T zdded7Ll?Ijm&|0WWtCaVMCaZ<&G%a+NzB!amsEDiG#L&)g8v5E$UO#5>hQW zCnWT{Xmdg;b>r%NprRCU7RyY&xVf0vuLH{G7dM5pprnxPk~yOe)8X~gy=~Bs$zfF& zUC54gTe!Ud?23sf{qTy(Gta2={qAe{b_AQuJVf?WJmOOOL_O?JKB- zz-JH#$tFj1j$>3@T<$z%pJKqah^JXY9N?i`OPXxfXsS=P>N;MRUOXfmjROn5r)%K`ZPR{{`w9AX(uX2+L7c>XrYu=ZbX`9-8Tb`R z(QW&snzWU|75j0Ul$AnC`rW+b#{wS<2-mRbyCO{S{g_7}h-w(m`9+F_#u-ezTYy^3 zh-m2)C)RwLLz-V|R0~up1A5YAGE%T7_=XQkJW(P&?BO2*3F&)G%e7fiq*2NAN~ROt zTljUd7!Ue&KvM1vR``2ZyME5qO=5PGP46o4;y*<9i8$AKY3Q?w>%W}s7hF=+XN|{Q z96H<76;Q4pS=#hjqU0T-t5rkjr)!q6OSAltxdXqc>0Q^Pu||86w9=1Hgr&DLnu0_Z zKA2muk+_hBMigqT^^<<5mczvUN-H@D`yejVXN2vh1tiGK7|pVu89aA1hx7ndkS0+| ztHtS{%^X%4FBpH^E2$>nj#!;Gr$a)XjV#$}Cfq zu6pQ|SSa-xI!Il&H^2SP1*&q@C&G(oZfEs8Vk-B`IUbqRN|J(<*lF<^P!_WKj^Adt zadjK{fUZugZxzLZTYr_TC;lQC<$ZP?GYC*S;ZkTG{hYnJ!{-6cF%SS$=96H3K%~?W zMhf>rx{Hc1`RD~V5G89;?u8cBM_!7n+7oHYuFskil-cK6^G^81izosJY;7*u=`BWZqM`!?Q!v&lC`_<&I1MtaaS zZ-KKIok43*z!HjXow+#nI9Hm=le6*A8P5vbK6`w@$@WYd27k zFvi{R)&`OQS@@8Ix*KOqDm{%|!vJW^Qa-#cQdIHETK~)UOE=)xE3l`#9GnILU3`3A zH+yRKX-gP|KcP3>)d%Bc6Dy)_w~8IX7!A5BVZRR(l3bOV?=!jT#*nU}d}Zja8vI_; z@A5XJC(+e;5x8z0)O(x({KS}_02m-9D{E(jCb?+5qWh0)H z1q)rcd$$s<^4JpvOP)`ktLmD1xHvOYaeP51m1*u>>lD>Nhq(1~>HzB^e2OwqapD{{ z9IR}ggkHT1pN`C}(@UH3M4r?z z(ro@&1`8+tEGkDjx{qXAUNE{E%xDE?&C`rr=UjWXyKl|5zg~UpAoH5E- z&Jm)zBhD%nUw!L4+d4W+x-YeQ8GN>?G}ZH+uE|IGwA4d5g9OJwW&UFyD0aB|tlSyx zupkgqqh(jpf6luy38lovKjWQfT$;~!!*j0ibT2;{{@__6<%jo}IwpJ%@4uB6z~R!sY5cJiQ-!}8$yhwmyK>@1gs^gY zRe2xNW}mK6@Rlb;zK`QMv1oj1w8t9Xfm0O3NreN}Mapo}fvW4wgHkPHKgA`t9%w5u zm#(4WRyv(&L^xBI3G=vk^DS(f1QS!09*5_JBP&sr9)@?B2m4T2?T6>(yspYdYFqWv z6~alu>}FiWOyTIZkg6#l2_Dr(pupnspbm)__$~|gPI|R=qHogt zkVTW&w?uaW9@ILRiu{!K&y}YYJ817l8>MsnWR+5XM!9&4u_XSC#J|nI$rNUANXq@- zyIoRX5I}b|GTBdZj(XPop#H$rnFPDt=u-4hLQ374oV@emi`)~#-cYW2>cczD(e-Wh zTSpyg5Lo0k!VZ-5oM^lK(z^lS92ln?CJUYw@ObhSn z#;4y;GsZ}KWBj?8lJsV|TtsKeBvr9d7A<8@6g~vO$AfZ_(U1uObqL3@GDOq6j$Z`vy1 z^ydjG+3blOSUQ_q-+W6E=zYM9=+me-2Qzvr5)wrqarXU?61p|IdO_?0@+@80BI^<{ zc6)fVDPrs3qHmXF-A~ErnzMoJ2WBv<@ppUL@z-v$D7r>GW%xE*Lzbck+-uhJJ!iIA zuMQP5-0{ZiiNkGK>$hKVNDILtTo|3MfF=@D-2ALU?9rWenkV9#4WC@ykvHa4qaJzW5WDkeEM%C)tLe zgg;a6Sn2nh670hY)|}#wpO7VihX_a8hPH(Vb}4KOsmGUvqmw2L!Qb+7KOxzdQ!=t^ILQ{JR4$|LW&7lyX=rZ{yJ zhoX9HhNWTDV+b;oMAKTubYzbmV9azIOsTeJy49re`jNy;F-(^Dzt)ZJ;;~13Yb9g? zYQ6$gPLYS^HK3|2l81ADU9HjdMPr-4N+>zxbk&y~7~0i#_&l)u^mXCND5daeExb`w zAeg|DBV3WiLZEO&{m@zWu$hPL-it%-YESOUpXUBzJCi*jzXM6~E0|K&muSHH-sH;_ z3Ta6@O8>I$n@{a3=fy}Rtm}43ap>1bAX`DrS&Ic4@CrC2?#fi4&zEQYKB3$niD+3i zp^7XtXqmo`@6~{3!6Ut*j=;jYQG%YqbZSU(t%a3Q^3i(2(K98vOpL52=x4#BnEC4` zzNL7nw5!hH0IDy)o|Uh-6PuwXc1kJL6I>!wpg1wWwUWN^8TNNVEw9<mekcZ;8t*CpzT?lGZgo?{x0semUz`NN% z%0HkolVQRuXv*y|H02iiZwz1_Oq&CI`KN4DJ_kr5jEV*TC`-Q;XO&lxVSgI=mjg7N zS6I%obJPMVm9B#d0KE9el^i%P2T1;>KlU}t;VmesBE0_hBY_xA)-j|Gba09Zn^jQ@@AEd>A|;qK<<=-nyLB=v@dfg2+I1er-=sukdpg9S%UrZfF!^?aC#n) z{LfUh{Qf-wUdRJdSpN3vwAa#94OOFk51m8IzkC7!R4M>~%-c6IE++OCG+h6ucVVHV zoqcy`O9m+Ue_La``TwoK8-+l;KXJBjR@w#ppYU#QLOzh<&yeXBSek7L004NN|2?k$ z@4%D!K+->Poa95}$ONMl0AK!T71JeJ3WP465S0I(OpF|`V!?lW|E;!6@K3ZVMc}9c zAnhNTXl{P*T%fB}9}4+*IwHUm1wiUQ9p<4(>AJrL0Pa2ho2F1B7^@IS`Umy5*e~8c z9UlEk4*CTxz0Cun{Xzb%rui=t^BSB`2&Dc)?Qc=Ke^KY)nL;3q`R_UXTNUbG&?W!~ z(9lrQa5S^EaC_^hY(euM9lQTt+<(`L@ z|7}3$184j%qW!m_fgim5zlO)(26;g+aWRnmPvCzi`v1EPPb9(G#XyQbj(v)u&D_<& z;9?*d?eE?Dcdq}x&3HjTfTn{PIIjpuEc<&r{+xXOIr#oPSaO2?KsBu`JS|-QcZtJ8 Uml3q?0Q#Ol_gO$Cbaw#$2Y?i5iU0rr delta 38461 zcmZVFV{j&2*C^oFwr$&(*tTsunc$9Xdt%$RC$_CS$;6Xn!ZXkFo;v3{@2URLUAy;> zuIlP*t+n^+;7h2kX(&WxIdBLJ5SYJ*Q@v&qA~j&rv057?{5k0!N$0UhPt%lY3#Ae} zb1;z9@~Od$XZjQb8sP=F1?;x2!?S{|5UToot(JY5;sC4g_Yw(F)eh)8AYQ+OUjwO! zJb3eb4-oO+cLL}d{3$CH0bhvJb(U~)#r1pt{d)g;e_}9rmIDj69%_RdGjsHZoJJtj z&%Uh?(k>swLnSIkRDc37yFSsEXU zCx#yeS!7Y-n!lUZv^57bsU@kzPZ^)y`xA2)j#s4Lsr68iiOVruLAQ(cw|tUx^)zEs zldsy~dRb~kB=1#VWcd(V#@0I+j|D!-;8}o#AlFS&^4Zj5ccLBg<2W%n;FLOIowUe? zYk|$5WqMwddS!*x(*eLQrWt=6dPw1P|voVV=so?&GpU5hxkY2cJDb_gv~_d`pY6qPIPpbkL1 z%j&l44ej=~XbE{e6UgtESc11xd6e(q5qA-$O~1krpCtk%TqR=e4bUEbqqYm!ODUw? zp=hfSAc(Nb6_V`9I5hRN{dT$egP1h&y_%=}I#husy;PTFLc~t&SJqu04t9)dm4FRp z>y5SyE$f(Zoap2|EKs>MK}UR!x>5-ce;MXp!RC<{OO07d$b0z zoWuKBg07u;Y>ZLy8;gf0n9I+=hpC(hOI)fLd;hSLaYBx(CeD3g85!ar?*`5*!JG0#Y@j5W`9INA zNF-7xsBWqgRZgn;gS_^E_H+FKpqGx0W}uh9XU#f6zXzfR<*{GTcy`>pJ7yEdmLu^3 z5Zbm>do??nUDZB2N}?nPz|Abf=Ex*98M(ID^>)ns(FfXM9@ssDo`Qfs6e)P+4rdfr z<5`Sl%_#=3FM8t0%Po5ubN5bP7%XYav3#cR>o9y&^`L>e-pkl>1eDVN;C(3C`8uh_ z6ViD&&+0f`t%uvzeE_Ah+qgqt(fAm_IwtDAZvW_eYb-%DZyiZw)qW+{1JHZG@t1u_ zk29BnAWm1Y{Zp1myo=BE=el0-%&oC5xG=m-j0n4&{s91<8=5Xc{T_ybN`Bk%?I!)Z4>zW^SMq|)eG@NBtPF+ZKu zk>q6^Jo3KkJzM$5@mmgrNTkSn<2m5VSg3MxPf<;AS|Awn0u>6IV`1w2;m0$#6lNtd zuM+4Gv8DFu;s#@ z(D<{JI}+-v$a^+{L3CY_g3O|4$>b#8q8LT3KT`fYNQ*o77wM;|B&mn=8zb`^k~@*h z;jZar=-zc~o=UVC%6AM`Zd+6@T?SsDsuM2zj2HvMKC0 zhO>iC+3_$3J5Sm+|LLrlW%^^xN>XCtT+Tg2Wq555n1MZpM=;M$TYA4k&Ll?v1zv3l z2HCf1Yfll*z$nC7E`SN_Y%u~|Wpm9fGryAXebM^vO;zk~+Au$d^{ryGTKOuM7;W(# zRBQR&qE?^IhUY)DDAP7;_rv+35ImAqrXW(ZmRG2aarOqgBW>hbgc@3%vP?izoKD0V z#}9ZJzYg}0G9EcKaOqdmIxO0EMLC6DL_#lu;mRWP0Y?iVcz|Ki&nl{_nM$*|0k|PH zB<_ru*Cfe#;Qov;TJ~z-zLr%R zWjQyporkY5$Pm%>D8wWC+;+%_G&ct$p`ExMt!+47vNfflphY1M^F3KmgjwJhsYps* z5b*KV{xC2Zr2yb3w9H1lk{k>>_e_Au_~Z%NNI0&Rwx4mT<*ZecT%=WEV>3~UMgT15 zX~qqR?Dq}Yp;uRR%X*n`%?zB`QFkUx&hcWa?|okJc@m<2k-tCBE8?19Gw+ah!}noI zyaCR+5|#|!$-b{S7|m%TkXy9g!Zn=^uk*oqwQ~pXAOi3oZNHhPV>LpLQE5|Z!6R2H zN@)#^#?>q-69)#|#0jUoM=g$oF&~mAkUIj9(0+TzkQ3&REN)$tA2A1eZ9KRrs(Tsz zQrhry<7;f|*|B4RpGiU$idNR_nh-gaWKnE%^r2a%-?*5CYp%`To!Fq6+|7M^tF=oF zf7Bwp^9Ixf0pixNy?}o`^GX*LIp+F3xF@D^W-7JfGDAPI#B7LCE~wIF zya}Cy-q1A_)Jb{$;t|)8;Pl8mvCZr_8ub@;hz5-DsevMBSH76DvgCc(h=dELuZ6c;n5At% zzhyo6ck7Ie9u4kios8`bimacX<{P0gbJw7M>4JtyF)K2A1OoxN0{@?n;8?Gjf`h;Z z{`cIhf$#(BpNo`dGz!3ulbQw2S6=HG?=K+mJ0A}We>FyC1Lk_*N=So;y@7HRx>=iP zAP%p4MBRLAF+aQ5B#C9z-H`Y#xHAmW{GTKmQTG^z2ScZxg%R%~Ba(1A=9;-JEG{_i zn+M;%J)!xv_bdjFw|kxjo%p zWWQp&Hbf0Yi}oh1whyciv^i`Ncr^udvxb#9a)=4Nip>BgvkO<+97fK?p6=!XXO>cK z@zRm)QTe_UEt;27OT(TEirtDy&32cF8+9|VP?}LSh-hGGAR^Ltg+_0S3rC8ZCpH!Y z+&)ttW0`H~_dFJ?Yv2}H7;O7kuN@Xnjn+S^AXxRrjK&ZnQaKwS=lA4IuPWD z-@U=AeW(Fz4Q;SQlHbmeNF5&>X*KrDR6gF6uJTC#P!LyAZiL z+!nezm!L8H3da6@^){>?enOrqmwBij-c1gF?^r*cEQmF8_?AhkG^r|uQz|3JYW{#X z^i#fhUwZFoCO|AnNw2DKzJ$%>C3VTFHt=9cEae^$daxFy5qFX=L*FrGH;*CH{w*9& ziE#-GbEcroZa!2bW=?b!o%Tui3WkaIg^RrudzB$)C4h*tANyq@NO9a)8LHX_hsxrP zf^giDFNosAIZ^T!?=(KQp zP>Ub%A~U<+t}=t7YW|X``6aNtdEWkW;j)Tj=lInmUC%Vepp5N1>?^J2Ark_YpbE-Oq<YEO^Ama-2nm?`H)97sJBb2L>m78^(Qvds`oe(PiH$tc^!93mdu17XcYA)bNN z&d=pby$mYd<91L!Xym+cxbMU>kD#WHq?_mD_T})AOA=Qla_5B!jR|FUbOvKGuMjtY zMNIvI>JHf-rsSFuq;nuS`$s4zH)n{>%ArM_0i&T%!52I(M<6 zaULO8*5)ldYF%fQEyylCxZHDyiZaQS&(o>bOdpAHJ=O2eU}0Sc<$~+q1f`Xk4GSq0 z=M7^Q+`J?5&(6!IhNrtpo?(ahQ1b0^@Pmrr zXiW)-KcE;=Jm_`8>MGkPH2cuXq!N@p`ANlg5*F2M3H5uvAG?>IhI8NvJ6^(p0e*vH zD>UwAC`V7h<$$f-6LGTYXq4W!B(;bQEISa_CfIpRxWpv_@nISkWT zpO*0T`WH@7-NF7Kf5+W|*$Wj-l7zHS^%x9JqS*&|!Y z-uz#@StIvHN66#VNJr3< z5;Qu+Zw1KU#&)M@h;}*IPZ(dn&hsoKaTV$9BtNABWTDjPDkj;6OMxde$2E_?2b3vX zw`0j4{-%b($pQzsDV3roEd{bxr9@h0O?wr5I3l})4=%MKW<1yX5b`9h{5X zG69hX-#91pf>O}UhQx`8SU1lm8aXRDZutoi$N}RZs)qP4&StiQ>l6l1-=jxIg(Di&Z{)@EQT)K=>^uvCD(gVv@p048QGWu{roDfGQqt} z7Te$7X1`aVYMzDa(M@*6%S)p!iqt%|8$}k`MrQM4Q&Xj8%OlvPj7S*F|EXaT<1`glE~XOT?D-S7Yt?v7*X8BQ)FGPmZymWfIdX9$;Zw??#c4cWqk#%zi2wAt=RGI}A z6`P7?0jX#LR95qC{odpsG3yzCC&VR6DB*VV5=ImwBAI*hs!Gga%S$onzp0Dzv#cUt zkzNz_DQ1km6^l@il~6Z>qyvDtQey-*-G0xHO>$wgla<=rGjP`nA z4o)GZo5uW`#=ow9E2nf~=UHy!C-8G6J4F2QOLpzvG{$Zn%wL4s+5tdyzsOwsPJX3r zsZBdxZg{3Hel5R~M!%`@A*sk4v<3D)tV?ySXV@Ivz>QK2WSyTXLn zOZ$*= z0O;K>?F~5q{Ev5j9Kh+`C2A!?tYf3)NvLH79Acv19cZB5NO4QND@DH;ou7P_MG_C5ybI&(Cmh0k8WEf( zkd6~m1F@6c!I)o(|A}}%_LGB0pg=%e5dJITHJcC%!~C257gLi0=A7^)Fh0kg`to)d zWY#@ZbIU4IS_TcrSrI8yDVUU(u*C4x97NdCK*n_<5XYE4RR)9fkhj0rsgnjJen&)e z5wCvIj@s=c)413J?P(+o4Th}YaN2#d+Fw@juIt-jOeZRQ*W@MddmnrIQ>fhp~tVG^)k7OGv>iIKA^}voI)F8?JAaad9 zLy9M@@zwW)(B`59hCo;n$RCwN#UL>qG@bhB86UFDg(^uSw2Gf?m} z5$c0tCq)ec&I%%*A&O3P<5X%D3ZFOoJ+!vBVd(^NtyO<=e%vIp$#lEi<`+*Ef>oNx zvT>$4ZNpsXfx&;tU3~Iq%^_Us4Q7ne*|AbICep!Z*Unnn&98_zDdTKnLmIhHwXPOI zz0DaZ_)mam9uq@F-X9iz0|+GS&JLU4A8^L-!sMC)Zq#rD&1beEZjZ&pWmUK@GE5z( znQ`k5GA1bd&AZC_p@E&NME1z{)oigF)C(i)j>7f;jH#WwA6T zPnUdp*6Znn4n8Gue4YX?S(ADb&bajLD6wXChCiTj7=M|?y70Cxk9NEX~ytYMXa3|jI}mU*w}|9ob?;!{ODe+z9{$p8Ax zQV8j30lsSZ8W>*=$v>&KAVp=r>1~z0SfjCs$YO?R%7N5EL?SvUv|dp828Ee(@7Nbq zCaek*N`1NT6?^!_^A*P*nNegV;R**5k0cy;Uo&x~mRVArZ9nw%KXkmU2?O3?Ny5A^ zDV+Ht*-1z4YGTiVd8$bQZE$fR*(^f?G{^K&0CV)px52S)a9wvr^K(BZpc)HEVr@v7 zqnDCnbAxFVV{S8od6>P0B2Nqg22XPAcF>!IZ3A;%P`yKR7*K&D7 z02v-8Z9c8?r;%1ncBi&{H|ycFrrl)-OU|>>x8vy8ln`v`iag(&!zZyX)5zL0T1~S! z3adRFxtW$b6rM-W^HhJ^QjRxF6SQkFbPsvJjvqRR`=uzC&2=#~9}3W3tKDnvFx~Nr zZKF<}HTzVz4CYzb1(l0eM5o|nfM6;a1LQ^L^4#6pGz$~gYk?X zKD&`V9pb^5Lv8hTq6)_@B~Mf{wi1TviIZuann&H8d7PiZf6S<*sK+G7<%%oSZ9_lH z$HpF6{g)y8Bq?|JQB7FYOIW+G)46Rn1514{hjCOIkv7Auw+5R$9IaZzHN4bQ0V;)q zOuB8&WkaD7A=A#F87<4Ig|(*oqZ;dUwgr)VV;1&R>qDHlh?r}vq(=&vP9_qgTi#Nm zi1HO3w3~!awwR@}SJws|g14oIe9XLP@$R_}s};Q47~hKSeA~sRdjNBq9cH;b49nnz z+jE`#xL!Ix$}ZpPak}P$Kh6$z0oYY8lw@$zBcFaonMD;4Q56xsB2s-4f=_d?&Q$x3dw{qHD*5MxG ztCQ3Q?$y#=K;migNm&yPO}E083b}u+No{C$9?`=1OR!hohY&7GCsvEn0hV0DX-0e- z-h{z+73b5~IwLix=k3C0QH$%Xz|fK(fnnPAk;J|H8B65Oyn>EJ0k2DL)HiB%^$Cgt zLFVwPY=>LnUs`CC0x~U9Jk8Ij#y27+#EDO|@>fuwh^J*;y&>O7hjh=UsJuw9!@(IL z+EF)yR3iyUL<~s$y-5990AcwKkI5)Z;;*`q_D9C|Ua#B>O1WS~VOUVvI2fwOK}l3Z zJ;y}IsJ|Qz8>j^-g0p!JWfcf8r}>HO$WHU((I38C%j2yo&>9jd!u4>>iOnMYgE_k6 zXrE{;*R6QwgvK$SAi35vtQ+c`Q~cwQH@G`S`$k;^6z&XXcx}@YRK4H15fHiWoY50d zeAPi-krqmzA6RV*BM!y8Q^1!Q8*X3+kt3UkQO$%8Al|ZSQp|swTp0bs%Km@}JM-Uq zRrSB?)#i9+4#9W&c)BC006zv|C*)1U!M{$R#?a=3J)PJzqE*fS_>(jjsTtx^A=1)N1`D3M9?=0{e|>#v2gS>d9s@&Eerc=viEt% z>)CfNkNES?H9;U(?n)yRfAvC?0fJ|QGyf4NA$_CNFd^x7y1ymf~f}WPkDZFYy-z99e3K2U!6yA7qVXb$C+ymlkU;=23ZPA9xJ*( z+j?>^IK-LbO3HmQz&uh?lHn|=8T6l>v^8WyYE0yoV7v0 zi+HF?pZSJ_{cg}>weRm|ye~$<;b*>Y<|oQHxAo?5R^YI&Mqu?#p@K1NMJ!#Cr)X}z z{2(-F?k+4m1*%V6byy3kZ!88%@t`G$o#297dj9RUx~-Gv!%cRz4f#4njKcu_=dAM3 zl+WVnfLJ~{U^!$l{wbAk<(2IwXuRHWGw@Zd$ui+fw&>HWl2ffRYc}1`vg9k{c1AO6 zqoxH2+LHd@3rl}a-d{lwCo}^kC{+}kPivif%C`SIyNy@%QA0+APFrtGMaC{AWsvW2h_MnDW+}B2PH4P(*UhQMmKY301;n5;B$#WJCke){G);H2)%?sKe-l=l7FY)o- zFOzLie!Tv4@Ux{fqInMaG<=QP=CY1=mCWl9Qx5 z4)&7n{d>Epngv669QC5uN&j5EF$Buw6SZtZTh2;|9Q)HYgz%0I#*p2rVoljat?HD% z{AFHsz`}Sc7Qu^?Kk8ETGbh~Y*V2k<4O<5?@dC=e36&DE=ngG$bSN4l#BUYmi zM7ia?M)?nL#)}`;YF}h=4$=^yG;*{gNc-;?fGX&rSBg66kuqb1mWq^2&Y*1CX(E`p zLNN#CyJ2uQECthRh>LS&VHC&AksermTzTyp$!u1jw+SqhJVr^+6$g@^cha*P&jcoPoi{!y^= zB2>;I*j7_iyiwDxo%p_@NpkbV@}g#QK$GVk{N+TAHJ^{RN~VJ6R*IT7Z-Xh?nrGF+ z3Ycasf4p+J?9#k@GK0i?yax8zf$r<7sJ=u%M$%q2D%MXG>LT@MOL1{{(<01YrjVLZ zTs2rO?vb8&<$5l9tYt#kKjDTJ*gNV<16LsRmCm8A2g@rGAoGCxxWC~6M?hR$b|a~L ztztucrCmPfxbu>&fUeqs_^*FAmWJPJun_*1lp%2co$KnA&;g?K(6vy$7;o1bnBYWu z61-bUX}nw1N23FkRZwJ=V`^LF?xnGkcN#VVD{5O?pB?mk+gIB*yKN~Ss~x@qKUF^X zn(+~Br=Kk>cYA!?=C1m`KK>vFQcYX0haJ$h9MXhP;|h%KL}Ksf*AXWewWYA%L@J>rU%&1`*hvt4k(y#TYZl7(Eh8gaK}4|)0pT@2g? z!gg=I)U^2E3q3DME`Cfc5(1l&MYyRe7s%E=F0(0z>xs@fhoq*d4x5sz5yA{#K`bNL zpB`oHG}_ud1j*Ffj%sCx?Kkac2NUwqkp98E-SR)(z35>gZsH2h3^j*MATjei_35iX_ z1?UcN1xFyn-xtab{RxTp#UMQ-&bkyw%)=E_D*#*EPJ1=RpAHFKgyagEYsfrLQNa0v z+=;CC>2My)7)Q}?Ok^L4);yj!mmtxeYUAloX(?`^V%uGndd~|mNHcI+8*___pRT3o z*=5>dQpeI0%@sRb=DMWZv|?hO;gESYZ8bYhewS^-Wlu71VECL*aUGg8VoX+IAJEzB zX@CUUh-Xj4J-;F|;_vQPR=2c5Ir!0gnad3y(C$|f8S#GuLhx%5NGEBYVaU6ehhJ2E z#U%0~1%-$H$l9`ZUh)w+lST@DNzu=VG177nO0P7oAaNzJQYlC%(GFU_iWGN8OPZ0H@JSxCQ|U0d&X$v-w|liq(rBAHFZ z(EZg$=Fsyc040&fwf>_E&DL7Q67Z5*6jfD3{TbZtYxA17ap9zquMWp$Ge+qTuLta| z*;kn^p5yo>cg;lqTV8>!MGZ;R0MTkfF7vO-~RsQN1u(wa}>)3J-K@Ce0Xs1YdHUHhxA* zIg)fxBtX9}h1Ad`GyrUkF@3~))QI9@{gQW`?kmgeFam#MJ1(o*#*3hjH)_WkheVoG zM;0qcU!fQCP@wTp$;Za9%1688qSNML+vsCp)xqGin}PvgBU&U_)d4g%@M)=iaoQf} zGZ=%GYqoU0fspJ-d%q5SYCesX~|7S~058Rdh z=O+TIw5 z6}5+p)NWRHq}pv0zyMcU>fA_wIDPAKb@B+NZ)XO+2B@TG56#;`Ft)x?jmJIS)|Fw@ z;YEG(_WNdzaQS(zQB*2dGehs2wl7%cLxm{Tdx^+6(~yF#_^Zvm*uQIO_TA#6nl=)+ zW}RFXXnAa~h&Pk~H6zgi^pEnyuUG&N)iWAsbM%+|Mc$LKgyAoAn|{cq8E~{_{kxp= z$pq;+Tjdb9igUDfvBq~qUTAeR`R=>MC%Uc52R$D3O9R?dd`W-#4zCf$nM>*G z(1amp0O&vUsJ@RE);=f*2-^SGQ}WN76?ldLXznQyXkdI^U#Aj=kFL@_mM?==GB8+Z z+1kNFI%wId6l|8Z2DTE0|GXYxle4mvxtm#s_IL2JiF43J&#^YGE}ailMOUzWhkjR+ z_fwwBGYKNZA{RUTe3|9l<9*(Cv;6aMGim|ikf}Z&IGk27UX4nSIQ2I#OAY2;AU|pm)pVNVAs;Zrb%Ia#GJl*r&tN4v zs)_Zo=%GH!jdh0zLG2+Pln968w&RPF3IF8}bT{I2l6UoD*_-3XrCVxF&pD~HN!)~8 zV%u?q;>4P_>l+{`y*JZW&cq_7k&kl)_$m|6pcXyqv%j?1oiawqvu_L9L<$mLdgOw& z!`er4COj&fvwt5tkR0UN*$5qU;C8u_zW0vCI_jaP3NyDKXe;VKZD8GRxj#$8b(kkvW5J8&t|63uryAaR{c2rb3Wdhz!91_~EWy zZr2gzYeU~>6L*orgp=b$9fIqduFIj#b!s-aWjAzC|s8U1_ z7_-?OEG4XgLwv?HETUA;I9?l@vvSeRq2)~`Rr%W+gZQusr;deX6NnQx5NV2#nlE@Z z_uIodSSp7tk9LQ%Df`;iQVZh4T4r9SWLX_AWZyRFC^Z_v_P)}=jBS=%bm_jLZ5UB+mBY`?tGZ%p^6i$g$c6|0c$ zgg)21dy|Rvqwm5utv9q@K-CMvUbb}YmD?aYpi<|Uz~=Q+%YZ+O~FuLf&c@lK#45;`V&V1pm{{B$r_hW za-B=nf1NF2o`5dDaPuei}93M>xWgRXZcTm9}?qMBbC0OJj-AqF2=wesN2 z)F+Ve>jFs^GtF8!;Vi6hnNWysXZ#0!vTmiI;*G$vUI*GWmUWU1^~RcP-wFD14fYBg zb^bmmYnV zUt{J6S;Q%&5}qC+z^pddQd#QAfupR>5rb@B(IHXEQ=!&mFAmCq@jHnew?EbEk8Ke9^{dWKKwtc`x*_Zls42=nzX(FV=_E z$av@q91G&;3N^xU8hUei7A9Ugu?Sgj4|#5VZl~LB*Z05=J$ev6*5U$OgB9x`HBf?N z7wsToC9NX>O#IY&`d@xBV|PJbF_sJD#@I~*G!Z`7;$wKr_IVK|cnT9&9@rG&oR!Dm zgHI%IU2w(N!YyJayk*9IvMEkVLnI>Xr-96}sdw5e*+j9~Cs3o^iLYiJII{7N_~KNd z!>8w*{^JtsUzdcSIMvJ6Ji|qzEvP#SSQv$J0Xcd5o~l14P>K-r*}ct=hsdQPsae5`)YN$^E>{pk5U)6l*8;DLen=&bgWJ*+H$~5J zah7*vXrA!ZXw@e#*0Gcfc8#kx727kPb?}!DT*p8KMHBDVKD9h*zwUi)UNB{(W-QbK zAov5r4{}YyaZM;+JEB=v$XyC07LtW%q?%{EAZf&{?za`2t`LqwB2TvC)~hJB*l-yg zMGbi&&oH=Tlmf2){H{iRh1yb~qOS|KQ|=q9)CHRY&rVO?3>bG=U`Y^6cViPql)n zAs&)T*;A(>ChIy-e{m}D`oB1}6``+~+WbRPO1UC+^2ePws{9%DlV5u7Ooxx+L(^ZN zaFAJii+7e2DNnW*M?u2(3;qI?zVH_)@N4b*$fPJ6M}RWj6YRO_$f4ti3!5Rk&k1*l z-gjAy7-5Rdav}B3T3flE#XbuC@Umz|z0E6)*KLCK3POH5-VKnG>c2pRL;VBPhJa`* z>So1S^D8h%N;2p!hF9nm~dnUEi!6T=QKQW`e6TS81rUqvHgEyh58 z(Z53VZuG(IkyQza)Q+Q~5LB;6yZd9NLE-_J&eeUpJt~v;uxsi_$@aG@a1A7tYYm3P z4$>&?wY=u53dG+i1sD)Yg}zLHP}g;`7o{O4-!lpfM>##nX2?U zA7=g9q}lGhZr8U!_1zr|)~-xQ)#0?ic5tF}x+u2Ljr&W~^TJ`%$VKVxlrQq}ST&$J z%daN!1MDB8vi0H3dV^0Fq>r?eZ#ge+5j9TQLjh7NcY+`6_u#L$Z+FFA< Xm&S7byDYc3H6mO@Wh56$#7 z(YQ=NI*X!|H+~@rz|HN5)AKb{pep9wK3vZz_|mPW zjpIWge0$fOC-5fmR1w(`F#KzA`(&(J5NCuitH->Y!^LK^WP@@>aB-Vnp_}7b#;u>D zyVU1fHgxHqZVqIbhX#(X#8Xt8C-cMNmrUsQmk#_NC=)4;epBEf&JpoSa$m9WbFyE# z99~^_KHPo#L1cb1iAJ7B^h7j`!iFA4c0@Q9fF7pMuhOIblUSz?z?}ke>JgI7?&6&T z=%>{2ZG7zR-`9fNmq6TcCx%QAOFTI~?)WZFCA@g2h8z(7qx%jXc{+7+?)E3cJKWdh zSbgc2B*|Xaojqay!~WN;uT8-GofM%F2AuHZ^BmDTBp~gS+a};F{2TQnN|I@~j9bc2 za4EI~gvt5IU!cf909#6BiqtDZ9s;o0V``x?2l{j$KPy$vhv;5a=toA^rFwxHGVW7q zS%#ue-uLdx1Zc7nxurFQ4}p2n4-Y(&UZe6LKE&h$5j%7SqcKPgsMT`p$(Q-1} z_~lCNS2P=04?1)%DIkY#IjbYyWza)KKSzKK6m^ctB0@$u05&$IPaKbmWtVKAtH9O7 zCs+|(0u1^bW8Nk?5NR1m0;IllXVHUGa9L94R(KdtP%m6^&$IO2m&~SBYj)=wF|lq_ zbPK)E&!hXrh+~tlsIfRVR|M%^p$LCcyr~f5u6q?^P||G^1-%Jm$wSKMlPo7Uzbxe= z1eRG4c}KD}QhUHetbb@MLV**tV9IlOPalWq-kl_y5Tm#wTaApzp}Y8NVH zwBh-!vEXNjyyN1NsEX8<6MW8u%-eFKZP~ApTZuoY|oo`3M%6lIG9rQ(VOAHZErfB7YgW~40u)&vC zywu5;N1g7~2aU~+FYp?ph<)x}sE7@8Z&b|a0IDKeE*O>Skj_{Tb>-I0+oUMwSOC)& z^(p1*SAlq_Gp&3ET#CS8W0J1 zvkb7wQQodwG9c>8@jP!)d-cX@U0~AjOi+BjSgu?0=i8}Ya?B%|2a0SQ-0%sOEDf{0 zM{so2_=uMa@(Es)jSKLE(UtstmZL?1!le{GK}vj~+9h^A!RjS9KEe7Wc)s3>CE+~q z9tzvL6gU}oX?{&FO-&W zXO8gwS^>TeF6~tu`zq$@cnML3-zna8yaWflxp9e&T;_G`S+QhL3RqR@A z%j{FAv1o{EbzHc6RtvgDtL9@exd8~~}I zOYXnF`7t_0WyA2!TDkj(F{~0uOtgVk2N#Z|!;mY}WUu!!U@+wn#X?$fbGDDXe6w^$ zL@!|>f0QPhc8V&UJ>57CW^4>UQIUg^(Keu2$Eh=N{8`05ovu;_nF4;>(;Gy<;NvJb z=<7;TgVQK2$FYi2XJCl0moV?^lmt)@%`rXwUTAy-g^%x`|JF>o2xQ+j-~6$$dbT_^ z2FH$e6!*&bOZ0ov^c*}Fhlj(UI(4MIh*mccTXP@B`K5;L3W(ll*_^0!mwY%O%^__2V$Jq&ib zWKo=1h^Mct^xPxzD#i!9V|=DSj<&UEXTltj_9^8Qos}lbQd}Jj{f&vlSa30g!gcdq zzL~`hS}Z|R*kG%%SKVe_EI95v!`-x`TRz@Wk4MfyZN?vZnDNHGH=0|8>)(ZC>q2E#)H_9k_V!o_^3?GgqGN+{ z9VaD2!uK7hZ*JSC5P2px&vI4|S6Uu%HSnRyL;l}SBHfe5(Q9fsix)_XCF4YKRJF5? z%~ibfd1-r>*{ZoYM)9V#E7I4rBJ{{wPp1>D_qJ?2DjB$L;kM1^yB`7hA~#FWQ2x@y zjYppIc{7gVbte0ekBuTf=F1&lrwitQ@F9IA_1d+B6*6un=I_-(h&XJw*7^>{DX~L~ z9CB_5Y`rvN2=;@z;A^tYNDAOe85`^+ylUCaxAx$3NtUGr%dk^)HC{^q#Mf-pbNpAV z!mrOX8)Nc1lcRIGDjNV}wPw_c`2(1+uLZ^GBEc>GBjHEFa0lm0KKVjlF(iHfwGR?* z9EiPr^Ts(jX566la%}W^0L!hpfCcjvD^z|ql)&o1(k(_vfcUE6Sa8_G8KbuOywW4P zsH240gnhIONv30%en>!}Qr3oPNWdsPq5$?BI^*Y-lB z&Dc@m_Xw^+D*?^LX*PZp?$|UPTdFGF&5DM8?jaI0q3{JryDRJpLTDeXSpL|8wJinO zcB1J_xGVimEgRyAicWm|6X6+xMFVJ+ecEu%T$bK1%^mX;eX$c-W_;F&2W{)P&dqJ( z3cr;dWyq=sz25*1b>>%f6#wvx+E<*a`ipT0?E=RYqkV7$0i*=4mi0#eR)p!W!LqJf zJRP9aIi+S|cIZ2M`D|S-Yp=S!Pf8FqOcoLa^_x3M-n!4Oj1=JmwMV|!y_zYJ$uS3i z&nq@_&11|Q_xSq^s+$ANHk!ls{$Y@5fI?zc6!Z1?}8O`BhKdXcmAX&+8Z4NTDaQ>NKPw-4Ne5go1S@ z1vzv|WGgp0D#~JSc+UgHGP{bv!}mjlESXj1%5UR@2p$FY3ppu%wbL8Z*i+>;mF}U1 zNN8r4=>rv+MjD*O!HA}8hVk=m#3Fnes?D8^g=&`<3mZ6n@_)|}fOeJ})8`&Sc-PIAi!E?6MIcI9= z5I7C4cH5aX;<=U)Ncp{)eTaq*7&cM#9jE|HEWUbb>vM%nLpsAZ%LQHYSvxIs3=08N zdk}P02%K_+O+N(3actXY`nBl5GA58jVb28X(fev36`Vpji6%gad3+*Tw(y`Th^Yb^ zHA409E_uF%E=}Bd)K-{>?5$$zh1w~!7}ivzie>i?*MFF*TNKMlS@^2v zHMFr3a5f8W5Q)ub5OAJV(zRzhRX|2}SnC~6EcH9d?GwIvHE7O>I0VsV65_fFUmQdq zm`1tjtV$9N39BFfyfuuGAo8$uh*Sgg3TqQ1a7vi99h_0CzFhsG)nqTJnAjUsNdBNS zFz0wzBA6ET{=2mW8ysvi53(V} zv7ypjsVI;!8Lh{JQT)@4yz-%Z*B95O%tIbfqGcPm z=hHW!+s*A4xD17w65^b4Yb%Ay>cy&@-d>2c;5%8}?|*^{@9_seyOdelpX`?3D>X3a zGKqfwl7b5f&j8K5y~1u=Ik!n=eyZ$qBu`RlWB}t&JQl4b!H`x!wWxE;P|OMYT=XY= z$EJbSnu%`=VrytU+y#pmAyXruG$HS){N90=0M-FvGk~2D2XTchuE{tr^EAMjXDfyw zw-!-AlL;CB1kXiqcR*%5ei^kni~g8T#WgN1Cl5R_bu2D>fZyhm)inu^<5VeEfWgylA5Ac-;GNR|3|$tOkU2Q> zCde%?S6~^}=4@}T4+z8vD3V_P5(lqhW(Fth;Ia*8L^MsCcO{mb(VTu9qqH@)eg!Q$ zi`9JB3-WsIH@4TP)M=|^OQw;Srd3XuXz#Syv&-ha;Qj3`@ZMgAHtK(Qx&-DNuR_8Z z+uH0o$11j11-&)sRo@>Byo`$y;n0$!ScClhGvtmo)Qx@(()4i4^|w8n%2n7_=ywN_ zeF%T@&i|rSn{neOb5!r8tw*GmP%Lbthdnn~|HVwtv8b-% z{&1m!LGC+#SDXS^3TBc+#tIT#u}X4|U7A*6hS%K2jp4}HG%uL~9_jno4Mk&>2{lo2 zfr^snMDJm)oo-&Wj@^ zGS&O(QRNRgvZk#v=EvQNb23Nh5wK}fz2i?Xtcq*Aq@UKf859=X`rFCXX+k}DjC;;L zwPRo;!HC=|*q3(*7B)7CU7u!+fl{2|LJi2;Eps30K{*D1dN=R(kXKYjMA{8K=CG~% z+YeO+xmwrl5&0&atsVF@MYOBV#ViH$pTW05(v~&qdUVn;}zW;j*89{N|=16oK zGaB!IPD>^VRPs*ft;z(Y?RPo?penepn`Ef$g8sBt>`PUDu>bJtPOFn_7yNmarDY9& zQAssl$&9%oWYi*#izPm(Uhqgi#XPdH(3Z7TA!Op}9i3npx3a;Fr1KnCj=hV5d5)lO zsR?!u$TQlnCUz4Ln+M3fV&60S<{hm*hHMW^l!Y-6?U3=LkzztsZS^R)A&~_q8T=Bm zc+{#BjO8b1(zZ@XUgJ@s3=S=0L|3?CfIrIkO-+}iwDFiYp8qzuuQ(?Fjd6AFk&0CH z?8?t_tDK_~O`$*W7M&51S>j-{oTr~nMg9&0#U9uDLxoD+?u z?Cm(KUenvBJrWWdf3g`3{=i*|vsSq;{Zyv0BfMNX#F127{bsOydmfPT)g;FuqZ>7I z<6X)yC!uWh7oF@)cIqglKJ%;R`3p0RRe@^3V;O0gjk<|kGCaSbk+*p@Ys}^XO#$3I z@K+;aiDkn#ykbeIQQOyvePUz`xj-)!yYx{`s_74_l1ZFP;Kz+gkp zu>PbK?;fNyKgi-KS=2s!w^|)LU%w9m3Vk=jOORP|XoHaMt-nehJNdePm9$%3lS)nS z+llab)z1v)cn^0KiagR9GKkcFly8`t{`}|s7rfT3-LxSZiWt;?U3GI(O@`>!rYc2* zaDsvc%O?u>C>|w?H^iv%$5_(!g9xqu`%khz#(;*;vhY1uPP1wV4@cyy;*2MOpf+yT zW!^u$VSl|hemvqa_{LKqR0$!)wY{Nb{}nG28aq`QR;~W4Rwgucs^sy)J#aeX`u0!U zR|$=rArj_99kT$(_sg64fm!cs2~NbC`+jfy9PJpi`hRf8TN0pj0*`c1U{bO=;hUW` z1L>Xz@kpwAQ^LM$URlFvDg;&mh^*i^Lw|g6oE)#g1&}hLbVQIrIwCox^?3>&6W8mJ zZD3(iiU{o!_OJ2s z8|h>q$0J?f3NLKeiP{!|e(ov^g`<)n(mK5_VUe$Z8Vt_H6q1 zUj)qV$Os;iTTV{czhJ#v05P6xev%zj&hoA?ZJgn&}e@`{HJR1!@t`lO7#l(tyQFRNEQ8MF|vkC*PMK@w()PFO-c+nl0y zM8DTOa0{e3(jy3C@Ga3kT^hUBvbxtcTf2pGo@fwK90t=0@z)CqcEmwClIHzcw9g#t7=qs|xkI7#b9q;~3o)vJK<<`^ z8!m64;RP;sfXj*BzfY~F5B3F3u^0j2JEvj+A$LmXzAJ4%4m+HM3eR*Qjh0N46CuL@ zR5Lhoi8?4Az-`D}+S_#{U7DrvB-am}IHBc_tQ|RQ#yGd6%6#DFoK?jx#JaKc#?YMS z13@zxk6GbY^3#t*-J(({<|4p_zprk+$!ciMDD0@{dhM)3pn=Z2VI;?v?KvH8m$q0> zn7(mH3NEH|v)h92Gk$dv=GR%TY}KI=E!<(&K%qhgzGp-8V?#kKi#q7R41owKT_V#1 z@r*EYdsou-4DH<22%D1nl$n$WET!n^Hnau1ywNPz(HbgPC^&0&Lxbn|@oKD)5gh9y z?a0A+scnODjVDn)EQB z&4nG5MApms^maKpvw3mLR}b#7CvQ981&Z1iQ%kUNR_}?yLHBSVLyM7n zpizdrQr1gL7P0PL^D{49hi*NC5B|y{_{0=<{R~IFXgNak03vdK44>IsDJ}~eOC2Yu zeE`tWF0u6;=myryNZ{o7h&w?_xo_npNNx2KI)i8rdyZAzGIX}p@~AyAR*t}zwM=## zo?-KIcFqZxp*QEtfrh5dT*p>EdX$xoZ7XGhmA)&^^?%7axP_PMt4^S*QJ=N}TYPu5 zlnn?z6xt-&U4^}+$Ud@X;iJ*bwMXA?@NH9xE_@f2w_Eej&w@Mp*t2T|-R8x(|8@;x zpswc;BM)J@?!`Z=_0)r@le4so6=s+<%e;cyxT-(LZNjYP~M8eeaoy zH7oXEo)`Rt$=dO_2EtNeYbD(yZ>wt-V6UaDeh`%f`Xxd?RY2@J6B}XWt-6!^VEkr# zC6sskr?7JHeQ0X7)3cbtPoqDrYy2I9tfjvn^%`&pHM+cMG0kxhf8yL~a~`~gyah1# z!cniExdwLJUqrqE7s4Mh-vG=(LsQ-By4ZGG2!dGQ5S(l&;K&G(aO{uEi=hADpIcYb z9Pm!H|L=u4UA`7|eAfpjbSsOj@&SFyxY*>1ZxuN2ghx9BhJFU(`@(eWcQSw74px2< zOx}lK&as;Ai!);JALjE1tGbo5?5o=m|6t0F+3xpxA6a%~a)#;Eq5=QL`WGGXoj#=+168dn0c zL;e;h?+0lgxjb30iv-9S^e&kk78(NXKm#23q z!(x1=c`Q<9&yk$R#}!j&PsRMrts}c{#gmdGgLYyGWJNtM}6Mf4U(hsaG}~5U42AZK1ZD43_+)gu{h=ol~+SwW~A!ZZ<#Yi zUWuVoK+O#~r*!SqwIyr%JMui#8BWLdZgH%N=M&UNH2qo<{epI@rlSHn4krB?#C)3; zk!A@zxn-L}*I>>(`vvP$N;`th>KwV6wU!4iJFLw@0qHhtE8%LcZp< zQ^iY&wNgKc^%kO2#!Ie_^%NOCy-mxq2`Q&#fY{mvu}r^~)q9d7m+oGi;4k#?1D#`% zYFL_+ADNpc7pIB|nrC*9w@+i{^zJzJiIw9#TfErJ?cS7L*Gd$fm*Rd876G{f7TNj^ z7tMmdP&o!`rKQbwO&5U(qhSiFgsMZ;xIap`K@hz+j`JzTXqjdKO!sth-JbJk?a0gy z5JVQmqNJR3$=;He-LL#RV@ArcYfCiY)wlf;DTS{)iBQc;k`9q+T&j^DZIKWuU}Na_ zxQ{)okp$WM@b4D16nTC)?PvzBk;^f=4cN@ra$P%f@c6G1U>-24gc+_>JST0ism#x> zaiX8@la)BD%VjMED6@Xv_)Uj7UtA7kfDjgUqqcyn_=c|sCbhG3d=ANRUK+$#y>b~F zfd*jO8KFXV`zr$Z9yc04<_8F6o_xIppQ6Qnusx(2F`fS|%HrgqDTYAB))c8g@LO`M zXUkLc?3VDXVJ3Im7n~mU( zfd3FBGh7njh9Vj%OKSZ`fF~h}>5kSCAkW$m|C< zGHdazh-nw{4NkG_v)}81BU@>^59oe?=#m!dqkCZMlKItJ_CV(=@vAQmE+M(UZ+z%5 z1+R=6S)-C(udtD&uwz%77HdY?%d_HcuZEVWt?Fu}7Vd^*5rRll;1+ffFHghoMs*SE z*LR2;n8UIwYvMM!iGR&G0ZY=Y?w|vBRP6?Wj-dfdfyDQ@P^!xzt}B zwZ=_|08E`$LDH5=%wk##cjV46Hrs(h=Nb&IBSg^mH|bkKTjMA^8aIlOMsCb|%?Nb| zV=G~Yp$x%4g!D;V4OYg2oq(fS@BRe3$@raDF`KXUEB9LCDSuu9ws~_QiJ?h0(~H9F zu+CHJDO;t^t_xUn(-$5I!2xpw1C$d___JFa6%8TM_&Y^U`76adDk7>uCu3sWl;h_9 z!=8(vY?ix&w74ZP6MK;>_3y-aCW(1nwaUbSK^xqPvi(TUZgit9h(PYL3$RyQgfR5672^)!rgG1kXX#3k8 z)%6!vrS}}&`@Difz5xO2HuBgqFWAzrr%$r-eB+fK5iNP-;p#?06&n|%NXn+mpK(1QD9aL1z z>MI1ZRDuszodS;anP4a!Xq=VWj+wlWjOs2sv>eE_s_L_qM*{@bU>9oeMs1a$R12h@ z1`MH^i>RJ*1W4NzxGy3M5+$*N2rc;c3vd^;K`W|@d&KG^DC>i$>Tzi55QOETp7lC0 zE^1_qYBr7y*29Nq*zD?%|A_SEN^HU^og3GdRI)c-e!$RfP~l9gOOhZ=cL5fpo)gZu zDC3#Oi$nCiY)|gY)mJVj@VbKSR?Lmlzi7Jev%=)-qUg8^)^{#OMZYuByQ(NFW~_>V z#Y45q+I)yb%FIg6d3raDDRoU3Wgh~9vR23BU%At2T(gD?G0obW;>#6Tr?77D0(JH! znu~T19Y9CUma4~Wncl(Q>Q)++b@kE?IkVftV&RsGzt(A$YM0dsn`hXM0lXT2^z~~A zHQK6xa)L9I(2HFluCi>=$F+wq` zfCMK!|KFrx@UZSd1J5IHS%{MOS?BFn&&#OKZc!9W_z3ff^eM91)jdY{e=(gGJa*K# z#RA{J-YSTUz~hiLga+6j;pH`d_0vD%op_RMnf}@n0m_zUs1qMnl=m!d7{3hMn7^tg zIqB9sIlL%U{m}dl`D7R|AJ^FVpOYW=Yi;vOBs=++F98z&19r6~vw#KvM;W)_a)Fip z2Nb9M`@(PA<_2^9Z`-E93swmG|0e&mcd>tFCRks5GmKB5bK9IM>9ntP-F>||r@2I7 z4!<=7b1t~`RD@U|N(N0e*1eHWrgU?1aCNm93`}Iu+p%I)eVl|-1w(mM5+Tf!7#yxJ zD1dA0D`C0kxer^G>3V7T`}^f{&%WPv_x0!2a}Sr&$N4=nL^%o~?N$ic5C}hS=O}3d z@RjWokQb`iF(}PbzR@myc5)Ho5>q}{5Ha_rjto?Kq7 z6&a%EA5St=yD6dWsV+n}RKCHUucP(U>sv#5k$hT2xS zv4h%H{s#;nWB6+J!P8$3Q5&c^g8I-Ha{pkA+@^a8j&!-< zjr+tN%2T@-%+nsn+jyUF%KWU{J0TJV~3k5|a^sjXII*ckHbi-jZmOL1zgzRKfm z&xt1CStfGfj1{k*6SU}U+fhEdalgO*q?soqu1z*8&Z#YWu)iw{r%KiahNqmZ=S&TM z+KNqJl}Y38v*ZfnZZ4npp<*EN zO@Sqmu&;5zm5-opL>_jMiKy-O1)E)+d+GGZ}z-E)KKR}{fx%=lOAhgP{CDg{TrI!ZJm*4FvBNtyN?J7e6 zoha0%1jdz>tiw<0* z#_AO7$Inkyb;PzkS;Xtzqi)Z<-e{AA)%42?(-%1{v!*(gm1wP3j)B}Ge{6^gTrDb0Er43gnYpY-D z2^+#YtfH)uz9qJF88}iiG$&-+9O+9()4M}mI*{}@ znR#;#h$4V9Z)$Jax~-bZ1!8ZtJPvlkVc3s)Zz35|2r=rhow}|rg^<^p2on(($;^rJ zen>8#Qqk~AY-vNb_K@XVHrj4Zp(+aW^e}k&twzh#E7zam0p2m>3g1u8v)7`V6CUIoOCIq9(cJHF2J0zwwW15v&H@}n1G3ErmIfGhxF=^Qrn00k^Fu<;b z74D-k?4mXX{OTS+I^Qh%aLR;Bn-kul1x-g zj^GG$#XPw3uh{aq==qXi^A<~L-+Op_t;~j<9F{ef$DZbV+%~|EKz|3)TLqtt&iZ%NQJ>j)Zbp%DB9vVhrBeNOQHIsn<`pl9eLv0aO{T2|;;Ttcd z`iEcn8zipa&vW($H8qU0wM6%~5jSkso*xip64O?*C64mr|8QmG zjI>r**e}XlA(w@%G$FzhZRv?9*pwOb;roMkYN+(tlDR_PIxCAIAgDW(@gN;t_L_(Z z#P%t?CYA`FJjHgqK0_TTY7w*RJdm%v&K0J}6>S;Jmqr#^2Zh*U3!}L95MLY?;z4=hfgPvPNf@>UQA^Nb#iH(w$ z*URWg9R9Ct@-&)WsTRqNVvkNX$F3w`0eiWT-Po1SopRWdwItvB349@@Syc`cs#xZr z`Ju<-(&S4DO_V9$HqXTTK4`|mlVZJ>zas#&5+gBA zoqZ|8{FIZrCCd*^I_%;?mg(>x)KxMh-a?`>@%oDu-QU3vsJrXxok}tAnO$vfd69l{ zI4+p+vA#yJ1(V%+3Z6VPyfV^a*Y(Ogs4GEHy*%gg3&fYHEx#qxdgQ6xUd`LwB|C$Z zgwo51##P621WU>W%D9ebQYrw!ZVIN)AGup+sxqHqpqT289B&Vji;8Cf6xp(a7)qdBqR z88n_R&l`9k85DwG%)ZWd=V50x#w?D`*TOVvj5f~94*i)O`|1p>m%C&l-6^$hM$=_p(&b*#Wnbd+s%}fqqA(e7wx=BqP1&F) zz%C($CuFV+dngv%G$LS_w6>#TWHsUO7PKgb8N&`-84wIce1b zbu+t6HzU?MlAM&x(h?bYzZ!p9QQT7?Y?$+xX5K(+ej86%X)6j~`>Zdiaam3$iypI+ z{j{QcxKJ@*Ib9I)aCPu_sEVbauf$&?W?5vU%N^DhQyE2B2nA!KB#y=!rf(-s#*;m9 z(In+a*pQny0L349sfd19KVlex6Jd!&AR;tY=py}EgfCAi(#956o4>3e?(af>Q|>7N7&u@ zHpm$ecN`GzN{c;AAURdA4}q=H)TZh0ajr64rKW2qyepH|iOL%Ux8Lc|r!E&r8pNsJk!g`R z^m==dQKV({9Aml=iBdgwIK8l9M+ZQ8$wJiE!$s(jO5;8^*j^@q8Ohhw6 z3b~NH7GL}~@$_*ZuBL{{uju0i&*b-8Pxjgk9^Ob+u`X)Dc6fDIoVdZ$!mg%TZiki7)&myn_9j|JJk_b+jg9_xQAsUQ`w9{T^vBryO?4~k{u z=MG|9F#vW2h7&8Uok;U9u>Jf0!nJ8tfncNn%#Y-uIkrwiXG2EA9ckikXJBw7A*De- zDanZg*^|CNtMMnwIXkyUd0>fpVqO^c)k0!G{nq*(c_4fn7zvHxbKSlC>^t-?OV|9@ zwXEn}?&rYzYR-QvBWIK8IzxzX3+9W-A(MNTJUNv}BQr>Pw-5`fyWP?8cUY7fBQOU# zu|fND0lAp(TKjlx9H3yj(nkXA%o6?%y}nD!^7B1(ZID@?`!b#})Me(Ye)Pex@&@-B zrR1tn_?Sbpg6Ucx4YadKw1VlXQSs_%>wsl~30gY>hB-afJ_vhe2$GS~*$LrZFqKMh znv!zWC@6jMWWQa~Sg~Qi>B!d09bi$HZ;Ci|Pw!8sF^0xsYrlrfN;eC`IZ|u#k``3O zVqWLbn{0_dyJQZ7Ee-e5LuWnpC2a1cjJ&89Mre*u;X{vNWmMcV{(?-?76HeX9A%nS z-Yiz4H5&7epjjGB=Y^R@h)pgoHK}7~wuM_rg1d7eBb3wi0~vby1@KJs9Lza0lppSvn2f{h zlo4za!dN1mUn3}UJxUley?iupt##?0q`ziq*@eLm8iE{G3ly?TqMF*3ZP1Qaj2ND) z567m>v?eB(R|dT%&wTaufL^+;_^2olC_PFJ1WJx-(bF3qI@Hta8%oiu-ru7=a^q0) zic!$B30og>)1yDy^UebGA?Xgr=xvyyoo8G~63$vjf{8 zNp^U2Dc>?i$+>RS1`1};_3XSl*sEpK%P5Yq`>@XfQAOZBuMGiy##M}w?M}a}nWrFZ zjn=hr*4-L{HCt4%kXbiMqTGkW+#0fW33G2q^!cl!x;s3@v4F)P!Oj&X!o?wzu8xt* zW;2-dGg!vlgA@pgX1kFmIL5)+se3QBV#DytvkKCjgg?^qG&=*zx1@Rj*$m?+?8<7Fbx9R{3J0rtC>;i)VZ0FEyFyTvB@=~X8(R8r)WY?KX&n!$3AAB z0)~GK3{Z0JO&U3QL5<^0ZF2)L#?9YC5f~oS%JB9~IyT1EG4mUYXyPdTzU3e=T)tHx z*fti=jdl2^n(M498Ov4=Tv;V~f}bR($=8#qP7?PDR8^?)$A&Cv!-=;k;azz~VntXs zD38zX#QAEI@5>qBO^gCb>#~(FX|P=9mC!=O2QQ-F*@VfgQx6YjcHcdUX2x zU5tjCpvdpN`&C(y#1JhL5f;i`mv@Z;LI+f8s0Fm=5cZmgqShPOXi|`GvW6`jNdp%i z07uv`4Z*qHJO2w*Yn6cqzNgzO>CjOwL8?gg|ZW9bGZSDjPI?F1SmGu|2@x_yRnwum}pEtmE z&2L9-#g>v)($Zqk7z{oS`Bi(r)(ysTX45{8LJcy5h=~TLK{Rv9`8h-3>PL7zjRJXc zoEjR{aQ`&5vY3Q%Ox~YB9XX46pu-cLWD!@I?xbL|;ucbWqWdZ`l60*e?N}|5;vg+G zd2*~wM@6+)7t?XsTSK{95ZxLfm4;#EkDy0MSzmYWrl`4ir{1?4F3guKtHR>p06=|$ zzeK9Z9FokVDQLKpNMg_GZP= z%U&d@``d@N$0Ho;I&RzYB5I4X4h*cu+5H@Xw|=iWUgpG7x*D2oczRULG?B4)WkXx` z335Y^K%e!m8L3puimXd2r_7OK*ePN}vsi8M$jRsB*_SPe<}wNe#EH#7*(DOU^fkqq z3(AKZ;T&*8dRZ0JJL5w3lVzn)vm6nYhm1I^aklNnSn=2T803GmvqP$qXf zRCF9%em0t=vCaun0;Ro|k-G?JnrkOdLmXbX_B#A4F&za?KR0nUK3-ng- zGcE|R4G$EI^(!d~roBB1&a1JS^+pwQ<2Ogsjszpi4Rlw6eC4~#R0I!*0|}ZO35A#aU1C$Bvz6Cy7!TU1A-0X_mdPUc@y0@qDz3{^x8t#H z8<~#wP#GByjTy2Y&Gb66qv$}O#3(mCy`hlEAISGT24rVnVxQYOfFeL9jS4-`H%;(EO6c2HIW-?AV6rE%b5~CtQ{~s3#LY zf$jm7uD+pjJ>MdJj?9f4Q$h%?U2`$}9|aCadzed)HS#>oO|yZ*s$_Oj*=t$ZvD z{gfJ?=3ZGO*E@Z>2RWf#Q9Stif*$UJ{J{z_*?*vOVwMW7$?2(14xsEnS<$xDB-cl> zlH}-oHSiftk`$!Pq+ZBP1dkRgjUJnH02A|#{t-|9;I_JqU|VOX66F+zDId-x4X4#A z&vx`dHK|1t-45A?*3YwX@5YT%;Q(&eLva}I?q9>&`yMbU$jbDOP&8k;X-J{66HN2S zOKM}sMYBns$NsqD05s_%&>!U_L`m<6uOR*(qf`e;&3SJ2+pb9J1g-(c z+;|@x^XerHR_)r_yY>ZtgYRe>i>Lb^s>2dKQ)U;w_BQ}Qm3ZBU;+TI7!*p@k59TjS zXUa``Ws#>=u3>rizl+RR!&Br`QBVJgks?T(!M)>gzdt^N5A{uOVsh%Z2ON-Sg`Doq zUL#2iQ|eX^&O?30IFpny)7$vOdd67Z7-D~~ZBW)N$2;7IduSy`TZ-2l3dRnrD&+(zQF&r9(_J|=ajJ(Iw-$O_(-=+_Q{D!SkQje zs{gHTSCXouZRJHVr1}~W2>7h5s*ZZn9wjqns!j`h9Z3cWkgN5MDc}+~x|4=GAq_Vv zIPB4{t)5=}GdU`>Pg+uKiea#!c5{^tO{01=&CA!yY^&Rk2MMO+p`2zXel%)hU_{AH zz@H>XsH@UauW_4T`6};~1*?g{8z3OgY#K#=fhV)P3=?t#yrJ zyP*)QG5DcuaPZ@)1o()goD znaI*{=-6d@{2Jj^K(|@eN}EXo)mZva0JzQ$#cWS?!L>#oq@ZhVYN$?jPn%x%vcHz) z@?i<1yUPPc0o*&o$?NUpxbeJ$8R)-#*{V|sXEDxt2NkRw0HwQE(u_sVH-ytC9nAyS z(2cW4W|2)>nWf1>%dMI#p9l_rPR;Sim$UB$7ahbq+NVbi&C0d7I(^NAObZ|(AD;C<5`Y+C4i+^7l-?mIrM4wA}DRW3{p|-j^ zTo6#PG}YIC7Z5Yc%wO84aBY0-we3ki8?2v0Q;AcF0T}&>jG0 zBzZyjsK$1{o2iUXJcEX=U36dpR3(9*`6SLTD#w^)dnHp)m(WgLu8Tlmvov4UqF&My z^x~1p3wV^LCo82&Mc#Dyx!F3iCK-B#dOUy359t%MRPP*G%S0*oT%v_#mQ99`&N?em zYaJmaduccc%a#{}OBO$U&mWsYo>%xVz;j$i@6@QUkmr?DTWsA}Kj2JQ&{e*!P-k`d zwJ2>2S9Nvs(t)e2Qg7uoyH@PVT5jJaQx=a;4z$p?Gmt!!V%@6gq$@OVwKroG?!H;@z>l5w5O;JSRkE8SMWlS_50p%y9 z!(s8%soTz*OLRqqV{2AR0et9|%D4w!CQcPmVN8vL2v`}IYi0yKnAlF^RDjTF7*D!vi&mrO8 zYS=jPY8!WdT$NL78U>!&@tjFS-6gJm+J-J}Dl2A1xr*=7-pm)NQMC1npLg_`_L6LS zI@-+D>iyS3aJ(`7)d1Pfu)ur!8iTJ!K|GP~iI*`oQShP%^n526DI!tE^)NUIlpJk6 zz`fas9X%JcADkY*I?YQMuG+a$dsi;Pl$1DWl*Fql=qfvS6bC8xX_LG*>7=pzEFi(K zuNzN#&_`J>@4`CCCk=lrR68=AWYZxK0qyZ8fCWyeaeGF!Z03nVqf8u^|QhT;Q{hR8A(S=l}`A^U)_hmVD z2i1T?`m$~@p&W){;I=~B=s>Vsbe=Hw%KwzITpwqbZlBMM0o3(C4ct~7GW9=^Oa~fB zG%153YQE{DU$O6FzS003p1?R!2ew=T({`^gXz0a2uudW>Hd@T1v^QY z7xgHfG|G`VP2RIzWaS0M+Ln?KOaELy~5Ia#n)$&)9M#F*Y5W2e~BZPlhB2^0g+)1fMu z@!rJ15Q2D`2ipPhM=RF^H*#bbBC0a8%b-Cd>DkhZ^ELQbS{*N2bOz`hNn>ZU#U(LT+b=L1;K4>@+`F9Eh;0K}EAk6@5|l&A>@+r<*%+bzgUYR< zj8ka_DQf^1f@K&&e+1%el(6KPFez>`chvbMGbrXk?i?VJKM<3~6I(aJR?ne7y>Z7D zc}&m~sw9Zrf+*4{;4+eAqiiA=zUgoD)NO1Z-8E;#GEuaRZgKD#6Vc{9+WP-}HI=SWA*-vr5#l(5D zp4kbRwhco|Pxq&a*Pd#G&ifX+8YM&W`anm##v>2#rDYR$dhlhB4)GV#+NwiDZd}F>O_Z7mZhg} zSE>RO+D@`ecqJ_6EDNXO%FS_hb)-{PQAC_c@4cxhVNd7xU_kcoAc~3My~$cy{iT-J zPe7OO(h0>36;7taE|Njacr0bEj-ExHmK)7q)kNti!I)l$ty29&4QF0jb@ zhdWj^zeuL}OP=v0oNB{c5gcHRC(M}LE3pA-e6eZkU>Qf1%jp*?@+CRT&`2r+uXgB5 zo>!rqAaW*_VAB2&FHUGIvlZSSYM~4WSZ)2YC;f~C|3<-R^I~hu`&CrV6cj9YXy;Dv z-2EH8ccRa&*N6WwjUWCdtDeT!8z8$9slF5X?vxO;@fZF@EsLbhp=4*=E_A~mDN`ND zB54_N{&z9yMlTuaHCk|JEe2k{D^5Sby}nk(Bh{(K`$0(dXE8%>l?MDpk`MMUBJ7eX z`d38kqH#kB27ABY@Ia6~!Bx9h|2lX5lrM-^KevtOK17-*g!w4@ z!J7M;(h(dA!LE(qd_%f-q+ENM(jx)bbji=RJ>iQmsogL5aX8#iVLPt)u~6LLSl?RF z<4WCPhG{1U=N%Dh`{_U6&G&I9`w-LRGDfvFg7#0ybA`*U#Cb*H3g&OLJ|N=;>YPyj zhL7wsaZ8x)sO=6~8M7;5@o=ji?7|vjPNUvCwo;FPD~H?%71gsZ9lI-MSDhdyh#8!?Frn z9)Igpk$N-_K&uz*znRy5SL*_XaDj8AO52M72&6wKImRkxDU!b+-zes0B!zPPk?gt4 z)dv?$J7Bj?g9+X+rCm?v52HB`)$qc|7v=%jvasD&emkZOgOmaue4iil_AA+G@d7{n z-ebq%DUfiwPH!fTd}IHz7ZhciyH@AZ5Ja$-nUE`-QSWLKP~HEtJ5m7m>!Kg-13CEQ zjb@x7L7mbOcIvC0yI1a@Fi21tL}~if#*JeIi0ZuT~1B-!geKTB|97V-fcdtJB#`|^bnK${PmFldBs!nfY>HJZ-Xk? zy7D{{vIXBsz^2X6ei*PfofEduj>hy(M)_icC-W`Tk8;XC5=yU%)_+5sUsjHe#B@54 zv;LUk2!B+1V+J+DS*RJF5P1NMR9fDzkeqH=TmUB&sil9Aa~!HV1+6aFF6=ro;(h_? z|LVF9sHU23n@Ck4bV4rzq4$mysUls$2#8=pQ;HBkIz);fy(ystP&z6llAze=T{%duDbDJWrT;ewDQ`z4iL*sbV;rju_N9 z0xtUPPO}Yb)B`W3FFKMzcaRKuKsf~2XC0|0FcNVsp5bRaA)}N%0gzXX0NXgNx9mDz zG?md?#8+?aHTZjK6m|_hcqdyD&zZng!8}^cIWkJZh^n17cd*F9oQ-%>_p0N&9Pws1 zOvWz=O@O-MTq5CUxxDnLjna_Gyj>j0p8*<2v5{Y;IV~ifNpr z_e*OM)$HbcwgRbmqQUP7ZzCkp+6}zV8!2ItvZ>TYkAS7|Ol4ruDslDgIx>DbYh7s6 zAk6S!UaVw)3u$@?K0@ycl%BWCZgd+>RVd=JTM!5Ye^6`oMNR@$D4zeOTk$i%lYP=A z!Bu#>Osq>59I(W#CfNzdL7C$(O*}7bhhmvP=IXDDaLip|E$hr(d)wgKs zD5lUwTZNKx86R3PEePUWL|%#h41$37tZ7~f39SpD{m}eS(mY2*?7Qow4-@1ESwvOy zuC7<2=f)SKkPC|R_f_|;p-VL@tK7Khn#{4Hu{&W<6AUNH30Gk2q3+Xz$rSA5OlKsC z@saz+<~?gI@Swd3Kk2)(apVFpGY6`LlPC*Xx;o#8!iV}aYtGoN>BK}1qv#s@W7nQD zBqU`MI2WIhF4oR+vTqC&wS>jaD(Y_=ITqFFbt|Khsf0q=0E(%^4rIcZ+QPouJL?XP z1xKC@$tZlfRX2+pQR8{Pj#0L+#4-mKFAS}iXj}dwx0yhi)oA^5&-Ou?y(N%m!@Gh_ zld`!qJ#AO8{5$=_a)`N~idCR!1F2$r-;+>p4~~)XI~duPzA?Hw7MTO7j?F#6tlGX% zwHYI1Ey0~({Uy}P_10WxeNx~Bi|&en6wQbVg7Vt&}Z{AJ(+!Dw}bVxV2)u>M}`h#)){LGRe(ivsMd~fp#ops~MRjJh64Fkyd~s zCcV`dVI326R40=;Mf@Y>xCmDfK^Rr*_02e>1x61Y?H|WZ9d9!!wIn=RNq6w*W&#}z zJc9D^BD}Z*+~ezx>rchmpe1|hAI#b=-R943A)6IP@EyE2m^7UCL&S~>Niz4v;bu(` z#iSV1ZI+we;j=b@*te#pOiCSWvk(<~Y*!GX#+~U+$HP(KoADEbF?jk1-ATURbpFWh zy%u$E)Z3fUtt9J$n2#0#`x*?~t>PDw%l93Nr_2lsU`>-hJt0CZBOZvYqK~T{H-fZP zt^550JJ~v6J7KS3Y{u^}6k)tMod%|*JqHs6JH)`R-`JQ%M{~`R!$>#9%7b(_@~?-j zI6F(ZNWO`?K~nHG=Oy!NVt*c|C_s=buXh)=S*<_G_t-D9-)w7{HPjs9dLJ)p@2u?Y z^Hcz~;~&i*DVdU*fm@iAv}5}&6}r16b08?ydz*aV_ubt@mz*P!B}q*&f40KOc~s@E zb+PwG`M)>;(4j=imiq=w!3}h@%>WEIi6OZm07F|6e_+nb9eDu(Fr_zZ*qTN1y0e%y z`ynW~S^An{X7yw@QFxcN3m|4sct!wKGWhqMPXVZeeG*$yjiwvE!B+elts9Hvh^(D+ zRZRB8m6;qN<{@7@tHT~I(7btQ`5pQ(u%_QHlVaWzvSWt6y3eg{YZh-S-xs%h$Uhz` z!P6R3*s~13f?(y#kV*jL`mP}v$s+T$!1Y?5YnO`Ro4wGaWf=@hMJ!MMo@3v9^TTJ- zT0qXT_xyrH=m(X)iVEpCw@nTV)d11g?6_!>O3ZX4{>1W~KxIp+W(3A#&%LWkY5 zksB3{j4kDu)(&_}naQ)HkPqMU#@m}WmAQ>k)G`=%E!>N*p(Ru!jI#Ze9mTesL^Ej| zm=lbsow$26nS(m-`G%uGB=gj)qApF8D)CIW0dw={w>@8Wq<$E8dTFe=bZR7D&G;BD z`E22Ey)uc?VSTnG7AC(_{F=&6Y0V*-*R1)8^tS3biRRG>ca@}>C&=i~B+i136w8{Y zUrIiUOC*FkiZN`h9D=WVtj-6R>%Fq>gNL*w5~V7Y0MNbWB|*`)QmI;BVBG5g%GZf zF2Pqz%UAE4So*I&D{%MA|EaEwPJPXF#k{XWQa!3Dr3=_R8+^MPSs8`N+H_-XDNY;C|8R)-3_sD+zqk?B(z6SDfY+k&?=*4>~w#i%nNz( zgo%E6w5MV1!*^g`I_75OP8O@jD!1u<-d~I}Fo9eQTY&p4kbV1X3-7fx{8r3$NBEEU zoW|hVRYIXvuO8Vos6O^Kc*IZk<#v&x6{`Z;QK6D%{f1d>nllU&6w#f^=s$N6o>?OW zW873gAhTm%&QOT!7vbTIT8w#|S=Dd0qDu8GuH5kFV#Y?SgPwUsGE*ea=wFw3o@x|a zohfMSb%7o|PSPl1?8Qzmz8pRy4^hsgv{k1=_f8F)l6D8LmiR%01tONXDKBK*;i4bj zyj-2+ZSu@7*Z~170oeEfTDS43y!*qZ(KPMdsbzL^R(qICnmf zwzne_Tz9n+sERCJ4=PJly8Q72J^Or+@|D^qy>;ie+EW)M2>PQEN{t$IY@n`7GYWN& zt{*Ax*iO+*cLvXZ4J8g!{uG*MJUk#Matiy;O8@0`?z*iU`$g`?ug1W2K3icP$jA!+ zz#pVTVF*)SYBHW|9bhMTY1KK9PN}=pt5hxO{d~<%SqLZ})i)=$uD5USDJsAF=Gv9N z?1vZa!G3?ESp}wuJr4OcPvpsWUhfMRiR( z;`Wo(EDj}e=6Tky(-0D~A)Z4F1TLF`$&y9y9E&L*QaNq@3v{;t1k-T23GWse+1yNN=RepPJjIN$7MfggH1L-FdKcFwEN zmnH*;mGk%NT`d@WJ#4h&6w_bf!TTeI=Jmyl>1oDW;o+cs_jk*%(5t_+SQRsC48*1! zUrNu#hLv=E>rFn|_fT-^XmNLPS9yVao~wZf&fA`jp53M@W^HQOQ{)Q!S#L3TUX$tq zEKGhS5BPC$Cf}qqNTcX3S-)8hN!@s?v}q1)yDQb53@G&m?z-?$*E2h@7&*%N>$gZ> z;#$2bpn6HG9Ea^Tfn*ivv;bAlkwt6SfV7MWV5s+^LB8(Q$h>xNV%Rv8p#Y5Bd~_I~ zAM&dz*H9Zx?&ra_IcVE|^A;!)$DTd&=Z912)Gi4XbZ7>&wQ2SyOUrt};?lRf(9CI` z@&%7MVHfpAxvBeK*x@KipD*OuBUj}9!k&CFFw$Twaphy}MJjt9tZ8``%!xrcF4e0q zcT_!JQd`Zc6L&&{ox2i~YM(fw4rAD|o*?c?W*IuFk#}tjL(8$C1huXB)W+*l+8&iEiC4Tp;?mCYmU4ICTwgTl z3a2#IhtK2|2?=%s_SO&R=n5X>wkJ);#>3wEi7?%DgN6ICi4RJ~sIFW&v|g! zmfR-$>h`rEXhn7O)i;3uJ*8A{(3L8O>2z;pnBCWpcCSq;MsM*WzrkPNvC0blox_&s zA-(h8H=jkJ`JZ@ImPaWBuc}#4*a&ew=~tk`CPsZq{Ji8h*yzk!=E28>9f+Q$Da7sF z5zitZ#t)=*f&qp&k80ZqBuEU)Mc41wWIZlvRrm;2QA<%d%uOypm5@1yb4+kg68z%& zc|~)Y_~_*IuzmaLwovq1lWCh*YPoo@uC=SWpN~4Y-7%k%yz@}GGwh)wG9qN-s_Za` zwVW$Td_^SlnL16oTVI3m3fz= zyl1%!L%ArgC;-sLWqKUS3OvUIU;e;cwOS8+@1ndafna;$qC>TEj#Qa(B5e^-DfKKZmPnut^Knv? z*YR|8@|JXPhxz!N?#XfW(=zF-XByN4MqR7~LQc4iDv6Ex%8j~P3FJ9{TS;BQNAS4QHU%yYvnl`pvp)a;IzzT^2>|F@ znxm#MKrqiSv}LPLUyg`5&+)(KnH@!o0rK%4gHG!So}IeHT$DKm$a8`^tusZ8sy>xQ z3sK1!px_B1wQtA`Z=!S95+O{dFvLUD5ayrZ{EGo{sAFr1vbxT2b8k=I|7X5Viybka zvE_ui_8KT~(yad|j}YDcEa>qz>gj7B{|V~!&i`joihJpxeK6|xYalh>@nD=@gUfh^ zbo&T^vacbYK*zB3_&-xRMAa=7qUzRJgKh$-{2CxXDeK>KXPQCorI_B}9n>03p!-?dKahsA(*a>tt|F2hyLl qh4n&l;{LJqpDP>j!gltY;q*b>!U5Sp`~ZHyOG*GBFqb$cfd2w@cOovG8(p(b}r~!qVXrV9IiQmMSEvG+=l7x`TBlMX_lQRM$ zctW5^#zf3Np3L0nacJlCg~16=wp?bq#1)H~%d>BI6ql*#{Cy37pT6T71m=Uxd)R+G z1-%aQe>HCG4@nNeu9$2E$b2?149@oL>}>B$?SlII`UWDYD`}G{y8*u7AM$H=b^x}a zBfW4|&fg>Ph>W80BGZx-3V9G!$IbCtEir7F$D@x6A*^r*_4rf)#F%jaRvq0wTXD5dhp0#hrp>-(`E*?3!tZz z68d1?Ueo?kbLg7BUeYl#8ep?1fQqZ{|#l?y<(RJ%h6~q3OYM>yUnfUN$PI? z5?OZE3dLL?;u7>KgF3mE&hw_I-y<1_D7Q&2*oc*H6$FqGy0e+a zzzkOIGWBv!c{SP7bgARYr@>G^%lU@#XgX~`jk~f4A*h2Rk}6JTqx(O}lIWMnm9c@i zfuMm-)9uh&a!$wBe8(k#A>1PTCSPA#FrjzoagtPr9PC$xfw6j1ZFmZ4rq1?hJ3pDO z*W$cR(D_ZgZN_Igc{r%K^#*87NZ&VMwI;xjOTbY0St`V5{E@#dfpneif>A}?DFePP zSISQvXR^fw0iFGQBdI09pX=IfwhQ`*Dlp?ENME62Et}Xyau{3)cdivibqz6BF2k&$ z(ce74&V|bDWjI`ScGoNT)rnE;vbiQtx1<_wr=@~-$oU*d_)rBU>kH^EE6-FQ*5lOi z$$uMUL+O#IK^TOM2;X2YTMu6K&I&eC3*{n5j?NKACy*W!ZhPA{LM^?K&hZdSc1XR8Be`kk`EZHmwB7CznZ%0hoN0|Mq`!H+(8Si{SElrlA}=+Rx688?nQ)# zBHig-v#)s6W7p-Uw&NJI8d1`i;=#99C%JY`ZiU~UdzAztA6=k5HTW}nC z&cS~CaD)EwLs16q|G+^qJ~$abCcaY=ZR92Q(Zi8BIy1u_1f(Td3z`bFup8V7SmX%} zs*Vor`?p~c_b;KFyBPV0^2?^r4EtjHts}xfI0BLMx7aci7@6gTK#I2G><+CYLSY=R5CPRX$)fi?n`TWqc=jPcqp=iUGt8jP z)taKIkIKS#Z(mQ}RX5x#4mJ^$Q3l2x&UT+b@TSNq=ABJ(PBX=%jR_tM7fjqwUiapG zms~Gh1i@|%FaNBv_T;E?U+Bhjv7?0~-r z$+kpsN1O@8*+K;mp4rNP&%n0+nJLH|v)E*j#MTWKdAMm>!7rpyhYtU|jMXOaq$+0g z%BFG(N^I?GXHC7lAkc>&#>7weEdCLdLB0-j8NP0q+^DNjGJ`F1*S|hLm;{~byNQ4F zX`Mn$r7x$NsRL#0EIy4YXun2hm(ZCuU*k!Bua5TDG;joYrn4skrp}R1X}da8yM*y! zpFWey_(;)+J)9-c^+c4eK!4kCwTgl}v57hofYME;69*ttTM_8ClT@Jg|3R6aT5%Oy z*?!s=6-i{*Y~6yBLPMUnk;~Tb!$Yy|G2hrgaYrMKxOViPx|)U7DuMkfBuJ7jfX!;z zFsJr7tmU9FwC3Ib$i1Id{*-)&-T92j;{j7R;b4cbWvTr$x2btPXuXi9Obzwv4!J)G z>SJ{$N)W1}Wa;IYEyn=7vMs!lCNf~jwhJ3w(@b+eK_lw_zCk8)a`tE*%)3oXpWfyc z--tYx|6rGb-y(eTn7=z%k)X?*C-_tHYz9->RBhZC>W(lESn2zOP55XTXkDa}p_`wN z8XkZRkx%pO`~;N50jc_dF#IzAtB{*Q?uF+57Y>RP*;Qw6efgAF>7ycx{%> zi{LF9jl(^g2m!qmWfJ^VP*J<=H&gaoZq`I1Cw0W#KVJiqc%}_}LD-09d3^H`QK2ls zKPTLKjL;<-kUzmUiOd5e)XD45MODX*L)0+Q?VZD%Nj4rO<4UuB7JVvNvpP-5a|@;Z zeoS-!e#hvQu0Mj{q&IOomm+x)(l2Xw{iFeQ8J%j@i`O|jR%u;c9dh`&qS%T)dsBk5 zBD;bz>tay|?p$13fbgBIzp@B~f8jw@=XTAHIt&Q{256vD3`W~$<8p&GP{m!G!sEIZ}Zf1hc z#lR?^W0(WglPK5{-mny|ex1Vz9v*AN-w3_3-;$S8QjR!_Mx-cIB0_>rFYX;D|08aF z=MO^YJ20GqMcAV}%tLeW=7FgV%lQ2^^SSeo3wYj-ZKDKPG9oqVAOvOiPbp9@j1Z;u z^{q~^Oa(MAj~D4zR>9b?RX>piKq4q%yZgFTh! zPCRqx-n3=eBCW43^|ScM^z@_2yRKlw!nL_!bBg^ng96<`xj1t?(2FnM%Gyghg3+Rw zAT-^&qP-r6WjjIIvyr(jOJ5H9aJ{0o9cR;wE(lOz$#u9TMgECN%uBWJz<+Tc#Pb?_X~-PfLXx-GbmZOS$Z$^nq?Vu%y)d0c0BsrhyC>?vi>uHspVnltdJ)&2it8slPDjQYK|v0P)lw$wO{x1z1XT3GAm zX)Ow26HI^~YCPPz2IwN?yxQHso8{{^ z9IgKKP%d;*Fb@vz4Mibm%&!+9c4JK36OR7KuYCq)TY`8;<`;tI7jtro%B%2upZqVp z#2LxxDN66|E9039!NH)8s2XPE!UI4wHh46Dn&881X17ggDnZ%YQntzg?`wU2=dcJ9 z(~5igX;QN`M)sH15&(MC3%oV$!US3$3z_SJDhPRU1E1X(=)6kTlCIn^0b|z$Ohb#? zw;q0s^AuZBcK~JSnNqJWpQvbI3ikNpTWWpD7x_jZr8GL#aLa1qqd=U|CjzMG9?}Yt zZ5eo$kwS16l&%?ADS2dH6Iujd9hvVk1(o_^WnuHOux>m)uz(+0r(}WXBj}^)8PS`b zpVt@s%pCA*ZJ_DXG(Y>2S25}h7UN@+;m~|xc^a)ei!^_;3+N3F?*-!h1zCP1C3!?W zKeebXpp95S1MJt`3ydI3$FO2p+fZw$KaQ&$Lj9*jeYEn} ze#ujvtZ@^OmO<^D1j; zp4l|8FV<9=v1vQ)3;))#TxQSB5Fc9MrOr~RDlLr1!HOpXT~>KRpNZqz3Rk{nkcsI` z4(>LW9uc)hyI{Q`MC%46>WrxI1!I2hGjoUNxq^eaqA|`f$Mtf2&+9x3{D+c^+ZN*o z|FByO_5V`xKjsGg<3BK5CZh$cyXa_Of8%>`X-rHTdr3*A=d?$XPDU;NB5rQL1*-p| zY&;+VRwz^H$^ci~ihY)R>Z&_a8q@t~Wr#0zU?E`5ti8gf9s?!vu*_efJa+>D0oViq zH=8!Ajr6SZF*El(J1@Bo0xz@QZwEX-!tT`JP1=!1xTenbN(u7z#&7}c=ps;gN3VkL zko@I$C-A-z2Sdym?FCSi{oQ$RkWrAufe>KPkkXL0U^0;QxKz01SdQ>iU}|8qF73>C zfn`v?i_8tV!u)xwMpmEBA;4(8A4q@_##l?3*q-D45>FqEf$=r7gox&RzQTyVmxjt7 zZ_lXsgEioNe}&ENJum}&K@66L(jV8;gHr?R9DP#{Z14;$EOinIL^RyTwObd|w-gkX zd=0or;gKbnT`}ycsxjIWb)kt0BN%u>b6nF)CXor_76-6Z(0an}(U26a=j9XeZy|R*zZ&|Jy z_MY0AtsxX!4(Pr*T&xRviuPg{*l}dPY7!IMm4g;Mlk1-C(b)sWVoY!+` zHq*YUvyz6gmWSD=GBSqMP}3dPhtYK@4z^Rh$6IKI*Co6oU^JGcavzsFs0-*{M%iAf zir0Q=Sij;@Fzf6>6>)34`cWY0u!>8zB{R$I5w z`6;O`pvK*cjccb3KJyiv$FN>srct%~KLM%+_*TbbT_N3J36yBy# zX~v})E`OkSQE;L)+fq<`*|#9&Ylkx-&Y)OFJP~@aVr&35GbYyO%rnLqbd}tq0<%dH zR1s8L;Tk1T=nbkBv4-Wi`u0R?G_^bSX*$Fc1S}?6#5RbTPuOjiQzu(1y^he0&|w?T zp^S@fsj#NG5#bUw*p(X8g-<*eD3ObL-A!v~Di>-re`3ozpVpRSoxn-sBj@-mJW#1A zll)+-`=tr+X*dH_qO{}nnJ0!gmcmZNM!en`p(=UvY5h~|SMbTo+_BYBn2#p`2}A4K zC9I^*Zm=YiQl;HoPt{r59F@WxI6-!(s@Y3TKVBd*+XiZ8+C+!%vO{i%NzVftI z;>_IaV-dtv**idBiYnD~yzE?VeVWFcwD4q~Hah{p{BT;3J$dtx^~LnavLUkNRBiS; z%ftePMBePZt5z@4kT<&Sq>w>{yro-3l|;f*V0m*uP`6QSRg3lB%6%xm7J8U_UFP5^J?<*A4PjS7xb2Ol6Uc`%o0 zc3JW>3uXIReU5-_mzqax=eMAxjgGRl1!}&l) z71|(JW_oXaBJZLiK20`>$;*2u#7zz5)mccxyp!E&coS_174h zv|fB{WIN(r`Y&M@ty`8lMt(0+9`z9JuP!Cvv(4i zlY}O9x4?CL|EQjEg(iVJ)=L262h20a7uh?Hz~tAs#9H4g)jOjA=K3U%B>eSl><3|d z&M|5ta$cnDeRLwWKlMF)UrdoF&W!&NP5M9^rGqXNX7Ki4ex+e@}bNr>x7nR(1B>^B!XLF z33=-4zn)^)SHubWuUYaV{12^Y+Mzvz{I5<-vNVGJw+LV-2mh~ElyeaSb{x>u(7vv} zGF&{kh4C}?SE3-mUnJV1%h5L&XlQq>&!i#cFyNWCw&_(?*Bg0sghW0@z(%3+q@ZC& zLsqlq>_WzhB75JhjrVs7^18a%OYK9Xt~*YAU-E8p-gBoI0owp*LzFUE-dK2IT4v(J zhTXTg+LS&OL(6a}my3JtjTpDlu(q>kkf>*x zsQW01Cc2M3(dlFMut7AjfCO+|cXWFhp$D7=UfU>G>k}@`dQ}yrp(xwtK|!G&{j!OX zPI0nulmlXip5ILX#nCQMr8<2JRU4J_-e-fYRLnHB)NoWes}A??zG7LFU%z&mSlJbc zEE1Ar?L28|X*AI?Jn1TYZcO>_gT>rBbWP|X$j7h9gvb@5SLHg9 z>&$H^Z3p%v^$2akzd9}wuz4DOvL@>R6)9X0MesH80JCqP@9S}cKTh$CT_NAkz)a70 ze=a~wB>>ByZhh-2+xtHenD2pLwLsBh$h?d;)WrtNJ%($6{?-Y|R#pb!Pd6r8f$>r> zpFdON)0R*Gp3;5!k6-qOm$~w~;VDhId6f8_p~Mo~K~9)~KV>E48~P+nN=5#7;5i?* zWh0-##qACEi4dO*;}-=do{9E_o64^4j8J6GGdwkKD zUzrld*Q`gj0G71O{RCk#mYHPTIMIj{XgOum74sZO10()dN$xT3F~v2NziIwkk^BR-P*7uMafK72~A-r@Si?wsM)W}MG(e{%dMukLcZ ziSz$6dTEIN@%ts?@lgY8RB+X>{L@1C#@z!GQ07)zsr7L{DVR&5gsaE{)CWhxT1&Ov zlKB!sO*yt~^DEl^LVX;ke+BrfOC(`u-a)-`;5{WD#H8PGFTY$GCoe2b9s14s@Xh*g zy+3U+_JJn!OTdmg{t9pr8onhNk^#xl*agywh=UB}%+0dWf!_ieK_TjxbQR~qHA4Lp ziE;arf{@HZyXoX<;j3UtIB5qB;C2glJASM@zmccIIcp`*26Zz?@<&v8iVS48m+sPc z)63sPbg>!HGofL-LNXKp|0FSGY%R666t^CbSzN@KWGl+@$X<<2(#c<0)8siJ8^gxa zFH%9^T^g+vQ${M>|V!=Az<^GOITA+b&^O$#WuFknik-GkI@1r=lO4 z+ZD#O+`7gv;hiKn($<^3TWg_ltEQ_gPQ>%Up{9Twl%`U^InU4?kS)} znT=It07rqi;}Js)7B9BX$e~NE;XYsE=R5ypwhPr6B zhdQHP?gFC_nM?N5EIr1m)Ka+H`aBAr`!!&*yH6!KSKL~)ijEysenbuvY@#qf6vWjy z0y+KE%EP?6OyN;}bPGpxVG% zl3HAL;GGd@64d)o)Y0!i5okN4E%67ZT3}1~?{8Nn)_=7hP(%BPu~ys<=`Bbasu8DJ zaRmd=_W9O=2|*kvPo>2fjF(|t$LF{TAD{4oLpc4si7{~ZC2nSp9-(#R4^9a1pojh7+J{u-T=m67bo6#(3c!Ma#?_6Z|EL{ zcnF%mXHwk={2oztC>|>j zFj)SYkq8*c`M_nE=sU>zfNDJym{0f~qyycgh%JfYsM@=DEG7E$DV z<`M^Hdv-@sM(|Pp*b*YU9`KFQJ}ux}zCL7fgPVd1eM2_tiC_s+p_5#(YJ4_4Huw)z zsNdh3>HkTv^8c3L|Lwp{@j|Q+|83DIF$?<*z00@BBLnDG}23{>&j{bz?`Sgr- zVhI>oE7`XbaIf+N#`A%wn$$)4fmj0Ow2EcK+6XItPzYC^!VpF1AHP&EeXJ1*;y>Sa z{H|z@lKrvRkQ;awKEgT44W+sU67ni8GJ_cIv>hKT<~ue54~YfO!a23O^<#SoSzz13 zH)VhsozQX92OF<$6eb6L7fl|@5z-=)8~Ag!={}r>U)f1$L=57<`++4rxk3)0KBI&b zbG3?iKHqHrEY5?!!Q`WnB8rkGM}n^27lflAFK{TjdV~*Tk&-Qj=d*j_ck381n>R~k z!}n1XvOBZS#>0$dtcpp>MM4#Gpl3bX2F!K=J>T)Eb5l>w8g?qRPZni1w zy`4%S{}kBW4Apj0T$9f-RcH;UbM0=n9zr-mF#%zuR<R!2{!}?bW5zii0Oo-^99N<@O?Dk-f}-*-#l48)2mxx{R|Dz*6+L z?S2o1fi^=os?sc9$9(dk{8>X z*JBd|+&LC*a0d!Yb?#P6PcR#H-66`Qr3OCD^qaH9)-Z*;Owf|dXq44kt`ijv7V~v# zE1)ZEGUywq!9x2mbvZu(Vbv+v+`Q+IEkdTo@LEInw(c%A%;7FK>;_roE;x+v4z-2X z;W>MSSY=3V(^ychoH}$_Jk6V{@OPr3lg<$1tJ(-YLLYJMz6SzeH!7^Fy=;#^{4b^P zBmZWl9hLldaZ*cM?Pp_lsg3zMb`&<3L>6BAPD8i1;-9_N#v*Ni#xdXR>v9~9qKCBl zrL%$5njamzHx2vB`sPW@qY2Dv^<0yd)dHBN;>-;zU0wV~p)=cGHrz+N$b0Y7eE$@g z_|@8MZ-;pea)=5;Gi(X+nkRJ%o6PHMT3~TVlQ+jz$(@#tGFhvv8%{WRU1He$Bo*m& z&K^Cj&arM}#hx<&)E>dbZ>6B@?_0Z6rBUgjpv0`ppM}x&lP+hmGwQw8d%h>!(k2mw zlcPm>$O=SknrNL)ZiV^!LYM_-NsV*th1{=?7SR>UIxlz{CGit}c?Od(l<|9NImVVO z)o!_8?mFHgx|?bG4t{>((hC|@nZ0>ST+n|r7J|UOYp9I@-cJmr5QoNpkQnUUZmLct zXhWMfA|?tz`3L96m{KBGLSP|N6Z0LQ)e^<|XJ6rhG~1Z?31I%}Ro)X+C=B6E1xqiP zvmgomK+4`jtx}?2F$`J@(QbfP6y-UN;5?4}$rc5U5m{5*0Kv@o!;Ar97=#x`$c+UH zYqVX{6kNLzFwYTlCz8Pw6gj?2#=X>xDv*)GW`mU+t|$}UY3ew^RQhu-bPVh-IureA zG^*Aew2L?sA6JYwKROdBXY!Bv)DYN=5#bg%xD2@rybwuec@UR3G+!qnkO%k9Lm4{t z{>g1CejaL~%RE?1!^6bGj`<>t%_7-uZ`)Ev{$Y7=fGCQ}i2W404-&dhgYxANoL*lt1nZTwi$i2HCff{hUQCm8Fv3HnKkquD1y z#BO2NRCzTc(VyPk>tv=<$G%Vzqr(bvC?!%zMMlW8R z(cI)Hz@Tm81{&eO{^6hzoz=741A4vdGW~0|9~%PebwUYJR{i5RCtZO9{V?+VJO3MB zR6eKpfn$!e6DYA0EV2`h+&+9-RFfvfj8O-t!a*~-1BQw8oUS_3&mACbECe0xu9|S2 z6QX?~!@iq2*KE1Y>*`JH_$!H5ZwR+jX1Cr5m9JB*JzJ{zd$(%Uiz=DE-S-aJsONI%+W z#?=Zh8L|eyWApYK!UaS5txdcVLxzRfKbAwk6RFt(9tt#uutZfw+0l%6qAwMZABbxU zz)N9ehQP@(`jP{ufyJ=E@RTs>2qqUyl`gf*c_cwh+Vck^#)EJ_PqJXb>0O}i)UFex z0+VObfC^3CisA@tW&Lcp1(twL#K~=U80KwZSo$rCN?ko-ow*>gzRF!^6o=}i22&>o zd9oA$Ti=cxAL1+RYLuaf#yq1(4L=T_-N&YpL7mC`c1DuIBOE=Zu>?7q zcC5*rit4!;yDPWyZ_0rt1vTnkIdYS?L%Z%#C_fYhMJk z4uvt@De{yS0ejI5EX2U>7*>`<;{*o{m1R9(PSMC~ht#JjnX5*eX^z!9~Bq97@Z%Bl4wIBF4Z*xJ~=nm(ea1OKp zs&Ves_A&{IHL}o7(}5%i*wLR}OQyI^jof8htH(Vx?$JVDJlxwu?@NalmMA3LaeH9a-H_vV$mx~i z2+DJoWK#E>>DMB@#Rn!ib51B1=(6n{PUk8ctx`HbO3o5Ntx@tzRVQs=8D|k-zdFvv zm%r`+^yg`NgbX*oNLk!ubcDXhfGxGzhAq1Vsv#yXs8&q0>0j_DCH z4^(kPyKd&CL{&wdFrGpmt8NPL$?&?4cD7_C2L$DlP88JO4)D!pGSU_MBsLTntEBJ; zXL4Wg$&2zVT<(IRcoY#CuAOP|iWdrNwU$M&@H{C}c|?jGZ=J+n+W-bYaA6$orGnH? z_GT(n->7*}^aWIhfvs+~o|)>qRvHBw2;9gpaz8km)2`}W`Zv%8kiSY4N?za{^;KG}3?`KWS~kWd#ckW(;6IFK_!*a_NX z#3&_#lnPaXSuUsF)(PckpN(b&TQ#~#lV+wsJ_ktS1TtOQ>(j9Ppg|of$bZ)D4q?*y zVFGn}fZiEYSQ`}tg7z{5fFRfVy0f15WDZzR@64K0WApog`mO}{^}$5#ik%!KY$Z!^ zoxpwOM-Y-SP3(inE%Ln1w|cEn?hf$m(-Q0d4>JA{8=OF9l*GwcaONK zm+_7F+lRWu6xau3yuwh9%${QQ?N`3WHoN7ssw`O3Q2XIBf5KK$1woiDrH=}KlYok1 zqDY(Eg%T5j%S7)mqvF;x7n#tWjgfZ0qFk3t9?Y;+!fcHULDe#FAwAws+|O4*V`@@~HT+rHsKL8G+7RXqM1WhDR4{?Ih) z)dl}w&j<+<{9m2{jBFzNuV>`f6DH@>{sOEi?7|T20s_E6@A?sUC5UTP46R4N;(V_- zPx5?b-26X2p78|{bCKk9E%(qE7>!z%J*a{3&h|CMY1KIqe!TodEMabd zN1FKs@|EM%9_d?xRo>*Vg6*fUH1oA_xH5O0&UyYVD~qqjuVu91M;kUN6+zZ}1}lU; ziQr?BKaahlT?k93AcHlGhB|HhMbF6FlU7mugq|`^*tC6jHqCz*ao(B2eU#u5@TJtaVG=id|y?aRKAd=iDORMFCAqeRY5IDkmnt{~semL66Ww;Zjy zosMH%cx`S=uB@B$U=5Sd*S-3{^)hDhP6)^i(Twj@OmqI~BaZ(m;Coka(9s1h2_0v9 z{PlN+YlrJ))5W2;3t)jPNXtMCT~veu?BF-vlg4{Z<$v$b7}oywU{!nXsWurVu#)pC*KB;@V=RVA@;T*Pj^|JA_cD*lz;QkJ|t z<;r`e8J6ij^o*6f*(nQxiIr-~;BfZQOuUbXe$}E@4-P;c86hGVHG=Jp`8ONW;Fwip zO;G8Xvtws*t!1RK)Q2^si%2hEz9i|u4a#b3tlX_vn{I4gR}aI-H49lmp_!=_V^n4c zg!{uIgX+lgTiPjlFQIBR>&X1iczNtrB`I%W(XcmfgwttZ5jeB9Q!%I{RAS)3oZ$PJ zDnvZD-5OvqtH?riS}FFLh=O@U(LkI*J%~|9pUxd;n2pM1S$IJ?0X%UCUL<>=xg{Q@ z>3Eb$g^N*G+8&0^9RBXQ#t+wP_-BO0q)}Lpvn!&!oGIH7TDb7x1rqmc#zpOEwRmiF zWj3jOms5Md{ML#TW>b00&=tHP^m7(P8;aI+D;Gd-II9Jgi-&*QZDNogL@zRXGjhXy zrAO5s|JkNA4P)dWKEg&7lN!)d8Qs0mNu?V$+Nja?x}agn%DP!xX~S@03U;W*zJ3+? z_!X||?o1$ThP+nWxE-s668Ib& z(tBkLDTc6p?-uI%T^-6+=-Z<$0!!lPX)bTxrUg}|XbRqd=| zuh_4FQ(r~Kywy|H(-dS<<%@?hj(%7ps4UPDid=c{RK$|z`yySCE3KA1FMh^q@d~LO zcz%Iy?r#phydaysM_sDLT!x{nU7v{^{L9`~Len;1ACsRE>ONgC5bWL;s)hMSMHuin zcMNh#k11$r5V`U-O$t-N){n_`TuOnq|vL^_O2es)djap??jlN8~rtk@+ zcuQ>U6b<`iLNm%mQ|*N}Qg%9kpEF>AHAtdAg6WAM*)SLhGD7zL|z`vyzmjCuv0T0jC0{0^vtShWo z>()YzA+okMJ$msU&_;+iqzhN?PM-Q)de)|p?F_7ryFnY$Q6#yTwycyDL1ok)qC3P_ z%x-4=^7(S19oEH?t*ezatC`gYf4&pG8?KF;-@LjYbJ03D-1CG$f4tZ|2y`Hus1t7- z2z(_cpukviq&^DM#8XOy{;yih*j@3ZxLP+IPz6W+03F?etrbV*t`gipg_)s8ww#j| z=t477<*7FUfsT!yOv6ywUc4WR#Q=1q595Gg_n&#@eusWK$ei*lHQYk`GBpy0N7>JW z0M5efv}#_3T&;aE2`Q+by6KTn6@_9G>#fBBICXNeF|LcbaxFx8+<+(#y?TzkzouaU z!$~&GtjAtrdn}$z>uz=*VO|@uK7%x!t$hitAs1zgFE99nN0EFsI;D(fr|R;W91;($ zjvrEOrwy2cg7*NeaBi=~@lw`a8=mz5_fuxl%?;W1L#0Wys9JLQjif&P)>Zv8@<0ZF zuEMSsp6UHRZH0SxeFzC_f*>uv#vY#vmC;+6)?t<CL!7ir zPN8Aiz;&!fm_tKUZ7%_^ut$@r_3a$MnGV;`BZ3cAAa1*qWd%t(?HQwi9-T*4KOUz` ztiB`vfd9`_G!!bsyty(rhbt2gn|WJ{RwR@oJdJ*5aY;nGtBq3$`;brD%;U&tKRR2s0LJyjJCHIuo%M0-Yo;`>U(0+n*++81lj`~rq z1T+!ZC|07ul>P z#{25?Q$FZjh^!oIZmGYqlMRFc@dn%c{ysdkgv;mH7Zt}g4|c=kH5FQm$16 z84TuS)l56C=#bxJZujeiyQPzqaX_-eGRF&H4id>bTf%r`f|hGDMUQh35(A+XS;QB1 zUQmGpMZ*!X{u)fH>yje|f)ZX~19i=hF+ajQ9~|Nd0Nx&Qp@yp&_C_zDV(zLG?*jA#>@ta+~;n+T+#6M<2|3YCN80cyO4zRvJ zzD&i!Nk_c#U)j3>pw~DJ2xST96Xx3IaOLOL0Xuqz(BHKU?Bw-CqE&;H>EZED2Xlv zVcI@pKih=xvBklC^z1Y`egzx6EO$V{;sfeKCFf3v&qIU=W*~8Tvu=m$#AAlz8O=|vt1KkX53#QZ9FI)QFV?y>oDYZ6 zBq^u!5LOIl#cn}LqN$)$n>=c+ArPKyprNxhF5n%X^v;xn&|Tu!$&BN9OGQs4)pdUK zW*L-Sw`!p;{IgJyHZCgTL`blocu9a7p@EY`aLP{?tm2;M!I3Xb;I>u20$|rssLHCr zK_*mBAjzrv2et9^S_XBlAB6DLDBeAKl<%BS;W1$yN%Y_%oGKub*u;2T>mDf*kdwTW zKUp=M3$58|uuG=^#@-ZpSaBoLhWvdA2Thl@7_sEb<7xFdhIsuEk3Vl)=xF!jF2Ip| zO-iYq=VQ#Zg6fP8jKpLq02-k)741|7WkxD%Mw1hq8WYrgPSZ=ujhfb=_bBX8l?Jt8 zEOp%saOrdEPy1;GZ`yVyA{oBaT~%CMpy-tuR}A2zUm}%j>!5=z$efiN?R`%NqzC=O z$=zuUH0}mtn}&{o2FS65+|h(9`u^HHG&@uO;8i>7_VMdHU5w>7z`Gc8K?+XsExtH6 z{@Kso|4s1j73A>bcqQ_OF7$nMt^{WMcCDVG#;HZSe-K?H!?g`@RS_XEFlshKhl9a| zkzU8sluP%qa&RB^g%6t0vwV-x$1^y~tIr3s%)e&thW24jr`h$1)jjH{uCsOTkNA~? zr6VVAk_q943!pC^K!bvS?slHDT(G30iCLphLbu0J{(C2McBekLP1uKr^UC2+ODS@d z$5RKVGu-;`rois3pH$Pkb;QQc560VebIC%nQdZlYO9suapi*U}CfEIpTs|6JkJC0~ zGu)HDfwY{ror-#EuI-Ib>+O#lb;}lln-xGJ9<( z&^jwfz#QFIA(!(aFZ&!Qgk_@mDTv%03SU9^BbVGf>%u9m^nwe@BWX>_QZk%|Y3x3Y zxfue>%JC*B;r|L>4Q0`~&i@$Y^?xzyXD1n;rW3|jW#pOD|9EQi@Ryv76gA3908xo6 zh-g0%6`j;*dCHtfd{O$o1{0-3n zg^sTnIN?`;I|xjJKO+D<KMI=-(Z$q0t5% zud&fP9k0Q#;0)lHW1&-mp;=&%MbmNaVW;j>j{O7swD|a{CZ%!mwM|&B9r#UGYeOKU z^CM#&?w3aa#t)>kaXt7W#mml9p0U+#FjKk8niVDZWih#-=U` z!GSCkXMGGYaLp+VERDs-{K2Cm4qbP4-icuqc+MGLR67a}9|X z`EkUx*{-~5Kqd}SZgDr;<70p`zJ_B@5{%`%6FMNL^x$kNuJ6ndZWB--rg!M~5802{XtD4TsZ_wIkUNAPZ`YM1XI@f}?INdf<^$JQ)5^@yEL zbKCEp+0WmpyVwhN$^kbzwlgAYJj3HW?tubs-IH;}_kMD8z$}}q~$~*WVFrn)^6&Qbj zy5fxQzFBjS{PQ&p0$`i)nG&aP@fs61d;XdeH+%64s`6dP707i-&eMB|6j68jS{YY& z)-C~Db=#~uz=ii$0k*mN@-%4S+{LlKcX9Vx+#MNk_tqUiaewIm5m_Ax{fiHPKR>_) z*wYq9^kmO0xczGnzSk3TrVT%mqAA;nUIDHj6LAJS!;WEy0E<`0FhJ2k8@K;S0PJPm z!3+0S{y{wVm#BZVN5vk%?L!M_;A+|z+{ZOsBD;UnJuTo0(}~t8swb^S)3t5d7HT|ENVBd|}`57!K|>B#@APC)J86i!ce z<;q;;RZf>UbBw*jzcc>ZPfusB;b< zImd}qr@3^TDCrT{U@uv7#aCe4r>DAe83a@!iWP$DHYwcEzofFg2Dy=^&N~umawPuE z5;i(VH3PMs1p7k&st=f2hYMzhi$xrqv;JJ3b_;RleZsmTXa90!69ywG$TIWCx%y?U zuZ8jmkdPrs3`?4rSWgwlL}+7tS{4=A!vM*4iD^xugfxoM?8u{*1h2h5_-J*dzwSw$5+eA8#X)AN7Hk%K{C zH0}CVkt%hJSt?nlOcldGOuQ?0bOT-z*Glb`00dHOnP?Vln|P7GLafu4L^WVfy9A)5 zMFz?Ne9PS8od?{EMvnXfJU>cnBlTYzmZo{`)I z)>~I!ngc7k?sg-Esc+V7d?%tshp1T>$v;mEnaG*ec3?14f=d2vVf-YylrFE<0PBy$ zu{ot8aTu&D0Un|855B}-dY*ZsGYl!`;2&@{TR=z0Ot6rs>M&D%u z!nr_&AqmK3mP%IfC_AGgo+jJ6i#9tpBJUN%JI|otJVAbMTJ|_@o#ctaULX-dr|%e* zJpx(Q9vZDPVkbX8QNz>TuJW-6puR@Q&e^wj3Rc-18tK`mC|e^ZaF3F}I#LSbqag5z zqHI6iHKrf3H|=&a?$KM}G@~z&?$f0)+zli@M{E0k0Bk^$zl)8eAzk@3wR!1MR-G&w z;2|3hN1L0x9;d96q@luS1jxg6?{>)gIx%(VXaPVPS4Kt=E^Y8dBK`>T?i8nZP;7tS z4||ML>_`JX)F~cH10L%XJH>XVTqbTH8=pIGPWjyVPT3$E1>}@A1pL7$dyi>`hj+@L zJdyTL=#(Mxx>M{HPqKuY$mHf#PO-~VoiZ%R;1B8Ssv=GPnv%J*N-HN!57v-(sU>$< zNig0+)G3?ga$**FXiqfI==YEZHF$rtg8b=m#fOce_+TZ^OMbO~T+OGF6Ppqa`&v?T z-6>be)9mter~I2d!xCQi?$RmGWcB>JJS%l=%LyGbi^74kdC_y6@?3cysXU=D1`+3! z=gSM6@zm&g+t@lvO}Os;my%jFeLc_s5w5})nzD(<}6DYl9>#<+h*Kp$3% z)YHy$^pvvM)29`)hQH<%G0|peN0RzVZusYs-wZXT&S0H^$r-ls;AFpb3MTv8JNH|M zX0rc*&i&T0ndq0-iVXrr75$HYG=xk(i3XNoD@LsmeITIMN04W;^Be zat%dWoh@-DPeZ+>DN{^sBBLYI?#wmX(f-H`B^s6oYDt|8`!TeNc(+y(#W%{Ex=t5Y zga2{5b#gr^*^KFAtv8F;*mlFdx<(%{sv=ZW>LZ>w{-&ZS z4T0r^bSqEPI~s0bicBV2?8_hFl(&f&=#c2tTj!5f8p2AkrwHTTF3BJEjrgOUPLT)i zA=uo|FqmYOzB3doVg#pb6|c})IwfdI-D3!oMCS~p@$T%xsiWKvRE2i8e+cIgu-DW zh}h;#F*mX{J9Eb{Hb+SySnFR|Oq9g^5}OKdsf(55r7$+BLIS*&JpVt5vrp=zsnYDy zl`6*rNM}qp(&-``k5fF)il1+0dc~<(K+z~7zN<5E$}KFF!c=_9GAJrG1kia*B6V@4 z023KYDlnN4k#2v~B;}XSpMJxzNo((8H`pVNQ97rhVtOgLh5N-z0uJgXh)I=Y85JgU zN^NbJLPI`^-k^|efk_D+e4*y3C$yA2sDs#7!&b{0e4E_L%e*5X+YDem{%|-HW=}h! zlLg1+Z3>J`zAofh5s21%0<3#pi)$9;p0J-}74iR-!A^hirg)2Fm>P}8iEzp`mSGWT zna8wbPl{t*=ns?cA`O`{%R`@|BWyD*pM7HBdkvvMSJHjkO63m9V!jU=2n@8*DmoN@=N_xRLBDGRn1 z{nO#3)Kg8cL8BE-(w69W>X&W+`2$MRh^0Yh>AxuKR$uBgY?91T(a zNylJALyKoQt5u7oZ^e8k5UFE(C?;>?NxD+QA(o6T9+l-t^*c2Up@=`rk>zm8UGib4 zd_+EKmybE+<1(5?vj)dgB?^hl=A>v++0m2-Hh4XBhFO#hk9e5%p4yN=~X^ib=)A#ly+3bUI0RD?K{hGcY8pF<=BVMV8u5VUwG0X=cLq zSX1~=OSQs$N|}}im~$giEs_{Fur$HpIwsL?O<@HbaWdjpBuvJX?rh@F;uHlnWnO4H zSO&1SX^GZTlibP69D%s@<2124)7Vf_cb|U{P&&`=i_k8}^?GQ6h{x>pIvgJBuPW5+ znG#t>n5SyFm*a&}w znj>U{rv3VBCwlyJPWZ!#@r}M7SVxPtdSlEARvp*8GQZRCFof5Fj z6lX`aW#%bfPdrUwAZ9u2vcoBN%O^>(BK}~l6`*-NcKMW3KFt?O<xmxoYwdDfiVh zx;m12Ibhts_-j*f*j}Hd(BBxG4uK}ArAhjvUZi#I&ojpE4>swkK{|9@6l@B#PzIba}`#chf`bQ(Rvgs4XIi z7V*8ZQ$8mbQm~eK$H|UU^VBzS-8=PF!DC%YQXnNZi!HQ>8ISE3-#EqF90Cp*UF4%P zw6>w8FohpJBlYvd?>F^$jF*3+7Nc1MY%@cVs6m6JOgxy4(pZ!`dK%>*_ot)F!>~ z^G^8!Um(8dlrM2y)X&UzE%ROFGtbqjzDS^k<|y&ivY{OShYmd!o<)RH+|O5v_wnW8 zyW%}MbW9$E{f3X^81rS$;_TK|n3ZEkji;5AXAEDj4jJ^UbB4@^$Xa_4rJ$-xT-y5t8*D@j6lL=yJv5VBcgc;kC=XPWgs>lT3X-ETZNu z`L z#1ozJU-Erg#28FGn&gxrdAw78z-Rw(lO^2ODOo1R?Dy4j5@fDP$~3#VW?2ixj)Ofb z{1lGXHIq~EaHhnEm!V@RtYcAT8o>Bv>c9Ew@IyApoCS&av)+F)1G|R_X4~7#sn|hX zQlz+T8fI7hry8a>rX6`NKPkhHbA7Xe?DEGbh=t(jL%AH>ljwE`{h2)4kHbW zY@jlh=g>c0qequF4=a^T^U6W$*wy!Ux)=UPe$1ZY6D~ewOGu%cN&JjOkk#p0ypv|m zsXm2{GBT>+L=i;}#&g}!bgx;nJEPMC8T|UU(AUuHH#RYqAc=Q7O6`p|YwNMl zK|%L4|59Ib13Rev)Yq%7Z_ze#6Lew=DEt#DQr|}=@~nSpc$VmOb$ysJ-W5YZ|NKCs ze-=Np+DMsw4UsNyd8V``@eKnoot8K{{ve-8%qSxV z;0x9e=Zd@EW}4Cb!+`w7QPwc|% z_@=vO=dgbRzlS8YI`J=TuA9NMO0W11Q{&)HFO+FsC!3>zhLX|{MN3A&$kU{QlMJIF zh8A+37yDI`hqD9 zb(|H|lhZw{+r1xPGG+q*j)1a;uBxBllgWqdI%CV$aQ>-AT;|>UuELSbS1n^s_xq6p znQu40H(8W_fOQY}`;jg?Ont^PSf3fF3(}6~n!!$n5m?MMe?>!K{oJsBX<#LBB1G;r z^`d{hZ|W~1I^A3owK;Y1%iM(ghU9nq=f7*D@aV&X^q zg`dqhjQe&=29D$tL)T+C;ba`iw+2&9XHtJ)NE#mSH`J#81xNayVHm#+h%5?lNRjsE zD94-hl=~wQQYZRI-ue@FyWVmUN37_O1X4pDCF+kyPW|({{({81=r@1Ml5J3uxaBlg zt)y;4+xn-~9Zxc@KRbV8nL{v?WB?bP_$(*={LUO_ab93q{fxWD9QQ*)gbN+xJh z8Dd4wOAto~d@xB{ZW=KER*1hEh`rjZ+q|?Lw3{G# z{ppm?7%m_)xf`-MEkcP>G`+{_6p$p0yhpt+Qcf=3nlNJW*4#3;%neW2&pvB z@wibxVbvW*?WERj@g&jx6n)(f3hY$ZjEn(l4G-z%a&jxo)&|s%QzP?Kp3+W^fy~L- z25Ov^r{$b^8)W8bJq6T`)3$?Fm8Z3X&1)+h;I_rUz76ykWXx{`-K&4Kf;?A>0p`3L z{@7f&8OT4tY?uQMTKs8RbR1++c_L)MNstXosMiNWp&CX)4IB!7m<&q^zn(?};8-{X z<`bR|8fXL0h-U$L1KRaOz6(I^Eog_#0@Vi20@(&x1;o2-ZuQ_Ihd+CA;o>5fi(cH3 z$F1Hx>>zIS;lj;DUoL<86^v|y{ssNpU_e1p8w@Nc+6ses@@?RG7zVe&kb>=Sa8)}D zbq$NbAq88ZKUJ>bW_v&k@?$Wf9YlfJ0R>fZJB+L%Dhn&ypeO+5)%MkPR_88n7K zhbBN{8FUzd#?izBx5D@i7;d#(6Jl`q8tAhfyhO=FuVT1c#o&L4HW(kr78B#xlVUJ= zohVHG9H*==nMcEiVu9@4Q%Wn=Ltp|7hlx-KM^Misf*wm> zm2edKm+7zwj)CLI<5baC6P2fu&k2)1io!Bj3C*wyZh$l49#{j9z`O9O7z!VYW&vWk z$Pg<;o@f!pVwE^ToGxaGzlln5hNux|ie=&~5f*=E6XYCmzBpH0CeEW{y=I-xV+7`{E`1SiFp1h*$7Ou~&k4 zL-v0bZ%em$M-CG2%3kEDM%*eDfb@w3f=%^fhv!WwBJG0;LGz3SX& zdF9#rjabezuZYhaUv?z{Mw&o_n3k%M?Xar6Fb1bR45wGHB6k>0xo-y@A+Em>QW0B5 z49UpY+Qf0x_o9=k&MAvMXs}Ba88lyT-SLqIKRksf$PE;TvS9}_~L&8 z*Cjk42A3ANE@N&`b9I|BU%%aS$hj^jU@K%4xUMkqu3SS0o?>>ot}?iHwF$q5T$bxv zv;7ZqtJkfC{36%&F<3($OzVJtZq2ne1~;rBU*x)x2NN1ibzLhAE>E!HCSn8adtHJX zbixy2k2Q3>y4D*@vhcPrg&p8Am%4v>Em^v2gVCFc;z)P}3*ikcf{(EnzQhvv4oATsI94b;OgPBV zxNyAaixb2k^on8RbVlGLQG%1jcsxo>#wlV3mWpybTFl28q6%kFLw zPR%$+oQZSA1$ZnuuX*IGD#?FIEh6W1oOl$g#1pt!Jc}ogGdfZ1#goJvxI}zL&g?6! z7C&H(_!Vo#Z@3I4HsB%Hh|@4goCsqrMhLPTPsJ7VZzZ0IEqDR0!b|aVybAw@{~*Xs z_;kCXb5#pS!6=+^p71P;cJGT8f(EB+p{&$}u-bj_m2UBYVbRfl2+d#;k*r zNd`YBZ(;qA>1-0@sTcu`zhbtK8}Vcv+;#gO+*47&Cvmumds*cdA>A_?fU@ zZG~)#I$W<=b|?&yMbH@!Bu&Gl9c-sbE^_u9<$%@xSt z-(eEyKs%@v?o5P@eN2U+?st>j7n|Mh8N>dSgon4o`xN(Bd+tssA5;{${%!i94+~uT zxV05NS_30o9~*xWsF88B8G6%aH#7E=Hck)r7{U79UB+4ku1|TxcvpFW>oXn@=kw>L z^!_iwXV(`MCa1n+zS5fiiNRMU~ImK^McqhE7pP{MWR=K`whwpc#*Z{S1)=&!8 zNyc4O>IYM$%us)Pg03G;CiF`L`-z^P%$~l<9^;72No;@rzioyTOg;HIMNc@`G!%uB zKFS(c)MQJ)SoTHB4@fNXtGS3fb&-T>{bua{adHs9uZ11v?0@iykjgCq#u5d&LZqsi zz=V17{OyACFN1PYuX)^ZePSednYluFRVz$pSgz3GKpO)`m_U0Rs57vaG5Ws-OwSb= zBtJ@6V#0s1mT@!Vy27I3#`n882xkJFai|s(S%wU0109tA8vDqO@1sY`K3Is2e_hHV zCn04+EV-hmF`2o(D`ov$lQ6^3J49dW++8Dbaz(FlOFD&}q63moYDccfO9$+o4tP*H zU>^&3pNNN&xuUOWB@B;=ekNb~SLBKTY$H@{gnoZTg{JU}Vqzc-%@ui2Af z;oHUFs-ku=g!RNg6$kTvhZ?xU4BSG-J!B&c-7bbRZhjJX1mhMMxFeZ@Tv2Gm4~s1I z-VB)#7X8FPa0tIRRYa+NQM@kRr1~e!qS(Pfsl_X}2ln94GFSGdH0o*juB0?e<*O-b z8hwB7P#>s$;LuRZ(417y*QzytJQksmZB(uWg*So?*FhHE47s=g2I4JnFy0D9csm@5 z8(|8z!c4pqD)66h0^SYPcn>t<76{{3I0xI{GK|4>*bW=;LAVXK!yWh##Bc|6;7<4+ zcL@z25&iISF%X{+hhv9026u}&l-Ml9rzn5!c!uJR=PBlRK}7LIaXBSBSK({4v%M5^ zyh#btdz1wIOWcnih#mNE(SaXQBJ`1Xof4rp@e}a@ek%6iXB2yUF22Jri8EiJ!mo)x z-(U`Yi!S^Q^Y8~8gg@di{0WQjzc?9xrg-ERoQ=QYLi`O+z~8Y}3cN%jMGz9Nl?s1v zkT$$U+Hs@Qag)rzEz*J8D9YF=v+zmT1D}&Q_zFcEdt@HIBYRU~+n1y;KuS4KI^`ge zhlf(#!SpqR%0uX1z8oP7WRWbCW;t12E{~LV$|PWDNp!Y+MV6CXE9Cofj{HK-liz>IN|h}asy=d&8Z3`f`SK(+S}svud9s=!eQKJl zR^_rr&6Txkfvi`j$YttO*`T7bQT<&8)rGQ2T`R-tCfTh1DVMAJ{UTRuD6h~m$DQN zUYjg8X!GUm+G4p;tCn|YetD-Bly_;T$-A{P~iXzTC4_X77 z++>~dyTK7ZD;EvkBVM-#&!#>W zVjrBuch@7^#i14Cp2tpV1zQDf>c5G^j*tVni5u#^d{?3J0M$W|sro>Uazn1_3%yl; znt88y!<<>(N=ZT{xx@8xGKGxlfB_sGaS3r9X63C03PoHMUz~wZ)Y$uFuV!Bti zrZFbS6~@i5-erHKTrnegFJK`id$)?23^PJ1`Y4NuW4wBjx>@FoVs?T+H-$arF_^p- z`f{^^@4lgjnw((Q;c<)`p_rR(onW&X9o(A0&GwHBV&DWgwAVdZ`l5(~Wy zneWYTXXJ_n2C@0vTu99uU;sB4@g=<@&v64}yEF0}=52qxVtR=;hp&a6+&qrsygx3b zm1$15Tk%ac1%4DoI?uIaG7exv($1tSGC|(>NLDojlgy44BF|N;w^vEU~MgAurAthizpWra-0%gjVx`O zs4DLw+v6>fE$(vdHE^pqp@Wj`1mcPDAXJ=?@(4tqCmCA2BsCpoqzbFIgDk{qwu_U; zsaCP7=b$UN4i|QaAgP>>1{IQ{i-~Ibs^PDgsP*ct;%K-20EKt(uvp6avrW|TQw(cU zrrUqPmD5ehK)s>VJ>AZD)7C1S{1vdi;CDtl#Zb5mx3i)ZzF@#I1CU+dcAA92>kMr$ zpboc_li(*9(%1=)rn}ee$Q8ku2zj&QI12u+b7$pckKs3%T+zh3oRgPxBjoXCAn{4# z8W?hFUQSGe6R_jlJ@Rr)ji>SCCu!E6?w)@;we{TVb@!BX(xJKyO58n_)f`&DZG-4M zWz6E*E|yj?Zo7!k_Oj2-7J1q3EIJVDn1xXRYk!Xw85ejR&^ynzj*jwN(abJHtH`q% zFJwK|z`a!U>VQ0|^41yIOD`5<-Z({L^OL%;+`OzXwSXVh^5d#=;&!p3swj{AteEC@`iy!*o^S#OB0(O95@= z%=q1km479jnv;6@ZaO(YSa-KO6E532DDU*j1-k8&z;f5b32mg z=PTdATCbwAXi*suJ6_<`Q1#hNEY;jUX*D0<@54oO1utJ zGu5obW$zwnCI@vEY4q8k)HxK{-!j0;BxLK{CSaU7hqi%pUwH|h=o8f7-0bWwKz+QDLyr*u5@6|?f*LMi1 z?i4n)N%T~Ai(cv;agf?9hNvx~K;0*b6m3|wi6dyUN2+b&81;adrydjw)DE#k?G%2s zOEjp5#d7tCI88k&&Qp(xi`9SQ;xe^ctWi&jb?PaxK|Lcjsb@u-dQLo~o)^2+i{dr) zvUpFuB0f~FijUPE@vVAY{GfKCQ0p;My^TH8JLp#LqDQ@l2djVKaP=V;t9^Kc`Ut0} zk8y_j6lbZ=ut|M^r>if??f(ZaP+#F{^);?l-{8&aTYOsmfG?>Zaj$>+3Exyd@O z{9OHtzo_3Ns^4XX`a@=FQs!w&4%9R`Thpaq%ao^5s&bl^Ew9sZC;mi4O53{!_`bJU(M1+sDM_WnzWHB zq7{*3-xlv!5$S5M(?Nd(Fi%u$7nf25)h;fpASbZ8YP-0+iel3%dL9Ms;>vb$RhuX) zAi&jaVrDBG>{Ur!yM}d*1aoad*Tm+c%|w8LSpb_CJ(u6WO)?MjN3nYJ?ZkY3Jy$+d{RXQ7nyTVa1#p`^I`A6L$|s9hi^Fp})Hp&mN zr@;aRBfw?%vtadW_8)*rl+!tSe@)-b);z$DTf5zD=ybF)=@E8x{ zI!X*DbUe=R2^~)|oaEst9-fZlnFQwItd5T}{Dh8Y8Gcg7rx-rRM4yi1`2-f?g*g5; zfyMYcM!u-yGjV)2fo1rdj=yL4c^zNS@kJe9((w;E{!z!5b-bkGD>}Za<7+zpNyp1N zzOLh+b$mm|zv%d;e~y3E@hu&%==e7s-`4T(I=-XhKXiPTZ~0yvuO_e=XXE(K1h(Qe zM*bHM-;d)53AFIe4-;s`k9hH89)6;RIR0D5PZQXS7nuBKI)2XZ7drlj;V*gTf8+SS z1g^vDGtPz#ew9GCKwJo2L=xx`QC`R5LMCvd(1?qO^Gu(4f3v7cAd9nXsvqkjK~T)m zg%QHJ3i5Cf5A%4K&%?zDkrWG<<0T}Vs8%ywEY!s!o-R&^6rR(?5?(9~X}5}Hd~~^5 z#>J(&SfLA37b|tKN*9;u;_?LEBCgQIYKCicQ4<%naZwi+YXzc%UcW%H{kS!3HRUa* zzbWk(a!&tde}UM5>-hwH`y_)Qw?II&3C#5iMbEeL`BuB&djczO2#$MprdY`NqfHsY zH}Ph!FPE`=o0u8HIeUco9_2k^bA&EcY>xT^Iq#@vdtT0U1S0MUfr|rv)`;JLjj!SsYdWrPS{Gnp zIaxCskYrrPu`@*D24sgjTZvg=*e)2jpLuOee>D8=zeK{ohj6Qb+j#gh{JFrwnU>j6 z?CWEP%;783>PpiP4Wf~PxS1zSln`bo$#~cP=9CA2f*c!up=_nb+Hggos ze?CQ>>GmZOX80p1=|sx%Ov_aHW@jsm*GPNUw>jn>+p!B)UYWYrCauj`_*WQ!Jkvxz z9i@mNPU?ViOP~%hHEEG8Dh{q=lSGO`pPSFSTm_nmWUJX=_ArBjO>yt}iiv9;rtDV4 z6=_2i>fTa^f6w3p1(QuGI0 zPFZDwf}L^uo!lup+dCR)*=_flI|}Xy-NZchkpsw(VBU9DZ_P{BQ^5G|cMiB~6y#dZief3N_d znghz4m6=kP&2f~H|Le@Yf;%|nui(TQkA>?X;W}Nq#vabOMUV0_u;&a5)ePsXvbx@g zU1+M%wU!dGm?x{S-S&}yZm)0UoWM>h0<58-ysh#y;|>l{ZJrrAl~-B)blCG7l@q4D znGS_Mhc@flo^sBh%?>2 zL{V4{b~5##>&yu2j_H`L2$fnTCw)sfOFxkjBwv2e)U$-cggs~CeN`$ z+_~Na#lBpV(^F+-Ut6ELiVC>r*0U~7Xrg?cJVzV`tYK9kGWi_YcvX+>tujZLY>FG# z0=vM*3B$_rPIv*A0h>4$f7JJYt6HE#D1T+dlGTDJ=k6h_L(H%;duqrN`~eC+Q&Sli z=4-~HWVU);5|(Za0(z9xVppnIY-IO!^n_-$@*Zi-DL^bjv4_gBX0B1v9xCJyI~jJ@ z)=}GA!&;nUT%~dFQLK=YG|5w2lbz1nrgBA}rAk#Ap`I9SVyCjre{3SAnoYT627OPt zVw_|2Q1nLnLcW(jWDC#hpY{~o;t=&r=WXy;>uLjc;~oR|;-1Qn;6cmb7H+{5VoxEL zZMR5vpHFQx#3u0uLtG=8D?gG!4@e)s1N#m96;4wZ)~cF81Mlb6eD%$!h<*ci;x7qtz*?*J3nl*XP97{A-0Q_O0~=FChzVr za2NjC5UpY-wQ$o4xP`1;2<{e;ofKFDtmQ6RP}k)Tutt?qK=}*TF3wruQ>Z#p%qv)ZwWV)xA)5U?eGi;kHm>%do zP8CmJ`K&Ezdyb;j;chBg!;Ps%L1sJD!`9E%?Vg7US}|%>m)5lXhF#rv%eu|lMIYuC zxc%J5Z1WLDe_vMf+w||Ne=A{0kj7aEkDUJyQHi8D%bK<}hE-HQ%F(j4Lev09pDC-K zG-b-Dl_m4lRnWB3XO}*V-1^Ukq{yWsGu^T30&j>iMeuH^QNk^p?cu{4i)PzUJ8{w{ zNTy_^;ob0kvUt{m>f{_cxhtFVg9lQqM!9LrEcCyFe*t1t-szD!ml`1on1Y>6Q>Vvz z)mA?L25pC*D*T8n*q)+TR5KfaGL1LjjtDHd@I#E8O0Tfsi8b>H79`E)z)oH2wXLfN z=;dO0>2D56Nh&;kE$3*mc1Nbe~H>BXoZJsK6fBZO4R6?}gP?+hVT zPzC7&qTszDr00=>9}M~5AHokQ7^D9gjFD6yR(nx}IaW6TQ76U`sf&&y%0sL!DaWDJ zCFA4J>ylODNYt$z$DF!l<1p$Pm~;|zdnRyEe{x<4^XneN90JLUgSk;cGP!`}C0sI& z>W_gRY#*U_eUGN0S`D26-Gu z96gCRs({GjlUUe87gbMSQ3pw~xTiigfz&vbB$sv)KJrZLUM!i!GA4>d*H2)1b1W50 ze_mR`iq5sqV^JvlS{B+21Z|(vXypYoTEz$+8p@O8W#yUTbU6=KOl_{7nyulXW@=f> zL*3L;ovoi*D(;O_%O)PKoLa8qVLcC5P2o21a5WDbr*NBicmogDlpWDLiOr=6=6EVTiJqS1k=XqC6S$#--=lkPUTFQi*U`UUmzlddWn4*7#qW&bd$Wz!ZZ$_7Vv)Cvf z5ZmNO#dY#Qk&zFJynIBQl4r#&fAUdrt1O8-<%IaKd|ZsnC&klpQhZuIB|axVE?$zK z5U3f!C6NoQ~ee}U*}tYAa1 z*-I$!MzXU6PZgChOz>WEX$gLG>lk(}iyga`G3BHyQj{*|EE^8OwSY`D;D8|(*@balK>?ZMU=EymN%Y&HxgVR*Oh$uEjMNL&X<(fB* zVF}T`nPck==2h-Ym#$tce1man2wejl6U56EdhB&Yp|O4d){ z%AevC;odHPj@#rfaJ&2^?vbzK0S$Oe6L?CC;#p0@XEYrzX$icn&BeF0c`7U(4vm~6 z6VD;cYssbU`qOwzPc-?~bWbe#hv^=f{G)V_mi*&%Pds@`x+AD}fA>Kr%C(OK1&<8Y z9E)B%hL42ytzWKc#@hnpHYZZCRD#U(_KmVy-i^0XZTypJ$?G^xR|QkOI(`@CRO@#^ z8^evfNL1?^X}*$iiRw7dtE=PH`hDe9oC&J6YI#5EQ?Y7UO{w&b=Bmna`%W5CRpmOx zh4+@ISYA(_>|XoGf0Vh8V+o)o5!Du8rB;nPZ6O-8MQGAeXx2<@(^lcIb~%n|SHRX* zV@O+ro3$FeO{>K_v^u;;TZ`MZdYsl8aIe;gF|7#?Y3p!Sy9!Te8}OWVHJRMRtJ*bm zBi|dr$9@e^O9u$gY^t?L4gdfo8UO%LO9KQH00;mG0AiMOvnTSdD+6MdbeGs20V011 zeALzP_{_Xb_M7D!l5Ds_AS@^lHVGi&6%GvvM=*p)0vPaMNxn%ImfduB!)3ki6K@S( z)oP=H)`Ki63ZCFm@3vZxYSp$LReO21)!)qfe)mWS?ff>2<}Zc{?5R+JTM5~mi{{izAK&I zOXoc|zV89Az4{Ms{J;Z4@k8l+%s5vdpCdn%L9iB z=1}~%H2;yYAKdt(2aeRc5bzR0o=wCjB_)l^O<5i|+MbZj>&PvQ;ieo9)Zi;_@_1k# z4U*3H+z`3R^uR*Ol?8)kZk}|R;vgcy<>$a9R3KfiG=)r^hR9ZW)1k}_4U@0o(u{CZ zk()+(U?sj{P%%RqB}7KcSBZbj7~>|NL1W!C&Y*(~I#@=>%jg6*O_WZl2ZA&yhx}A# zP`QUHXtHcM#h|Gk=Hw7*rpc~{I_xkLZkq0a^>mmA$I;;i9U+|(Hy!DLQ|K^*juKcR zR7Mz7Y0wN=G}Bo=h-NtlDW=)1Q)yguv_Z!hRAtZ{H&x4)H3rQUIM08e`67`82Gt5& zD9B?Cs*}zlY3c>D*q{c1$4Rq9nnr_~m=Ap0prr;alkJwvPRGkvvotG2l`9Q8!Jrd` zk!ERD7<7_|~# zr~V==O;#dxkU=voh5N7sv}x((WD&7Pr@*@mx?A8jgSHF2N1A&L`lW$a%IAFsUM}!{gB}o)4@zf; zfm;mfHSh}QB@EhW&_f12Y|tYzXO}^b8uXZfSIO{hgZ3DBwR}Eq&=Ufml;$aEo;L70 zS@MjV_A(Sx*=K*?H3nWQqt63@+*U0bkj?sp_dJMMMV56 zM=xo{(W?f%CX-(Guw!wEETi8@^IL=7uyx4R^`@B6@3b+w=`9ad(c2Os-jRTjt7ApF zanrjVT!0@sn50n|^m~Ke>$kNG^ZxJ4j6cXm9|(qR`9ps@?S?K2Qmv~4w0 zs$0^wx*-~gM;MjEsHTpn6=+59W~{MsJi%BWZgJ@6+v9-^@hKX^qb845N5XO5*oqc(LC4P9u2mx4zweTNY9whxH*CLy1=GL zSDYseTHO_oN5ZlsgpgY|C*9@Iyp~8f+!znUyJB^L)iNW4bB*Cixq+^DhZT+oTLSS2 zvp%SNX+h|dYet0SRE)W+q;A}wpJ_`E<1i)<5ut0NL)TXl6tqGGbOJcF$zW<}RqQ5$E* zIwBjyP+0#gCo|I4W<{4+AzRd58C~4g7Gf)^u?>iktrpK=i?OV*!%z}goyjG;fJWNg zCDu>6tXQ0}p4MP2usUQlHrBDA=g)0oMOA+u^cE#dV zp^z906Je(EG-_!yi4r!g)m`n*a1OJS^!%iU>FyL8%i7GI84L&Gv-wD+la{f}t0RA{ ztkJwW7F~VUy46;+Ne;~e5+YdDr31tVy->(7xh^d>nV9K>fzFO#OH5Bx(JrPll#krP z=2jnxt_y^8OlgU*zj@|vY_XE&KTO<_ZL=!eT9x)HOCNhvUkr24k!^@$7P5#**w)CK zl@82vu1rrkFDpKSXWKtz)`-?flD~giK4UNtVnYz}Vun_HZnz~PrXSM^j#qcZo2-p- zF+wZ8q_1BvgDo9a%i8_WgJbbPG(B55W1G$B50;qP5D;&UThW+y=nMqH!~u@DV$wkF zn=dPC!|{y8!vs|8f6*^L}p>RwpurW1OAdNF^+~Q6voY9qSr0dYAPCK zq>DXQf+y>X{c%~)+F(T|3xj_q-i)`HeD|(2@dRASj+q)a@kBhy#M^nC{v?wglIBLd ziHY>RH2FqtlGwSdzFO$rYhnxXzS-4$R;ELLrjJdukmG57|KM)oDfm-9SLSWPH0To( zyKp`4)b}PaaRW*qOSy)L5tI#zSoY4n{cy#}1SJC48NXt4#X0NaR1PRQf?I;YV&1NQ1)DW76Cy zjE&J0!yLiuBTINAt0^LPNXoU6Ld$T$IbCu&A{$oHUeLly`s{GP?RF$ zgy;+s<^4#sM7lz)%wpWq>>-;#NAe0GxLvr-qN zZ?)AD=!#iB`%d=-V?K$ZojNq;CGV=u+?_mmvWfTbQB8^ zSb>vGH9{0vBuk5z#*(KTV8KY4S1ipak>mKeax=*MWH?MO;+xkB%d(iMM$1u4q!}a2 zhB>y&EOJ&FjBoPAH+5Qk&=K_!Uq;d{dxkBmRbu*t1}n<>*gDyaujp_qM@XM+*mu6E zd~6E%OT2&2RAaSl)i_ffqz-1A-+#8REx>mKQ}<_3m#FH~>1#zSzA0q&TZ2%NWWOJ= z7-tmhW+tvf=3~5?kQt$zBF3=u3^A$Pbg<&=nFHMdE41DcYNFtYrYcpFOy$RW*@9A2 zYr~w&#AHI5smfJ_sV0jyrbshY1bm1nG2h7$Y`=eJW6VIsf}1tURMSNJ%D0g}50&Wm zfUKV`o_d%%+*C&h%_G%OrmB>I8RC8k5$R6p&Q!BZHCr9+R>zpCN@cOV*4SCOspg1z zSBs}oeZ*8XGJme{Rg}7xd@MPiQ{?!9Vp{X$pd%X{RH}@z{m5!%2XHM|+}LE|!}y4) z=Bs}NZdGflg|ai4>R834z$lsE>r7@-I%dT>trndYNC3SzsgbUDFf^q`r>kQtJX}X; zQ(DMFK06)v=`>LM)u$uzBHq4X@scLDsyEeQ)nMZJBE4K*);M>`vbjrS5aG~zE668{ z`lQSIM}2)Jq_8DoFw(mvOxu&VS;J3f)QXkYY_WG8 zreJ6HuCTkSawwNaq2R4xx+Ed*_XO z@4TbWeETc+&UMbYcF$(#o_o&j)wi9WBtI6gCXfVqZtE^7s=-_A*+E()%VG8At zV|bUooNJ*iyVqw~*nMiMOI>wc8VR!L2VN7e5mr_uWsB^XFiS1lx9V$5Gp)HVq^+xEr zt^1z8mAnb0V>EP8#b5#_P7t7*Fo){J|1Nys{jFC0do49HK3melP_1^Y)9Aa}8}_an zY*JjCL+L@zARdQUL813^Ns)Ina+T^&rE{H2Z8FO%oAexCEcYZ}X$f15!^dAC7w{w&CXP5FJfVRL% zf2>WUG`dL3Zpe##sja-(wDqC}<*2AAl^kGAWZS|P-7|hq-8Us$`iRBVv?jGxfNa!~ z_GDcbrc-1ST8O9{3*n8o!NbJuJm$7-UpjVNlNlg7HXM*Sh*upgn8XxcWev$<3+>j?|NmqKeR^o?qIy`>;zTQ1tT^W8vf9 zr@oE1saphBq$y^9*V$Jtb4}i>hA#8d z;O=|iEQ}?{Eu`~P!7t1ns_d2(Ar!xe=~m6%yeQjyJBH^!a^uH83R`pROtzKj+F6)7 zD!mOP8NutJy=#|!d1@9N@28#_Z*P=_=)gA$n5iur$TV_aRXM#GWbwAD<~$A>gS;W- zcP%r|MqIS>6FkE2)Fg?`D2lq#O0a~C@YxQ@RHu`$i=wrzeTg}V0P01B+(}yDH@~D? z!zQP)ntFWm*6v3n3aLzqZbj$)%2G@BpKPRRd%QtVzNlO#XcOH<_x|AZQGRz87(0$h zmoBV1PfhJx)x14&IX&#POgDL#^*Rcxul5y;}b2DHH4l<6GeNxr5=w#(v5;Rg`CGKuNNJ)PrnV<$M z82P*_5m-bUNk|6tpZD zZ;n34y~Z%QDCC(FK!wkU6on(rja$LSC3DxNKF)DX70%(_vPd=BhlOC%b1NjEv{meY z3wE3g))}xe@5Pw5*+iV`Mklew4l-SfG@EZyz2%uC_@zAn19dGyVB^W^y94x~TZ|yn zUroPK_eY_nlc)frTb@B7;ye01TeoGrmX;1|rc&?-j5*}eP}~`_--s9W8ZtI8Zk~MA zL9)(JGGhpf3mgyqnH06b?}%-08>}Wa?t`)w6!*>&k6S(V?@o;4RrOD~j1;P*MD#RH z1A|2Stt_@$*dWYg!Os%OEU=I?H}6>C)IRSUcHZYisIS}7*I6#fG^aJ^W(k9m827QD@#K{WI@&M{92ZU6mR*Z1C6>7#L7 z$vdXjC=ZY}C)~yGnuBJWL#jq~+EOXS4xB17u&*#tOaDP`%M*k|Z%BCtZGS*E0!)B~ z>4R2wdx^0^H8;V55$43kczUhbgQS?|zNu4jW1vTC{1(8%qg8l|#JHz!I-n6DbO#!q z1L;$&qIDEKd>PBGXLesC)Mlm`l-Tk#ae^2X3b`aa^LT`pvmPkVAl{%Z$uy14#LilgNOi;WEoGv5u8j14Jp=)+n&d zM6=bX*F^gZ@v<;qwtLGN0YA^mKlubB;FU_^6b3JQfswGVdoCgcNRa|Q4ViP7qH7x{ zPPp?KLZ-7t0ev;fMa1fthcu-Y-Xq_ySnOsvp$xK!HrW(+V36nud$&O&yL~*<{sW zqO@6SU@EUJc%zTK`%B?Z4}j7|Lg6HA@I4Mh{!Iuo-UcV|LacAqIkG#1iy0NrUMknB zqF-b#SYhkQLO?hqb|4sVZ_R9C&l#d!zB+p&2rGg+Qi#;94Qkk=gAi>jCc4t~TACRG zCNqfqh&o$+5qPIMAlO&a8vGA$;3!{${#Pbz9x*NZTVh(CfqIfe4O`USv!j*K7<0THJ$(v+{d3+c0axS+1zzI9hu;{N&V zNe1=JfO!cb^HX>!J(j`VU-FGkl@gx}`)ekca`VL8E#l_B&RwkL);xqhN&ylQBTl9? zX980SJh=<|wK0;wlnQ+wGV5)P*Z(QX>9vE8%_KIJg}zzD(=mpOJCh2*f^UY`Z?i}^ zE$#P~%+Ajmgn(Ht5TL%chd~Hb-xHkI`w~WWc4vfB@eyYXkdDb*eXy~Q>1=^cwf7+q*A`Eqg89*%+8%RR9BT@|f zoIGr|b(yB%K}=pXmUO8@sh0CxGnHdAPTW)VN_{MMm>dSiYzoUY#4q1

j_esv&Np zYb-V6o99Ul6a^dK9izDqRvbi*J_EdGCv9@MXv8p}!;K#S@tM^vF6LiPiN|L**C_(4 zXr`=#poC+V8>r-U{)5$aUv(GJbW80M&dlL5#NI(1gXHZ_crJfy5<;jy@Uy4T$lU!> zih?=U!T<*`R+cux!HCXJ90JdjifurS@D<7ETh(uGRT6z^%ia=(?vvLrQ>2VvXf#p6 zh+>*`#A3>)2x}N)+I3;kf>ZHh9mkH);<+_<$!Z&fJIb3OL>v@}n4w+B;_GJ_4nExd zVUgM;6~VMkI2DPSU)$G$kzRK2J?J}TsUKC&)cvFp9xlZzK6Wh$9<~<2er7Y#J z7%dvaqAV#Qy6;5r49u(68|P9k#S%Z#>cgO%kQZ;xD32$J!c50jr-moHhn3q!-f3IT zXp`^zr{K4=u0BUl+F(-skw6zBP^PLly~Esd#2ux;0&z-XeBy0G{ov77>v|v;zy>)1-^&+`GEEV>@{#Hy_7L*u3QT%~9#^3PAVsFH+O9&LbsBIJPLH zm~8Toc;exboS5pH>{ z)JKZnnk2U7#cDb26qBwJ>0Lk_^Lwp=}l5O|a<#U2ovuu2#$O5znIVa>IS?JAI&%VuDZ?l({d^If5`FW?R zOECf@y@v*@alYYu!s#A)YhN4~lqBVgLT+ zkDPXfA(`V*yQ)kp-`?VuXw>q~@%hZ*`H6V*`cEJo-!XZE#Cxb0Yc97|wR%-YMJ%C&6H4u9w3Ve1cFUG^S7Ma6I)2fA!ZQ*G&p z(mxAPN#;14DG>~rMTEphZf%MBZC2xxqd58)8xQLO!b;4Y{nDj5ftNpnQM-qz9m$hZ z(8a}lRI(4pXiD&F!$F=+^^Y~1jBi-TxAhYwMUB2pA5_oH1{llGo)FSLBf|{+pb$bc zwGHbfc89V=phk%%jHdbJp8} z5{=t83XPT|)evANQAJxpS?c*_k-%!E^eM0gdHiI77raFV-y-ocw&AuCbGehWZSS{- zrUnwFa@^fVoGgdrFe&AZ9?yCo?DhkO66|&tevDq$1A29v@6IHKz}Dw?B6FxR;?!TQ zx>9OC^{A9X5`+UjT_XraO1tk2*+OD zgnW8I?ke#ZyO~K>n{6ItfL={FGc^0Fo80@kgRF92Bhk&M= zP%DlphYvqL4n)gK#i$K-{Rq=={ zM+!!yA(OK*#)%`=jqAtqCh}cZlL{IUhB5t%?|5gMdxHF7hgmm{)(@bC+DEGoyQfPU;FtDrvHH!66F1q2o<%vCBkbGwyV1=ub(JcP?u=dBkgUX)NOl8Uz{M1 zDzp7g%{rj@YSD{$4Nc~u-hF1r(7UJ>YlZT{vl%ackR{_n7dO7*N{Z;GdM{HnkG$r& zqD!C4uPX9M&W<*By;b!yZ2&XDHvM3_=f3aTRo zPbKeAP1HUvoxt5(r+i)+>Hf^ELGkMV3Ljb)avEREuBU*vqB3oqv3-2!`1m9gUs;KG zQP_8RXOSIK&Qrh>K`!a!rSL=-Z$+SFESNa?99kw4K#VyoMOqH>Di8B+nx!w4)k<~N zRv>S5r4|X)n&WX}gs!e4QYG*Wza`z&wP{}cX)mVn4j+?`Le6oy zu}$TI14F-AZPiTR4HWQU@3_%u`MO-D|Ejn~C%%eQXiWb#5@jDCT4plUJC;j^#oMon z3cFz+VPAaCx=)%-l@L1@y4O zuG4#?fivi6=Mwn4dL~6F^A-5di1%f2{x`B@1M}D%>%V1u_ADV7z33ELYFTzn=#%RkA?tD<=XoHeCxi+bo>k z_TO}tFlVyB+qZv5f;VQ0;o$&MqyPZ@|Dyc<0lI^M$pN`|extVIuc;K_1Xf8&{_RSG z9{`YZb9Hrc#Q4hs>8^aLU=rUWar6^$!Kwf92^GXN%K_Q1P)up|r7O5eu)sy9`U|xs zjE)he!O+VCNsN9+$BG^+O5uc-KedoQ)AZZ+PtkGO zKP&-&SPV)Yc;|}Bc!^2b9**oB?vDSz3FFJ5(`0Ee6F4eYbG#}KWFi(<0stObA?05n zo?~vx1F5fku-I+C>%k3r2Iq(FuRuY1Xcj#NjPb+&`mlQlWWqxmqQQo@F&}ZAcYpJ| z^N~{H3^%wJ%>P~%5vBlu2Ez4)lOqx{AP=PD{tf?A@%HcBb~@nJs*97S7Y42Xq`#u} zr~KjH)IhH2A|wOGUg5vgycKZNWL{zt6@ctl<88oo0534(3P852=kwnH*>DV_B9NKr zH<2rmJ&d#>kOp{&(NP3)UPb&@5SI9plVE#s)SE5ZS=}`Yp z=%0EFe;cgV0svZCkF}gE?5te1oz$#2|EnPLZx?@_)cSkneQ5lb3ou4N2}p6p6diFm zBad5w;y4k>zXQkq!oZb)9PGd6SC1R9B=Fy>ntmI%k;Fd)vR)sfs&v1K|z6Opo;6Kl+G(P|U delta 35988 zcmZVEV{oKxw?FLIwr$&(*tTs0?TKyMcG9u!i6_Z~|GDqyt$LrmclVd|sjI85 zx{kGe>pbV{Aj1lH zaA0)Ts?rGq@`2`+M!T9zg?FJFawISJTRw9Wb|4tx^%TVX+9|A(ebCd?AD>iMC@46- z(_J^%@6_xsQ?>K`5g%ab1~Pjk1m)vj?{6Q!J{%C4Zl8_e{q!MNqf!o@-p{S_8FqKC z0LL+Z5)RJXhi?XU%4QvCY3!U+q@mDRr&W%@lB{JO<^Uw9`UAAHri&Fc!^k41=Rz!} z({$f|qx;y?ZgZmY#TY!vKY!zTQj^BmL)Ujj=4Fr&soGIF$a1rDS(ig2lpAVBg>vPu*VDoPP`=(#5*3=v5<$RW7QqH^@P0R`h$ zxo}y@VFou+kkFs682zdKY{?dDyy}piad>uA#r6p;`^QB7qiB%jeBbee<6wx$(TPm1 zFgyGcmBBhmDUqG0sm;MFHwMXB8#Dd_bw%6JteRtY)G(q)QD@(9SS4=kM8FtR4%t}a zW<|t`WV5Zci`Wc>)q+EvH{c$PVMGt?CkL;=(G(q5sm{euyu`{Z*x8oQ>TsXKOdle< z%u(u*Lgd=E5*LS41)ZT0h(7Dd&iS+M#adSuYPpXi{rL-?>Bppsb72>Y zolnOg?DI(*iCHrLl7Q`E4Zvx(sg z77fWm$uwY`P^F2WUzXc7smz8V+M~M=K5bv4)%6l*$#?byWCz5Jg z@jI93NL_9#5G@v7a}4jDP}RoED<5Gw47?8j=h_kYd1s5Uz2E*e1Y z(zBtf&73dw-(u0UeHCt%u0CR`0#^fWg9&?)$CZ5V+ZM3UDPe6Rpq2vQvtT4{|IEE* z53s+C@$rH$`O+9Bia)2qo&vs;Sp`8;1n{h&*P!7-k@FTL2KsC{mP+3IMkeoxU*5m zPiKR|;zFyE%l9IJ5T|}C0Eq+9`2L#aNuq0b3;QJxN+lonA{2kId=2YVlr+dHJ(-i* z6rJ4#GX)|r_@rRca$?n#`MfZ`#gZ1Ri&4BMPgr!KO*C3Om1aD{aO^am-zv_V9H*9S zdlc>yWvAXAOc0-Zj;SW&!sOSAkbMbq57pqUKvC;GR_pbAq!xbrb0dm1+ zrD}Nald0OfH!AKaCi{XuF)@xjMgt;8%azD` zoJ7D>7EXh6oa?lzLG$%bB*iZW?YQM?(1Rp4f7APm5j7Ez>yr0RcA)~O^(}8dQL)YfE?W{et|(w1pXEx9v@`| zlgjO!xb<`2+pPps<&g4hMJW;&nO&K-j8DNuo#P1!Jb9W<+u8C{lm=w^fz|JV=PeI_F-GE!l5h3}|a~ z0z6z4oxfe(0I*0w_PnT;TA)7#XI|e)WmfO^-G6N=MDv;o_Xww6s)H`8Wozwwk7wOw zH?w<8rGeF4pOLNUTvryA*MteyzyYMe#0bOHC(W#kzvp*6U$V4>li%y-A%Tx6<%q9W*B1{w@s11VUu>XZz;(9b9>73A zuKxb$|G+1?9i9)|zD~30H~bOYzr_|7IxP6#K_vN}m;$i>7f01mHfc

k5kI@w1c_zj-Jtj_xDyQ0{GUV`QP*gO z2gC2(3&Wm=MkHZ!%++(7SX^-2HxE9&yFz`Zf**hSh_OMN3#109Fwu0?Ll)?i<@0C! zg<4^nHP!$d!wXDH4sfk+^G0(W< zhPJ|dd^2^N6O((%XgMmC)7|Ak_A91yUDQytaCgFLYu|cbo5LoaS5rVYb4ZyZo0!m} z$P92iyKtq=VdPZg?rJV@YANLsCmqoindd{%ta&K~9CBY!>{3i@vb#iFubqK~(u}M| zL<36&5s|(tFnU{DI8@v?wy_}K_L_7X&1g-#=doa21-Hn=VB5obZMXQ|VEwZaf>m$y zP@6Y^=0+2o*@jS^m0hy39YK!x-4m?JiyE+6-wI14`Rxp;IJkjWnHzbIpqqQ0q99QT z&CxqEIU~|`QJ0B6DMj1fndpbZZNU$xVl;+dLD;{q-iFk}j>%KxG7i+ky2#=09qY!D z1hHlg-ZDs)CRC+xN@V0%%^&avr{tUVq<0Tz{KXQL^ePMHi`h(GQh-)90sBC)~Wq9efy~0Jcdl$w=g^-9~$YG7HQ1O)xFr3F~VZ;U+~Z zO3#&;CMHh4>S-yIWvW*$WrUl=C7Mqz;NXimC~VjU#KxW)LQ? z<+0{?gzaJu5s&SGu==6^&%kPXYUxrhol5tp4U`WWId=@sn|S6C)bx>bv3aRXSy)X%SKm;Gs)W_inKaERC*XLJVTUo>}%?HAYg$Ln3r zNZRmKRaeGHX2w+|YGL&q>d%nsF`w$OZrqH>S8dqY_m>%NVVIBP$fw5c+GmFGHjzBV zo;Euylb!2PT4~G4M3_#4Y)s5MUtO5Yz(@Fly^rY_a zda~rVlm~Zs6?DTTnm4O+7b6<$7JOxG-pr%cd0Nqo?A(pZJ%^|$lT`6MopR0ekr3Nm z_5KVN+PPmQxb{s@TAA6ffI@NJFlNEUGd%C~tZb6FC-w{c9~>+26InMPKtPJ2{}+w| z$(WRM02?O)Da=prl9jm8Lp#Rxfk>G#q$k^+G#=3a?MTKN2QqR8gsSoCz<%qt5<)Kz zZ+2i+tf(~4kV9Mu`BoYDetA%orUb+vPz)&^^jcwcl`RySJ!oZ83Cixg#3DNhi>lW6 zx?P`-oy$+dIq>*x58(iR-+|F(8do!v!_tl&00+8EPV22HKEVjZ>{|UTT5#Xe;8ark zKv-~)jiKW{W~m3Gye^Fnja~v)DTBOTx%Mr?v^I}jfo(xr$agd36q^f~Eo;(xQe}=X zG4@3)JWIB0ao{LuQ)p;5!*u4SC48O!#rH^WVD}_PTh<8|u)7n#ZorPQdv^5l4hp{w za2Q+am8|3A!qIq}MzNDMyqV<5FE*BgfZG~B+un2?u(oD;c$$>?T-;zUHO8>iz9oE03m`~(Q(fH4qN zL;M#fGh10Gq@73)l^uKNn^8gpsZn}E8mfC<*8Pc6gb=+ttr9E?O0j)^J(5XAUz#0Mk zaW9G%3O6hx8=bG8SIJc>xSPRZ`}^ChcO|OkX^0-(L}#45H0q*A^<$e+M4@d&7C$yM zRZ5mTf^G7!q`{JfvWp*F+SR-vd#o~iCl{G6vIWi}=R_0?ODC0f@&G12AcD#Z-5V&x z%OW!yv8CMn6$YB5V*AjbIF)6V&xpy$n`91eS)wpvO-Fgee~o}Z_117%&KY049RvTOGpO*}M4 z=nM9TLg;)??S*5gwDF!6sLr|QCzIph#63%ShYS64gb?X^;FQ3Z$jelYqAl#=T*&lB zwUqqApqy_rt;22m2!S%eL}@dLOA z-F81yA+zh0aMT3`z?DSnTKol3s5Q8itx;x>e@|_9Su`_Igo#& zA7P?1QzMeBi`!qwy3MA-ETFK+R5bIPipF1MCC}FPP5u$Hj^X^6xL64#%x+%7h+)j$x-c)(D&iICHGYp`#^_s-2nAU&brVP$;5UsAQS-$V@J>E|EER=|%^FxwI22fnbJVkdEkzBG+rJ zLcuKBDGGiq$H7F-mY$Q*UN6+)dvM8yG5?0~udCn6$sO3amRtDo{9H*6;lF&7espaZ zW48?CEkbQ>1E9KIWUhTCzEU^UrX4TW-BT97mflID-c19~3Tq&n8pZT9bR ze03qNsht22JMccJ(Bsyfp+f9(7Dz2lx2_!1c-vS=BTfEAOM~Ay?Do$~qr>N{_cQO# zbc{wZE3Dd_j_*_X!u?!JdXcgL=v^;u_1OUYk9U3?z{&0i1OSBn-KRYjK>U15yyyQZ zCNK;L5xylpRQV*?93(dN`J=R!`d)TL@rBzJ_>}|sj(z3+N$*bm#n~186_$J2XJK^I zXBPebe1-oWeE!vUF(xjc?6Uj_q z#2twN_WQg?JZ^KGCO@U^J2XLQ81Sj#NW5m?w*h#Kn%&-3jjGuc+LBmiWAkGN?-SPg$fd8|L z5Or(%&aeXYZ!(Z(Zv^|d_~4|3_%|X@@{t1OzT-<^e2zZ#=58~{thuY^lvX4+4;YTI zB2uPMFewAE#PHM{MA%Y6#&p6FN0~lV1_Jevx4diBNdptS5z(B*tDdwYcRI*4E_Ok? z8wf*!AgejP@4Q*=Jn#4_y&XNj#e*;$RK_0O$`?~&QLv#!qv=GZGsqvr3@7avt(*X= zW3}q-$%C{Ma++A-l(JVTG#_{PbyBsH$8DawhcCSWVh0N7*z!k^<#_VW~g(_p)0@U%kMtS(tR; zFHPRM`}Obp&Qyt=&V9}3QE>E-F9!gUrw=pvUNzl1X2a`98^o6>^@a{G)6`!&44l=y zzqt8kWSwZ2C~9x&-eM=MMBa1{W$Vl9_%r@4(hkGbAj$q9a*aGgiYKn})pZBc=AZ-w zLs$~X9~MVOBQfnao_OgQAF#}YDz@Np5MtaSp&t=+!&^o%Q1CPo>Vsk@Mh*Z@^CO-i z3XgSTRcaIpo;Uj3w6?Zj=>&4DRi`*VZj#t!x}0zGiY5xcDokYAI8(oG!CdHp!GFnJ zeDY_`AzbPWq>s?qu~IZ7(7|Ze%v##bFN-%S<7{9<8o5rktQ0`K%^4~9je}<#5kp1X z9~6882*mHq4w>NZb4K&Rga^_KP7Rz zo&qje6MN!Mx%BNQv1Yc1KA>?Jf0@NN^R_IFw7&^tGi_n=qqh|q5a)2Rw>4HLikVG z*sGlu}Eo)2)Z@zK8a=Rbjw8EJ>&bCWRAU1Uu>QU3JW9 z5Kk3JfDJA#B%5W3zvieu3Sf?2`8FuV1+Me1aDHxT9I7FoB*uo6ISQB*lM_Uv7=4=_ z#KY_<6me|eKX4qRk8zYl!VIqpv(ILza!XfB0w0gD3pF~(O z*`3((-K>Stns${U0G(!~Z^zKFDIwU>6nVUx!X~gUQ_0%WTTC-K3aZ>3xtW&Q6`qID zb5(!aQjXP66SQeDbPc+}jvY9N`z9-w&UG?19SG1~tKDmEGu`ouZJ|z_HhEPw59C_d z1(u1IM=qJ+Qow~2V3jx zL=}#li=U`wY$XiS5++hRG!MHvaydVR|CmurQIATF$rV+o+lG9WjgCID`Yl2BN>Xm~ zqnfa)7qfO^r*YeC1eADT4&kUYAZ>(NZw@rNIa;-ZX?Uoo08|PFm~>m4N(VzEf~TE8 z)0>x63u;XDM>N*xZ1W@dMlI|s*9JLp5iwU;Ne>k;zne&mYG?gq?hwwvX2Gc178 zt&v^lw0Yva(>^QV71^WIHaL^DFX)iHsvke#Ne$fw-oj~jS&MswuTD}Euvxj^x zp0^8|MJ=kc0z*rBJP*~jk09>hPY04a@d`Q?`o98QsBhG2>*5vr1I^)8*$y_tzO>LN z1!S6~c$%J3jc-Iuh!dV@<*%SV5l>1xdxF1_4(gswQhAVIhk-Lfw4rVUszwlyh!~Lg zd64=x148p09+Oa*#9wtI><^9aJzlvNlybldL$RQ;a4=Ml0u!l-x{rvEQGYoc)Kd#m z1ZD9Y$SM$EPV*Dlk)7nmp+9{6D2uZyN2`x757WajCpL@l3*zXCrG28cT(jbt6B@&O zg5+9Dx2~^qO7@FIUgvHf=^b$vP`ERk;k8YRSM_}7MnL4gb3%_t@lgkPMOr9^eqgmN z2tN?-N(NtItiORBK#pi6Ml}=Ohj`1ZPB#B-@}J{|y?zsR=D(p<^?!uge>Qz6qU@0W zwsA=*DU^SU1T94He~WzG-~TBx40)0N?eI$u6o7LN^uGov@Yf~Bi4_zuio!#P%L5lN zP-`H?)3D%e%F{*;f`BJ2gwmD==3q5l5$y-P(QiRCbR-IbPXxUa&|gR&7Ym0^6URH5 z(z39>CVHN?J)V7bbBRCyToVLv;7w za~2;%_e`oNTiXX#zsH1GaS|-w<^<780`A$;lPmOca>__@)~twF4sC!$kS)hT#6}{Zd+jqIVfOER? zn8tE0vL2F}PHUHrVQmuWC=BoMa^54IxNYifld+lcl%SCX)$V(cW0c*!Xjj&ru-vl` z#T~+=ZLBer>l>vhiY46cr>V$eJb!vkxZ43u0OW|hRQ5$7#gc<3Db=Z zlMO{ZMFt`>kgMCZnWPVHGPG)m0HIY}{P-AE(_9_6Ji>12hPiUyCL^|b)a+7x*^FSe z8j_v#G)qOvPJ5-!MCVBowhOOy{e@NwWPVh3kA`?XnjSfyF>Yr3wV2v-QV4dDrbfT) z!0d*BetOT;EWRda{D+~TMb2A1L#=$*A1X;uJA1wta-#&?l-nUPCaNUg0SAnD=@gKh zwtEf)MVadqyod*?^cinR*zX42R(pQF#(QEE9KPmzX1=0~bDM7tr}++hY6Mo_6v`Px zm&MW~c?##|%l1P8=k7wolA(IVRfn{odPk$76!)70*$FPVrRU#nt6DpFK3rs1T9L1l z#W)P$r)HH0C%qO=`o;3l0ZYM)aZf3P%dc!Vfn#-!8v(Csjh69WvW1^!6`X1nnX_qz zmc?J`w=($NYpv`FyKCtv>MP+d9>C!Cv1Davs!soA2nn|=(P1l zRb=dvlPCCEzfLAuY4@vn#eHlvS5h$|>D4|~{E}9sA091I65VIv0BNc8F1^Fu*1Vv7 zVI3-`dlDb-eKJ`VWk+jI`%}#&;Z1YMCsB)t3wif~h&rupQ}Uoo<}LB60~W?oun1nh`=J7>o>>`5h=F0Z&TRnZGb#GeW}k@30x-ILPkS_3 z`OI&S!IRqBxd9O^w;ktt>Zq4ImXv1u2}&AyRKNdd2U*NVY{){H&V&BOF29H`*93^h zzOr8|8L=9DAj&Q6HpqW~GhY0(R{J80b&!StrIDj0LE3xA08~N`zEadm50@GvG?yo5 za0X`4P7}e*6^J=7-wlDgU@4ehLtLCG3!^w@40proKg$&D@5figl#cJ#Tzm0+>YxloFF$(C@X9-2Q<3h!C#J7Tl0Bot7Is+Zzij0 z^VXZ9t-4n}EQ4v*@W&~a$pYtHlNcoC<20~G_jO-aMD->7(-U{AP_d>|s0-DjEXBp) zO$#x9nL=tta#dqFyGFRIivKvX|X%!jjEA8+(#hw*!`ghj!$9?^KtTgmqjfLT<)nN#!hcN+5uu{`u+pc zaG(m$aOe_mr$1Z1XGEym0EF}JywydwqvmWl&@HZL*~Hd6H`@sp)B`XZEndiBs}^@z za+9ZD(8a*5Cv5ZNOG%9jy3q5G*a#SllXuD}c+aH&Yg7gdG?UJ8z^`M6dzlkk4HPjq3 zfyB&p*Qe8-x6{2hW&#M3<&v6FNaR#T=D3!Az)TG>R8kdh=D8#v>9!ZBCt=~Rt~S?z zp2ut`>Z;OdhDVEx%iMQ&Y@?r>ZZy?N{K`R3-lp0_kSyv^;pbx7ChbzFqfl$PQqDze>CsdK*ogERxD zwK2CSpZZaPo>i(XCUqn|-c-KLWv)xgO)Dnm9tN3f(^|dV=zG~ZRQe?I28Pf16x*&z zBgSMU_5q!>mI{cc4S#k=-1RLqBldQ^vbv=e%Eph{%~-1cfOfr-NRRv55Q1I{K{`lt z4TIl3+ z=*F}8$W%03o!^bJTorifoV$-CxmztdWvow3>yi`oZSJ=`<5ugT<>6}-&oE~N9lH>{ zbPEl!p#dN#ey|l7Yr%d+)$#pu9c}IIU>u?FV3&;HGURllz+6haEB8towNq&~xz3W4 zqqlptOW<2g)+S)0+$*8XZZ4Bv95*kPAaZ0#z4g)dmulHrfL*YWMPNMs!Hoa=6CdbE zln>1$m@Jt^#L)HCO6Ji0B>*Ln%eD5i6V29I#S-w6QW#lTNc|bqO z{tUY0I%)Wfka8qxr-+As2L@Nu#n%IDjWNB%yVZzdV|cH zWDKJV^v{99LL3AV_s5Ism-R12K@&bfSl`SXiEfQXMYt9^cuR$srr1f@zF z-if#0JD>_dfm@{&Xr)b5dd|W)T;N({stdz}1vEHP9bS-#T9%KZ5DonSrkYD(Klm zayJo-t#4H0aF4chWf*mMQQtg$znLRkex7L*mdI7l(EFtB3D$a1A&T`}A~Md@Cu1xA zYIQC0>jcieTYOZ}Mx3u&CzS?R9vLj+4aP&wNHm}OMY`jcFMx;W8TGe1`bqvG?@k9| z_zB&n9k6NoAFf*eF5`SML3++oIl!&t9I08X_8At~#*ec48gx{?^Vax8w^jL|$D@9! zM|+AZ?kn5oHNrS`E_odsH{|pO{bzrr@8yBD2MPj$_J6LH{C%?NbsC`1fK<(0B?1kM z&+F?H!myDQ+Q+gb&o_A2%ZwAPyPo^8rJt z5W%S3!~+sxaNKr$u`*%5{LWpC_`b{k z@L<`UNlNa`^p!KPh-u_w0Y7|{iDys?ANAQ^ zn(a;)!{ynx1Z^S&i7(x9z}jH#qd4Oq70%eb2lpihxVG0r1{}DZ@1*ZNqp(ieZO&?8 zq&OS5GUSit9Xo>E2S~BP;?}+zpWJ?Qrpgo>Y&NqQt_hiCZL(uHC924r!nY16Ws~{0 z99266QASZANGwDI12BAXS1-3}iSo3e@3V+I$zj6CaUu`E^-b60(B?Wc>s_+y-8r^f zf3I_e<>Fg}tf0_2{z_0OBnXJ!=n9e&*1#b?~YggQc_D;6esO>SPJlRS9QP!c_7g;0Sv&2uP9pSgdTT^or{o}cfqsmQ7 znoA?-J$%O1)0p>{7+seaaY18*!_uWb@9RmTit)Rx$Q*AV@GbMwo~X2S<=p3F{+V6I zXnu6Btig9wcgoqpKc)o}{#QM=^;hWYQ8lb201!>`(ZJ2yvGXzJ}x>N&v zhBPZR4YEG%#Vn*ZoF);1& z+BKGSq7C)>s%-Bu`cgIaG8}c@dTs3Bww-@4oy(dFdXs6%HKO*f&8^MPA3ICfV7hME zT^h*q2c5&VB`^2efTK=5`b^)3j1RK#6G|mKJpiIvO^~Is)S&}SdobQsQRREoZCwT5 zH4s3wn~%SHfY3YSCD1?i0{U|gRcMHyci5~kV~h;z7CLW_nSl*ft{P9c5y#(DP}>sR zbF%ip>Is#o;qoQaFUn{gQNRrOcC*tPZXZ*n$a)M?B{*c+#~=XkuS`bNiXwJ@S74~d zu>U)rz_ro>kt4FH+h!!m!FK79gtUyrF^+jc2j>%gb%j3Xx`F2 zUW9R;f`sJ!(*OeD&Jx+9;3Q78wHoxA6*`g0tm z5J8{qCCAS4uS;rMzqp6}&h3d!3Ld1UPMfhgf*68$MWMVF zc%AfvDzO~gmZrGLdX9^;yu*X@gs(;`Ub!)jC1kLxTs0}!?s=>Ozr5hu`^zaBc{lf{ zo5&$Uw*=WRx49Vi1sB?f%-tnX9wSxd`|Nr|&3g(yUjtB>&h{ z%dkQdKq4>CE}r^SBbXBGCJD@%JP9^g(}DVnQ?bYYk5g+Q`m(9bKQtwmDN-kW+7QdntkPcynAf-YAwpu4>J`K55RP$?$hN~k+h3l zT}w)~w^@#BAgNqqFetX4N@=guV*KktLKcv%CrN`+Y^VbH=R?l^tz6Gk!&OnfMMSO}5r~S3VcgpVFq(NdMSSaGnDa;S1Lo9Fn zYN~=T^)w|QLt*hGw6w1LYP!-|JPf8behZ)Wa3{;)%nSSO_B`kMTz8!2`QO|Qe}BG) z3Q)zo+k@*K0SDe{+BiN0z_)eYxu4%8oG2nY0)~DqZXJ(y3E~VBW_FvGaX8y-6t7dx z2rh2XD|B%@%eeG$bd`90%YrWX)5U=-^H9(6m2iS;^JIQd^pXMn{?d;B6JO!!cO3J* z9dM_BoN|a{v$J^T0QxC)bQ>45^Y^JB_r?>q--#g;#1K!6jXA!HQwcBLsUiD^{p`Af zN1jfZn7f@~c!&GC9IY$)k|f#fyt60ld)WKB^|A4vzmp;~!hjQ=c%CDAhXkaaaNGEw zhJB-cL`gIalW|F&0+(WoN0^wO_yvl54q!{JNS1nK$VE7Ba+_SJ$c8@I!_Q2S^CG%e z75bUpd8wYShK&1^Qkt$Plr_H_i<^<5#yRuii_vw+_?vVb?53fnsP(8Kv%wP1uM@z0CeCN$t^L2 zf2pFCGY*Q2^TIk`ZV|A9FPA#aqZb;R9be!zS`quqwLlU3+_gb5z5QGj*>b_CM2B?7 zf~Yg6cHSmgG27xiby1&Eu5RTV4|S%6&!7y5m0P=d4wdWZ`skiKyDt6G`<3iktxN2as4-}WtF>IXyH*RjMl0r{lZ6YTjTaY_wsuk2?OKp_X8Yq% z5MRCZmK!)R_8b7I!AouiWKPEKky$XjvsSKNVhk$;6639)RY3)#X)xrZw= zL@|(7+?;L0FW)Sk5YdZS$RDN2roTs)%$}?t1u-^+9jnMe$!HtUtl`ueIZjowPp7Gr zLMDUXcJ~AlFnBo%4*2|_sm5uLmg88#sWmXf*NdO``JM<+56Lz?@h&hvgu=&n(0^;9 zTs&vrGT->QzH+)WIts^*b{PB0_)F9~ae5A(3-XdtaAOKvis60u^qmU$$zXiP+}3(9 zcU(1yDksSx6DE~b2hTN9IAykftO9IiS(9dHsuwDRwG5K6gxZ)+k(k*?lcs4ckiVTY zXKSWY$BzO0y`5mEOBTtQiFoqLO3ytkuVTEvGsQi# z=SFkWc%`;=*u-Wj=;5_`!$~b!2frznw9iQ#&qW#FM!((;w@4U5YyG>RbWNz#ih8?n zz}_A!UYYpw5KoE$T_$RX!~z}7=EieNvW3%)Abgroqjl)lbh%&V5wbZZYjmuOj%zXUr; zSM31=Aiidyp5eb@6?}cB+8C49njD_dRoVa;t285*%^$#oeJm(e771?g9|=F=huS$` z^2ir@iy-m+slAYJV?pfgo7T_BF=Gd;mtvyU{8?_z1uU4aSfTQ=pafR>fwvgJ{^Bc! zqd}n$r;OU>^Gc8GqK*<~n0t&R%1tr-@~{HEd(?dCt3KFxTDi_Y$>XEH_ICOIR{A0gu)jfZ9ia_ z5kh)l#qvfMtZgaKwh~Nd!hXZU(%d#r))zab zWyWU>f6%s$?bz5dF85vDR)(w$*ZU3NP-lKsNAU~0sCmVyth*S4(9U;UHrfM65I~Ce zXkKgZYeAR}9VqR*#nU;LI-}G~$O?I9FPp8+VeL`3_eu_=hRH;tpnh{D$zAi>k&z;N zpmxjixK}eJGCAVl?|#K*u6~T3;~smTL3MGU*+O&J+WR)m*C#z&1BGXsfOiGZ6hq)l z=};SD8CDskg95X#utxBarOP`Y)K~zDRVvq%i+H`uS#23MwU=W4@LPNXFkF4NwXtVlw5a$k zCrs!_hl(KMI|J$@t_PK>SQC?GwWZ8j1X&(7dF4 zsL@eCwP%FddE;juhhbaD^HZLVm?vH;M(I$n*NeHeBG& ztU3*8NH@s$4IzJxNkI;s64}Z{j*7C#6W)DavDB_S;Nbm0AyZ~Wx#HUxA%a`J{X%xK zZ_V`jH1=efO@(Vn0TPjw4* zPgivWPw?zbb;c#O`jGWSo%1UDD0_V9eQsyq~Z_L*DK7P z+|Gra-S4}Y@5|ApOh?U6(F7yuSZ1&9mAGM9J~+EQWid{x%I8A1e{HR>qKHR8U&oD6?AP`-^(GR+O74D#({m`<@N~QJnA*) zL>vNXGYD~i2w&_+?VCor=&VQ*4hpLuP2CzsOAxtPIz*@edW5x!5jZ8xTK7+>RbQ_D z&}y<5myhobC?tJQ8klpuD-lc!d;UG-f(;6?nFm>DqY_PT#$=7RVJ%{%c5Zm*FR7`< zaHxmez@^?(q96cG;#gN{s!$Y2pNP_9!YGTU+wsBmvEXQ_Y`73>V#1Uf)}5)W z$0`#uCUcVq6l>YW?t1n1>vnPb1}s6LCI>qu-`Yx{vU;#8r?nMeE%;1S_4ys6!n^&! z&njV-_9MIH_eco{yiBCuyQJVk!ZScKZ!5RkQqE~qnV&5E9L|+g8t%vV6Ng1>NieA8 zUnT0)JQ#hwQAxMjo1=W2Y10DM#$6vD2dN~D!X^!C4hB6*zjj(#6etU zi)}Q{%{cLQ;@OO5$f-dT&}2f!KgM$w-07DYi(5i%%A`NyQ~42_nw<+Ckun;a)z5G9 z$@(J^kK;rsf=mud^Rp$+;X7#?PXQogey+`!@*b)mb>$uia&uvHos?^zbaJEbvz?*Rlq8+4JbuUqPHvy=vbyYTJ8(0 z#gTFsC$mI@W7%%MFf29IRZ@2J>{1mZe9H2qm49eHnj{2{J{|5dMmEXqWU3a3t?`e^ z8A)rj)?|NonBy3+qsgj~t&2;6PDbk=`-gP9b$PCEO0_f(6l`x@V`HZa-x?(se`OUG z&0^|K46~Ur)G;FV>`u4cPWR0DE05;T&R)}KHr2=M*QMEfJBhZeOguvND4abz?K6qa zN{^be<*_LJD-aXX3a!T=Jr+*fXuB7tC6?0xldFF%bHvHhdQcmZ?jfqOGddHa=FBwyCJbhX|Do##9cC;REdE*u@70b()?9| zonC)cy*l5;d5f8em+&kW#%y-_U{ftiu5{nWOtV_v;0u>d6Yjg!n@whfgYkk$XsuN{ zO)TuP&UylIo;~&=>MY}FCOUNgFBeJPC;bU-_pz9F>7HOYWj5OBwJ^;~VM{F3SXL3{ z^1!NygiJa(DJUlZO7 zTi9z12ifp@r)Okoh4tDT3s*D*BhEoJK4^vHa5KhqW;De_M|0Ecy7#6`?+@SQWy1lT zuVB2=c^FLEM1F^JPi?H{q9)eBQFQ!1&%PgGA_RH5=d!q~Ehpt<%OR)UIGhxJF8rF|$QuC(&Q7LU6?bhWP zMo!rfUf1#KfRzYioo|`F5}MrmM_-+hr`f+NO7NVP$R=Gd`FQL2Fez!FQ=#>zBByIr zV@s3^JYQjYW~?%e-P9?e3e$i7R+-i@+DARVvkVqjZD=VLN%uGuB$bE=);jzbd6r8 zf)4X)2u9~|d~^s#ZQ0sKmXUqniF^57nus;~h;%=S=2*pEie2?gvCYo^Tfvt;?^~|j zYahjl#9jH>b#YUa1HD-%rVRse1qK12AAtO%$Rm(n6|H_1)?0l8hOGW*Ty6D@xW?+6 z9C+C2o2?$@$4sk_V$6Snw>WgyI{i9_{(9VC^&2gGkS7eQKMs$#`V*Y~M5jN==}*Q} zto~G|Kh5b+clbEN>Cbffv+!)IKga3~9-WKlF@NXt*WI9joBP_4aUfUYefm5#xfLp1 z{Tj-(kp)_T=2{U4m7BW@v~pL0EBC}3A*;ZZhfr7UY6n+MfvbNFG6EUJ{d^g5aPI;= z4w;KuK@YfEL7k?spG|km@7s#E0f$GZg!$m%&HuuimP0nTiy#vgLk=wA*~4K7)WAqM z0>;9TFd3FH{&HTi0uF^BV=m^Fg@_m6g+OuuZ9cQ#9e~~~YJ;pIZ6_E-xD&FA)K18e zrkgam0?U)eD@}jCG~H#QKvwjSrl)-Nk_n$Qy^BWfgg!-mcS7HylAX}6sALE97ld6f z;6d>3gn>ovFsP;t278CZVQA3~=);|Nm_6lr5!@)H^ zcN!80|2v#+TU!6@hH;^j$C`kmJi~hnW^^RvZoqbn|t)2l$%3`+k@c z$d!+|9Ql8)gT9^cDg$}GT;|nTf+;zWg{G&Z6_y?1Ce9!csohQlEzHa3o7?SsadP1z*7B zU2dJ6_0tZX8X2s3Ah9IKOM*TTesR}TEBC#smhpdUtyN`RSJmx%mC5*~wQ5Y)Rjc-1 zwH-9drr}fs9-2bSXa)Cc=@Pn(`>pgiJ(X}Q3_uk-)++YxVs@@FcCNAPT;re@jOR#K z4ufC<42J`FHUOhx5<}*4TM1KO9?XCRFo)f3KGd_rHLyE|;3!zl)WXmV$G~OK0=K|< za36m>3D06aynqGpDfWPGu_prdMj!UU;n)w$u|H160a%58T!Mpe84l)1I)tO+FphAA z9KA;1C0K;l;Yhpu4vM^f)%qQy8Kb@MwA!SJOMV1}|dCX&kCNEXRxS5+_cc3<`+*+1~m}R#(qW;8I(8 z;M)Texa++KM#THC6&S}8)J;4oGZCl7y6 zoCZ7?1q0VYZ(Ik(xE>~RikN{LVHTdi*q7p8ZFW>1vy;J5FHaq4M=LAbSw6ga6KLBL zv8gd7Hm%`?gVH=3t!WPoaIlJPBmp`oY=WKVoPaiOuN7gT+?=4C*!CC(6x%?{f+ID> zZ4j+0i9_r`XbEUOO~qlYPxG#e!+L-2Hh4G2;aDCV=RH0SC-^ii4k!A!IjKn6ljVdg z#YZ`~drx7Ct&mydJ(UMCd)g)r=$f2glW^}n-GQGGa7lNjc3>+EtV;5B7W2i7oSkHk z6BQHBNfp~UUBvc>5;)h9K$oMQ=N$EX`>20O9QA_4Q7^QPdXeyXu{4(?&tiY2F7Ktz zS^jFD<+4sEx!gX<6{#oL&Q^LO4#h$?r3>&&{5qLz-(;WXnt{{i>EOmQ*v!s^9(We? z#B*UR*8>N!Vb$OT5M~cJA1`Jqm%;6LImB@@+=o}f!*~@ug;&E%crE-3x4_$Y1AL4( z!dG|`{K#AXj<=$lJ=wsmn1_G2b2PYxQpXLJI8|i zn9B$73VaZ^;KSI;5#SDdgfaFofl4+L|;OImTw|G&aj~#rksX!?Cm7o^ZB1ED_k;-)T`D*um~L z+ugUP8lvr0*>Sk5$a}ZLY#eq}mD~e65h{~P;Z5S!ioqlIK<3EZ+Vy-83%AXZb35#+ z@!r!0_deiV7|`0Gy=J5u(+2mkL%6*6$6~4EpYM?(?;aWLfJZk$U+-gFfB9TijmPwaPx-p{0gHT* z_i;HD-cVWOeL`>&vU<|iz*9+Cd7qwVpZA%n65iz5I6P;6KX2Pvhqdx3cN15zoz&1( z>o3?^Ps;wq4%vTmS>)3!@pF;O)s~2p?em`N+wHbPP|D6y}JG^1Z=FJCMp_deAZzX_?`nJG@=pM_PnD&1}p_(W( zAprCLA%J(f2;g1oG}gB7rEL4Y&5mWHdoa^J{|B4kckh3Pm5#1Pc8c+=t<(wcM`>Um zr-6Nv2KK1~<8mNj7oXX7Az&^LZ0R) zZ-!y*@U>)}Z$$Ps-nVkZ?*#FG7UGB!@Ao&u;CA>y5P$4I{7Ddh7Q|m>6;r;4k4xc^CWYo0{j zp>p7ejBkO4|A8EQ2fE|CFbLm+QTRTT;|DOEY0klqVKIKjJAMJH@k?mIui!-dFPx3v z!g=@|T!{aJYw&xx1Al-w@JIL@e`el(!wmc#2NHka7($#tgp)~eHR$3>Q0J;IldC=t zuA?m6$XVie&Jw3l9-hM$pVJ8Zo~zDZX(YL*n7UC36;LVlqfs=SM$;S`Lsc}E7ST9bO5PAPZ-n2~hqodRaTB*iTtvZnER0W09Tsm4+(`t1DHLB&*tYQ>Z$5Bk3 zL@nwJTB|Okjp`CQR$WQQtH04n>P|XE#p!=kbq}4U+Uaz)o6b-V(*^1ox=_7D7peE? z67>^Zt|48axoNZJp(`~nU9AnEYqdeNMH@@kYvpu!3F5r|%b zEP5Go=@rPQSD^>J&Xlj>a>%a7&)|Q8Ba1OlQIqX7wV#~AQPG*tM{vB}LXr7=x$O>> zJH3-0RCz`#4KK<^vOE*j9u9!q#nH-pZV6#UBm2hDwG)+0JPKKiEjP#Q$!**Tn)#?( zZDs?T<(&X?lwH#(g{88`5ytZ!Zp6fB}K@ z4`li>^KpR1Y@rPOJiHS6$#8$5yv}$EJXb=FFSEd7Kf`D~T|_f}Gvo>9gXH<=_w#vU zCh6ll#6s&mD5DjO(=xCi!?oqt*W?0VLL*<+Jvap)$ETCF{0>ZH3w?`i`EAIc|G-ds z2M(q8;4pe0j-n62q>rJIK7lZO3dhiA5Th^Q1o{e2r~krv^fjDM-@$*q^aH#|Kfx>X zGrUQ^z^C*pd_}*(j|!2L!okYL<&_(!C=XVuEL@_pF`~NRSt=LLQF(Z&^5U&3AGfRS z*scojA=LvPS3U6w)f=ByeehG&7r#&g@CW6m?rI?QQiEuK8caoM2#r@m>0mXCrmNvJ zUlnucE1`NdibLFJT2FuP(aCBYpY$5Oo>)Gav7UX>%Q0jnoGqUeIA#DCFUa|-J_*{FSM?uCld>zQg$r3?aRRtO4ntkcH zle_MFpn$uAYpgew?xMzma*fv(cG$wf_T}5Qf&wjhDQka)W$ienrlf#_JAa)<05-|pU#(%ZCq_+LmqVJlGs$ws29MajnignbCS=rFGCC0 z4ikXXM9|a$;8p>~odnrx3goG&&|OV~F{%Q_tLcAmu$lo8H4`?fS#X*<1TIx`;3_o_ zu2WUes^-HTY60w23t_jah9}e_cwQ}rSJe`DOC1j1sT%k}Ek&h{#0<3@^VACLu7cQ8 z)#4yk#}V7a5><~ARRbQVLU^!RjdN5ZE>vr9v1-QU>KHUt1RGTp*QyvEt6K1MwU#6L zIy`@0ZNyFLSiD9Zhg;MMxK*8qJJm^epE?;IP^aQc>U4Zdoq_MEGx0-pHh!bd!T+ga z2-QN$QWsD+E>3;wBJ!(?X)qV5!`0e^`v@1J*B?luW!_I z>R0u==2I_drRqg(w0cz=r(V})sefs6)W5X`^@bK!Z)y?sHf#1e+~U-ne*rh=A%K5{ zSk;b;xq52DB~?Z3cvww49$r%t$C|t;(1u5};nJO$U&MeTccQly1_!hbTU#c!##VS# z($;WW$u_H6ErC(V3_pl3ZJ^#`d-?zj^&t#ZA47@y1V*V(p-O!Q3)Gj)+x2*Z!`nq% z4GV9xwfppW5|+FRC3qGqwWt+_7OQ`eaa?}UB8LkJc7ntA#|oPbMjV^#x$gJZ68CkB zB`+Kd(~>NeN?EMFVe|eLa@2R=Ro_E_`T_c>A7KKI4^}_JH1!KiSHHq6^&9ATBi>}c z;z56>*3T%C^w?42XYein!|-PLRg-aBt@dyDPpe>8Pz3g0iPMj=yZ-}FO9vVVuC(}y zG$a53fJFcRP)h>@6aWYS2moxaRmyJ|9`vR zW+#*B!M59W+q9jurA^WtwuKhbgSP2GAWe%&6H|_MvO7tp-OR+<*`xshLBx7+smN8z zAvRJKQOHINhj<_Y3ZjC5H{J*ysCespGn-`Frl|Y-?f1Upeeb>R|K9h$H&6WQ^A7{4 z5e+Kdg(Jnd9G~FkliYuNO2Iu$KdsaHdoPy^Sd{@B>EbYZ8UQ)3FN1}iDo{CfPeV+UQH$RNx zM=DO|l^?5Eji2z~Wo~}zH&Ogd!OvB!$0N-C3kAPq`YQ#$X8H=R{3eQ5RW#tWWA^3+ z{8q(w{4R>$EBJ$obMQKk{}{!eRP4l`S;`yS`^#~f|El6V9AQXaR`55be^>C2JpHFn zx%n42|E5NO8=-%SkO-4RA;~xq@q3CWQbd%yiYkinpdwTrl;n9&6&i1y|i_J((_nSmR!!&!|lsc2{k)=UR5x zY602pWIQ6Cxt~d|;}Q`K0+T#9oAHcvy54lXj6m7B!S;WQnasMDH&C0T`C4AII<2JP znIuf>v&?>yyPMZY%q~*ui`ngUTbbP%Gn26#TOj1@6F4c5XY_lu8?&D0*d(ARY1m0K zEugTZK#Ibq8LnvvOdH?QLX#V4k~bO2q}l5owOrqACiitX`}u?^(;gtMlx3uyuA}sB z@~4O=lv#hq&2nneWM9!5%eK6A0;|f8$E@MM0#VUQTI-#ZDKMqcvdyM!PlxHY7#(Sv zDSms_bO&~3OqcvpUO^B|F_Ip^vcq&c9k<6!3Cu4ax6$k~ZLfBN&$5~OzId(6^n8>p zyVDVvUS2VgbJb=i>n6=D7AuZ5H#asr$$h5R;%t92YnWZbAyKN~{rG@}t8lf3YjCx| zDI0t|b@rK_96y)tnLQLAhHIql ziN^`pTAS)gnA>N%8V<6om1_0>|5H^Bx8h0-@8RaXc%Q(GW0BdI?d)XuOIT&IuTs~< zTrq!-Lbi@O^C|rGCbF^Bbjflvr3oE_8s5!jO&)X27T4%88N)Ji;xR$R(+f1*gqsCG zLCo>dK)&Mnh2(jLC1JTF&1_%#Rw9yBLh`|gptt= z-M?67ssOhdTASX&SoRnLdWWf}vMjZZrq_S!)p|PxgYKFXe;Ep!F4osdx6Id85WcjL zoNMM?NQ^9Y1?_JkzHw!GHp4;;0x;cK-E4K)WJ`e<-nI3_y9yO<$a>ulUnM^-Tr=r( z+17<5u46zSAfrjrLOT3L*XbuIIz`@D1h&2-o$a!0-OUnCJ-)szd41W8Nw86{=^KA~ zjU-J_=TMoOTA-i2ChKO`Gdm^j_E5?@w@W5*Q??fz;)<_M07}ws-ru7lw1n z;z%M#>7B0A<0CnK)+L!5JrBYLeVbudH`vu=UG+9Al_GZ=o@XTY=~hp#>1G_;@O?rW zjuyfI=>1lvn~wQ~(qdU?f6Qa8Jjxg4&bW_~PEU_xGaM6ps{n}#-%iTjY+a|-m8Ae;*XeBp-?-yQ)~Z6^ z(P@mV=k(CwlXN2nc+|~tALJVj<>s-_u5ak{wNU=ZI8}TMJC9B}tvfdD?lyn={A-j< zTZHU_b~Cd;?`O8r1jAA|=E)eNw>NE4qRQ;c1X8+9lIZ&Bh;LS4e%|!j0;88?NXl8k z?cmpnBaI;~K%+)4CogaU4AP`I8cg{ZOd1rRMu*d9)>KfwI>2dV#&K`gR@ce)(tCB> z0_TvEHGBj&Xt)tK6sDvdhRuJ^=d`hjt*(`7H0UfI?^>*hC8Ast6{4~*Wd-jqJ$~EI z)^IJZqZhE=e~2}FkVjMfJW&t?8a{;UG_h1v73$iOcKXM4RTtXTXmqf&L!yRK>-Yx8 zrf0kOOf%hQvd@{JRugX#%L-;mF2#h z)=a?ve*hpU*-?Q%sn<0rU|ciROs_egtD>;Hwz}|4T>lBcOwm<-9i!NxFW-TTfpg-VP^YdHxrS!n!nV z*ZPzycb`)6?$c}XlybOFKbWT<%2UdnKBcF_r#I#)m8pL|y(KUIV4mLUQ%V0rxQ(p3 zoqBg6?9c3}90oljLkLxdhY;pQR>mSjD5{J_hoDr(iie<9E*(NiW$6&K%4%jE!KC(K zOpZ;-VQS_5C?OI%Dd=lC#A4H^pTqPa#6JTrobRA^IW#h27Nm@zSQcTjjAELchJ>7s z`EmwMmI;4U%Gs!ub8w2Bi`{Y_?Yt8o4J-~XKoklP+BLG*g_jRwZc}w^UJmoOjoGcA!0s}h;HGM{6I(FWTR7HRG}b$L zthbn(C1b;KZYsuxmE0^H8~Wm_xv3eOtL5e`+$?_^MQ`~CR*=1?G?C$_@^Ok}^)OZr zVb$n_5)LL#8^P(sSyv|$as;c}BLvBs9M&czF|EpBU7O!KEr&DOXz%*=*oI+j9726C z*yIm32ZJsCU@NiLli6ny-JGXenT~3TBqAedXb%tLtQ^ixM0h=i#x}oKpToAGw>gKV zwh@19_gzL-?WikC6pi4V_SjqH)TzU0&Y^|$?&S65Qx{ELPdu$dXrp0UIES~5s*5I~ z1qW+SL=!THU2Q}oIh@Pvvqx|qv7Vp91w4xFP88*^$6tvViD(WTK|jf&b4dB4984xb zw=;*Xpw~@AesU~!52J!&cM&wXnBuh@rLup5;cw~3XqU96YqiEZ+Hu}fYcy5t_=NJI3?4soe8#R1tVu9scnHrXximX^3rrp2SO zM?5Qg#m}WHUXxkzhU^PPWPfOq+#ia|i$V+K#i3exNocjaG}It33+<4Xhc1v;giL>V zCCcbte=N8!qAh>JU#76L*g1!B1Cj7en9l$(+&S#!h1ixH_W9R;5W~C{o0CI2ymkorRc-I}o z7BVlx5px)ef>`x#qFh5va*)!GpO1fhmt+Sqn|S*;rVe9D;mUZD>A);<)ca8)uR=^- zgSqlrESA@yMqZCq@*`LyZ@_waBPExc;mCuykmjzGhj5L&4Ih?w;5K;|j>yBfpOil+ z@5ZAP1W(F)@SMCCFUkAx6S9lLVK5J}MG%+J%&W0EjmkslZx6@zH@C~!Ky!b4Bz9qQ zdr|D7=Jsgp9nJa7bSD(zTzYSinh3Bu8D2MtyYu)~&0Wq3;Nk$>IyE5^D#3Kg%1AtN z2=7eD*ro9Zk16_NWkFYoM-QSTt{gouIXa3mL%b*+ zxeHYZ8IQ#2qP(-NIB$fXrY?V@CQ&?^oXD8QE5c%K6?w94>Ahoc@5O9_`*R4(2T(?d zr&2zMYWWc5@JHxgJccvm<7kynV2^wfrhE#$^6R)regp58Pvd}m23N^%670|7CiyMg zF29XI`5oLNpT}qA3wS`jh%d{R2=d41e*KU%ew;LhaQA-zP)i30SAG`+!r}}704x^( z08mQ<1QY-W00;nVuU56G0j?_pY_C?AS}Xw~e+PWjRr2`Eyd?Y0=9{*mN?VW;HVG)8 zVkjCyi-ZtK03)_#^G&j{?8e;<&E9)&7tXU|R8T?521UhoU_0+Dr=Ff?Jw4I$?({6z z^f&Xq-z^E@?*Et1zW06e=FOWo?ajRS;*XC#2>_GSGB?)a^SO|PFG%yE3tw_`uOTnX zf7h?1c}1FE3+y*8eAU3$+>nQ_%lHige=CDGW$=~@-*$t?Ui~{4zT<|0_^u3o@51-o zFvK4G!G-U;VVFJmz=a>WVWhq0BR7n}k6rkQ^m_V_(tIk-XVUyhn$M-#C%b;(!Y|!W zhJO~wSMv3W3;*JV$u_yay76!LwF|#-f5TLPOvS%T^R3K%=fdyZFx}qe2U+qD!TzV5 z^k35a+lBve!%;TEkFxG3ZU|h2ZkUVDyNKK{pOg%~mgb)>%5uXol+6n$M{r#{6pDHH zPk|Y^a0TV^klfPbF?BL!E7_FtnHwsQuR>{xTvY5Lj~iCv^9Gf0PXmO=K=~RZe;9*Z zG{m5xE;`7dVFnGC*%2~3(nX_W;B`ZgM(5HPI@qAGZW>49Wy=W$mAaXeiPHFF*D{A4 zX2M0~ZdgkdZX8CF44N#1K`uJP4X0CuL5E5|NT?JUG{vB)vS^yKJdX}@4l;}mXPruu zMMoGk-Jl~4s&vr|*>a{qv!tJGf6!4Pk)sW&l75Z=s|}hfgL%@-7svvG7D`_u%`ws} zGN_jMz}F30Y*3wSw?uZTm#<@`S<0%U27?+6S|*GfE6q}amWx-E;+ADWbW`psNkK z#-M8ry3U~M4Z1;aZ#3v8f0@47pr0AkY0xHF`Evo?V$d(7zty1Iq`%#uJEXr;n!60T z+rZ1^bF+b$N`H?*T|)9+8Qf7qxu7khZjz$*>BN@jN%c#ZUr8+fhsPZ)TefAmipc)hT{+n}dh z^t7nq8H1h`IX=fBN}4hBoI$@7q&;r-p1mAc=y_>gFz7{FQEWmliJiQxEyhK^a$_ZN zn4C+$mZ*@e146oS(Qn*Xh3`6$q~#d&szI;y*;=M~|JMcM4cSNntQhQ@E_%yFZzH&a z;i_;|dwa-=BjE7}e}%ztgVpYj`s3F8sDF)xV65>oQnWROP_nZ2RR3E4KdP+AOS9CkM%C6}18~vD6AgqRp(jCYAlQ?#lA@!(oU8$DCl7H6otIT-V=3Rw*ewJhib^BP%E)l2H?=2i1oZbvj!AGKP7>-oDa z9&eA;e``M7k+9VmTw^V=_*l8^(a8D@3-#ITZwIL*5)D}O0$@`JwuU3o0IU_>Fi0T(!Hr@pg+XA7xH3xR(xJK5D{w^tKeaEN4(Km9~Zl` zf8tAfy8<&9XtM&V_X8Ki;{IqFTR3Ag%@`L*7_Ik<1IMjsO#5&K0AWHuM?8LFe;!*T zD{I2>jKzccSzI%bJ#+CrI0*xdCrveV0{b*p8<$lPT9Qu?>T44*OqPCZ39`O?nUSW-7gJ8WW=!GjT1hGjY9~e1kL_Wq3L_ z^apys7pr!zAZ&eLa%QrU?Xv%yf7`@W7;w>tCVfO7BMj?{#Q}hgh{IJpX3{5kwn=~F z2G142=VjdSCN`sG(x>#92=7lO-YKHL4{x^hV_(50hH#BZpVK~*zMy@XT1iHYw3FdKol!(LJ8MHreQf1l&E^CGX6x*)x) ztbo5GW_j&9-5ZQ~C5pD|&{&wft2Xj*(xgcyZswz?9AVcb=5&{K+2m!(d$53c^K!2w zRs5xR5r>>)lFw$V3}(4HDS)&>OqDC=AE%kLRUhkU7cwz#yK{4T87k?d*Hmsin-w_8 zRC%mGWy;cF%VNn>fA+H=U+@Z~DHJ)5nR1c#Wasl(NsR6e_5u=O;sTilf?ZV6p=n8!^!FpQyr?NxYSfrO`{*!Ugz40xTy{k^FCZW zmFgm)c&Le&30RGrGM|T&^%vKdStn1Kf3m3-s5zVvr7ATo zGn`=J6|%;YuGA`ZShe^@zgp6lD`mT@xKRsLe@(CS#lCEr{`5npA7bJ)f_<$t*GY4| zSokq&5r>-t*-G+q*VOFVYra%R@r>J~Rt#Fs@7zPCS}YKAZpO`I;-lgUb)03WC92-U z$Mo$a!8NW^EN=_fYOyxPRL6>I-K3UgrYe#}rLq{+Ao&VsS*BwNPSR7@;M_FM<-T*JSJBiPh_G zW*N>rU=3nFC#`8`-AZxLACNgNtxcuoc8#bjwg%_U;A8SGeK{C&fHEYBp$QGnWGs0) zJ>%K`wTlBY+nlWhz8*_6AD#rZ*dOMyf5|4CD^FePg3a+ZE(ZMJK%10e1yYKp^I(K& zrTravzqhfBHJZ4u-(?37o@OI{35M8)@|^cP`+3P= zjvIq<{npU#53FXnL@l{DoLG~rf!1?pyVLK1we8&b>H%9#dt9Mw~z&5akty62#d9LInvEE+8{5PzX#bB&P ziekS`T&WmnrLL1R104z~N7 z*E{`&q&BLx$ZPZiomOUp)|d?_Y7xg;rHy%o9Yu;WKnpEfq^y;`Z*{p=`ss^SvTeD; z8INJbdh3Q>4`ex|EA2xRf5aj!ar>opK4%Vm{0v4@PiQWVWx;@cnq8S8TMZPyWizi1 z`D5}*+skh?a7JbZYp-DlFKMts`kt)Oewh=~L;LYgR~F)CcK8fMoEw;Rt^LkP6y@Ph z?wr&xPdJG*TXX#4n?*@xbj7^1R{p?|IhMapSaJL5H;0oRf2i*pf2H#ZFSb*hhKfnI z%H3da1`)Gr#BBO~+LXk^rmG7`t6HmAQ{AAp%R21jwg42jtU4GAxiF5&Y{H*Ai&>fc55T(%vYL7zySB{N z4LM~@fXbMZe=19Wi+@I%+DLG5TLA`4f_&cG1Bbw1m;%FKDvW|@jCD(rHJr_R3Tu0O z3CQ(50&d?9P@PcW+XZ<|9JM)`Dcmcv>ogmo|+*0W+Z zuvAWmBjHS#4d*}&oCnL`eDK2sum&zI z@Gx8le^0{o@JpUW`~}|XXi9bzO<|gi94%ZC_H9X#t8W>a%b1(_0Fzk?hjhcC%zrWe z4o$$6T`-k_(`rS-hm{q1y5Vr1Iiiy#u?wclfsgElNfd>g#lKigU0mmj_sf-fPV3TX?g5l2kD!twYFB49e+Xr*o z%nRf={xx;s6^ogNmCWM_o)Z&r63?H^T>?(wo&8<7rY?(qq)*0QQTv=)VSB)5A2(*x%(tZ#?*b2>y`ziw^sEt9{9SNiWzNu? z1gxuc4R!5-(xI*dtnUPG>Tnx)V*$$Ue}c$M3Viah(HYH^l?gbb(imz80izFrGlhWR z5O5_4@W)xsh+|X^G~y5(2FL5Z5?1NH37U0(5d@{DG3;Z~2iUi?>0<#@v+3Ukd2l-n zf;%}X-NoK_H%x?kI39JuOt=>o!hO&P55RHoAe;c(pbfUO7e35>yMz67C!7n9f3nX# z20vqeyBl^h_EXRePxI(Gc#-|@ZP)|v!(R9tUWRYsSMVdef&{N&F1(IK@LL=JZ{iSm zo4NlT9s%z#_wV9z_&sy~9-a^HGxs0h)$k$S03YEk@G;&6pWqhw6d#7q@HO}xKZbp{ z55B-3;7j}o{!BUW6&1l>X)yeqe@4M~eCqG141S>L@DExB|DsdiKP-VCDFibR?@bEE5;9wYqLtzXagm*BG1ohJy>(11c>zq4ihR<_u0?xCIe{Xs}_AqU4oK8}L{I37k~DQ{l}z*@cO_2l#m-%Lx6Kaquw7*_V9ai})w^ zwup6%6Zh^{DOBKX7ASnx9(Q6 zhs#D=Gxizn>{HIabNP3s&vP47&zju@xB5J{+Z(a!?&#!rVt?Lge|L9DXYYIW>=aV5 zb9wM+a~G@}u?bcPL!NtNf1jsI2-;R~r`_EvolWMx+0J6GUfk;>_wz}Hr%y5>9ScWn zO_|ZdatxdfW$c(o;S89Ev!Iq!lJ!^xXX6~$g7e@JoDbbt!%n=29k`Yqw~ifm2|Mhu z@F&i3|AGzh9p_#@e{zP4xB`cBMmv(T*`qm=osTEuLe69taTa?l25=>3u>rI=XKm#? zw2gDgAm?`>&f(T@N^}}~OBC<2ZTq{(cmP`E;*s*!s9XyMwfFix{{;8 zH5>`9<4ABle;mW{^%T4bHZt}lxCyS|-1bI}x0~=6a64yDoAEZdA8&^zShz3XogB9} zbBw-+n5_oc$_jm)k1tz}#PlXkb84I!z;r&5vT*rYDQ8PiXvrk|0x^lWPQTrw_&ne$(2 zar7wx@K=0CyaEOI8>qlnVI{r+C*zyYjBll^cr9bypQ=;NU}hz_9Bt<@hu9nK>EukD zzxX$Je+TTfyXO<|f}JC|?K|v6&Rirxd?|HjO@kv+ch(qA!T~>kV*C)s<44TT$1n{) zW$}FmGx1OC{h#yvmZU#H6Z0Wz9%pkhFvW>vWc9qw%e>uUR_L!%+YROXKDpgNAouOp zyxli26u*Vx_#KSK?_n(8a9=T?Rom2V<`8iNGWU#gqlZh++6Z@}A@B!am3py+iFY+)e0&VRmJ+ z1I9^?nSfWa%AVcI{jbYp+r?$imhVneVG`fRH|SGf6ak8 zR1L?|T!_#-SW64wOj-yR(lKxuErP457CLEhhBQ$AmoeMXvTtHnVQHw3d_K>Eolar6sKx^a2Mc6I%j6OO&| zcy-;j4oQ;^wq14Iwx+W}&z!`JX*{p5eq57aO*0BX-1t^#_$1WehOtX)xuVZye>Pgu zM`Gbd*74IK2TGg5%9YBD!x7)of_=quw6mGdC-x?#u#(!$>@wppryj=#I*HktrNz}< zM>5g1Yhtv*z9T6eK^0Q$Q@XW6=+N$lnJ3^ct>Xl3OU%T#g46*gN~M`2k{Y=9jJWtL zjuy$X_j#3#Kc45?C)^jG^6~2J)>PT`nD>>%k>*9B>86c~IyGOe${8n<2P@UFK4Jwz zE(5^u=~I!998d&*=EMch?`{%)8=_yp>2q^KnF`d8AG7YQlX6HCPv`%9^8IDzwbd#c zTgK*Um5FWMqz>EGc3)O1MWesdbKDZS-;HLJl97(}66>83Djhdj)m>~C@Dje%;C;G4 z)-uEEy>xJ@|5k_d#CB(cJ1_4Tc^~>jF}yAER#y`B2lyyxck`jyQG%87aG~iaB5Fs1 zeL%#)M3n^eBz5&H*fj01s}M~Ad@i<6o8%sV#Q4vfdi0NCn^Zi;dlF=ZF5jn3 z2Q=haEgV|g>+4$o;YyU^utWVAu}Qq1I=F!h>uiZaunw(!u#Qq?c^q93j|UzXiynOK zXqHs>+VYJ%ZpyE`EQqyD*! zj=%8r)hyel#m(@QC|l!f$JNKZFZ6EFd_A?-=={=4Q<*ctYxp6D{4(n)YBb^#4)I!UCSnbXaywRrV#_Uu ztleKjeRn&1V5G9RZmiwigstr|71}61mra_`M;{OJ>F`CGdz;8UebQBX%t}7W*zHS)(j4GOu~8q-4{2$A~TgBlxrs+dPPQ z_Mc_t5zi6Fecu7WX;qBd7*xnrV8U9zdw{gZpO9BP~a;&SZ;#n}RiUCfkLL0Fir!rZ4dwqgWNn zeJNdxpkI=LPoUNi| zK}KH6B1JQl?23$}_P(g>B0WDw4j3IQyNlproQf)ACoq-{S=jjOSt3rj=jOBqHRFiP z+fh~wStCL7it}E`ikaitwDNxGSbtrI>gu$w2Su%Q$QutOB*)yYJH^KdAnL133hks; zUd&Pbm#N*(xVqXU*(XXiL9PWHa?^&iNCx zD0TS84ux)V;!-zPs$6OWb*#Z9)|n{hbf>LX-WjvkeXmdBk9-Lz!{{i8ef`q0IFG;dsg zjqq@5OoXOmta7Wc?104%y~^E*cfuCTTXt<^Z+_73`ihoqyUQw$5I3dhOP9SJFbYq< zHY15F`TT2SwA`cCp*ewDe%G4PeF`p-P#GSU5*bu)HPYSoN}ACAo>N06cT|KNQUAKC z6H#AtDy`;J%066J*8?Y=OP|L2_U=3rPU_1PQ39w0#8M+&bMRznXJ(DO?Gyi9e3Zb%=xAP3bb#a_34XZ*GXs?J!)J>n%e`vRBNO^)mBTM*^7(Q-hmV zzFKAGt&aqT&rexEn~I<6ZQf|o8&>`+69(k9sBme+&u%Q&M4d4I? zVL){+jwcQd+i;f{0FOcadqs-_fSVKEe)mClXTyyy{y8k-Wa!*=Dc)BqE9j`;gF z&Pg>y!+cAEkWs0iMKnlYe`8i$Wp>zhAvrYap&+ivy$+4D-JBKcUJ!GA?KM25#w z$&rra$S5kLjt7xk(hyHjQJ_a3I`0Xpa)ELVz%qfJdV(5UU=9XADzpU)YH-8i6@irG zW4W~#a>au1_$4@auBICljs;}|5GXnWg@p33AXirbdVqx)Qtauf4zkebPw)!|Y;cAo zaG)}mb{7r?1W5FJl01SpQBGr01m~KR7oF*)1~G6y+_u0VxD^`2f$H36$}9N8Up{9@ z9uKNJ zIoOID7Af(6J!JePULB_!FK&nINI!1%Ac2a43X1>~Mgo;wIMw0Z#{662g)#^bPoE?P hkz>h`1}8)Ps8kGE7?y4V05$kfg*P(R4pwmh{sP^oqfh_< diff --git a/classes/ssl/UltraViewerSSL.jar b/classes/ssl/UltraViewerSSL.jar index 15f6867fa86e7f3bb45c819cbc39f684b7f9ec90..c03790501157dfee62a20d33fc2dc2ffa10a4040 100644 GIT binary patch delta 39835 zcmZs?V|Zmz7o}UVZQHhO+qP|`fCXqNmT&?67w7EzsoYiGZ~2=;y*X}PzZ|*&!&Y!=>IHJ-C-yJ29B6k zm|tJlb9tLPo7b(Zu=&{7l?%)Z;6^e&zP592#%z*fvC z%(_Uxxq{P*w2Px883F@q(`?fLt*etI#?>`&4xF`56yKqd)bP9uNsb%gUNDGJZ=c8B z*J0Bf9T@i8&^zGIl=+j-z4^Bt*>@-!Ys-UdKC*p-=nJl^Sa1m(ZaCfIx#!Sf+h~^O zPKNr4l-oJ_DaNqdRFlMJ+t>6r6L1};DEhXtHx-#G!5^;Iw0095TCqd{8tnO=xln>! zZ3d97<&xF5w?3B8EpVqrrH;nCi;KI-a+mJgb2Ajm`Hb|YGxc>AL~9p~s#O+n_*B(P zY%m^PjN-b#ay&;D7+1%@70MrY%G8xr1Xok8@Gd=;u0ti@D)yADm%y96X?8%*5gaPv z1|Wz8A|#xX1tR70cbFZ(t!TdoFCVJ1&9L;BHwd956JQ8@@*q;MQ7eNA* zPUVaioArx?9yeuHHWh0oELco%O0vzZ;Hwe=Z+^JUid9f&U5}B?ce|R&M2%#Ros`Tv zb?9wHf)2+?Yfuk@*i42Wk9IrhOpn%_f=nq4!WG-y0aqp-E2gi#jEly1LHh%3dW(q59O%Bz z*p{i@GzI6>0?fcnIJ6&qOz@Rj(RKl6@0-zXtemQ9V-5BB6K)MwQ*0Z0R**yT7L~6XS}S|x+7Md?;2vA=v;HU##?8SKWarp=d|-z> zvQNtaGe$DTG%{nd{QbMJ2swKwsJ)4PK-c>GOIgFLKU7MHQ-MeKh5c!~`aIhD&FOo8 zXk*#_uzm+9HOiB}~9!!@bBj%Z4Oi{TA{wrsABZS9SpO?K8yUkw*HQ zrB@8_0Bs1Q`U8`BZW5^Q_W*up&}#~=0h&z*qd2ErQj+0-XM!Yyd|gYbK79f=j-vyk zj_%{6#w9#>Rx&`ZfRkI9_VlMeetbr`TH2krPMoN&QHIa^v{J_1Yt?odTB1?_eGmO6 zMhz#RAiZF9cDbOsp8lCr2k&A-qZN;#+qw8pJ^N+u!W`L=9bx)Bt)|-2WCFZ&D$rwH zF#MS;p`&>1YYvT!(E@b0z4C~nH{Jv94<*?!EYn~{M z=5OvkKpleIPx0JXVknnC2iDs@^z1>l-jX~0TALv43jb7l~O0@=b2eHjfyfqozapt z_f~&p3tmzxI8bd^XjZ7B{uJl=iEshF$&?~&FVGH1IFK}_c~`b{O(+s7iAga7ta%@K z)&baAcJv(j6=fgaay)gMef6{3!>D&$umTPEIF^i5ou#nx5-7RrlBSpLmO)^XQhmsy zK=?10J*tk>o%{=<;jIY|9l#!g(QLdS+tWhnDOxMj(EJJG0Zo2+q&;a+M|KV$e=sOWb>CzFn#NtgPo{A;~dCy|A3%q0fY z(u{E?Ex>lx z)aHV9)&#SmnpaFnE_sqBl4d(Xvn)E3Nv$gGs1o16fn=Soe%B#=mvoYd%~YGz78%Tw32>r%R2h%r8-??JVp1j z`m&r;1bHH~ynv+#S}k?*Z=4O>x`2SDb8s~pC&7S4GN=%B4BvbTWtU!_4s zpB!vmJ6**;31y(+7y^65)wH=xRus}|^jjNgyX#wH(%3?#D33IC`{|e_izMbdz^yD> z7>PXgsGM+^1Ynh@b=2G3*;)f^e(+WI4-s2p$hDlTx>wqtWw50zJvnF0PXTZ~+?Eti z-+UAUaeQ(dNF8}KTm8TB}|kQc_lXanvu zX1at}d3ieSk?+W8!yP@)1)%tW-H`2zF~D&bFr(T8?YYITWS*1*^iK+%+OzeC;Z}J6 z^MTHnbWoH*MCTCD@7dbi$E06!ttq6`$9Tq1(ZRVbCzgWz)UCSKV{2d*^djfe2<2S~^<03xae%!6@#1$A z%G4Nno%(X{SHXv}kbl8vUoc!*v5>Nms7&?w6qHzdutA@YN|H!JfD1c>0hUF|iuT=w z!W$)&GR<4UAAqBh@3?<7Ysy#aM<5&7Bg3TukqFfTO}wtrDY!a#?)tPVvak3Nge2IM zo#4YNdj3jk{$WOV1RnXOhWHSycq_vSOf-uo0Zs>gbGgOvjikBN5sm`fQhv=wZU`5c ze|}I3j6`l~6q?2Jq&;^tf zw){0lt~hs=x%KUXBwmmzsw5S%ooak1k-e&gctmuSPCQkFTwn;Uj8!?E$J8{u>W-t>jY$g zJr_(Z%&+UOEDs-kaiXllwHPSK7nzRON~|qrdWL=bb9rbbY(&B(m^TWNOf}S3(a_2C)>#ozlmx7zT_xu?az%BsR6um-G zFdmVNfsHIVH7jjGfl$#DlSP(r={*+ktJm_-N-;ZXA8XhQV=HO#L@U~^&qu|Y(wYkX zmk{|~&aO$OZ>VdUDkiIae>F=xq<3Dv!LxQ>;0{8@z4OLnXc=CJt`?U>$lb1uzZU4l0!@C zCw4AHb5U)j!w>vpDE3Gp5LJJ%6;P^Oy5qfDsuSLGM!k3VI@CT@!z&1AR!jSx%~*CZ zad&g*QR(Jd=muy=r+QC(v6$ix@W6C&fy4+scZ>&F;UL~3zg=|P%_)yoqnfJnaP(d4 zA3wr<1{IT|-4YZLXojSYeE+rpRL6V3)f$X#G#xa4_dlELq~m00rAJ~Y*>!pU9Vk^q z=jPsP;owpwwMj}*bn<0jpx4FB@@1?FxUm$z50&!jGPGcVrp#EP3X!boTlnq6l|r8m z{cKgK;MB1DYsvKHjpLj{@VnZV*>_qNV)#ek!`ZbUVLO^}Kobi1e3K6v;EtI+ck}zi z1PNM|4Rb%Jh9f#Iktb!yQTIIqC8Rs7dPB;JbcQp-w_1G@0}CWXZ@bz z|K$14VcX|>BY%e>=XeYrGG zU0Rtr3YrfPnh)T6f7)Rg08bi}fgg9}{_Y_*dP_c{0G6k-4`h^(1{=v+nCD=GyahCa zLp87(sxCz8ga;>+5e%mMK(!9e4nY8N%ilgbCFuX>c6_kUo-vy@T$_ovoNGeT7@gvXu;V?Yd^NYo zqY2bnbd%xDoIa^N#P(UMr7A!zqF1(12iFt~Z3TpV1)O6$ z)`^oX`Yj)Lr-7GbH;d_&;5iF`Vtdh^T%#c`!mdQu!*V8;Wj(29?V*e_lJuB7>c(F@ z1gO45-byMoG|pEn+0tbxsm}n^`D@GmQ&7gmDa3hEjkxqFvR=dY)Jg=6&6Vba81&p? zJ*aj9y6tmUwQG&P6JpruIRP71)86v*in^Q=h&Zlt3QSnP=&7{~BkPKxV=66D%nZhm zomn|Gw?{EYdgymYx?^7MLSj(Z$__JZeI{zO()c?De2Sh2b>MS*&t!SmyxR3jPFyv< zMUN71qq98}CDgeBd4senBYQecTz%M2n#GjXQHc zx$B0B$+|o+9T06PZ614w?nv}W+JmRsSa;w^3|;cJM8h*}@MXgHx9c*S+?^mg*dQs6 zs{0Y6C0SD~vUEGXPyptk&_*Z;m9H&D`-L ztf6vZZe`-v7TgiDZ7`6LgZ2e0N_AShTR_wVGsB468`=1 zrG$u9@m;n*{D4|I3^UlWI9jHm6G$Nmlf(O4E;0HibwZaq1`z5YfhH%)zan)suyD5q z1XT@rkD@t}h?@);uKeIgxo62r28`u>5HL>-fO0-y+K)sQll~4fy}1N3?v2shi||ID z((TsxrRS_ls0u#wNdt3zd!uQhgy_EQh*4e-1;*%~74fcKAF+BN%)o@dp_%nXu}5ey z%C6ZpKbxMI{0Ay@?{BS4|17Wi|F*pU+wr#aQ*c84N5Na3XpjHr!wxe8+J80OL>#|` zN|XouzpqWi&%yqmT`S3q|L&&#rvz7~@PC$c%MtuHVQkq5bw&PftwIVV;0=JGh5FYy zw_j<*owJoRje=A@2b_*H<~XG!Ts#MQ+6*ERc%lJ|%;1XBzt4{e3-kB%R-^rT9k z8}pHSM=*bBMdmJ{)#YtPva@+yuCsaGZvX%h$VONcaNUrrRoii7Xn{}PSU2|XV;g0M zP9oklzQ9BwFinewm>@7)z=B?>f>Z}d)i-MK>N7afDC3itD%Ot;5>cY(`>w*O))>Wa z%T4(q=aFN))BG@+8(?9t(h_qhk#4(*p;CbpV~EhWi0r&G`#axuN6@&sofCkUrR{Ig8V{{8J7CLoXiW2`03temRUqTuA$#hUHBW1qFVpC+@ zYgl$>{!jvNp89@02JQHS5{)e!Yj$2Q3O2c`%s5Te5%E!Wy5Xz%Yv0*R{&d_QpffXM z8OBsw{WP%N}ixu~G31Bp*1yfL*F@F@^u6CkT z{#%;TmQerMoLlZ-y@?lt$0w6R*tyr#>#zFjpuM?7AE0w0bo;uRfUoK!uYKumBDWF5 z$mLJZwYIr^8uw@cw_dx@qGz`Rp{qJ~!@<~)_)+Z6`G=F>kudt+zx-!#nnL1weXhUD zq7D^Qm8lh;3{~BeHnl_cbuI(2G_1v+=c?>Z&p@5BUC|3alByv&VsV<5Vm9x9iNWB+ zFuLl%9RTi(Ca7gefs-iSlW1hl7)b2sy3!^nHkNNz%uu6Xg7{)y?6|n&ow}Bg z`ptkvp13=SEY=^>8DP<9c$+|0pdAwl;x`}~3cy}KuFlrA@@7f6q z(2-siz}uQ0B_DMymSAs}DE9h0ma_zXZFGrvk!{dty+>*uh z9|zHbc$pCmQQzH+9zpH0p!$jZqQ=|AiIg$#(O4u0F{)1pj!6rw(>7PDPo${*;+~nx zS{Bk@{rlIctmUo);Sy#?Ra7u)6ws8GBXpA<{E#6t+yd8Y&3+6vc6gMbR2?qV`TPXbh+1_Sk z(F5LmFuYLzIvVunG9$Fog}X;8EMw{;*NG-CWoW}Q)wO+Ei=r88+;zwBXkO~DcJolB$^r0< zov4VQzA~=HnM>%cv--4%5{S409Gc0mGOjFD2vU}`S*>s9WT|~3vErJ`&|(=TTD)m# zpIh;I@~i)(fpn?qFb*owTKru)4Ud~&)pHVdI#h>VFRd!JL7Y-njDns6QLqNo=8R`( zGkU~aC3EmlL;DlBIWo;tJoL1-jeueGq0Wp-y7jWdouzBeZi`X6?d%lqLL9T;B&k*7 z^OdqZ*e-0w`SemZ=|qgS8E-q6mdnmk%^6th(4?M;hiZPE(qy~!{x!3*OX5vTtK6@I zgbd^wn@CUoI&Hm46|YwFz67kw)ut3NqELTmq)M%CL=JBYKlHI&e)}T0FaT&L`PVxu zWT-bN!@DhqQlQ|+k^NRI3EZ0bD|XtSAEDN!^Q$VEQo#~7OLM=QML;;KF$v5B6aGYX zp~r36TU-nasLbJ6sY&P-9eRGw;!I&*u;pJuepIUsQEC?0*I$W1l$!mHksPATF!aNl z#9$4Y31xT9U`5zX#k63&9}TdMNI7wA`P0dXs>eOaowwQH^&}}_)po5ZV#tgTk2q#M zYo*c2!K+rhB%#DtN6b$9`*xCdtk{+Buv-VZOoSP_|>p$Xr;9+to0c^FAOSAZ-z51mQpA^_wc@#W|N;=70fpY z!q8z1o#Y{z_w)2$bXv~@N0dC*>}2T$0&U;q*0uD z*;bM@RShBpiUaI=sUfE$8@f6zy$Nc3&sy`mr&nN0%}F<|XMBw<9ym=?LhbVQIlfY!f!BgQl1eX!kXrw_S~_ znnU6mB9YSWGypblJ+X;~9?M``;Ynl4+4RbB^%ya+9s(e*Xr6coZ zh76lh-k_r!`tczr{TQBRY>O`aT#<4fklqb!w!S~0Y4<^gE?iXjyw@AbqWi-F<_v_@ z{iC=(<_8$&%Lo99%INFPe$kih`;vBd&Vm+a&^L^CH30VqE1f4^YK*v@BK36|^WPOP z#S5V4p)$=0;&3V50@wF!yP3mOz;iF>iKF{u7v%I(=d8faT=f#He}%htvh;*dncC0< z#rbDoVs)=9m~WMxI9r+Zx13jSj4`blto24&Lz%i)_^mm!sGCNGz{H?K zm`fayLqOIm9L?DL8P33A^=o{q*G~?OC3||hAOf~e_-fi8P?js1QP#?P@ROPLW5cn<+-$5=NybE%br=-hpOFbO*A)btxFbH z)Jt??jqmadFW_DPs<#~HgQr2&z)0Fm2RPl_j|en0PDZh@uyu| zdfps;2NQkG%V^`>fze6hR4O-*H^{an1q?&^I;hdnn317|a#zyjt)s(@JD&}gbkwK( z3hFj#bM$2zm};HkVI=3IwrHTe_mLqc@0=TWsrYRXdy_*x_sH zof}wg)~~$J?*3r)ZA~G7ia=nAfmf-U1>&bUR02vFe!V47vPb8afxc} zB)w1mmUvw-HKJ(uDI&vqV-lgl+n{?tNCjcbM(=HQ%*ya6${E;j9gC?!hj7U=+U~Snj4+9>f*T&gz@00rJeHV;PW2!&%Le>`f8$pe*l+D2^#@?z zzM=mMz5YKRtfWd`&;Ydd{v}?RU(U@`)98%ls24*_gk`iwndU7?(rSpafqbov6CPS(u@H^3u@a;K`Qe>fQd%KS;ikA5 zk0XE~!m#2G#v)=Vk2j7uA#S~=O!iwU7aq=;)))G)X;RxL(TosD(6oX6C0RmQW2rKIx#0fg(&ymF>^MA6gIysb57>qjB4K`8=OwNr1lSFJzHJW zduqp=>Q9+Qvg0qd-492IoPg+@Z0Zs9eB^ma1qXjL$sJsm@mlY>n^--izcSk@Qdeg@ z1dYYs zzXTL8T-gid-C_@tYSwd(t$$5c#_v>92qu?|`U^(6ofVfrvgx~(g3H1rhYT%S zjI(O+v53n%!!cST-d)!P5%`TFN7+o9MfACQq9`j_a*kj|iXUB|^3P{o)SuN#$H!LZ zQaJaxb$(ymS(C$Qsf-)BLNtYa&Y|u=*PCtU0~n3ww88TU2v2%V4GV)AMdxluZ+Wlv zX*v@;wRV{bLCA>hL~+s-r(L5TccJ~RGzi52lfq!KppJGqr&+aD-wIYd7f zWlEM>zpY{BhTdRH&T?v)h*8`M>l-rAgWK0dX|OQ*EYltdKdVKLA^qOEov4Np`J5Or zdSwYKg>roFmHca+9QpjCj74sPTfJ}H6F|_vRjDi8HjRc#$golDX#tfEh0k!N*y^e-+YouwUE6S=Vln7%U`>;V=U8E-#z4qX%iYqVlMX{t*UMu^%^clC!FRXs( z`31Ihur>7Zf^z;IW2GKv6^^EUb1r`P57$5$eaB*B+|R6V@7bcEQ15|oJ)B<};(*76 z6R=Ar98p`7=(Vp|3b-oHF8U^Zy7t%W&w&?X1371l15tQFnC(D$j2g3AtW|~$l}{Me zTQYmMSokLk`f)z`T0g?EinAf2ydfLhVRGX!9A6{_U!s>=jVq`Jv2Oc;Nf-&v|NMbp=3!Ycg*-VF7Idg1BcEzp?H#L*JAn}yqTH|#($j;a*bk(0J2s*ce| zdWZ6g)5~UDxmYQ-$FW?tbG5c%H@E%}EOaV#!?$%)C};?_5Nm+XzeoZMCX7FT!U6y} zCEWxQz!0l>i_B%m8e?!QeB~sV{%FNb+?8HRYxOb$HSm=|SXefk?f4pZ)sQ9{Y|MR% zmAni<5Bj+pU!yT7EIh1KdgkiR(!+RMW}qum1P>fn@Z2;1JM0rEd&alibO-ax(o7r? z{V*E}I1jhiu6q@BweiI&rlNi31u!C~EeXdXGulYtHOR}wzAojjnsA0i?*V#|{C>-mZz2s04W2;?d!(p zR3XfUD*JkbmiPaRE5f_yLs&!$6h-MZ-sDWUg3;2f0h=P#Ew|#Zas~`0;(VWzEJ=Y` zcYW7_!bX$Y_`me*{t{WwY6{C$uBVF~j3&0FWtfT(_R;@gc=8WliN(aN6(urfH?fK- ze#RxQ*eFBDCT=s_ktv2gz)u7s;?ZJeb2snYfN$gxDS$SFpi|Daiae9yoW;b5(I;n+ zkk=#L*j0Ea7&#pioz}Eqp~B1M%EHHC(b1+I75$h{XV6_*7RBjm>rBQu?9(y(B)XA4 z^npX#qx@>31x^Fal;YvR?||S`X*~}kIGdWphyJIUciQ^pg>;et-~j3ae31Az!G3^& z_Hn)pEGgwUVWh>e(mY0>3c(uu+4dunnVa{s{F(AEwBTP4_e1#zQ=Y?~GqtsKw(7gh z<(5xdIy%_t>sFp{L|QK1Z@H=#bMpw1vCS3wNl2=?kB;jZgzqR-zj4IFrm4ErTwJ{_ zaycx_549I(0#;eONrSb1fRaWlCg-v#a(xmCGMhhhFt$iVMkHor-+$2)UhU=$7T7~R_F?H?<#H?{ z6>Mu&%E{FQ{yFLpdeKhZQsYlbNemJbPS393T#NZl)avmUf%79q`eQEq4-5{-#84Li z!uE6f*cHzy62ZmRym4HATL@Eezg@Z0L$) zW>vPL^tC!ekSKkStkWagRr!2Xem|9kQI(XdWClwCP)n~M?h1t&_6zDic;m4AJgobN zx846=ym9_7ylL(Hr(gSA8Abp}=t~;Rw@PB$Mha$bs06--u2zY3$ZFST;(}`GrLyg;HLYHZ0-60}A z>AucbG^m$e$ET(rYH$g3uaeDy)uiR7hC^XL6$QfYJ%7 zR?7&qn+Xjg#|`PV)(uXoOEaVTvHL8mW2uCpIZ;=(_G%}4GljFaJTsSYujG~y4<3IP zX+QH?+-~b>*AIXFGl#`EGDU&pX@ePYT-Xnmiyz9;92y6m`5ZH87~Ual%!mnoef7fJQ%Ykfb(Km~&OgWOVY+QoUQ##Yh-k z@=8V@an(o;yf)Mn`YJ}P>EqTqV)5xFdPYa{BEiXN|7;~F!xdqJ>;!?gbgX0wL-$92 z_F=_MyEdlcUrR+9ladN=Sc09*ztH92+o zXe8Q6=A9QNGA^Pkg$YuER|9MskBpFS()M0gqjSMjo76|J zH}os z9ONAQCVKY@c655O7X8f-_P#b>1}Aa1-bhvF%%(H=2V*qzwF6mA2?-f6WE;EqYzR z*8sme(*Do3$o_ngT+6$C)E4pw%WbE%Y_U{1hvVKQv+mcAa&@&9&%>;IA$mcdvkrAD zg42PajJ&tKsz!Uh-K}u@-H#h>+cx5xH9#`W{PxNv@>LMvC2{GGxk%~_R*T7zYW`7I zCdx2x?N6oF`$z0vOfig|2>Fq-;-0f2w8v%I2wTJw%n`(R5JGn%iygelGG~7oudzCK zgB>(rf$^)D&wW{tYXKa}Hd*=%OlbjKs3`K0Pic{3>5M^s$pih7qAqPE6+y=`{*d0< z3We=(}{krGhX4Hu{}_RJf6GP8Zet)w7Fhrafmw9FGs za*&i3GYp7W7`7Ap#c1^N9Amvf*e9rd zz~j14Phb7)btV*o<)_*eSSh``w~9>c)tF(1Rg`7sp3kBKoA!;j3^!miiwSd*^T z_}IO!*HCy!W=Ncg@EOtY90=%=*#z&1Gw&JK!J$J2A|g$T@&x7j7Tnh^qL!z zyjcbko`M@85^h;UC~l&3$ft>cL^7;sQ2Ys=rexTgO&ef9R~xbn%R^d1Cm@?4$y8Dk zKe07V;sx(q2*?c_C-UNKl`T>yYhq7^*A-p)DBt_XNt+|DTi zDZ=nJ#*qOx+%h0C*aNH|e7X{_4Cfc!nAd^7c@rzDR^0j%5IhYlLF7b<7P?qCz>7{@ zAjYL{F@%0&Tx{xPrz9}dkEsws8E8-B&{@B_IRB(hbm3WhYAp)X@HDjM?6O^GO1}7+ zKvtjYDX0Zx<)Pr0_HsNq0k{+Cxb~&M*)Fp^;P?(GSu zXTJ3br{})?L@cg@SGv<<>dfHLKePvuE=X}&ccu7^XO#4B(Cc;F#V!o1L001*jK{0| z#&fZTMWA$k<1)~{#mILDuMZf9Loe^%e}9({-qO~u-a!+&cn(qkd@+3LmfiZK&Sv?Y z_s^Xd@3cLf#k-Y&TV1YKeWYF;;H;s`;+-(j zjSYDF?+t5U7Q`;lo2bL>^Lqk{wQ8RcFw%3o2&7EpbN2*Ox% zC-UB|1EnIrWUCj9*kAQ=8H10V{AD@kxE2#EXvDZ-Vp zG-jlDZo?m35Bj^AoHuLwkrGSON%{)#{Fq8G5g2uiKmpjix<&v>Kpp(Sr{Cc(8$d7o zUq3;K{9ls6u|8D?0Iv@{poypDKSP4BFTCtNpXx1^E05q-}Jp?OTJS_q2k z^fjq#1T#_hOzGm%q!cz%`eyf~7-9xr_hpqrCbNgvrb4FQiMN%@wSa79kmvcDm5I@_ z$G-5U2_O>!5fZ(IuyR_=Fu;>9%Z9LcI+V!0lCXSQqLa9Q?%^1=hjBld!b`7mn%oHc zqFFMt#FI}y)514d!i!HkGt$k2P@y+2GJgFS(umkO(>PK$#G&iwXKfNj7q56`swZFe zx}bWd%(;6EbH(pw&CF#_KBG(-gMchC^)wDIJ%Du(iA82hR)E8md%IDFhK4rp=&^f( zL~Vvg*QuHju>;qRy7 ze+0-VkS9l^OigX3OXDDQusp3wN*rK=6ycAZ)h9H29yq)BhYBqe3{KZ+ za2>VUz?{9BW5!Z70?fj{YR~ZdOY%m!vl@U{jx!t6hI5-Rnmf!sV?|O2{;Wp?MqXm5 z5)jcAgRBAul0OMVAd0+f&O~_&yyZW|B{);o)oL z%Lf9A;DiyVi=0A!o>Z)DG|#BqU#xpA>3wA!rS-{~A5bv_4%u4Dakf$(z7W`p=K(-d zNoIMJz^8sla`U5R%T7MkEJ#-ukv{uXLX#6J$j z<><#JiLxcq^}k(hrAF~POBZqKs(2z&uO@%lFRk}_3Y1Q28Ij^%mG>~3={|i$P`BTD z2GWD<7<)U-RA&BiBk(NedcDj`!|AKwE#;ovFbp-681jK1v%0dXQ z&=Jc+5MN*ljCofWQah6p6biT~ziq!MZ;}!~9i?$YehkqDB-%wp`b_;4Onz29OC!7M z*0{u0X%5SsI6Bc%ZkpD}XJ?$;M>)T&CRh5(N$F~lXP{9;SxfS%qVmy|W8IZlq02pX zH^=s~RpDGXdr5-f@&&a1_&9ePi;ORRHKm$Y2yO!y&Q_#g#KY2(CJJrU*3CG zeB=s_pc}tjFVW3gK7I5EGI%*n!x3@B4u`b(EqdhL8~PDf2^O(Jqn)OmP9x;qi~A)T z8DFMlPGI2OsaNzW)_YG)A7d%|Q9Y=m7hc`dU-$l^Ymea`?*vGTl4!@SEYEp7rZsOa zS75b744h!HEn3^jr2LV0emzazL*y!-GtCc~#B0CXw;b?-r+(iOcrl2yZvGoG_qo=T zeU`Z%g9I*(^_d9Z3{w<7daF4V{eoqYv-;|-ZjQk#$bLATuPb%w6UKLn@l}wQ1?y9O zLt!`cBjWHEjRvr}G%cDq&KNopksk3(cr8i~7l@8tkP*o9Esi@{p;54P7Uxon6TyJtGt*FDdafJlR;%g z0N>dxMv+?oa+>5Its@%eEa_~;;51Pie^|b$0v5E(JW28#|5{R@oD6eAwz0jynq`^Z z&wjuMI0WUp+~GD*)B$xnA20A2SXt}Ft}YG3IgXMfG{l)JLe85;7m zxP6?rMFo#K6Kn3%=JJgBr!T4yyv*E-A~EZ`k^yqfy7-3p=KX77!)D}B8z+ivJk8t! z9za%Z897qj3llxXw9!xWTzHqN*z}_^R_-cs@ZJo;zar5sD!)ssmM)jl>46ZkHi|q; z=j4Qm8iMmNg)Y|qV^w;hi?rnZH5{%}OpNKnnt@a7wDjDN3x0~^UT$UIFz^)US+h}- zodGM9$C>km!6S`w4mTD&8x#p@{1wIK{&Zd8?_&z!$iJzh7M)bmw5ADGhHmJLXiwt@=59|-_fn869iNX>JM-HYVU5n-&<_^ANh|5{{Zj3Wq6e;>I>hcN0bZOy<>8I8xQmzIB z9v<$t1!$CA68n5+`F*6S{ob#rsGK40-ot&j4wR zZVJaZAch{cEjw+CJEaGAVs<$Kt_4y&WghR%$@kDacbJ-&*A*!`gm&!D<%7}{4W&l0 z5-g>qj5FWgna$%EYYC2U}?s=t$!Ki3^+q4TjCpDltWaHC0jXub5Nz&XOoO z9MwE$`UW5_{vDLP5L57T1{Wjd5`YCPbqRi2VYj-gC_}lv61Yx?r1m8TG?kEuwc)GL ziY;>)3#37~wxh{6r!_T@Juc``d!-4YI z88BHM6zWVVxIB%VLkIlSi!MrLP=s#mhdPvs<7wB9hYN?8P+V5Vw*0!#jU9H;YZ|HB zlhcGDozEc7CjR9ORdt_20IDkg{7viv^Tdm|4^Wwr2w zcRKjw{MGQ?zP|&@JrgEGaFU-R6w!Dy5>#Hg!L7SEPpzoAxn~=&fUq12%dqm#KMpkh zAD+suBhh#9{iZEu<&qXSJxH(ovjSy&`Xq-(HCe;a7Joe*ur6U`*EJ-}r)5-aF{%^( zfQxCs%~*zO*u{{)GnxW56v%(JZh&eiYGqdhF(a`teN(8DSj)q!zQTzHzpCXI)Z79e z%*~W+XJr- z8g3iLg=GtSxOvDS)Kz72e@cx@y{_ju#;;LGMmOCzREXKL0Ep0tVyVKo5$sF+?}C_? zrW255BYiA>YWQ9f9VOd z45ZmJrLln``S>A86t*yGIbULk?Kt3TN6PC$k<9slJo(D1n`Rk0}$nj+# zr;>R0s0IvJ{&h;B*j}U2rX0V1UU5M)tCOB$>+ZDBh98X&;ivn+h+kz-QGIYK8;Qs$ zG^MFARkpwzcrm~1f4#gH<(SBYjCyI_1+sv5N5EQaZB19M3+t7@i0V2^Pg9D#+8$_Qocm&^ z;z(nzI}2|0+RePhOAxppZ|w_f3)h?+%xOQOJb7hq;y7)u8W)6xpV|JZ7`lSqMTP%<2o(dd1e-UdviuQ~0FK^e zEtDWpBPbf*jxhU}>q)8JQ+o63-$j>8uXB0nTs&Vt3Z!SK$)NY)S5eNQyZ0=ze|-!G zevGPSy%D*8{S=hz^8rxsOCYh5^iOjg)sFZOZ#b&h;GrhV={Lv^L`{}3x3Jr7%e@I(ZfQu;1nwe@WH0whICpZXeFmBsNH zD2zskOTEjWi|LECtu=OlK;`T^MIhS%JksTDI~;7@g#24D4WfH4=1R&Ef6Z1eu@Q^K z_rLLhP2qJ_1^X$J5!XDX)2mKjl@fZVJ0EpJNi&)ZrV7vRN#I$Ioc)~IslY&Y~*|kB<0!BLvQ7F zf0*75{Rltyd_M{)(Q=Up2RQlPck`_{0J+U<%)gxkcEmrMi*T( zb4ER$^E>sO3{{2dO=|ZI z-Lrew1y!=-l-zN`rdeC!AiDKdzCzUOX~H8b z8*A1-`0SBaT7;XC3%l}$es^5L9b3*AKXjB4Fj;L$*(cBfBz?t)JW7r8Q26yea?90m)KVD?-=3@9M%tbt};OA}Z&t#|CKt{ovySBy6th|n)4Q6lZsp!w6F;Kz~b)?H% z9I?~Lu$s6#u-MsT7D*XG`;s*vdP0QLo_D}bo@tM3E`=ZcNDwpEy2Qp}%PpXH@!;_S z*JwuI)%tbR%@t(Kl?Er%^@5$4x0+96=Wtvxu)NjNLfDe?!~63hbsh)sgS8XCiJL(r zN`X`ewo54y9A^{KXE zz06bxw(CA|R0j-H5o2t{y^&P!8n5uy`eb;mR}eRz`!4JJWq#;T7BpTVl(;Ebb$B5E z^@-uXgA8}AwiX);W`l@)apK}aH?s=0oS;hfsFuH|5Fa!%xdCO9n_hmB>y2-AYRwP1 z9KX~SqLEhK8Zv83N3h>EI?#vs8^>(M5pt&**c!~I84Y&Yga5Uz*MU1BIAE6vj->Np zt>Z>urtD2>HXxmd`0sHOTC@;PLIjZjE+7*@7PdcM0%Bi_3-S~_9~sXId_K|=%o}|3 zNvscE=$64MV&?k_)ZF(CC~e4*ZaaskebNX)UzdYJ(u^2`?WFPAUB2rd4o?R|v*LyT z;2UPFUC0;Y=a!L>urfXZJ@qDBh!@Cy-x~+2eK0Zj#>q*Y7r`AdW{?C@w@^^M?!dxV z2mxfuR75Bivj@cpMA;Xg$S*$vcl)?vtRrhA~TWxI~lA z$(EUG(YATOTP6vO;G`A1;|5_(U$t#e&2h|wy4GcD(>QzWV9trxglQ*7TC`~u<>=6l zJKO7EE_M(h1-&k7>*vgs8*lqCv${hsp~a|C8|QT1)3;Rk^-gfwo{bOY2)(meAX6jy zuAXB;T{H1?^Rv{?T+U0#bHZ@zPU#EmMrGcnSi9UchX(E9#CEE&{e$h72v@cw4SI!f(gf z(E^Iu9rV_m2S3N{!4L~ZJRkg>_7j@g-9kjuC*Zv4SKL8<-l!{ACkn4XsqN~>$4SX= zp%aamNtQH}^DNnX)5Z%CAG66}2J6U(IEPoDT1J~6(xYMlEzyq&ocp*m^(g0xO;1D`rS-%dK207{JH&cu0hq)p^JgaP zGR}}Zqw4FDdNCm*g7+xSgz@NWM`Ddo<2u^eUFy(E#)?xu_n z`L#&}Qqe~Qv`GY##-kNaNFTEJl>Go#BbrUpehl;2dy_FE&mfnFkRFW>>a`fd6T(Bz zPIO^`V3Avi)cL~H`eMp_G8$^oD}Bb&M52Wah64%*hsYWSy!t&ly96MJL7 zTb@m-u_(HnYC;K+Yn>X??4fx!XqJ#^VhGQglzBmfr1x^$()(oNJx*(mwLWs5z|eyN zOd?w-Bs0A#>87EohY6~jAE8{cfz%U6q0ZFi#rMKqI%+){P9&|N?qo*cj@Nx+JzDB|K11bZn17PZ)Lw@B%A9YcPx3zmD-4sM$wEdNqYu99I=ER$EXwCGG7`^7r+W1TF zv}4XdGL&GR5eba6Fv|FH?lf+RUe%%wriC&xAMtHY`1UpQ&x$M0z4V>gL? za^>KZQ7=9jxiK0OsPt$TKAo9y+#)#3XbLXb7w0yu@RLI|7lm0a$=oQ{QAjU(?t1Uz z8rn&qGz00GTdo&I^$2>07GDfiBJ022VKij~zeCJVV(yx*220Q=?gi6!)UgABf@7a# zJ#vXjDi_9-K?0_UKyeiFw8OQv+U>`i#1Hv+Z({eo`7Ds7K*aj5uhbtpD*rT!*fmsg} zRs^{qaf+e=CPWPlw$$OrKAJ?0von6@FJ$$ zuin=Y@f${q;y27TNFKQe~6sMLFJ zyZD=sdu4Tsc&pRNS!mTQ917usOJ)lB5>&7@WH7(=L&?o!;*tx>XqgNF8`GUxkGh76 z4#%FmxnL~6=Q&qkp=*aDSc4O${>6Krh`%eAoD$HAj05UVky4SEi_&)%l{05`_R*Pt z>ZLFZFYt;PUTy1>xwweeyU6l{t; zLg&u5;?pGCgFo!;k2w_4$ z21MX>3?podjPaY1A?yIcSsenmC@05ru{P!1>rWbP6 z=GUs&fqYnnN%m@WkYSv`h-<=Fy9k{fU{Hq)PE5OS;$FN2(fG!2Z9{TB=(P6*PTzMC zSGMeUc|M*K#V1EDl+tc(e&XpVdUVI{ zF7Y2Cb18ekNtrYT>?#45Bs}^A)mIQXyAD9vz`H4%)ZZq%M&qPOVm7VSCa6ZUe8T)v zZR2NAlk%rN)Jj;Bv_9SNCFMrV7fnX>`!Q{+YJM3}ie=T=@!rZbh`v=bzg8getlA&+ z{i(D^>XTH{mb!j{r?`=5Ahp}Z#AcWhhJ zC3V{!oeZ}{fl#*)UMuY5{bn>Mh}+etsqEaFhOv^m?aL>r?9V34?W#|f+Nw`j+wf0x z+jM~^TW!22zELety3y^1SoN9K)mq|A;{1YV(WG;{$U5NJ+h%#7?m<++6U6zOAFj(Y zqT@SYTeBVif`K>3f97%u)#VR;SE0fYafS!LOihZs80cxGUNX@@j5I-7-vy?4V6Da0 znwd0X+vX}$6}Y4BjN`&MKb+0~vM*$8k4XWS?6pVYNlaGCj@$G4PRbOZE4IzH-5*=+ zQQnll|8-PyAvT*z_#qnr2YzD7Bo}}b29mv>`a6K|ikUj;_){bRo@)BesPu!VE=_R2 zA0)Xhb02Xsf8X%|nV-}@G!5eP68!>mqyZzQ4pmGGo=-#Ct3Y^>Hdi6|s`8rcss{iI zw_z$zWx>zzoV0W|l79g3$tUZf*VU2C=&%uY$qd?|=F0@IOo($wJlDv!Mhh{I^T!oz zAax-fF8iZK;uFC;qwp{L{4@(e-&TYZE8m3TT}10H;d|AA+1~YD!@1hKGSVWHox@Kq zEMc*ifnWrL&alpe7ALh(aFR!zCIrAeYn!Nh+4$zx!}mdpf8A*2iVs-WvFcPK26@<#95j!Ni$O!xHfVl@@uBrA%4Y4Vp}?{-xCmOzPMh%a z`gqh7_0G(?(@6AXKIM8^aV-Xv>J?Jw93BNbHFc9_9s{?E(L-+cU@!eV>RolJD1V!% z7b*1^MRmkYbp{?a{y!>U1f>dtjW)OnYKUGfHY29$DA?5~`8C;2SvF(M%PxGHt^4Yi zY&{xr1MZgyn-@8U48SELdj_)xz@~EyH8!S8E}B6cy?ssv?H%dX5knHgt;-F&Q#Ds% zNb(KDVbsG9wcJDyj938`u1*g*JE27hTy=X0{fJFlOv-qrMq}04Pr42yY>&tvmAMH} zn90R4Q8sT?2lbg1PnWfaR_$Nk!aVOAw5Hyg<(D5+5o}e>5nZ#dfK2f4__ zl|LL)S+C~b<^y?KpSG{upHtly3%d|yw)xXm2y_PQL(cikXAU<3=^D%q-H{7_n&xM* zyf<#?c~Gu0!<4~nfeDzn*j|JSyz_1G@gTilGXSybiDq0zGyc_qUbUyoK)x!_D(;3X zBbMndm$>O;N>{^nPYqLRAn^+5sLJ)wqp_%pI^pA32Dqfy=G0gfJiTOvTb4rl3Dd85 zN)zx?PR^&RG^!fG|1IaqT?a(XRK`E-rhYVXI^r)2W`8pCvJ;&Kq{z!o@p*ON;TF>J zZ0AJ>Z1GV4u7eJP<(hU`z?IgSKi!SRNTZt1`!(vyn|yx8)K#2v<}vaKqISp*@YWh) zT+-;i1s>>`BHQ)Spch!m`vvIC=LUNT>%bk}uAq9>cUyPdUy^xmaIr=u!%yNEo6&*; zSa5#;6hJ>T^-SvSR%u>$0euo;QTD_h;g3M)lkW^V$YDUcOh^#1~-Lb5HZ~R>5 z#`u*h%XKE4-i6~+CHpg@3t_Bc#VNCkAYM&V2&knGTfMCARM&-9r@S^4cj?oiU0bN- z%CKGR5XjL=!bhi z)1ye~idnTcj(?f=T;r}tvNr;{8hGIJM1ocA?-lw6Q(lqa9R7x3SvlVz?H^QL%{Y1U z7n)JY@WAGYy-s~^fA&(>Pvt zYAu7b%*L&|RBAY#TCP&%lAX>_zvMyrM;x!lq$K7zn|n zsAh+qp#rf2095~=YUr}*?&yg&S)%hHg1kAL@^Dtqp{DyWuwrjwK}T?{F0J1k?j8r> zYA>=ja#}PiL9Yu@j3)VkvH;fdD{!-Le|c<($({hi`p7ty1B|w1*tpIE;@6)#ulb@I zndr2vHkPMEgSmjo*2rGV!qi7yW1v=HNyj^}=3IM)k>fa5*v%nN3W5k9+qm;1vE#iu z4I$Cuk4Z?$p=Ai^Q35tw$)LqDp*9Xoy-l`>rLy5~H&!@`H)O3@OzLzY)|<>sqB)RV zFBx8YJsA-}8k9zKIMzK`Bk14oYri{1z61gvMLPa+Od&Ux4}OOv8~mVayCnam!M|Gb zMf~3|LjrGbN14u;Tu8ce}gs%O`dgZ^JGHWO!QbMCxYo zPEyMs8;R=~nRII+d+BURaBEpnLTVI|noy-5P_^H{U}1yO$!CiZrDd|q3azu1vMnF2 zbdp_fXJl-(6;eL?de3%U=lP#|&bF})fgs#(afedh?|@?)v_0?%pnDwTBOVz9DmT8l zdssq6mfYh58lwF8qb!Kie_DYA){oG5OWXjJ@p2r2aj}B!R5gkuo)sZdFKVV>*r?2j)z}-)D zy#M^A3>Xhwd0-&?2aj?R?yWxD@$?lR3A*`ZIKCPX)KfO#S{}X3L$n>TOMGD??13WrOiU5lW}xg~*u5N4WxTU~`4ckCl$a3CjC zBMS1|3Jq3$`sGp5e1JkEM*h+$ngKncb$hhApIfKS*l1~&Rw2A9 zHl2H;40guFAqZlZv~FS4CfwFd86CUTSs5GK7P2VBpkJuzvxD7^{e+>spXLVJMd7an zFlasS>J`H8ojio3T}Y?}cIF9Qe7+s@s?ojg`<>1aCf?VhOl#t`SRQwX^TDEyF{9Bh zClhy=+c)%u=!D!DAI>*fZa>M*{Z}VQp8agA=H@TE*o|>l>&oor_s31w_#JJ6>sEMu4aa;Y zbxzEip>vXX0F2uFP+xj1$NbcbSw)CP;XDJvrgjh}`;yAmaN7}QD|NCypC&dQ@UyM{ zI^Xq8FG$wL#?sZ3^acwa*Vi*%T)J%O#+uW0=uh`HQg_lMVlL_v)YtcR{1@4t`2j+& zf`M=>bK{g=D~mFAc7NYQ(lOd&P%&i`9!jVK$Gz}2ZG&sMEl-`J4z`gow>B$&qM6=! zBdgdElvxC?Zj`q1Ism7mz}sF9$o6sDFE%s~;Zz;8<@Lh)(K#@bmA;{TePtRkb3nIr zDYJxvSd9r0>JoZ>c(L6K;zcX$GWV_7X2D4i=Bhuua&cd)t)N|g0 zZBu=NvyIQ>0AU{07ZH@IvEC=H3o&O(!PLkTxNw=Q;|=>=P~(nrxMIu#1;q0%{!pM< zypYjch)sdyrqy08Ea_s`q|*)?qYhotDw0#{aXD~r9u8m6ox$BC{3!UQ4bhyV8gezt!# z^IhhCo>)R*XvWh!0w?AwYFH=HL&-HXll2Uej*YIf2foi(%kQ_Q3k`)}QI!xM3-Rvk zns{g_h~_K_nXtJXH)+d!n|`jHfo0|7GQ;LuYg9{2ewt@zWMC*59wC_Y1|M-C?4GNo z)`=_AUYbpJU3~#_XA~cpl#9o$)6<^5-DS4%(I}92nCuWO1`5mMU5&Wzh$(9!d9XbF zyqbZzioeLLgGtk&pz@d1?&{M6Ch@r$1iBv7#yag$1UzZ{@|=7bp`33N-R|6l812(b zSyDAOH`FcYiiYbrTWtm?SQYu@^GOmw)flV)V0k6j@KR5>sb!JOw2Q`H``$e;20J_j zQt$%H0L$UR0xmxXR_pu}r3RXhB(DThpWTwwh|V;y_}WaMe}KUWsH);(pW2QUnYH=o zqoq3_e)maTHqorovNL;j{~c=43L>(ep%J1NX^fa^w5U^FB%(b==Ee0`TUFlD9oES; z)hl(rSFTA+VVhLdP05?vDsvGpD3wviE6m4nFez`E1=^98Wy^P(LHR3on&g`PR{AaR zCeoK7Xa+xjRqzL6`w-q<5n@%uU7+H$AAN(Eh15-g2d$lTC82s*R#qVjhA~FEn^RR{FAMlgrc~j;% z|65;|4tQeI?vu5JD;&48eF0u4T5Gyuz$<9iY?*14L(&$LF4H=FLwR@0nrS`y(KFjs4{O%OMi! zmvtn#NgfH33$(GCl`ptE45td6XzxTLfC?Ld3bex^(H?8PKVh>J!7@yGhBbibGmDGQ=Iq|tK)Nf%oj9fqlaTutMLDX3YdX7)BV1igaOzi6i^%df$pV_{0yguhiZqJH z74?OdMav9<*zLFZ@REsAGS;2O%kPenEaLYLmC8d5xi<&H_%Rk+O1#dCR8nPTr3X9r z{!L!1A(zJlJe_nok0H=1H4>fH)AYalLx5l=YP%On+!=TzaGAk*@~Y+IJ}Vjmf1&In z3TQtf>DTj%wA5JfgIMA?_v2ycJMTqfb7krq_M_MzVX??(PX`qAFI#J?Va`uXye}M) zq-6w)>`N7<1`Um7z&O!E&0yOZc?D%0LP;o@x3PX*k$t~@xXsd z1fxTJFHU~7FAQw(j|H&54)6!QqEdG>kQbvBKlt%5d&ol7CNcehFn0(f>PnCo;6?kr zBqe7_!Ndr!d&EP?G&se7abuIzh&6nb!?-m#!IY`SP%C5N$)-eW05s!;D-=gZ3s=eN zM^ekRgyXqg=0{AIc$sc!uD+B`%0L$b*vBiPVS?|IF(IAGA}pPOrxbcD@s|lf#CF7m z&in{Mn~{@O$`nf-QXa-ZeBr4r4I&m!Vb`L0*ODm&15n-sk|(e{uipglqzL$xw`ID(eB(#bPC&;&qo*9P=iBP^8BVrz;<-mdhRvOoi!q3F5R zc~fQT4;`#c1PJ?rMXM7?Hl0xzBD|@TWAl@&LpN?@O*#9z{OsC;LJJ%1Y0;f!mAu*l z9opMC)oDtix?G*QBV&GKP5A?kdna~e{BoxpFE4Q9wN%1id{MI{`{}1Rm0fA_#YxJP zPB&a_Y0N%sBX$L1@ThlI=|CFps8u5A^E`@c8R?=;jiFly_AP^n&;|Il+ss_Z@DaiFpeQCzxHjbC2= zA{|DvijPeC!j`-e9m$gXF@~@aFodKYhI@&M%g-+9CZf? zCnX`r^!SP8CR>g&071&m)$~!kC!sG5etNOfRHI8SDtT zp(RKam82kHCWTQS|Jmn}xl(sh_!xz~P+oa?c;eLb(x1F;tZRrFJ3_7>2F%oUqkfpwtXljN~ z#7twByEkyLh7EAL!tnsa5O$|CpOnz4qyo<9@sWmFLz5D<&2YosCokNC%i6_8Sklgj zUsljBiL6ywcln)N46Wk%wA(@{cOKO9W)EpAx^6K0t*_?64u)q4UOs^15 z)oI~?Clo9^;uE(Bv6V`&{<)4uEBK>Q`1yR;Vv0Fm=$B~;NpSNrmS%oL?S(s|7H30%L0b!LO#(+0GA@onJ zVV%v`*7qY0DwRgH;F;fl;+k}JQauejtjAys>M0mcko2zz(Dt82G-^M9YZ z=5x&a*V&-tH=~wQr^7T-R!9|bMu3lN(x^Bw;LRmz7AP(VcynbQAc5k6trC`WvPZ#o zh`_mq$iNvIRl3DL4V@lM+UDFQkvKOgL2nwNzMcFf4&VfJB;BDD=P@lDa*mOV@eDGA zJDKK+#(EAZRWlF5l8q=MIkSm|WlfBd11Mdc5wIckeEAr+nf^=3WZDydG?%$8RJV83*9mCPEj>3V@h-a zvQw7_Y|6ax5L&{bDOlGLlnAZ!P?pBX7#qMgpIM_Qz4H)X(gg|?PoYfiNE|6ZhR~!E z9V^Ow=F-gK^1y5;ovqWwa6r)orL!5AlL@#%)%veUU_i+c@o>#lk(>3f0!lIa@UsFt_jh zw<@Op;ZOc#HUBhLM5t3_bDmQ?R|I@L`sPSy7gqv)Km^wwtZkn$FJb*lSJ?o`5=YgSCg$TBOEZ*qo6kJ^G_V zsEGCbP~8y;fP-74yj)unv|XF{JQ^p>E3PN&n!~TrTKb}skFu^|l3TYS zBxh{XwtJ7A*-`$y4wlJYyCYpf6J0nU`>kvA`>2Qh%$Y>D4U>E*gB>)TX*qysU!A`q zMjwHAadbEqD2CmQD=>vFP!==p-YAK!cz!6Yf9)P!KC;y16|VVQlhSt0UA8$s`q%@) z&RmL7cu4ljlK$iRh*|EX-ZR#*=Kc^4*j*mg?efYQ4UojXa~TJV@S2A;jClrjz68b~ zcfLqrLvN@Etd3H3y{KUqJP;II9m4DTRmRl2J+RBZA!7es7;W!*DF^hKj_s8vM*NM5 zA?|pT`tc*I5^ZSdyh+db}WC<|0s<4%fu%Z27!dRcZF7rND~>7+O>>B zsci*t%c_xuen{cLrct;^ttZeg8i3d?RC#8 zofhc2uAa6dT2;*Wbmtbz0C)Ee1wdac&iX+=CX#d=zfeV7fTY5QJ8=r9lX&`uR+M@A zW|$;1I%i^vf6lBuQ0T|6It#Xsox9Wk#xGoY08~t~%3XXq8R+hQdEG#&3zsH9!mkH) z2h4Mq==gf)CoO#ibFMgeBp;9$;hqW9lK1$(Olx?&KS9FV#=J$1?c^AFqi7FSt)F=#Xq*0yd zmw3iwZihsy%Y=-+1~>2lfxBSSMVQY-NhuwEQtPA$z*B|3(N)w#5)-4=xn5^J$&J)G zLZaw4k%E$I@Yn6{?=s2)T#12EmBcdv&ya=l!jcs!7oKRJkpDo!PfnjmJ}qLA z2|X2`Xv%6te~g?g#oj&2~QrCKMzT+AyG!I->BBYD{7h)7TJd zP~W1V>HKli8-MkXDMq*t;w1yZ%P?CbuGl$dd8Bbvm1Qli4k{9x`YHstz@A=0LFQ9@ z%GfWls|sWv+YH}J)VDDjg&*4pivE@56bl5DMaw6%2TlX?qJA*^GL|Db%Ui=s1P)A} z#*T4R1V1WOWXpl*q?>dat4uavu(uEOzeBy|gjCn@?^AXcW&TZ>atoqi7jRqx1yX5E zUopmV6z#BBtvZeKHB+M0P%w=1Tn@?CTpm_+Dytr&XZlKyGptbu6Mkx!_Um`$&41Ub9nY0iQw;;TU zxTtl6nZFN*2k#SF7_vqTLfOb%#eiw5OiS!(X(wUrSVYk2Ad=5lvcjBY&X}oB!pZr{ z?j%%}s32*G_RQxu7qp+h6tjpU>N0d$znP- zB)GhIkUE>Kj4D$@mwCEMm3sU58e}m0sh-3FieoQO5GA%v@4(2Fns4XKbc;N_W!)_- zn>e;e%gWW;wRb1aIF7NJ{scy8-DtJu2Ywy9e|~!AZaLJV<=jHQSG zM+ZHi15~wE;j(e1fUOy}b0qX7`67#jcnOx2gU0)eDca}m((-;SY$Y?x`V75&VcENF z`S?!m7`J6z9dmKOb^@D%a%0vEU}mHSA>NA}tU$#^cD#{Hf(T%N9jy8xe-dO~s6u!6 zrxsCcBYlCkhlp4kBW9q^DBSYR_WN}bi8&4MVCd8-tuuRdvpeR(D-2hRt-csvRj&5H zo*zLTU+AzTY$)Hz55Ze9GMBzEZ_HS)6Ox7$M@5+$?AOyGcETm?X@{3tlwd9sS9Q!F zMKQI985@*F_GnP{sgnAS)7QBU=|*C&A)>t*qeQZn5G0srT(d%c4e!rZ3{k(J#AF~) zDVRNz&U$=|UJZh^vo1B=Ax^37T3KRqX$T`LpKGqc2~)mIuyAt8Y3Wp1WYPPohtSLG zh|ALaXO>@vC@W1mpG(l1o;j3cb0AbebOEjxyMgKcUS~&o4DSN~{BHOi(GRQOpQ!+Q z-t__2Koo#uYP|2hZnMuhA_5qlpAZBVok2aMO(S@-uo@<;;V+7^gUO|=KCqPuKl&f+ zKfq7HYiI5uY)5h?8)7CGSwVH`t>SdRaxO`D2zVlF$KRBsjx^5?FnDpwFFs7L-V^n# zCAPjmySwxKM%a$tLWtc*0`~+R67L@hJKPqDWH-$X)N4Cwp0R~sYdh{Eb_4joqdE{eYsTk@AvmOw-8hTDhRr3S1@4Gi3A zH48Rt(KMzGB+7%-M4>7NkgYITMm{SWZ}2#fz@!W*%%%rLhzV)@^q$PJG!kHwP8NpF zBVj;YL*aJmbcmf*N9h}d+^oR9h`xcUa}~j~YV_{IS5(hd953`;y9xH5i6yP(@+FID z)^(4ssnNZ4kz}tf;pnhEgajJo8L~MG^+4njt)FbiS#s$s8xfXlYb%Yu$PAprZe8_G zIoD;74!{9IGmcxQ0sA~ZNC(k;ig}KE60Bna?>Z8K7yO}t^_j;{x(}e+506Z2V=byV zEKbgXgIfz*u^@aB-m$WUXna_D5Km(TEZe({^hm>2Jad%FVvwQH{%}oG^RYLE8m6hE z(acQrVF!;BvcXZ}89wN{_rU==#O&C&TK?l&_8oRwCo#*SMx@TwMC=C%J$g+QA!o)Y zXx`>OCTA;+n`8P@8Kiqc}9^z`OO5%uhh{`$v0yBGKT;&7CO z;enX(iKod4wV0R%QMwRCgTi*ppr+3!`5cqlJ?`D6n-Kg`ad&}Z3eOl3;l%fnn-1TD1N|~h-PKl*n1u@SZFBza^EtlbxTDE(Sp5a7$`rkKt+k;(wDKrV^)NV}c z+hSWuKmT+eV@33AB|bO2-KFUwbf!T&raa?<0#2Qddk%4x9}(C&ooNYNI5#5tavE}L zQ?TvEB_}2%@SA{nbQ`~vuG<_fZ*|fl7oyEVH<13a+HG`uOwb{GWP1N$Kz7qe-ea?U zHCyB(X-fgibxcX$X|9!;qjjkVL41bd$0@0<2&HckAfQFe<(>;U!Yp^$f?G(vqKv8l zBZC8TNL3aHXFsG(@EqTCB(NbnA~N683X)1AdcQ0lxtf68VXL7?olA+x6VRyJx%u6; zd|!A=lD?OJ-WWJ;o2LBIq;Op_{3a5SWuw;_oz?@wh4$5xIjRltTZx4JFs$p79|9xsnzsNb$XTUk zMme9kXgJ_4kv5yHnxE|hRom&`F;cNff-o*o0jlR;vn5to`1gNg2U5y5V&XnwV=yHNce|VzO00{nf?>PEA05WBDaL?=&V2iiQo}xK{NG6 zW9XQ?O7~3;R~8-Y2V{ZGC#}8Ob=}RWTlZuQ#oeNXx|#;=_b{g83=mz!$7bT5liF*< zM>^0h)ptk!*RuAjR>fpZqpB<&vlWuBziISxoS9Q!N?qwxsD*0AmJhf~wOc{&MlI4V zaIwXe?o?fwJbe$hBWG9)8BdklbvHQcu>;yzr1PTm1Y&2q#5?2`3Box`B{|NtkQ7rUsxUQ&a3r zwP&+9`7o9DOX0^9xEncL$*0bKygr@}<^$O`Zlr$fj#^oh36x|7BER4@TXd~@0_N|2 z$?rb8{#eN#vp%9sPK?l5*ssfOSfjh&5d6XvOER3HAzf7NkU^5*h9;y0miqw`(`3ML zY*p9Ts)ypqriamKE`Yz}hSBw)&;_g{&Px}+1--q~(9yRi{1@71^ATe7^|^~T&dq@} zHN_8elHEtFfz(}=@IeVhllYgMk9HEECF5&IZzz!6f{G*DtRN+Vr>w0s|0H)4PaGB&<;I(Dsnoxm z)i3=**V@JGCrU+7VId`gJer_E(blptA_v#7y&w_qvwDIMyV8>7>EI z?L@28fcgR}RJ;+ZA1TwOaTVwvZ-&d$RMI?DR_)dkGL(C%T{`)@;bn7TH1B(*2yJY<%#-;eV##A%_1;ju9#NZKd&GFm?@!@S`*f+4bo|a{yMO?#n+oN<>!o*jd;otfIRUwvS4J-;Bi*Xd&N5GP z`5wCidh1Nr+>J?7b6NW!IusM^FbDHU_ZNYJ*=98z-%ZIPmvb|*SK5xR zjV!obzga@_29f2w2CuX=4kVj<@+j9o9DZ(aU}rvyu!^tujHAUR&`jq#_)#Uz7N;Q@4aO zw2&yXR1Rz^LBots5v{V$(`8k6s*TGZ?hDK-P{5$=oUi-65_0?~BWhmS9BO*fbkU@|n3z znpNDQI?e3PZ1%KI0%(q6fk-bnuE^YK3c)giNE#>_ggu7kaRKi z64ropUf>Q&PGq|k`;^-?`|@7R!R`CCaQ`Y@xZQY9YA>qY(tWHR-9g`b1IYG64#PYhC>0Y}p13Ov=e-4rzd(mQXC- z4tg>yUGzP9MBGI|F*M@0hm#ncPyF;OQy6SsPhO;UY*L;z>fG|x9J8UFLf&Ox0O_T{p%#(u4^g@{=3rKe#6l?|l5o2Szil=hy z1wyr0>~q=ShHuTG!zI0{1nvt${D z71c2hn}O!FWH_B*_nxP;K#B2Ux7#~z#Tl#aIj}nnLvadjt6XNcpKlIVeAuqX{MD!| zzS0|@!Iqjoo)Y^@aAYMwhR}iSa^e>*>6yYrKiM~-*otRxZ+98OqF?uGNStHX{JIYe zH8@8={fRCy587)Pm*D0CN6p#Lk9`hWIF{xomKt^n8OcS<#`JQ@F)3~_c#+RZ!%9}2 zAK!DrZq7IK;;cRwn19b-ifVJL+>a`;W}xi!)epqF!jM6+Lr9&hXs}S$pdPj-7Huo9 z4!H6#Q@WyRaj%H=QfE%m8w;WXQFIP5_Kt8Us_8_{ZZbsze{GVJmqQM!R}EErRJo{a zJWqN^hZiEo?O-FL&Dw%H=BAGY-Ve70ncRQBDatXMIZoXE&A`kWYg}(F>eejrfT-|g zGG~3xGZHyD3{mQICHyZ&Dh;C9jahjt5^tGwQ8v^MG8-zwdOtcQWxplZ6tZ)i6X2@c zi}UxFDQuU0tX9Y>kKq*u<%*lCccmF&tK%6y@>P8F2Ih%7lF}J2TN${bl;if`&h5$t zYvF|paM-cQE1@b9eX z%9${sH;tvP5LG%ILv`}$j9wzTB~YGHFfT}@lP0WR{0Cxk0z)_+`l5&X9zlZ(KSmd= z4wr5QS>w(qnK4}%^ZitqPW>yeH~R1zALgndNq!7uy*9iBoTl`#c19j%_{}Pti zp@y{Qf3nBXaXo zYfQ$IWk>6g#WTzZrETge9E!buY<$miv4cu+w0TfGKymB2{Fv?xh5Ct-w<*MpuG>>m- zrvH8*HZmaU0Tr|3w{^!%YQ-KH$CC@w{Z_J#C6}W+8RyNaTdZs^5|V;_%BxE@C;6z^ zBZoF@AWk+<0N*`2D>=%BnmW$kn6Kid)gHQQ&K|jLbEYrFGU}+8P;&dgw0ok0nfmoW-?lZ>WVZBo37~3pAJ{f(R{+?@-(-e zvwzy3`K=blD^S8TqsnXaGQN$e#*j){re+1dFSbMUD_+d}%DnNnR^#eNX>Ie?Z!5+; zg6|q}@hn-TEY~LSF#PPkg}6%96@FP^TJo6uGX2X|;d5Pi8VU0$9y=$IMfT+>pui=y zhVK`H4QPY-#zO{N@SQQJCZ{^8AH$W#rQ*Ykc};$;Kkny;sW6$;;PcH2FAieH+Ox3` zXE`J0oUuD8Pra)Pxh;mokj`8>J3Lz^76}kjL`nSFqSA$LXEh_cr=37l_<}~9>vW3@ z>cqD>0;}0pkkPiqOK>=UzoFB@71pR?MKFMt{>T=<_*oTmtIf*Qr~j>t)$X2aknU^N zJ?FA|s)xDh$BFp2Xae7*hd+)$ed zs}^(*x3Oo9?2|Iq5S<=uYu&7zldaaMTBs$-6BxMByZf?Hxv8(uKY&3)SnFY|{{d~6 zstumWK6zbY5fd+1i7xXP)rqs6Vo4i~RFJC)joXe`t0j9{#Jp((pthx$T78KcV5#ax zH=J5Gqb2n4&GC#@zqm79QTeVdqv&KQETO&iR`LZzZYZe(sRDuyls^a}zS9hEKVjwT zO{k+3>{5kL36z{`F>-vzsO@!G;_&B}cwp1qJ6$cG3%E0Gz{<2 z0q?XpE7C2_5fZxEdrrwIM@e;>R^A(70}RpjSS6^#@1S%(aQ46pVG|hG@0~s^X)f57 zSQT6)j+b7}z>yL)*P1^!5>vV#V#gt^Q+n;XJ3T&T7a7|r>Mf%7G0DE#7WScIYny%a z6OFSR^Ic=TriEl3@5ZzN=b)N*R?s!J0~;ixk%l{n=vTrMT2_6lnr)z#3Vj~mM3LeX z1%)3wEY~EbB^=Q7h;`)D<99Yg%LiNQ&@Uf{^gK;b8;9kdduTC9fhHaCL zIn$!oXnl6splkvKCgL32Dhgfac&+gzK5F>w*%IAgT72syMe8KJR`_JfTq=Ym zq{4YhyoU=2=hB}D%Jqq^$@pVzDR*6*(&*mDSjx;7g73R)g#Jg|=9{T(@9!Y$z>fw@rmHKfWpflNoY6&8Jn;B#(Qi&jhOC)966GMYb8_QPZs8 z!qWVxiYg^Gp;ykM4q{*~plE)3vQK(W&zwJna(3`=)l^ES;r-ldz#NPCAh_-UP9L~M z%>`~Bo4bL%YUp3zY_Pv!>r}Pchdj$)O^gQ>&kdrOSP(rCNQ_qcl?v8QjTSc71a8Sp-_`Wll$x z!uyur?<-G5P{FtNAC1ygP)HXeaSN6b{=m_*{C1J9#{tljJ;yUG#qhQt$mO&j48!8r zULzJE5B5avwG6+?U)+%JMHE;_0ji1^$YOC>Ok_dP5YVsq80#zuR)4&@bp?blzV}u+ zrCxWOji5PyL0E3DSM4KN5|Vft6lUFX!pldes_oJ0V>-9h+aogifUU0W>S|ZF1&VTe zoDT5{G@GC?^?h5Av{MX0s>dsDRvFqK2Q75fh9qwgNrXP!GK}!4A8Rzh-RR&y2n^S} zAd@jis0rpEIlZqrXWk~KtSZ-SJ~}Ls3@80a6CJACdYT#Dz(fjXzqED*Wc6$qW7Q+~#7*|-cu{WnA#DPHa4=-j6 z^y_dlm)&i-7tBUA5;cwwW{*BH&Vllj4mo;5!(@qn4Xv$!q?n=ymGr%Z6Eiv4T^jqL zBleon^>OlACywT?KOcJo-<%-)d^E5OXuv5cg z=|ltYiEL2p2W62e!>73-^&_B@_&_!ANn_A$&Q0;g>~wHFgvM)ar@{9S5Tw9+1t5m< zI5>LXG;1VKmG-ri_W75-;mHEibO*J7bknBYE6fRL-gDF{7Jytmxj(brJ;*aBel<)F zQJ?ANocLO}qFhIMQ2+MlET=;=m9C8TorlBw_v}ou&b^T$6-j&d?8RQZs;+PD77@

#o%1}Jugp@y2r@@PyFtG8gqDl-c(626pyrW zC;qk+3L|}_M1!VaFsXb=j1K#DX9UMDVq={ulG3HB7a@n~{=CQhg!C6de5DZfTUc%zT zmT_*8BayW3hatR+9H)VJuYw!ippsPH9dc{fPtg+i;7)3noqXy&T>E;MeqQcyJN$4_ zd#w92xH&-epxjqBhk?REcRH&Vnlw~%Sm8mqTO3Mi(7LG{Jmp`Nj*s*V&UqxC3=jBh zc_b2@4GB_{44B$X;TWmeXs}IMM6AoR;E*>@5>fBYnROOCcDh(OmHN>UY>vO)T?GW3L0uRc<9u zoAZI+bByPgr+ic4sSJL=Fp@&|sDgeLC#r%|Pcy)#C7^Q{vF3-;>=n9BD;*sh?slYp zCM*vXW~D%wf^ytV(E2*l&`kTJ7s(lIJI30)aySNugVM1MYDz(K7;lsu_%w%G| zY!N9^pVhIho=JYD8UCdrFZq1+7<)|JQUkBkl$JxVIC0q=`7_ zh{qw_sK?2lzi)4s%eSdp)$?vuhD0a0B`mp_;Y;iSq2O>Xir=3%h{Y{J@Cm~OpIglG zhDG@>f0n?0|CJ|i>xMWZ$9|9IQ3w_9i(w{7v%Ox`BcQCNoJx*AtbgBdH*zy&j{Dgj0ABo_xCCn*2t{#e;V|r9nE|M>^wL?>K%9 zH>nl`scUEM$9wuK@TKj?QJ)o^=E`zCOMf04xQ;Bg2mznG|JcWHL~z)0p?|^Ck&e0E z=xTG15wV<#cx)$gdMpUN-F3P;kV_uYC2w&S}Whtr`I@BPwbe z2UR~8H{5-tGl}C6HP7M--<-KBCYpgiaH|&A{_dpir0Cl03w}_5Oqvjw@NB4TFn6to zBNtyJ&FoF|J3trWde-J8zj3>UH|ojU3)GP@l_}SmlA8rPFFOo4$U9}zdv6gXEJ7;snw)T z2-}j!j=*uZbQ(aKQ^9j=nBN^W9c^JN;WcG zQKV>wfg}wnYb2a;;OvohmFmdFAGP%7sFuyX{=ll9|6v0Y>~t1bWG{z45ty53oZxh4 z!fZiFsT8UxxE+B6FM%7R$%}90nPQeYA{7K(u?ffM9m7jM9lz|l${;eF41K#}i?NvU zYs)z0r?)!3>0_~%)J|)I_VPQTOODgsht7F-cJJl*P>nXwM?3R3tltq*mBGaM{`g=4 z`XN=rO2Iuq)`q%_fc0>n+F9&!%udAD z-}&`Z1WpeJm)}Of?!#v_@wR+QBHMdl?(fPX34B+h;KU8Y(p<;{4u`~d`6D~T6I~W# zdTqJhwVC2U42ff0ACbX#O%poBTyY;d$XG*LP5@P7w;~H033O*~MT@>!tThZI6qr6q zMeYiFnXC5?ZW=#()jxmrX6EEEtmJAbx=CItoW@TmT8qz4s^q=?u7~MviJCO1l1dDngUBBbG_3IOSM&w)kzIo^SFW%}Nm4T4_%P#53L_a}L zXKBMpyBT)G0wN;$#73$&P;B`;wIUcqH?N*r%@i3n&)F++r{Ayml2gk>YG(Oys+q-j zW<*(?ox|gdugj@luUT%XC93;D_lqwTp4`2Xm`hQCpL7g`u)h9rt#cxp)`B((vZ(0o zQPSA}73l$9Rh&)Nm^UT0;8<(fsoVc4 zZT%}=S?=?*27a{kjXpXO>OVXIfCK~y49M|2RO%=h$73{T1+9-m`4{K{VE_ZN{U+=W z12Qm(asvP=8vk=B#49uagFz560s}Jr_V{{Z&{RO+Wdd*gHt=Ku8G!i+wM-y0^oE#B z`o^{ox(=BOJvQlIbBTqsAz#NVEd(JVQBhW2etiMxVh_7Pma~A+O_x*Q}jg{!6KDD{;>E`|a zr2bC@U8=vrut$U-fb72s{i#m*Hz)zog$DhO^-qnrzd^1C2<$8%o9zvwKUJ3gMp+yK z00suy25z>_cHR%&bnMvwcT!~k?7yb?D`fIt2#qY@?ccwVOBOmS7+^#kdgR}RS2u=O zUc^Wikma{w|HdH9k08wc#~_%EHuMT0w6lS?epC9hZvO8?I!Yqqvw_UNzf*PNcA$nB z$_6rlZr1Bfs}z)`#X97wzF%-s(if!3YG0#8*MIxJERq<-0hr+bBM+ zogp2Aei&V%yG7ro$4lWwX99Gmj@eK-TONs84O=%{+yy}fEbc9WHv71KITR#|zo+@$ zMkV8ThlSs);uzFu#`2CF8`PUru`lV!?8mgXV`wWv)Z;H`9Y#4`Y4hj+*|Qy6sQe7o zFyt>C3+)xc1k^EDpqWPP`7UFlJV0K8;9gsBC>D@YSuMywS9g%{a@nXrdeGYy4t>53 zf{vp~Ty3?3oqUdA(G7K(>F8$iC?^JZ!C)~WnbXzjL3$O_u_j_5Qm`{_xw&Vxr^Rj^ z&!fSwlR2owo=rsHQD_P{nwh`UVmEXwbayr5Ke3Q>iIa+Gjm-5SZ_>Ds1P!{+D|9L( zHriewuGLJ#LTf};A)-R0f(c9A-E*6>tU#J)qO_YBdz4rRv0bFx zB~Eomh~X4E!Ys+?fAq3roiqA!2w9L-DQ0b6aGXEYugM2^k)GLYRi6H#V)l}u@x{Nm ze%d-Ye^J4{b@*zWrfU+dU&87Q`%3T)iPOsE`zJd^>J;7g5xE;BJw-i+EjDYdaf&QV z-#3A@JV(s0A%vS0%_v=0BI>a8H8>4*mSzKsTjlH>;*Tk}Do%8gfhm0WR2)7R$o_kR z^I-x95;G-0crjeLs}?wkA3+*rQSTre?m0VdOdoqt7$@Ryl&&uR4J9ue2osL;Sg=}X zrYOorOjh=+MeBj@xy_H&N5ib=vxvB?4+K@``MCO)Ta$|yy6KcUhppheFv!4BIB%lq zM{tuzlJ!$EyHfZFkoaYh>}h^{eSFCst^SDg>$e-g0)}2*Wt+@zlQfH42K@uXwm8F6 zX#c|5TP(l0-oIY&vW8LyuPQpyhSJln%2D$x@6dk-RgQR7j&$Otg}-XTPJg{ja|wO_ zNRE7J=&E_9A8QrPRp@TD#Wdc&9-)!4n0O@Q*)cy4cSyNDcQ+XarP!D#7Dxj`JzLzE zyhzId-+emBUKyX%>|c);{T6fK4laXkI7M=2wC`d>V%>r-t<0LZRXa|~n~ z6{M5OpQlo;89x$YyDHzGAwoO$N(EMb3P>q28RU~I%o)VYyLg7@o}89W5Ov3XK`P0@ zd@sjKWLf_P2370P`WH*#Rhu+|?bJ&N>X)1AgG5}*~y zP;F02W{*%gRu$N1)mlv8<>Ac+s*Dwp;vTe*3nAMqh1@F(iqa7O_7@yok{hi?NKJY3 z2lXzD5{WoPS8igVt+;t*OMLB)&&T$~r@<^_{FaAMfWL45$P%@y>5qew_H6(=nsiRf ztqC6fF!{`C-7RWx@8ZB@Qd@smaFDfu!yZP72ZNjrwKlbG0%i%loNk%cE&Y@hw{5;n zep<*cQ{)uubLmYhk~$J4_ApVl1x#EE)@(7*2zX;?Xg2*+=BEXGt={>sNN-Tr1bb`N zF(;_21FyE7UaGOTHoi((Pl`;Ik+VQ|E9of(AOo#RTQ<%*SbTOweOUGQr%#F8c{7IW!CjamD2aa$C%Ih2 zxG7J@vY1fQv|*==7h8C{|G}v`*p&Nv_gkE*qoS4oN*l+*rnG;=-cOEkU|=$u>3|p^ zA`yaXXc zw^p+l)0{$dkB))%x(YoPDb(h5zbXg58Lntf=CqFi*o;$C@*)<=|4`DERB4`pQDcai zk4mw^g}E74qhwJaE(gUN3ViQ?RWDaUcrvk*?GkJm(O(bj8<#~gN zWr^Ey+b>hiGU+>Xrsi29K+g9fsG)E}(lXI`dbt&xB?3Dc%r<|1&Uja#Xq<%T(vEk; z$w{Fs2vL8nAFK~=U zeP`~V)JpEhzym~3dZBrP1bLXHXCgM0n!duo6a8n;Gvo;69GpX=Y}6+2jxQ8fHRY96 zdYEK+c@^%*fNG6*!b3d-By=0U+bj<5DFx8SPM@~Vb_G0dCSizWf-EtQ379xzvO~vyQ(kjgC!03G$1vO1wZK=4@a&UiaQ*b-@^n* z*Zn8>zJy*TvgEB{=VyW@H!3A$=lW&58)@xsTZae~3C4;WNzCV=IjKdvL5yrWzHT?ADSK7A<|q_XuWo#4y~UB;v9X9XSG29;19QdE;yN}0 zuZAs#^cCnvk6<`YVbZ9o?5g3?F~>W&P;5LGKM!x|hTs-rRC}%NSPg}x^NDykJHCX? zYE>SSRXMp5wQmi2w+@^f>|3q()8*1TjtPgI5C9wr)Xs&gZv~nIo7w86`g!+MwuesW z>c6T^%L7#pt0{jM>ym-^*832~J2KTHNjtgx1+7}G%S{6c3Qa^Z&nT(=m6vmEeBb0A zF>2}0j);mBe}vi2i5rp+31{rgsVFjuE`p-b{!kUQ1UUE;wcLtd?iv;^u^gJpM%E@W0T*wy zzcH0`U?$*C(+|)RUXla7R?Fp0qaCB*S99!*Wo_s<80>UI?SBOquN(2L8(m%gQA%#d z0$Ob1#q)6{*@s{GCOLPm8(}r~=Pp2RYyqGn#=lZGRHqy+*4$GTz82p}qTW<^ zk(A~1TLQWtRwdh4)2;XJv3+&ET~j#%zHP(%pumh-b%YAC$(kcIJKnmoPvLH1A`LhC z7cLI`WVhWrD~S%Dwc5+PJJmKE!6>(Ebv(LHN9UcDovAef=?th{x0S~1hCuVIplVmnD8SB!cwJU#jSnGgwWzfiOjJRqcgYQ^7{H!x2XqKb89fb&)r{Yt%>r6TA^ooy01iv?90L zN!8DHz`N=RLV}>G*ne%mS!_RV`zpR2KEK6-(eGEp9^A?mQDBm@qDG@?N2b%u?Z*ry zZ5u8h1FB**>+HyaH05&|S>P12SI9LUxB0YFwUWoIpSy-GyaA&7@@QCchfrm>(9P9p zeTf$rd`H9rz35x2`_D``%L(BF8gdQ@S76y2uy(0Ev@_={&FME^X7HHKcW-iRXtZ+ywfs{G>halH??oE6PChnItMa!Wwm@6!@3X$;i^!ie-Sx{pP|GOS9oi? zf@yMo1O$Jxz?VBHii}2L+-o@Y(ly#=o()xK#$_i!zePej#P5Q)h@vOwZXnPD$4ZRs z2b|c{k8f1 zTo(fVOZNPeFLM^*LbpGCnAVnsygq^UyH@p#h3(vuSc4MwIu?|n>qPT%KJ?qHp}gN1 zWX2&8bj1CB{!ajZ{PxVCG2R|WG|%@O6Tposwt(66M)>WasF;j0*Lk{$!xR%v&0hK# zMXy;$NiWP<`!b;&Q+GJZ>>DhZJ~#f?*k6d!HH9EBR+K_&h2%i?yIL7cjqziUSJ!GS zt>E6L1h&^xzy(WUcl-&bo-GCD^w!`93^v1+X^az3^Wt#Z8-F(ACI%l`YoR{AHh?qb zj={llvv6WAKhsHlCwZbP8inE}=sLd!Qg__^$&%fIPW4SDQ^p_gBl9(g)cid_PXZ^Z zBSWhmT42buAVNv5ai$+FzT*v`^@C#u0=FQ zjgLFXO+(EaMnCKnN10f7&?cwarY%F|2rRin0g8p9uIA&gTVZlpBN>8dHVeFbMWr`O z(61B1f78T{HU$`F+-UL!?^wYqp3!T{Jy`%>(f)Jte8eUSxFNy7WT5`9lb4)9L<8_q z#ZyQBvQL_%+<+31`Kh~6@?wR`EG&Z&sv!$j{Vf8~UcUL9(kC#~jBCp-uRMNPh(Pko ziMP;{w-lS1>m_IR;&yM;v2K!W0EcipdG0 zR*1e$58`I>6pT31_wPRn(nCK?B4&bD`M$?$pnOYPL+y!J8x6wSXO!29W|d)e#nB6z zT~C-x*I(gmZfZFyD!qs^%}hq^a22J~t@OaL)Wg8R;UefH$?vt-JzmM-2?nIQ8Mk;f z%N<8pGTI*7@ZPM3(U^3WAb=caq;5yiuqeKrZ<~pvgcR2IdCy9 zw#h#ap#fF?*iektP2sm{(svHH!H(|Ri}@ximCSZ9HtzG&T&vz|Y%$*Ph;E{cpEP<^ zHuVF|Z39ci%A%67)4?zljR0~Yvp`pu7LELb)v7Z`K8e73xwX8idW2Tsp4WDSSDRQ6 z#z0H0t%&@gQ_&OUw2inyTEcj0yT(ChJCNg3=&vc2B-Mz-sBB@mnoY=O>Bz_5UJD*musV=~*Mw@9)7yTk6!RBl`AC8Ci z?~;qRTI`P5ppTQiZ2(q<)96KZ$e<4d|5lKNO=V}Ue}~9`8VvDOS&VwQPDy7kFy&io zMXHtamU?!r%er@o`8M!ie7xbClyR9WHX2DMGej&o*Hp=z)m&o zITWr2ucQ^hz*I9_v7qbMisYI``vJ{&KXJD5`(T0vsf0=qS^&s7jC#nY?o9|{TVXDh zwLLPUNHxvAQTfi3maYKFffslu1HhxYL0TpDLthFTY27N(1BMr0b{7sTEfOY=lyv1-XZ zD>#br1jV_UZdF(7nCuseyvEfw+%xRNFMnq+&0~`muj2X6g@DL)=ZF^n!$%G56=}W* z=7Gf~KYU-TGZ}J`q3#B@A336d2*p%r@7r5uRkGP1<8#CRU}d+@n2qUQ3aj#er?8E% zvxz(n3O?zg@q}o5Et^pjOBGkot{t%z-`}ZM>wuro>o5qufLT zfuw?`rqHGcBRHF*yZ!{oyZt{1P2QPf%P7#75CPlgdk1_dr$e zF=3V*_)E7rL39#;d)D;ia^0MqQsSIdOG4%YYY<`NvrmnAd=*XPBM)Pw8uuHy z5lcm(dykdz9BRjHQEeHIPLHJo4bQ7|-Gd$d*x8MCW$6wBo_;876C`b6j{dm5QGDbR zeJgGqJWI8&vN3{3gWRQ~Avd&_U2#N3LmzOtGy)nGqSU)Wu!FFXykvQ?8w z^57;-qnZd1T*1MMk5MrJYQyCcbV=3Emhm(iveuzwm*B}{1hZBXZ>OhOC`feJDRv|} zO%Su5d#&lsx0oaIp|E+>$Lmse%leFRG2yMo)SQugV-s#{@XHR&uJ7-o^Gwa+ZG^#l z7#v*SxWzTl%yV^CPJ-Uv^*xsz!RMmb3XwKeA^ru}XTVJ-hvKl=wZ|{aTqEZ}+*hH? zctgT^*YC32_475_6(wi)HQP1y6=9g&c(Xsrv)@(4xBMwz#t^zBnkKOu=yzf_Zlvu;gR@AwB zZyQ-PZvc<2RuD7pm!ms^K#_E$nq^?aQT{F4?zjaZtgVe9c)OxdLuNsvE(C&HKp~}c*{)7si(9!}1L^R*F zpXsWhTyR@ZnC>Mgs^?Pv`KuLVJ{Per18p(~{s*hKizrxc=Ds|wsS~jR^E$SiCU`lOQrNNcI)PAxR29VD(fG>FivRGly z>r;DPl)l1hKBK(~AY?gemZ0<$Pob~-OUvS+fM>fnf8YTJXE-=)hLX9Og$8f2OPKf=Gax8%aI^}JD^z~tQ-!=S$s*I@7hce^iJ zu6tOpOCOBmUwqa{yRGVE(BCDdVA06hGdt4(7t{?f9Vwd6VXYE#S#*=5o7X|dsUv9h zTm}s*ux*Q@%_YuG}l$mrZ zX{FZE>cUT=+H_DY*>AmRMco^di-PhC;^~x|boHS79)1&>e`269Xbgn`bl0QRnzPlp zH(~?`kOE0e$;ERjB6D0zKE6*5(pOLxZRENnAL_K_t0iG#v#c~#gP+B$E9j`uYJ^7% zk4fKmwQr%FnXEU~ieKfRC2vt~AV?H;EAw$OZjp2R44H+=tCRsYxPI+a8GYKvcMy=tYpfu1KSiF+<>icJ z#!ZEBTSPmEgkd0ii8lke-<$$Px+;yPKBXkN2n%htm22J4A)rhlX{^o6%O;(R(XvXk zL?sWU#v04EIL&lOxM)O0-NT@O)-6?A4ZasGgC$SWZxDDKPqA$p)S`@*q8~6>tEqr^ zn($|L#2w!PQzCEIOUqjt!EC&!os7l04;a@=@$|TVf)Mmt0MQZgIV6jC!%_DANSD`Np52Ww zU*>yhpScewxmzwcW~_}*>5vijZtOKb<5cOQ=HjUrO*3T$9k~#`bO{c!q5`1ComumZ zG-1D@YI(0*M_Rht8HUL{*d$^&4LID$F%}c=%Dj?BY?a%Lud`%j>1|Su2_5KDZ+*1t@VaN6RlCYl zg|qBe0=K^u!CSE$CBZ!~ndPg)tx>!(EVc&U;9q_U*Q^X;Jl+fnH!LVFQltpi*_mO= zh-C`n1Uo}xAbbm+kWvB)_XVpbN?_{T!LTQF2L0uuBNg5vn z?N4eCFHXeM(m@+H#Q`{_Bg1G;nH(W#pm<=gXrfWd=kIA(jhiz34!YnxuK$dXbRcdc zkB4~&1y|9=*8yydFucUNR0(5ae3Q0+-Itfxq6hrWa#&Qci4#T}t=Eb%3XU+Yj3|_s zxQ3Ft0!>6Y7#A>;rO{4c) zu;PxH$~w}47gT;fs=qq7C!*EXkuyO=+H({hby`rC@Z50YU(6UC^lJLy9TMCbqco)0 z=Y9<<^h&UaZQ#fk-OoU_^n;3~O|=ZG6a{s*KshHLY&K~KC5d_v?SHy#x{%Iv2mh)b z$^WAUaR2N6K_l|-dW8QbA%m4Q0{=}cyl;up4NAaalC#d302xDQ{C%_Fu;2CriTdJ2 z^h)~{qhRp=t~<>LJm*}zzx=)83n1hr$!eP$pwZLoEB;Zb1@Fky=N(XqAkU@T0}h)z9uI4`0YrC0GRn9|acCs5vbo!5I|OqQ0-8a5wZy1sG)OS* zN$at4){&vcoo|L~s&X@KX+<;CKy{hYm~wW>qB~^M49sGb`}_*>+0_fLG)_#E*7^X< z$Q>M{R@0gTl}>AadbsLh$9lT`savPZqelomTT{ptKsg;-2yg?z$m&KV4(D)FN18#K z2j$Jv_oo@c#pkJdL9uMrG@VcCu0V|!C8B8e1tPaY#uU1*RZd}!B66ftScRa?k9Mgw$G~Jf3RZprB#}NI*srYqZ z%z(om{6G4y=jDO93l0W``mf&gfAm$8|7|aTmC@AB*u^DPV@DBR9sTqAI)xx?c$wz0 zbP>Fqp59#3#ugsRUeiW7Z@suVpqU_S^16>z*3v@yZh95Q&)(NM)?NoK+sdS}crHK% zP2T1m=3Q0JS7{b#97upkCVKq&GQ+dO^StR|@%Q6q*c{A0Lv1c#Ftu#75(PieNlh4l zU8}y29XENJFi&$35>xZN14C`EE@ox;Jq%l6;$MK462vu6cF-iE@oSu$tj_@F7krwB z+2iy`sF2j-k@Pakpdy{R5RDFc&;S}xYvM~P?}rQlJI?WM`~m?2z_ZBxKH zLV)PPEeE0%)-H-8{!#vv&3j-^qMvhXEu`O`%jr()-ZKjGxXt>s=DQ?E!)Auuk(@(& zuzNoVW?0sx0bkyGET$R-HThR?D9?&M+XJdC2k) zT8FCy{Z=x#JYwMys zTBhvPcU?pXM=W5`7@`HXwzCq1DD-!BJW~?A$6b62D%x93VxN(|1R|PP&zq@wlM!Ch z52(WgOi0Mgok;|XeiY5?t21C>R<-6%e5oLUaMji;ExNGALbT01di)=Nx#p1Jt&oGm zu9-WT8pGDdn6hL?xknlMDqm#vbkAZx={AHv=5LKnjdYJ^)(*-y&1o(T;P>zumrtYK zU!t^~UPSo~5%!B0dOWYkiONRrHo~(!fuOg{3p>J+mgO^_jx3v<1p;BJ6eM#AY!rHXuG!nS!#FB;+1?--#uZ~ zMd2eVmL5DAd-&t8&XII5QmusIPeSt-2?S}kMt{>K>68m7-0&~zwxM2QS|wUjt*yxP z9HA{%VJ*Q?<*wDl4s6-_2h+N&x}Y_h6kj81U2SY`d^&G0VnOJ*Wp}D0&+T^%*%ZIr zZvhTFbm=mE>oYz8q~XUDinzLnrqw|fN|Fcm)NR4In}rqcQMa|_yw@NA;Z7dj&OSoV zpcjAN=nMGoT@=AV{GK7xhKx~C%v+e;T_$=~SlKFEp$2S!69Fv?NY9Cyeaj~l!upGs zP`@a{HAH?>gNvT66nlW$7p25gIe6NA8ZfYS@Tg8{{N!aks0u8j9E~ta{4Mh23 zwO@&hizd%LFNP*xB^0Z!I}0>7_Rx+&$b5SMy7aglZ@OIHpMB`kf$_2w=HcisSq-Ry z<0m<31rjN09ss__O`N9v!%s%cHrOlrVxH^>n~A>$!UtkwmE8mb0 zb_E)ITK4gOxWw|0OM=iGY9%Y~VZu@7RPA}p41zg;Y~ZfD%I~os1qgbqFFCdr|G1>O zdBru9tBAy_5V!HIC2W1<0QA~L=+u_jDDOdH;;;T*C?>nkH~;Mv%vl0)g$xvvHWQAB9O zK+gk$KG1!kR>U1v1aq~*8+8O-C4a;~F%u3|a*yUE4!P9)v1HW|#FkIs&T`mz6`>Lx zETJW@BFpC$55~B?TjkkXCAVia|hjwf)B?4xsiH#{%F#Z2I*>Rf^@ZhWI~hs-a(|4j`73V-rh# zsuoBIc9Q^QO&kXsuWCd8gHw^m|AJFX0osy@^?%TmT&h5o^l|5jB6ouIFHvbP$kk?wZ5s8u34ge+EC)iV!p?!xTCsqSC zuOqG^U2hrmXd&|TQbD!$Y8%G^G6FtYo;9$e%71_ggZ>Yo z*7!x5QP#^=8eh+{B_#syqIm=kQvCb`T?Fh+7teV0osjg)l{?gQCw@&%;9QgqHUG6- zl)I1AJMT&aC{p1CO9+unyEesxDx)eRkEw_WBeyj|c17{3v#g)ytD2aCo5O`dZXhF) ztV-*nEOuo>1n788z4;siB#hU7HYU8SPP0bOT3w2nO$Yz}92>NMkyN+F*$`v|eH9Fe zHW{7qiToo}_gc^Q9nuOx;p$P8ANZB4QLcU%sZh88##1$)PPg);9jvMv64Kp`G8}yg zrE2{F(Y;g(J57(diafD53VwQoV!(raw*R6WyC_dZ$L0aYUDcT%%*Y>|Cew`PZ>%{&;)bsp)!_ay0?Sv2V z;YcN*GSjyz;RE77h|1D~H|-8Oo|ih%RJ!FjzeQ9(Y7GHMF5L-yu-!wx-jXToQ{{}z zdP4T@%5U~>ykOkybLkDstsu zVLmj{RYi5rLWuu4984~daQa~>hKRa+=td0w3H6@{D&_|FuirmNx%@wnB6=kUr1HXe zs;MuZr^3!IKVDM^T^Jt_~0DFiav&*cM-N|~rXpLf8U}2L^zLWh~ z+NGDhv)Jor7EJNqPIhGJhdTDJgku!zC$s&+mkgNqmo~iLKgNQfT2$71=-Rcjp~E@>I(B?Cm7| zJKWdBNNw?#1o2MCogG2%!|vCukG22Yog{%FI-Jn>^DN;z6d?7O%i8}W>?hUZk3^F& zX_w?lNJ-Xsgz>rYD{$m90Bdr2vg9j05aF!RZDPJW8|HWyFEd5fi|}4W@OOI0g<75} zGR{*} zDJ8{;TP)XlMYWc3qebJCJY&}>WpTj02z)5(W%sv+rph*6Ku8Y*z{Vu^h~ZK)Z&&Sju}QKxkz%=#HK5GlP!qLj?+ zqL`Q9ti+tqGa?SKVBP*m=L%=x+^bTm13Y(Sb_q_2Y+34#iO$d)GSz2a90>tuG z&zDPU!Sh*R!cP-=#>OR57N{=Dvmkc~cPKDOAETi!pEu1wz*%0nt>=LxfN@J_+`zb% zvv1KAams72VnBt3GczvWeqimHnze@P;4R3NcT3*Va~A*;_(gn6^v%CS!O{u)hl|tv z8ZWRA)Xoc}O7rM}!D7SXe~nhaI(5xgz&dlSS4eL=Q$ex$x~ZZs+9@=&>1Gs;ZI%cP6=rFF!R^S z8PeI!BEULZX|o2TPuP*|e%hq^>WSGrJlukd`nSOfCo-KqsS014;LgxB_Ncm;|; zgRJl2>>X8JVx8{M@0mMgP`vu)v=WO6C=yz!R(nvGEF2f?Rk7YC-V4-DMyl zAY>Q0jkk8GX3mY~)??OK^?-bB=b0hvdn*h8xs;3F6T6${HzIHMk!Qd0V@vkuL5atY zrZ7kLu-$5Y-ZoCHWo)|&rph>R5&1vKo;5u9dptR@3H6+2HEd+xwNquYY|^!eV)iQ7 zG+P$gCQxEf5m#zBads@{bqtryMkWg8M;gx0Cv0q^u-Y`CY)$vZpuc_f)LE=!$Jnt0 zBnK|I=#e=Xenn<|=b5o|^%A9D#up!J0j~_oA4&U8rbL~!+D(tnm`xZ1Wy!_SI`s0> z!VwXzh?(qBigfB%Wbw@L+F=kweb|w*EVQ(iKJ_YgjiJM21>01batTy2Hq?XISB5JQ@5HHDcuuGb27&cSEJ^zJp_6w?&?mjo9aC$|{_IiZ0E(;xy>ysl zS}i>1aKWVM-jOn>iFs9uzOhcQ0M;T%+5&ogDn)#HJxz+bC137#!i=?vRt+x(@b4~z ztqy4sC@pa z**5R=!Ws>xfC+4n<;bf}BM&AV*PX$3YT_*~PqEu0N52-sZ(WQyBcB_M4Ws3nmLX&7 z#h{1Rs&z-zWNp00Sdv~xFDfxHXZH ze%ZF8q5+}%Hk3D)&Es!CW9w&G%ZE!%x7aH9kfZ@W@1qFU#8I@WYL3Erl0u1C5o{H$ z%tJF}&s-jw?nTy0F7{#EDXp@!70qy6(&po-1go75YqxTG&Re)mv$@VkK(6o&2nO0u zim3j;eGWM7Fj`~03-wqp{Clp{;dLr+_6$C_r>It|nxIVD#n|kF=6U9v#uWq_q=_>eLiK|E^A$7KOoIJ~=@9v`X3-cvM;w~#vTR!bJBUzlYf5~QnO2S3 zx-CWy;(vy4^>X%+mgFU`2CB=B;eV zQ8yDzro)`+wyIeXkCe6J;+_aj5X|eqE9_DSt7bEGuQayIlJ!K7XqfO=!XLD(V%yg@ zjmmtNwv?bM!gc=u*wvU`)qePeomanNSJa-5e$&cxSTfv&MBqn?_h?$J_iIL&3hgiH zxW&~zlRTx+NXQC#XDgkl$zkbMv-3(0r23wTL{9bQN(@}}+Lo3ic%X92^|)6xAv8W@ z=j(dKVyb$Kp5+>SpGI-9r`|-h-`xE<#oH@2Qw@!4lYn~(&=5u7NNHCcWFAr;p@oJp zH@8Cp7e%y8R}M81|Cp!()3=#U*Qu{tgq^;u!e`3Jj}Ssftiz8ndo++ivQqiaQ33?FJiGbqWZ&wkwJEHLQtNWp zkbERm(~GpevJ69Yj=~^B6IO$`ITs>fUUikm_WFF)i*wSPKSR$o$97Gt7U5(++bE8a zYfbq60AALz#WxBf=Fg4REZ}ViQx56F_(`jm$?)i9i~)YDy^QF#x8WxAs{v%(;pReb zK%B@dfJJ@a%5F0~3mfWPsRqu#GI~AGc*!E9{4Zb1v7w0s_jNtngQu$+f+uA5h8o9o zH7x>%{^fQnlX@KIA_57YCzBW9z#jej4?TNI0EpQ~S9NtZpK(BY@MbZuV=i;6iI#re zpK|9LZ3O~{EJ4F>fl+Lm7V2J2T8Q*9BoWvXfm*blDkueKlh;d(ZeYj!_Rg;zjQ6GJ z62`-(r)d1)bWGFN_X?b_EV4J9rRJTA8u3>>{kN<04)(2yfE|%|Xi>LMM2jYF6nRk< zK)rg1F75^Q&!Km{w($0-qesx#om+L8S@6y>hHi+he3L;{S&C>@?_lkRiJEz#tfaY* z3b3w)1)rl)V2x08S{sJ|6RGXFV;TWj*m+UUVn@63-tgw9`O$Gsuv(Wio z)SgMCi}tbv!GMt3;pDABv^b%gg?)r7pj$|b2!TV~v}NyvO6BG9FO3FUQQ6o|zkJdM zg}xd4yCVLSkmtV^7i>_F^&HrIE2T(!69!AXHA^82l~esYUvYI6x_uqgIu6yYA~`;I z68oBRW4Qu<`goKsBYNSaDOveL>9!A!k2!mDMg6&GBO`|7kj`{P9cHPh5viLTph(ju zcE_uyPp6a1H((JOB{|qJ`PN1fg~fwKDXldhbKYmXve)kj1>Ws1URE)alppCWpGQhS z;6)RL7_3>GMvN$K=vL7o(kjg@9 zd^X3~{~~GS&Ig3d&9)j*+(Y-FEZ>8`Zq5zQa_E91Vequu#}bXpc^5PQhAxXt$Q+!% zC&?`_S78~~7wqnC4hcjFD3bqv5(lqgW(6ni;}egx((Vsv8IfyiAA?;n0$!*tGfiXUZOLsvGwX(e!Z34zxa-$(Gxd>vso| zz5o2;1@+RZ&ARcEIjZ;3)*(`hD-^WS!=GxE@akN{R}LpSV^KAV1)Hup^fJ?PEUBxw zKVGU}ko!*D7o`HM1hdG$#R(Ezvr2G|Uzt^4MpWO$kK;(&HZ7Y0JTeZj>kG##604(S z0~I7Lh~C0oJKel$9A%o>k6@CC!tdZxU;)fAFsDt<6%ZOTSr%DHpDqlOFIS4!eEA|_Nh3@$_CAa5nSq-&Cj1~y)_v6Sa_ivAHy5bqFs7`fqcn``s-H{c0B zGS%DJafOjAS>tvo^Pj!)3o=LOQSccvy^}9+tnwSY!6fs&jNLiNbn%?t19K|lk5dN=RRuvc_uWcn>V=7^p9 ztC1>$Y>n&As9dAY_AY$70@`)wQntKBNbp^dlvTAlpFI6#!;CkCQ?9@h={fy@H6^d> z7ZaBBHq{5L!*hLx$62lsk2&Z1Su^vrtg$TpqLv2A@qJ%KM2H+OHys6L%eJK$4O!ZC zwb)avl@%Fal12y-?>pMl(yzZ(k0?gX2PpPGub?BdUe0WXv zZ)7vV9D-J%hmLF`t`_XWVv;VP%Z}#~xf|r2BlAIUV69Qtf)}>jx|n~si=utiNde_@ zpR((_;A{_(3F$Ylj+2JAN(QPUvq_TDZQh1PJ^y=v)G0r~-w@G~w|`p5*cQKIfkd}C ztMT@6Ry>)n^81wDx>QigVYedys+{|#QJTs==%c0lK(gwc-N>suy;h=KFyuU2%Le|k zf(lf@jJYag+$@HRB{rp=|A&5>d31BJHG8{U$kf$4Cebi{b(0%O=Q+L%dk+Qk0zuzO z6Z`=n$LO$@)J;Ha5g_{)`+?c__wm}F(4E1_(r^Z%T{50@QcS4I?H+kIB(mUSgI*!a zKU%edas1>=+BT^v>pY5-!C|G0=1Y@r6Zk0eNu z(9qHScAt`yc^~tOaNDaNbw51KMKWB_lw$V5C_z*oXia(0Krh>`jDC0DvA)5PXRsw_ z*m%-Pa1T-h4Y7Di6t<7tuT{l?>JHif1-@Gm#mFo`+90F{o9_}QPQI?+CG6MMCDRi9 zb|ZcM>Ssl8yhXSQMICDm8${{k97&Z}_M8rqLff2HylKgi0Z#_|{jnoKLY*q46`t5!I?swNjz!GewUV?!mKJ*Vli+ zeWlRoIU*r2`h*2=^02a%7nuFFp6EoZdEocT&(V%StN(#J(VPgS6L_qH0+X8E3E$+b z8A$g$ghx`@mm035d2IuuDIZt~KxBo$8UFCaadNzY5J1X|))7W-(-8)i)cuzCn7rAD zY6TCMEDQO&yEpwckew#V*&0oZhAE0fzqdAM{C%-ciW_2NAdwj-jpftXpdJD#l-QK< zI4v{+Yd7?#Gnl<#;|@Wd%p+EaKJ%{d?M+Ca_!VfafvUV8MynCz^o*(2h$C!bC+cenEA?Sf82W$41zo&{@4iWo`xq2jh z4H_fR?&eXSnJnR8(mFg7(@p~)3D)(&trO-YtNYDA18podz8(KBpeDEncuNcE)uVSb zS?Lfu6a-^zK)j;c41fHfM`(hN`EuVC{)%ujz^(S?d{AeFMUUj^x2<1Co^UgHqMaEz zXx#J8jXzWHuzVRr=02bzxT5kq?8=c`)=nEg&IZb`??~SPnDYmOl#7c~B_{thSj~M{!;HC4=d(GN)svA2m&D-(vuUc&=^(p*jX1= z)rfE^0E#($%U*D?agd{qFKm}uYkF~D4q>#A|wrw6I)_1a#8KyN?mfsqEw+T7ILaU)L7u_C~i{LvN^HrR1vF2@U=ufL~*U zjNn)wX-5IZM`Ih5bCeyxVa*#{Ux>URj~lNyNW<->cl2MwX*^WjavjfbdADqbi*#`7 z$bqu!AWWJ_5S6Zc7PnL6lL0NQHn=ZA?JfbZ33u=|Ym#(Oc@BzpY6(`(>N_^r?->qc zY%y{VG|G@u%zAFgBGKJ#e&VC=)U9XqAy|F@pP1sQpW&<*D@TY1AtDdN@SDAs;<2)` z)^W9WfB+rs5?fzT53p873Mb1?($%h*`&v$l)K)*CGl+h_>sZwzLvLFxht?Zo5{(h$nP#j_LDz}9FA_RKKP=*w@oFw@Sj)SY|cSH32p1+{9Y~SF)zmZ zcWMxC?|vFF@(__t&XURWlH7zb1!Nx!a%&vB5rN-9pFI%vtsrqup()3y3+@gk8|2!WrdKxh!_dgY1I-kIzd=s9WcriDXwDY z%4mD# z6ea#{qp`y&7@dMN3=0R!faurOzK~<0iLCTTK%yX%hJ*CW-6v^)N9WgV{WFfm)~gcR zzr9njX2m`%b3&gmS=%00Kv+s_t(1G@O?AyY?A14`AH-#Weu>bJ6%c#QBu3bIEAFH} zm{4plh4YTy3o8fz4o&^;@+@Zb(-=tW9{-C;-ZC(Nb_FP++@NjuXHgX3T;xp#1;83KG}XPTi|w$5AdD3W!Oi{#92y}KjlH`(3;7Se z-?)!k_`$IAYl%Ka*sfIFEO~D;-rbCshd{*A_9Xk81CFPNS766Xk+1_lM@u zxf75b@;BR4UVmi2?!M0>6Bm9wV;~M5S+aa&g>L`lzz{ApdWO}^&YS!CmRmJ#XhqRc zp5Cbpi>XBWP^8R}BQ-~WC$7$siZ#ol^L@{XHzi31{n!%7lxBtd4V^jY%%85Xv-)nE z`JMYWM`woSrYJj&0{e-7rX(_JNST$;dlJ^~uI70EVoE)CqEa@?ic_g?m7C3S4@E`u zUv(;mRciR+Pt~A8=Joh=)aR_-AUP`!=Bte{)JK%%awHf}5p=4UiepaE_%!roMyh_z z%A6|jNe-O=YHr9mrK=~dEm_k_$a7GqxSdKp64(__$7m1e`n9C`1szsRhXwSU%=$Hm z`8F-0&64=COEw3t!CZOv^VTO+c7z+%IkGjYE%)4Z*c*j{(rwnrb9SqH&FVh6_DcqZ z{LO7A3KtNorGAoYEyO2G7u=m|DKh+e8ayL(IE)^4W&+H&?pT^ATopGFFE5|wZc=4H=-6_59$-=M&7)GR*>*p6TSeUFXr- zk(q5Eh&+l_Q90>?qa`nUKzTM}=9^>prdYy@Z^s2v3V%-$k(!qjJtFh?w?+Z<1tO$? z^`Y5uAA49MN%FtLvn}W;asqJL(Tv<97h`tou$eFAx_0K^@n0puJYZCbGF+*7kK15V zS)N|v#6I08D{)tr%32CgfBSh8G#%u8aoLvvLRj66+5#@)8@}$F)c*d%?~oklr9pDp zC!4VzXaJ_25h{GUw=9_Najo%V4n!pL=<6-?7%l#T{XW%*`E0f*i;I`G7y=DPQ?vrX zZ_%-yJx{^2N7A!~g~Dx5XnNR>e*^!IsYL!n;5>+UuAj zkl#J+2`8W_7R%h!XCe%;6w;Sq_h;XSJqq4`IeNPDGNC%z;~x||6Qn7^jGkkwCjqq_ zEG_MW{}3ZLTomMiA|5GAYJEeJGllnyvU{-`&HwCE@`gbwdD>?2CXOvc?k|ojNDvBS z@q-)rZGlq6yaV|Pr%?7e;C0WLt+>?>^xQ*qOAGhY-?Mki{OT*ar}vfo)gK3!kUY>o zK6H?RUq*whQOTfJ*vMMgxuZ>oJ)`X9S#i5tLr2_Jb-7#%cTKtgL98iw1G|8qr{Q<4 zx`6#l3E~>&pzP9`4U8OlRSa+!e-d3o3N3!Q?(fY*%`fz9F(Tj>4yPqa11E!Mf9o zPr^q=5^O9lLQ8>^C)~DKzeecA8kPda+h3aOe?*5 zyEkfW%(%8El9tf_*#BfR%soU1!x&pO?i6V%_pEu69<~EPym<1K9sCfDW%hYW-8z%} z2}5f8!D!G3^ZKmklmAV0nA4YVbYu)oR8JiW_aM{nq$8>8(kDNlE6AprJLR%)ILJ9> z3Cn$Xp#Sk;tu+Xo(Tmmw2r;|hDJd-u2;NuYmsUtBE&RTE(j9ZHJs>xZ?ixtt@LQ&k zoj|s_{@kkcj|3StdTMto=8ZCvjNa_I7!PGBt^j|Q1wYpI7mMWRC56P_ zT~x3>JR=b^8HC-_DJzp0Nk@G-E0m5te81_THs)v@eb9`&k`XTI0Rax&)R%Jo8I~Eo zU{43Q9lEgVx8^`zC?`=oq{P{Ur109f8*7APagXHE7(S+r!Uy6MYBS~7eMK>I=2k9=GtJE6@JmSO0rL{S=fSo$z=m@mSFGXo zD=L2L%LlVof)7`n0FL#UV5pqvT$S36nS78;>Mq-KoXEAR>c1-wL4?*|=W6gqZIz+a z^JJa|jG>wfXr8i!NLv+n&!UWyC9#7DEd+P-aObr_%c={zBw0MCD?h z^*S*wYUE66HjWL}!w0809O{t&$n>R39HJ_nYuA=k@>f0qz|d|`{#2`5iZD!f9=2UQ zC!Bvl#xsu(msqK6SN7D^S2ic`s)GGS+>Oh>XuAKi!sP3M*tiO|5;v2A-znK`Rg@JA zb_HnRK&`SiA7X(jvyy9$!3}dtUDHL`hmf$W)iL>3?z9^BZ^QYRX6+4$rHZT*ST}gV zI{OmM1-tuBpfhJv)#G=W-u_2*E3L|!dTFPu+08+*NK3_sby}s`MRmf)Db7OxpT@hs zel3wkTNO}Fc#0Z&z5~QnmMxf^YCjZviwc(X?$$ZXyPRr1bRViRTb7(k+BJKt9nFM5!)$;i)ChPh_Bq zHj>#*`#bbo^Uj}~bi=^_a*x6`OlX*9Bwbyq)?p1#wLgoFx?@~bI*ftJV+g|G%y#*k zCO)rU5FSVo)QQC-ULmC_6brulLBr3dO|Ct727}fl^$_75np*zed!eOv!&7=<(YKUi zhGJC#2~K+cvt(iLuo+-1E$bJKZ_zpI|B&&{V^ZpF8=J7kD*R7ASX5b~jRg1qg+ zq;K;5W`UU8fUJK&Qq^{2}7V@TLwyz_PI02fyPs(pB=8ZVp|(( zOXb=QYD@VaIDCZZtJx3Fa4|$t^6j}KcikfLO%Hc5B1CRl^*Js`72!A8&#yHI>&a4$>Sl^o5qm)8&l*K{c~`n z%QauzC(clw+WBCf_Bj6f-wCJ8&&pi^0wZYyjce{wK=V3I;Jr+-;{}`hvs5YozW|7g z|C%I0I>v)~;}c1vB9Yt`Nf&vOPo_qcyzixmiRX~Bk6dKjNLET?TuG*&A|Z!5hry~Z z`74~>7n7T@bJMjaT4bf8{}G7JnCwjDR>~@V(J^S|t0~^eppZLjn)FZX%36}1 zWKubeTDfr3&Dg+YPii30CD}hm=b??axc6znZ^}JdrpTwUT9#pF%&#vNi5w`!t+o0p zhrjhlED7H-ksEicc;$?+MQ_WF>dB4g@5@ixIU?AXB+w3{JU7dUIOk>91UeB6|d*5Wnt~u0n0|V9smj!d` zGpZ>@Ec#eZZf-9AF~8EKU0ZzFfp2`phS-sY6KJdw*3*3vO6E{M%}msNCV4xVHEXBL!*=;Y0;Nbl}T$i7#n z79LWRB)IHC4p$g7#O%l`^jBonHX2(&IOdHLHFd#HatQUnp9!;w8^5&7E5Eei>11sV zXg%UUc!yP#H8QlsmM#IO3*P)t!IzmB04`h>)8f+iw#g+8l-}lqY@0)U>1YObs0#r9{Y*w%3=sbt%(RRNs-JS zF}^pcr4wpeKFLjO$ktx+oQp==jVUw*!QNg*FTa&&nR?~=6MVoshC*KH_$+%hx>j}F^jOM)#GnFcBsqvt~A-VlbqVQJ#t?E zMam33LF55wzbqq7?&Sqj{Rb}k6fzI|Tnmb)6Ai_>6LW&KYdjbm^7&o7{@-C zZjVb;P>eHSCqVb9`Vs-Rr7*r}t6#Q|Qu4)k>BJ6lt9?&;u~KYn)+)OC=>GRkk}Em1 z=lqlt@jgD%!C}MiT8HEN7Nw6-9(7*?{x}7`8h);eOD^E`%_dn+_vd+#JA0GJl|}0; zBuItla15uYjoVJ8aQu7%Ql(Qq@%Z&5+(F}q|K|NFcu|_E^tg8a#r9Gpc?>C|NRbpX zHM1i)!k=PZJh>MfIXsMfsjxYVMKz^fzCJ6nVJC+rjis^2KR#~j;79REoW79UmhGtA z7^TI8p;N%jQFB8?O>K%b$1wxZl}>d8WuYEAW?>_X8PpZCp#R#;q9bE%5qAA15YFiv z|4sE>Kp6!RPw3|vM}wLg=ILsp`|F6CI`-;-^oRGa~WuL#7s~0%~|1ai5cFDL!zF70!V=x#2sm`cG%)FHKPwwimWZ zRu@w%R-=_!?Yd4sR!Lf^RnHFUG$^23gtN(4ANkf|W&W`GM6d7!&aIQNgxgT)(jnYA z{Fqc;s8VQ`s^R?LO5jB>>a(Z^*Jl5=KY!ftCjYkEkT~IO=@#L9Y`# z6&;_K(V+zV$M@uEbiGn7(rblYoovn>DZm2uVm-UDJD(@zpf_t#uJ050LPEQu94K6| z#7X-@k9|R|jyJEWu>Ss%)sBgvBfw)SdWN;hmkgRXQ?6}}ndR@G87ps!^=|&QAka#J z#58sKr3~v+_S+44esI!3H#f3Or~ja?q9Ms9619of2X^#8rvRYtuB&(QjgjB%a%y^MHVbv#F?qzqKXeMp;90SNU_GJpQa-8@y5`4n%DsqW12_8>iuQnVRmaoA?C?;ceg3>&0ZBE!<{AeT>D?esreeh00ipEcS zY{NTfJXf9vx+fhJhG5FR%6I4GU^B)lj?UM@GHQ%A&dd(|nH~G$46Tp~3#g5+l&82j zMrKECI1^oTqZ1=CATf(zz@e=22jN~6(+EXp#F&m%KbAP-M37F#POV7Y6@(pJq;m$T zn8SsnA)DB%y4e~a-L=K6)a3PDvgK}lo4jI=O0DMV@m#-S}J!KpTJ7u>{k){tU8c0S9$3M}Ks1)$~PX@I$ zsnMMwtJcUN$1({PsVG=$#*Or|w)h#t*jFvDULTi3jcf_T{8*Ovk-1=k89#o|H!LNs zSfFiWm+5B2T1Qflky~0KBkxrcOe;uu3Wg1H{nE?>wdS|+hLyIW0=7^3QW_WK^xrXJ zwzD6Xbr0q%K$g=5A@`U24+pB)^7@JbHR6^9MH*Z^Q?XD(y}K!&CD zP0PGtP7n##^64{QSk`&Z4?>nx2_9dT02EL+R#uWYU$;9-*7t*4Hvx8UCvO^#qg(lg zV4SJ`F?jft#P-dbhVL8nVuka+56Ha zz5e%p3Nm6rZj?kx`#o9Jz#B6ze(Zoe^2psbu`J>O_)xeTx%eob7al%Zo)b>JOuABI z?CNIyNpX;QaMUZgjci=4%}7tBIMY zX2dt-LW)`fiCL2Aqd+`O4V7QfNAsS^e{VcFYS(%BBH6^dX^1-D)nRet22TpRn`(I+ ze&&@j0Yy~G0-4#P>BIE@JVBUVjdmwJCXQD_wn2YgzD~d>Nkx>Y2!&g}pd4I(J2nsq zW#8YkOi}z1=ZjYA3)gdd)-LT2ah0mL7vKx6Ip%(t`i{;eYwsG%9y6G63dB^3WglE<AK? z|GN4vcANVNT3gBaZ)N0cFkfW|6K%qLF*#s%@0O#W7Hwo{m))4`zn?=c55VD%4jRdGQkAB0|C>V0ei0*Wrxs>?M+oVceCq|+KhW3zW$L1v|!h2b8mHF-%3 zsbaIN@#;;sM4(@=gu#}Ed+A}Yo%j+p_fbWj*NY%DN2u^)M6od`>>7VTrfrLW<4=w< z%_?seFVPx}`Nz^P50dd`Ghne-C1qG)a>IK{Ldg`*Q0nQ957ADZsHIAbx#9uX6Sljq z{OutVRHV5G;geR8JwiQW@*`l!4Dd?JFXPSXO~1Zbtv1QA1xa( zK2;x#O`B;=OfD@CdQG1C>gxf0^xg4MQSI&NQL^pr$x$tOdc#8pdV2jsDSFj=yL5+c zoQhsC@_II5YeQ~&42QekS?&Eux`Q!#>!#>u8Rt?&zpW#3nYd_Pa6Q}Q8+7z!Jg z{(Z$FKRCRQYZ;^BS~F^E4`$W%?7H0Ft!2{7D2}mvv(IX$j=+0b9RmD}tC%7?oPJre zOhMQht!d$|xiti9wy0twv#pmzxetfAHDv7&rDfb(Cknd!-<8SZ*3H_ z>rDw$uko-UbwU^b8fsgAA;h158fR*M309ZI0`_*VQ{cUQPGw1Nw8E3ch z*cldrQd#OdfTD9>(#Y{MS{z?$n_D|m+}sTmq2Ye53}5f0V`FR`i-5t1Ca%Kl4JV=D z(v3Xfma#-`tiwOmTxVU$RJOA3$|l7d{3ta|v6f7IoVZ({szO6BHe^W`PO?P>@5(z8 zE6Tb~b#!_w!C#wvSI!7;ViZVLm#v6Ji|sn6j4`tapza`^=uu1>gf z25szR9b_#mAG?L2IKqlK#MKRK9K*GXU3P$J2IKcHqTIipy$M0~^h@psc9Mv#{wZYF zqu1Z-W-{Dpk5ua0tICQbfoPeCuu%58xNQs&-ltYWE1)}ru-8NsvtGwR{|5Q`-LQo- z33ToOaE1-jB0S*DXI(voSQ>kLDR77;i=?a+;=J6BjQ`b8$hZCEJ)tLLyvQttCyriI z!?azYeOW1vgHptk;Mk<^CRvLGsD_6prg4Xe`4c1GkQHN0#d20~4=rF+di)j3wbmR} zRH4M4B9kcAtgbenCqr95&^>{>&HfmUAGsn2dLHQLII9w%sMLJ~Vf=+6jUVS*|8^x~HE z3!8ISHxwRYZ!^^iZ>uR9?{S{u>E|&f>&n3FQ#(6pQSM=|xEAB5AmP_rnu+Zd_5Cb? zR_f%dr&kCng{mi*vEgPZAV9t*e!rv#u@i!R0}MUw&oLZymQ^ep+b?M2^GEeGH!0kH zZ-D(uz>da>JteE8rNy8z7<>-$tM*>48;s@5hJ7BT8e|4BGc9g|Smu=TQ-=KIkMMe0 zd5YvXHFWCXfoU3LaY^Hty!SvIS&KQK(-VVq0Z*F#xL~8=22y{b=Q1*qY_%T!NG*|a zKP@$Ra;!{8MYT^C%W=tDL%Bx?!x|x#mT~!A$fKmJzo&0Q%v_>N59OL0>p9D+uy{BC zP@fPe`PO8QSn&W;xnUNaPnye@CyZjnD;8M#!!mVg;_w*h`qi8MU%)fukaH)H#=W4u zQE~XZ8%gH=`sVHN0LQk5*S55P*5a%K1FLa*_XojSzfT=Mb7C=F4c#_8J*sA!*x0+W zp)LCuxuI9E-}=|gw^YlDtP5(V%#kD5DH24pSZ#^O$)}~?&zq9XWt8%W6B~iw7fIdH zR~2T?sqU{uawK$ytHb9ZBjl|C8!x%;sxG`U!39xHDd^1f63Tf7!>Q_Yi#eXZ+3E|I z;b%w`F{&iCWU}zAtn|UbdM#U3$*X_7&W|U_ht8!O;X1|y>Up$Gp;y2-KfbPs>4c0N zP?8&?F28OR@b+2@^OM4wmYMsjmjCIATwJZoI`IstkWkxPaiNXYxN9W>0!tA|oV=mL zYej4kcqQWB=xR5j$lGoqRU}Bt!4(M#|CTW0&grK+U5|j=Qf@F~`mp(86ISkzr}CtNvm zPz@!1W4dk6+6Zi5$Pc{QgMl`PI78@;jH>ErhiJp`B(~?g{vu?wouudLctcc6jvd{| za*fx$*f$d%A^g3CF zf!+*$!fQut!*379{*@F3)6o$H=haxvcCCuFKFis(Ey=`s4c(m}SNYdvvrpHlNS=vv zpY~Smr>K6#aW*MDP?(Pnhj+`dZZ~SCwr#NJ;;bk2W82QNi&QarsU;+L`CN1rjJ zWYZUMjR`#Q&Wb*6E6m2!zez=FZu5|kBz~BQj4-!7u94TU3t?tDoJ`WG;_yYPq*0keO8dv&2&*TH~$CL1W^uDen?wQy-CguHc1w^x3-(%E)-_yJvp)_{nPp`m83HV zHQJz4g{Vn=Exb1LqlC--ms@Z={0xs+UI){ktNA=oz;d-e#FjDr5_yCG{#eLi#Z{T= zRy_7iBlF=d8WYojF=N()nO;|R6n%SpVw9Vn-cU&759GUE1M<3-$u*21Brp%ck>s;$ z;m~e_O_6DFWudJ(EeE{!n9y#S+N=G45G?L93cIZtx?i$5sO_21j(v#1LN8Zg!ez0O zW-{>;=mDv8_Ya-v`4$OqX0BhG5hP{`W+~uN^bWpdzE{9 z%{CEyfJ)=j+$)RpYP(-|KPR+1ikCoN$isb5AXq*o`yDzbX0hOkf`R&YAIh#hE84c2 z^y=`t6a@x<4SYtE6eU?RnHO>s;e*9;qsIn4z|3;3f5@9ZxTP*5)YcWMNHv9N%8xrq z%Vo8~yA{1(O=i(VzfHcb_49PxyK%i#B!I{DKmx|Q=hv|Io(D_{vNFR16zx|YS~95Y z1k*f<(i?k+iDhu%Clr^wTlU8L_>rakTp9Pa7SM2*5Ucy01?9LV~6Pg!~e{%T* z0imRrrgkz-N|jJw5qtK1_YP2BFhMJ^1^Ei?68^1d$G?zkL|pT%RmLZrThf<$`Ag1y z^5_?O{>g3oN$O=aeLGs}s&8k`hl%I@7QqusV(^cSD8xoX^cLK~;Fmv=xFx(5;=W!^ zGNf};wYEG9>fQk+sKutSV%elmWACoG0B!mR^jkS8anfJJmv(_4qtyFJ&3SJ2Tdqjz zgsuTcJos;%bLu4xRvp^fJN5-1!MC)H#nS`#)nN&rDZl5x4m1EkmH0ge5?JqsVY+x6 z`*Y`}Gv%gz-;t-5uVDH1ltgE&;VE;fXr|v|z7ZzQ;N9}N-yI#mhx#TsF*|kM0S-uX z!cKQ)FOj5%DRnFRXQ960TuI7U>23Vty<@DejIpz;>r{11@eX(49$LxKmSTGp6*-Fs zS(7P{{%MLWftXly-aYQlog2rsq*s3qQ#91@p5Z^NN1yipa>>{V@0Z^uyrtVF`{cwV z%xk}B)z9kNm89xuTX|6qslG%60zS(ts-vEChsn&Ds?&mBN0QqGDb)JLSBHfmvuFhZtPN7u|KtyjMiu*uN?!bzi(} zYh9z*uPKFU41OpZ?EiQy0p231`262)_7HtDx(s%9)tLze0Es)NTH5rOm8?W-NUm2wY`{Vs)gt;8|k~Qqng!HB=|Nr%kVU z*#H{R%ctfXdw~X~v=#1>xjT zM{^%Gbp7;!MRdbfW^uC6aG`{b~pS-BQZr@xtq`To$w z6rx1x6nup+5hMR{9n<%_mzXR4g}7W798Y0bmeo%&*fn8;*wNjou8)McqGC%n!aFn( z&1{|zs@mlPmj&%;AnDnxc|{cz#}(n)xOm6ei7m`F$Rvg_$=;>Ag{oNLWP)*5Z6EfK zPp{kLEmB;J2Vcn8JJz*eJk^Cg#>UoEUo~J}G2f9iaDEC~JbPh$(=tgJefG^unNxBT zt<~M(oRFHeslHxGP~0pte{qk}weg|Pwm1EBu>KFaN}Ngzz~oOXTcR3{ghkIKc{xq5 zZxHwLWuYr!l2Q$oY(6z7V(Y5e4J=kRN?m*4KuZT!}tlJCU%qr4f4%;w$m z^LTgOPgrQsy=(2pDSTrSNW%GLMYA^t9&8uCu_Tn=8rKHI&@Fq%?*8M*`?5<`?ws722pU*n42t@BWIp zzdkRY+qGybzk<>^#PL5>bcO=2O|=G0WErZ5*y+xpOCF~VAGNz^1qPYOPo1D@<7Ii3 z=FeWA{*}J-()iitf6lr12-mB=+e|r14!{Zji|2^DWwe7EV!v1;%yn0>%5K+=YZ$-O z=alqsHEbMtv5mVss>&%gjRMc?e99!I>6TDGX~U2({Vr}rwL;+1(aayIQMCC&kazf* z_MB{cGTO}D>iuCMG~Ss0Vt{OCSm3>Ng~?wdFOkUq$j6kLD0JT2{&Xu8DJogUeLpw} zlpJo}!@b&wA3hay?4RtzI?YKMuGqQKcvmjKl$1DWl*Fsb>nb~V6bC8vYm>e->7=p# zEFi_SuNzNjs@dDrllnw6K-IeYBeg63(9;7Za)17dtyqly~H z$)ddl>6v$tt8VP(hNh5ZBa-2}c%CkSr5LNbr$GB(92mDAY@GEYZm?QSibXxz+_OI?mt;y zu$_c;UcW7Bv#yG@RmS)n&3PFQmDjTEg5|pz#H@8K3EyiP1FQtqXIxPPQBB9Y0q1_S$I69ewj+hnX& z$OGiw{L5sRf)hKY>4QHX2`34K3)$e$)eeK8_ef!>M3{My{^Wy0_Zj1W$FRUn|8znL z7+bZL9*Da^myKpa6Gw5q4B4;T_<><&(IWnxixqo?B6$)?ocZ-3c8UYTR&5%RP$2*# z9jbx_|5Y3eA&9qmumg~IuyRdsqd;~crYXG?iwMvI=k`ScV}CL?Hf-5|KI;A;W9ti8{MrX^**=Jp+j4_Qj>~#n+5*)N>e4 zuHA7&9}@J0D+yyaA&PVgxQ(RPshS9fuLl}EbsIZIcg&fvP2_Psop1@`Cj+Pmzx}%5 z@C8TCTSgi|`ABCWz}Nk2Rjd)vWy$F=*LhV?)18LlOKkV>-rTW9g6y6+?$Iyv8>wu7 zs5~^R57~zlG7gA$d&is(^m7C|50l+t{jbbso2?WsoSJe1ItC>he1dwP;pUO9k2Et{mvgFkz8NT86;RvjWD zZ-amxU}pF+Ubx$%q_+U$;_NOiBU6hYZe@=%9!^7wKz*?ce?Xxj=`?LnUY)3N85&}w zm2Be9Y#?`+qbE69>8>@v^=lr@F@kbCF`Fg3ad~~P!TRYdcBm@0?nAS_qYh506Fov% zmY%*{sR~eNJIOlXm9UVrB$AFN`-iK$Go7l6GU8Nv_f<_1XF9(Z6LMf1QCuAV^}D6j z2aV)j0*0iQPAFEWNHP^pkqlzSLn%vj^l#*8+0pzJP1Md3%;`1QD%DT4&?YUaIX!gg z0*kDFxMNlGvs9YD)G2Smi8j0y;Xd|w!i?FSB0G@AADgxYmT_3Qlzy%vSCX>?jids4 zvBOyOybR@Pr(k9cCL0Lx;)2FDTju+r7Rrc#-8S(1cz~(k-$)p3J{)a1zlzG4f`WMu z?cC|@+kZ3pj`ex;`U&o*3Bq5$tEchz1$y!|*{sI52mPOj;P_jL47rO3` zl&KD6k+uvu|GSvzs}tN)idJd&n+YRH_;|a z5q_!xu;%`zbOeV&uqz`t-;kc|Z?1jJ>5%|zy42_EuE=@Vx1BEpakxBCVcV_*u~0nV z*eIay{Afp2zp>-+lt{SUC)X2)zOf%11x4BBuGRUpgb^HNCKU3gG&|aa)OY{vj+DUNn%J8= zD2ITe(Tpo3s7pG+PJN|o=hD4B46?lpqBQ+-eaZF6N8Zs8zl70fdA#AuzZ4z>flp$_ zTwU{hqZPmPYODWXXi38hy>=f5r?@LiUk z)O0$KtNw`ckYH4LeFiPVS-2UV2pI%MCN1YzNI}0OA&47_)G{#0H4assf?gMF7j_jH zaW{_?Z=6emd2o%>pERV>xLIP1D^9N=7i3Jg@dKoT^V7`{V^N&R`v-uQ3&!pQH7U-V zYy`m|N<5!W?7RGR%9E(Gj1K^5{C17j1zFYogT-w8FAeNQoFU31|M*{^IQx@&{0SJL{yB&= zi;o;B`rM2YI1|q5DNPVO6EXH2njUzilNV!s!3o*vGm~R9V@K!DCU?SD(T48G_>6 z7!EIYE^C}J-zU`>#TldX4X=uXD8?~)sRj(Mv#OK5$3|af$O}hP2n~&u(R&^eD`VbMNtV%AP|Cw zQq9_2{pXIK3rKid??yZoK|98Yq0a|oy=03qmKIBR3E&<-%Z1JFf#4eZAqpWFh zhvWoLHjuDi#O4XJ88Zq*uLvBz*>q};;vbq4-!c8%Nz$6YviUdu`K<$;ZKhN$%P5LQ zqh@XRY?1vw8Zx6_`~0t-Te+bc81bER4X*H4P+3yqD`mwIYCr{*k~^=K7hNAD*T_t= zpR*nQ!s?F(w!xVdlnyM`cjnRizmyrRGkyZwvOw#;E!u6BhNHFa-q^2LFF4hSn%Q{a zphRI55RC*6tweM_iW5di_-wsabf6g-zO@9B=a3eUs$4+RpahR10ffy^gJVZJq-G?o zV_G`2VnoJuArF`V7SwfWIs|b<$91sQmro4I>o6K|`Rt!#7)mfvAv}>m*0hvH@Ixy1 zk$`H0WOk@WBpyPP&N}lc&2lZudx&N<3Zik)*YFeLl2Pm_SKF4~2`xI=Ow*`tyLzYk zW z$Gx4JY%$tK1D0ttqt^CUjFY-0)=95WJb;P6gM!X!?V6!O5Vw>KJ*u8>LTE%o3~+H3 zZ>A-iir)*32G-9VsHg`Q?3^Bod#>%&y~X&ne|vb1;f@(S`!^cl%5^rt_>*LfNh_31 zy|3*XIL%&OHHV#;DhZc<1lw@cz9-p0FMSNP7^txaldf5MGaC<^pDHQSKZVD0QUO?v zuZNE~+Pxf8hG%%1!-Kouh35#nqUa3Gd7NERD2$#xLdk=f;uBI^4%e9saF3Y%ULRQB zDVeABp=YlwUt=t?K50*xgy}tSi`Ea)YAIdGtQR?L=pBNEh8jMC$ni9GutU-e@o9tta(Iy3&}ghQIj9Q`H7^#(wP3eFS7 z{w3;g!(SW)a?FM-PenT|#!7hs$GdMkc3Ib^V0V~?J!JIj=AEgjVTrW4$8Uh2g(Qpi zRibb$_lW$-Vr>_%mrOVe>BfARLJXfo{-mi&l>zQ&%8Vm<Q`a%6M!4`a16C$U^j&bu&Qichg!3+d+kwh6P4V2rg zz_g;tjUQS?H6icUJIQ8x@R-s+n9-#pnqWrDBA5|P31fPXS-A#gBS9P>;LuqNeC3V8 z(EqY`kljAD_{@APH|8jGV=*QaCzIL}$drHhaa$Yv)#P?}Fv5uAxug-^fcwTIjzkfZ z%<{+w&Inpwv*nH5P6k5#VhIZG;?e7)Qxw%-S|yK}efWcWki@M09q`=8OLX7)qN~q!PN~`Ov)0%u06p7#>FLi|Pwz zg^;Z^u@f<2i~vupi_L8oqz0A>#h*?zzd}oQ>RCAI-{jRiZu1Lm-Sf@`d9o843BM`L zj4}!SEY6yS?)BOWM~s|Ro|GmX8P1xU9nW@z99rNYz+|TzzJa9pS6dX_6p^bIo0l1x zJv&wt3=K|E+B>pY8Bn@i#e{EfPJXCud zKZi)N?_um@e~~rYwQr#)WwJD~lqE|V*=CY0y-_5GY?;AOQEEoiYpqKNV=W_wEVp7x z6LnE~&&+%8dq7@W6d6l@q%#E7Q=aog>W)sT1%bi_HDOMKGba)9>8J)(ZL(d{PbNiQ5s64yR zSxaA@7|@#-P(eR5ZT~$ygn+_GimA3f)OuD@f2mnFE!1<)_OnI`=?KRn)~nypDC_O$ z$cpgcEGju(_qM*~l}WOGNu+b*g~#Ht0-{fid&G`iGVv8W`$XZgqpOMnW-;LGBFEGV zpMU`$=cy{h3DvKfa~8v&oaXVz2JAQvdD#} zBwXyv6^@%z2q=8`FO=}AK{WPe)}5K1n)a2m0m4?oWzt3WAFZVk>^&Wh#34k97wLSr zqEbb7UY)V`(5lFFNxWaEd?1Qju!O?ip>`ljQc!a#Wkz4cxRlGsT%crNdem)4U*bwN zT18dq;(Hk`?xGV2!O_*opZUbyKKWN_jePYFb5T*6eZr(0k_!pO4vn35^x!7zY3|8+ z`&U{<9Tv@d_$6%qdxJejss5Vm$c+!e z4R#oH%0dXv2BSTF&Hs}Bf|1@KjE3iYoSyHND_3oo?I>#s+8 z%VG1B=^@RITk23RHIVe}s+s4OcJYEN-Gg^N`=(0dh|oL&iF;lBF6L^1lI+kjU9JDx zy)ZSpXTN;g@Wyjl(qUerzLu5C%Vi|?HZM72L@OlU(6MivGpsw*hB!evNVDy)6+JX) z9g*f$mp%HPgeP%gamd>2aqUq(5(!z*m}CFCa^X~5XfvgSVjNLy=r@UXCGRI@QRLsO z;?N~u3Jje#t&8s_-*FwYV$b0;|}Tfs5&pZoE539Ze%=1T}j^g{gGquy!FoK6-%4u^hkK>Y)+LI(5pckSbfd7%`_BV&1WD`pmdw0Hl3(ob%?G!@hM?{ZGKyu<+3 zIP&`^t4Q3OhL@CSoB7i7dlm1^R*IT6gQ78P4wwP@t!Q`g!h7eeSx%hjGW zRITeOVLGRHV z*3R5d2%lu0K|9rIje=N7dJ+86>WldG18+MdXtW1c=#bt=TW$qlY_! zC2At%5yYVkDleY2c|x;jKAQ4f$0iYQCPm!$nZ)vG5D@}obf-5(`xrhQRoA$)epH52 zY4?@FIa1)2@Eqmw&=)jID*V^UgHiwPl`nfUK6ScvMdj9NCfa(3nxoH}i+2Z>b8+@; z8TVi=1Y$2HeRk3t<&&sIq-oOB3U8V7c83kNAD{`m7%NK;pqb?Hr{AA1b{}q-xW&}o=#6U>ACdRNulr>N(p(+KrZ4i)A|!AvE=fW8AC;E)uM9tY(N-Y$2sv4r zx)#t!wveB&RGzR@ltJb@xMNFk$u@zzeiSbsS8(}84WtSd(XiK(-2*p%sBD61GnRfr zo!ZV^lwD8SljJrn86(R>glg60)B&JN$c@p;3bKg+A^;bBFuwHTssN3dy{tABpe6Gp zy#n073%+GmE0wEDfu2`@hO&%HR)%s37EW>iz(5EbxEIR+ZLtvr*|`89gbx51Waa-#!b^Zx`7HYJe2*prQ#Qi_p{R^$%cTq(B%1C&MCdRRO@(@s|NW z7(6J&M%IRk@gRa($tMiOmL>EG56UnV>#zd!fJ7@nS!T6N^A_HogWH8w;eZ5KyucCL z0)YMDgZ43~h#;kXzw~GJSodx?=9ku=>{+b!e`zgkhQx)Od}9ItqHzGQz1DTmVC7#a ze5{01=u3rosz5nr{a6_Uw=b{-W>GJ&qa zAZAdkrO6 znydj4T#Q09n$inuK{0q7FeFh6$~rKV|9>gK?*x991OT8v1O&X!ob);!6c-fp_uk=v UNh1M39zHbTAB1`y%pnE*7ZB=_aR2}S diff --git a/classes/ssl/VncViewer.jar b/classes/ssl/VncViewer.jar index a93d323fd46f39a7d06da3038bb124e001082352..862bb202e83d3908cc313764df8bb1d5ff6bc628 100644 GIT binary patch delta 37631 zcmZs?V|Qg?*R5NzZQHhO+qP}4ifywhwryv{X2n@y#ZD@yUC;BLeOfzvpEf_-WB!2q z>ZA8QXU-qU+H5E!RRsu0%x|#&9`j7k6eNC#{~YpR|2di#j^O`uwsat1!2M@Po5iFA z7&u~DVSasG&*g9KY+kpr!WLj-S1vFwfE&pa?TByLir2m_V26!PG!tz_TsiM3E2*hR zpU0t47psw?!e*8BPg4Dow!aGoBMBTD&Bi6^Qy&$ezj*V((T8XG`!@Hv_fP3Ds?p8U0mEvk-K!?o|~aiE?}fLovE+0AX>X6iVVuSJUViec?mFqdWz_>aFu2BBKQ>L!0BDk7*g?H((bR8xESFxvLy#(ImO|t`f zj^t2@FaSX$5+UK7ED$M|zr*YRZbkb&c==G3ZMIznw|TPN(?02Bs3k8f=aInM#{L{g zx(E`ebSh`I*sNb9_P8mtvZ+`zVZma8Q<80N1z(j2c=N+$Rjh(K>w1iAzT4GICTXO2 z?4)MZsY7oo5_C9DT7!BJ#AY)6c(mI|XL_{e6!gId^6@AJdJz?ngtx;0Z@p;G2~R&^LD6aGJMO@;rTWax;=_c4%1{a+ooSi4r+Pfz%|1TCms``%-l8 z{mqp+oAu@9nSxavUH0O7H%}X}Ky8^j>rqW<%th76?M9_?^8(RL#ARAu^`4$ho786D zb6zR(a&pyTVUYLWO8f$#k=^nSVun`1aip0*=b%G1MKv$N>Z44LwQWeKb#(^KPlYgI zq6qWR?hQZ>1@G1V7U8^5ujzO#_d})FY0)AiqCX6^lDV+acc~k5vc4#+M`8VQ2*)y% zJIbJN%%J$wGYmnMABR+b5M|EE$IsCF_g`7gJ%~ZW29jDhF-s2s$%L@+pR>dtR&)Cu zYBR~|*0zc@E`(p3i+e{UI5>9vvrp5y_3?__dMg0faX-lR%nJ)xV_Y=83))b$=`A8I zbD;Y=V_TMb(-fRj3osKi@z8$sG0|6QMcW0Oy>CXlv2v=ajWx{YS75pQrBKWpwVc}c zOw%ogMSu!f_J9PSs&_;$T(NEFSwRlTTU5SoXszs#YeQ@qfO~Ac&l*}DjGK!m$j-6# z_`nW%WS^c3W{hNvX=KJ^`TKWc5pvE@PofUfoVm$HUgf0&dIrvi`e3;WY}^?8i- zo74CHu&90@;UBQoM+)*sjNfNAwM7ikOPGMehI^55mJLb3`Yq&VY{fZGuj~Nm+h>Ty zBaQSqORpH<0oo8q^#>;F+$2!p?*aVIpw|>!12mfsMsaSrq$I-u&jd*(`MQ==eZ~ZC zJVysc9o@%CjY~xEtYm;*At$#o?deZ{{DjPMwe&l0op@1QqfDRoX{F4&*Q)Jwv?Qef z`X2gCj2ccrVMgKV>~djsJ^eGM4&KFvMk^jew{!8IdiKk_g*mb#JHm{4T1~a3$wYYR zG@!@2V8k<7Vn^}X*BlxdqXp=0d*u;DZ@dTIA4;-eSf;^@jz}~f`H+o2+{hCW!V{Ba zfi1D0=kKDyvxuq!3@pp8%_Io&+qY7fZ{Pll%Kwn^zpP97{U!3_)0vtz z_mh*&%I}P!n2ufLCTndX0BUp7G=s>2RqC{c3cxk5(twqKhT87*=BywF1+q&6cqn)) zd%wt;#}Ju9TjEjrQ0 z_-4)z%83gPCI|qXSQ0RW$FHJ@(885>r-*^kpb@t0&LWuU!QMgy=ve5|5GaT^XnANy z2nA?o0$PGfTvtR|2rYsBW9v`9p&%IiAIO0+=C~_3c)pW^ zGEX1PAxU-fBq-KGf#N7XRz@lwZ_jCk!*mb>xg+Nf9@qeZU?wXgS&y4pVHqI}u7MdK z2SO7YTZ0s02_5fA{q`m89Tk<8KodR+L^K&TPi&`}TI>#0Ls-({Xl8+ke9x@1X;hT? z>CBewxwrZ&Tkw)n!GUVSA7(#v)Su!#KM^j#H$v#)+mdpPxu3s#^3AIFlBsv!aI?6SZojt0Bk>$EMie*R*+RgBvY@;9D zl<|*-(^-`(cwFtGD`I*X=X|Lt-Qd=-eSqo=3l;rN>}1jrH0e@*m4B_*>Ljx8 zjlINxTADF#M95_6OK;3CzD=jqP0Tc1{XqAl=EZDvq^ACIZbSX4AH|9?hi)JJMB>MR zy#?6Lp4wcn&Yoa4RP%}r$s!arPib^e(JkKgI3b-ZCOWOy;P@* zjHl>+R$rETiXcyfmLIV6K&z!r{*AMNTNe<}bPldY<0KfcNCtHxhnIqfa=kZ3TlN;v z{;M>o=#zu3Yp1LDC!q{997AA_xSBSX$%;aHject*ZFhZZY&u)W6y=eoZa*Ex5XUFifz**#v(@iB2NxI~b93;nS-VV6)$F;KP6-qKmSq=P7K2EQ>(2v4 z*Fn2eE7gCi^zlu^@+`ajM1%c~;v>6TDN?*|iqD=*K$J@OqHZMdTcx&RbEup4rGF$Os90%la3pgp(vmCTcKf&R&1Q+u}l zFx(37e?HLpk`Ib9iRc^x`aN5l`}`iWFG^gU~y zwW4h&1s@+4scHt?#YF3c&p4BnPbUK@}TTE7%1lcw|j;0kY*h&OS6bCEPOaCohPprJ2SBkDvzSe zJ|99jVHlcuWRUeB_-r6kc&F1(AV((^n&fJ`f#*u>ei4g;fEp4-Ol7 z_NFF*B1lMt8=+opgNICw*VwuYenOm-d(u6|FOe7RJGKU9K`(MXjZof|P|tYe-(TvfABB(>JTK~$#tdXG5nfJlPsfhJzp=oDNXJa>KC71>w( z2tpEU%1QKL6+M3?HUBUpJOYn;Q$u_RR=kyA1tyurkN~Fxzq#CE_(sv(>Ig>zZYjTJ zqc(&K%|AaV1xBJawF<50?__eONh}&}fty6Zv3-*&Eh2XumjIRzxM!X(%69>g>90wd zje%F%cNP(x&1oQc)a%>CHo#x_iWd_!3|I8xxlLtjbREZqmu{ zBIrU&3S0gfBUhX|%e?yb!SR%Jw`^tUHi2t%fNs=5O#4?A(;5n?{F({HMa$W-hUKRh zA&5ivp~5Zql!0~Fg>>XJnqOuGZRQK*KZ0pGP{IrTPb`Iz{vW~o-+I|{OL`9dUpui) z(+vLKA%&g_^1r^Kie&OsP_(E zhuWuVLoS7 zw~LOuIpxu6R8v(Rfxc@U8XDm7enu|Jh_G z11D1}BML*wuFL!HK&c`+H}_r(2bU_TO>(NDlP?1Uy)I_9FJo1}jivB?n3PwSp#>8( zW#$r9h-6LQ!fzk0RQe3)XRAsDr-t2MOQtt(9OoQ@-_^d%zSFW0!#@Ha&aMRs+tG{z znoz*!n|#m!cg*a0o8KoUNYJVzuPO~CRca3u z2_juW!2BEd`)1Pw4k^2+MOpPNU6|d0 zvD{>PzH2R$dh4^F?ocWl54$w;9t0Skbc%5{1WJWmWXz#Uxc>;8o00 z{Yh=2tcp-UJE~_7BCIQxC$Y$3E)mmdl>f0$9~A50iM4*tvHf%2Ev>+5^4woEEs&K=Av z58+c9C_d|sfA!_kJZ))Z<|t@BKxjUI@BL|qWdJ;RPzHY7mHWGg*yt_!hyqx?&OVS) zLK*Zik+Y0$xw9~}HXbz2rz16P?9A^iF|4}PKJLPc0L=op7uK#i_*k(T%wDsj^pXBW0^ou>sn+%c?}ftM;=_tKq*s;kT2=bxJp()GkR8=ncJ4u1c?}+0C;oGt zlTv;b1u7lGv$+RCPI>EwNh!KKFdYzWscjy6i0(-A$=ZXb+E{nsNDN)_wnW1-ZSZBn z_qXdZo7|lsI@lm7j;i|+qa|5WEwT(dzAymhq0mMc378AbnY=W!`6`^}o&d;Gfz_cHUEGGXQ zW_oi8WZWC0xfkJ$Ii=gJ@yp0vl~5IY=932I`S!-pL<`Y<+YzI@9tw=rKP%#0y*^^~ zLYRSxctbPmi)N41V3b|6YkoF8G5HTv=-%I2nf{qz_5W>x|6fi2$;|=vUnyS`kU{`M0S`9vw|Ej#DIVIo?fT4x@*Ez3WX~dngl{B4#R6ZA+jx_c-wIo73 z7kb(ZHN@%R7qgQ0h&2RLEGZ9dg>Ps_C@npy(&xr})ZP)yUs{p5OK5d@Tala`9+&GJ zp7$F7Km@W876n{4KnI{rlKP*`bq&ca1MFNeE2Sq9Ha2%oebqSE?Y@ zK~nXNTD5c!Uk(aQTS)n94A&&^9^zK;-$B z`zU&0bvLmwDJYQt1AA6ll@dUEP7O8wY8~bGVypABv;ff-Yk*F=BzmS2IhOW7D87oa z$dTmwF%ghmPO%hG$mvPgt82(=(JF(JC_q)r>D)Pw&{ZEPNBOResl~1vn*nLrRhuCj zJ(xSSJ(37M@S-kVla3_E`L zN6xH|mnlY|w{x-L{w@KG=C)u83UrD$B~|gYG}!A#J(VDhJu>HLqbik_6{ZzoFQ<6h zCbPpn@hNlbv^r%AY0J(FU0Gn1y*S>yo>(9eEU@!Kx=`C{^S9gjLO5_4j?k>EGzsZu z-JGYiN2=WAfS2XOp|9WaooeW?TW`|Y0X^ZuzDz)_q5u(F%2@ z*E)u`4R;BVE_VfyH)tAnVUZ+v7;SE=AufKbP=o4nf`pmKT=fP3`SU9 zwZ@2$2FU6UeUJeAv5`HU6$ipme`w4fg}1AnXqEq#rnV*4e>UfpJ6Lbx#p3bFF0|;`EkWq2 z&fRb@HY9x%yL0~GBzPo@x%V&s8Jw<=v|gX*@3N>v1yyBgg(pK*_oPkjkaL~K04xn} z@#ncJyVEmJr)*dB!jGbANQqpWrlpw8KVV`oI5CW=I&cSoJ0p1ntrb=LdFzy`HY-08 zm6`YWwKTqY+T$*DPIu6LFZ4uE-XfuLdc3R*U4?>2A7{|bud>)!47cPitMeOgso?9Q zO>)h)!4HvMP5M+=nb{%|ee#}8iKQ)9vsa1R+rVGKa68l3B`8Q*eo3b$r@wH85B5*? zQYggVIy!TJ{}XdL)RFlwRAy(do0>BjhKSa!=&2%b;o-#z*7RuhaCqp9l%FoJS}D@P z^REb@x*e>-#BhI%s_%)bR7MDA!sJ)1*-^#5q2?W6)TlA7nTBqJ>o-9yOA4Gs^Pa>Y zbH+kq$JCWJL9wxXvtouC1rx*<^J2%v9q-h&gw$^aEb_$PNo2Ez#!T*0@~^aFh-Bw; zI^d>7sVYQuTe?oMmLnfTOhEj>Vr4pu!_d2f^^j&2;*0ke#$u)5P5ZW(5e}a{CfIK68pEI>zkSqN`ydX#e1wOE3^U830Q?^w%OGkOHI%Yy1B_KO;C zlO|Hfyhr1Z9K@(TAvh*2uuj`ttv->W_ltXGDr;FtfA#NQr?Hm14n#%?FiD0EkA}?{?Vgn$uo^vAnO^gP zIFUH6lgm(Z8y_cm8H-$)M$zuyh2Ml?fAUI$T=V7Kz{%X;(cJKr4iPhBTXd=C%({40 zK&@CV*cS2&hT5pedq9Q+C`N{TE%6376z5{*LoaK-`AUP=^_zsrS8~7paDKO(UZXME zK(_>Ef%A6otuL7WC`GIAE0b~pAVA=Z$-IFz)5Q;ToqH0Wa=g?Rq-@1ch^ zj}ttS9}CAr!A;<4;ik#g`#t}6`9}xc#Cq`+Q;x8AJi$RzgfN((jj2~M=*URt$4c0D zQY}ZoLy^u1uB4_U7p9p&+@&ho16h3$WI4RT2qb0pKw8KwuoNB`l^#hK&FX=p(W7;_ zh$@Q1@cY4x1r!zJOBqHoyAL#+*>{6hVf9TN(x5L~Qyqh^Zk&&@!4)xxKE3UY#JMew z%(`XQXlO)fuogu#*0}4A<XY=bzZtQZA72clsOsLdJA&}Q_Axk~2Xp@#M+aC2pvr+DaTZ5si@ z>O-BGm2~T6hdWExoZS|qblW+p-al~6f|I3Ijn7xg@?pEM8Rs)f-K3K++Gf1%Tv{$W zOEqU;t;3RgCLXH!bxKq0*8A7Y$}WjFF|G2x5)(6#Yiy!C`RlaxCRMyz&HECuDp#9Q z#fZZEp^+-Jz7aXRErjZ0x%~D;aA5$@PV%pJR>)9qP)2lH4y8iDk0bl7SQ5B3^H=P& zKR-gPO&3&EGNpkfZkFbKH;aUDR$~&F2`2oB>Ozm(vbVSx9#EOfvr?1TEjsl4oXwfa zzF^D0g#4&h8=}-Ku&=)oi6}Mu9U~<~nPDi@o5WxZnh9lh&0s~?O~tfuydMp)jz~Fi zZ28m4iK@pv*`2r9;q@dran*LMDRRh+5RW)^J$t3m$-%2uyd<&2S4YfF`}=mXcbwRl z0RQgD`^wRUEjl@W;sJzxFZARcT2}QWlKO%zrQAJl*0n@nDaay!!43TaOR=-d?YG8O zyPN@#hPO;qZ=C8<(@h^(!CL}2tWER?6m9^4BcF9fEAR_TR3uK<)@{s|^7z%TYiOmn zEv)q!JueI@Pj5yrEtXO!J@@dwm*$Y4TNTbX3Bu4}44vd7ndDl`byfjU90EEf?YTL6 z7}s^Vd3r2xJr~bPJ@Es`wIxOyb2bNO%qa-_HxKkWaBIcj))T~+POtzH4uTs7IGE{^lj= z6}KZZ%;`wzpW*4jM{E-|s)MGO5NP)`pSN9&teQjO8X{5B?lb^4Z#}Vzh91jcTj5D# z%Gr#{arIa+u^s{-uV}t_2ye8w8?42cS$Z@DErtx6QvRT$8~X7fC;b?nW?YLd{alf9 zK9JrGY_`5XplSC(hb}@?_`KH}%A)(j0_F^a)g4+~9~%mW`7#24qB8orvtRUO`@W>z zox7mL8T1X~T@Aqf!Aj?emli8-r$~LB&ir=;Oz{Hfd8kZtf;e1Cx4`v1$8P2@4e;E{ zdE)3k*#$Yh)Hy4#GgrL?>tErnogzIURHimGL2>>Wm{i>>3+7v8C(c%8{Vn$u9Aivt z25Y@h)=;MI75-oOvq9QFgnh^49evZN5SSEn2y=-eatO$Ng`*jpKf@U~tbR>s_4>)7 zv1CtA7ev7J313Yc3T3&HH7@>_99$9yUEbm@f{X-GA#RTigP@VE#Dd{`f}-~o{kl>X zG{;#Dw=*_WAWC{fWeWEaj`OMRjL6ezwYg87W*;p=+bN<(|0OQ^kpO>(0`OeBg@fU0C@dw|KzyssXuRSVTg zXeuG;Z_;F=~r#-K}beQv^F=O}%pi%gy?g_u1VatiG)&1aPsEfj2zo z1kKv&LkC23cdjeVtj&)O5)>w7kMsgO(l0Jit(|1_$=?#M3#LUD?LI|jT5n7uRCpV7 zFADG2*?cvBtzwQoI&jKqh;rOB+aVpugq@K8dhD0%L0UNj8?Iw9HRup7c}Clvwu==e z@l|lcV;Hz|X#KN{|IQi}pssX>xSD&YZMP<5UU-c()&el&sr2om{|nbv`Gu8$5vU6n zAhWc$e4Wn{`_QQ#WMtUL-l^!PlOq$nCP5`;Z6_nor1-|dj#5Q0FK7dYB+$DSB1nTO6l!Z-nJo)-F$G6A#vhCs0-vh8g6J=nggDojR zhjF9)4zwcF+6Oktdlmx}#@+CC*!?X9(FW7ts~5;X;kYWX%w!-swnBARe3fb5l4Pxh zcpJ#q+IZoiB^C?OcpEE08jv5}sU@Wq;uLPGoAEdT7$OWS{$Ly;mhyPxh!f)0d+KDr zrSgx%In(+dK5UxQHcB)jL=rS@pnvI<5Mq&RjPavjSo(yLs~Es6JCIaFXs%AoNl+o$ z{deq~4IzciFU#DMIXI)*H^~O4(=Ms~16j{j7xkXnF{k=drjeY4i*5JA5h5obIwzZY zWIZ2wesbZ#A5C%x*JZrcd+sJyPwB6$wu-dX8Bf7;-N+p8k!Rer?QTUd9NY{`W|#Ai zRV=?UKBU zAT+n5xq81*Yqq&{Q#+D~z$$zVoqn!fibb6{1mTx}0){L54|%t^gXEg^++*usla&cO z)f9p$C8Pd=(QaqOC6H|TZl&O|FexEJ3!?AmnovpnP8)#b+!7njS+#^~Qfjs_RTF7u z?NAm2V@7ZMQBGQqRq-YDWXO~eM2Wnm*0v<{mXmQ-4L%led1p9AYs9acTW^$B}>i`%qa1r3snC3?2G!dTIqzi>O2bP9=Fc#i#uy_I4za&BUgx~u+O>F z9q4+q?R)^E(cCt8J^|rLuc={SFr%2f?U*g^wLVQ}qGyNlOzbgGQnZ664jrJcI<9xA zo7OOLyjiE?bxFsTgJZk2+JX7h65>dUYx64R@heKx+nre43T?A;y{-9amZD_vwX8R@ zO~L!ds-A&g{3cpjr9er=fk3GKU`eMXa6EU~%?Z$-Adj}DE6-86B!29z#x(?dIA`0L z<{=1?|I25_|1Pm2euz}U27V{EQfwQF!j?<)b5W*bsrB0$W?tA0w&X0QhKU%(t+2i! z13kEXU9<)Zqt7z!k?^xx%ox(|t=oxe7?ID35u;a@@KPwp_g=}r)+tfXp=B&`8{F!B z>z)9D{;f(~>9%P!R6>T0VowXG3@ChtGtKTAuByX21nqS+oLeJJBVAEeO`#+h^SFl% z;_4zjv6!_7UsYUrp)ZOhrSe+Y-=)vEZGPePL(ea;t%I#$mlu@t_ZTbnIID0p^_z1E z!+*F2%IG^58{>awM|jT`4TX6RMCjrC(hvtcE}Vc}GU15Yn#8Pq%~HTsady!+@zb@x zUVjd}7#qkrTO5eO6T)l<%45`+)nctOY^Z#~sNRygndId@?HQd2u-l6oHq4!&@z80>6V9F0=)*^mvum)S>2b)Ri z+%W_|C|oLijPH)$Tnc?mX5OxMt3Mp5srCCJQWOiq37i?Dejxk@WRuF!lRy3iX9IBm zH^@lRf~(;H|4J|1;N6`f0fC(*{zn9OPk5>JouxWcG<|(0tkPfL%}{Ts7oPsz0*wVs z94+Cy*|=SI!wwYVs7mo2x#?@7>KJ{bcPOtoy==yniwSU^rmH^D?O#A;qZk-6+xV=Rt^ubc$aAFcR_yV6T( ztzJf;2EH-~3(JPH9bet3lYh2jF5vtIm`K(wz4jd%tO2Dhg`>56V9;cJwPvt-*0)coTJ}CVDr28 z85_m+mSX3T+B9ZtJ(coS>VR?ky74(x2s6M?WnYib^8TM~MR@mo2#;)mqA0z_o1BSI zFj|^5U{j>Jnd=(Zsd1 z3{w%pKKeflPyXR6v6#5EqD1EGCRQ=U&%ERn8)XRD#BGK&!z#5B@}J#a{SlwVD>z-geFQan8P9T1!qjX9{@1WJ}!`fC8ZoEjIuaZn#TxKAy|Vy+kQkcbMtuc~9*2ebq4wfT09FqQ2hWCA#t*zS6LCP2$*yp4 zfB*x@>TkS@suPC?r%|f9D!t_sg>s!OsjK*GX6uSt);&)w=)aU+_nRd9<;cpe=@Ik5-<;VuN_Gf(nT8h+)ptR9G1$9uZIm47q zO(p%JrW_4%?OLgRC$rv;jQ((vYJe3UT%R-CmIi}D=ycCz-{peI+Ne8p=Tv|+cz%!^|)Ni^z{@;DZe3b(Z?<>cxD{~UD)y=bRxsqrVLCIyKJXXI3H zuEqW)YW4Vw!1)m?{V^Bu2L=aZVyFuM;eLVrwFu?F9FtPNWgfdFuJZkH_!`c+U7;^n z3K{&9|3hv|uE@WdqCj8O76xxcHf%*Qt13rP`dXbKNR&QE*6ES$s(ikxpr6XZs7lIJ zGLxkcsHImJe}%#f`vvtMuyI&^9@hN>+wT7#*Z`c&7LH~f9vNCY|Jl_379^)qLB`Rw zX2=^Q%Zt+%naCCmEv3Wb|4jZKnBJauoXQxEH0zvwm}f!q*yiFrets60w1x*+Q7|N9 z^8xdrk$)#9N6+wvYog0H@FYxCyaw}D@dQ{m+MX#0sNod%AqK) zGXPKt3IZM)Yg--l&U7Nq-%#T=h0tZ%S$BwtPr9!&4h`z1*YT+-R1GeX?p3lmu$r{o z)Nm*~R1WF|OOY;H8})_sV917e2F?De)y(S=T^V?Irz=>~04I<_gcBCt{hDc45#e-J z>pjhi6cD|SqIm{o19xrfttSgVf{F3=1Sp-LYPF0+yP421a@>$!Yu(_ax->JYAG^=C zI+jWtniF+pYp-^)H&Zx!%Qth0@JeYJ@!;`yk@hpM#qGA9cKz_zKXX`&CsPzinKqaa z$A$f1xd>I3=Fm9kEZ~?)$M6neV|M@71f(ny%%6C4ciK$6ep&@wr7#M6n(sy-0}K!M zYdV?T0vi3qL6X``;m%bdlQAhjOZ9F|7o%Ww$txLs#8sm>@Y+yQ>8lvErjJ|eh{dOy z=ouZ&iv%a9{d1I{3|E8=auNmJGO$u84Ba37*@qQ3?b?`%e=QYdPD(1ckq{rIToPkM z>)@vnp9wRDX?Pd<@cfh~_S$J&18^Cr)a2ITqmgJQljqm`gW6N1$0unXQqMXisG2U7)w80EyCZ$LX(21C<>ZC2I zFw@vDo1Ws;nW7tTn_W?F*0l$}N9Tg6HmQ$fZ|G%4$Xd{TI?ObA(|59v$PT3Iso~=T z$Ewc0Vul?5lBnL;1RrigxfP{tVMYX`EL5)v|C?0mKX53>gglYy@#pW$Qm@FDz*5G;vrtLGDkckFRPcl*IF=_?moS6;zX3z97lz(5j!9vunG>v#TY(TagC zPMtA1;{i|QkG+Wby~eN(@c;qdE0-fZwU~7QUjzK^DEmL#BKz|}axL%n(ObwLEVrH3 zvc*#69FBXJ%(`Epm?MY@AcXED7CU&8WzPOGUSoCe20LiL0^?UPpZl^P*8(_{ZHn|6n9>5e zP*Kz)pVA`7(iwyNk_Y-DMP2$z8iI~x!Xdr26%zZ}$u>C2|14ik6>)~{{}|=>e=&-r zff7*H4Hu{}_RJf6GP8Zet)w7Fhrafmw9FGsa*&i3GaQ~tR7m7`7Ap#c1^N9Amvf*e9rdz~j14Phb7qE~uCI6m@mG;MC>)btV*o<)gjf2o$iUe# z9>c)tF(1Rg`7sp3kBKoA!;h@EA6>5zaVA}_32}Q}uVL_z%#b(}5i_C@xe(ALvx(l3 zXWlcegF}Z5L`0ev<%!DmEx4~;L@ievBVZJZV-sE8m&f1DA1LM%`-oV7eeg~s1`z^S z*FIby=!3j2WqQWHyb1TeHN3{c6IOyqq5Y#dc(V;8JOwvGB;2xzP~1f6kWZ5WiDX#O zp!gF#P06q~n>N6Jt~O+umWQ;2PCzz8lBwh-eqw8!qzm4;5Re-L2skJCj!_&~3v&(j&Ddpm4B3XT&r=S*)m4|{~+RO3e1mI4j`%^jpyPFi$EFt#$}*?FC*U_ygpzY4!yj4 z|NT8ecuQNqdIwG9;yFkG@Wt?{TXyS{I-BKp-amIoydE;4wQ!cnh6DPO#VzyRJnMKPn`e# znx8m-@d~c-x0o-4?~+QO{}MI2;q0|KvEjT^2Dt9ET>~OO4Aua4cm@hI>EYica=rKP z_uJeZoACEHfMEE)41g#ct|Y;wARzJwqzG5$(wLFrxeb4CJ?QUdO8%_rM`|2RC+RD| z^J6N}L}1i45(QxM>KX|s0d?>PpMHnGYyiFRfBgg{@qbAM$N5wp0K7i*fF_=n17QPv zqh*SRH@&kWo^aim-I7M~M)W-^gyylWY9T1D)7PY~k<3KhGo_15lTz478JpdgVu+c1 z-IrAgSr*8;LxL7wMpRwhQz9{a+ZCV(smL`d`+!pdne!vIgdY#YMj z=`bSqO2YDKiB94|x`$)f9>)C?3NO9NX>ud%i)P8J5>Gz;EDPTh2`@hFtSC1RLWSP= zsD$-nNF!qBEaNEM5QnaxpS8&tUA*F1X`XyJ>w@Z8GUx8G%oV?zHM5pI`HZq;3<9#n z)YCb<^Z?dDBo5Ycbta!!uo3bKC_7s#)Xi8GQ42_ zxjO3=?k@O*dqu_d<;p1zL0*(=6^wtyZEdWF{s@p!AWw-*otoOrkj6pkV0l`VlsLc! zE4*$@^vjLLta9niY^B%uBVps$NO}Um`MSdhKH|}FCPdff)h@lE^-R_c~Y^q(LAGaf3fbh zr1zD1l-?(2en7<#IAm)n$Jt7G_(EVWo(}*`C7b0dn}p5{oupHt0hBy=QJv__w$ZN< z8Ie|Ai@##-*wE6}WIuZN2!BwN><+jqdMT{T7timR0A&~pTvRC zzmGfwts+4-5uw3C7pKLfb4pCBBbtqhgC(9bID9BAiqgtD9IvmuJ7hBH;lr~uJp$-; zdrFxvYmA!(btT?WSZIQ?8I#`x`CF(l5&t+8m!lt_B*~UY*Z+34l^VtGEM3H@tKx}F zyPEuEzqH=#DNs78Wkia5Ro=sBru+02N!@5#*x6*8fEP48} z{TVr~6PY{0^;H5b(MxaaF$Lvbq`{mD8Rjm;Z_uIP-2GZ=GHUYx2E=$lf9a2|pP!W5_%HSTWMG8?9`^3_8p6#16jW}EOdYShbt?^nh70C}6(wpvw zQ2oa2h)XCXGkW7{^E+49E?~spCnG?X$;;~{uBc5bEgH6koEY)C@t*j@&*pVz3nq%M zBQ1@_>~t$d{ssGRjalKV>Im3F35eIYl!Xvpp(B=uAils981t?$q;@7H_#xn;{I>n3 zyh%y`b(GEx`7uNrkYpDbDGTjLU2r8zur;^;(6xoKLXfSqx2ALabA znq28CH?^xpo`FUYWi8pKipob?Ik7%NNiZ`f=_y7L`!^ zYDzV)5ZneZoUKU3$U{ed*H`!4q0^aMzP$IW_{b9+K{tN6UZR_~eER4SWbksDh9lyL z8xCplTlC1kH}oT}5-ehcMmtSEokqyN7xzmsGQLdDn!v!jQ?KY%toNRpKE_h^qk2$B z|8aFsf8G0wu057}yb~ZTN}?UNvOMSUnBKg(T!GaRIdFo>wrFi9lln*A`Smnq50R^U z&a@z860iMk-*UhUp89=D;Kd-yy7_O&+~-lDZ7OYSC4Tas%kBGxxGzP%t(zIyeIAiEYM0&(C z;k76|TqrtvK}I0Yy9D)MEpYtgjwEGJz~n})BGFeyr=jRXUP7^aJ;U{D@oNH+3O^IZ zUakP~ovk(2w?i9!jAtsZTNy_u?5|t5m%9+%X8gHj9Z%f)hWAK+w=@Y`HMyqdZ;C?R zV`x8woI68nIW@rVV8WJ$rqPX?700eok(SVe06%W0B>^o|&uv*fcCgVQ8! z{9*Z~3RuuC^CZc0!fQ#Path21*~az)Yqn)ZKL;kGIb?++R>OiGKb5WgjstAJ|;7ktPKq!=pxk`7F`2vfpc9FD13aA4@1}J_$9VHQ~$zIu}XOW&O zlArE40J`o&Tv-H`)xI)9&i7$?MdGIb(aT!Nt ztlU-N;JulGe??+iRDPFMEnO~U&;uc4Z4`Ny&dCXrGz8~kf4Ertk5%c3F4B_s*KoK_ zF)?NgYX(lS)6#Q8F8C>ud%2Z;!@yIZXU#!PaR#hV9%s$}2p(yabGWhK*`P>N=YV}&*!aT|>+WyH zkTT$|+&9iL8$SUU<2uEiX@+K(18lWaiM22~LrJ?KN6O)tmiSRZ;mE;sq-)WqP8uk`qcPvT^3YC@M!yLcZ-fg%5%>=_`9(M{nP55&;Jwq>Vnai{d)PRc1qz_mb1 zpv>pJIr$!z?+#P*^132LhtQ7wxqMK%qM_6%R)VFplzHa+JIndo8-)CFbeWj-`Cu!p z0v$=hKXHL`puw;?S|z4vu%;^N{S|x4-dPeYhohSBOy2;+#lM5H7h(#2&g5dmTmrCw zr7givE9_Qx6=f>dR|3}wk<`BAfTj`>aW;H4T5)AAV}UfNRTcrX)Gi>oZuJqe%y?$v zjAPj+0WPGXXp!lZW7jF8d$Wo_Nn!h}B)(%1d#-c~G*E*IK4$u))K-0SF&&26SI9F` zFC8(-H~XpZSF(t?s*~kRA)S&E5`YtAXtJ>`OU!YJSEv~)H#RmlGTGqCFXzi3#J|JA zN?F5Z3dt#z`AgX>EziZydiYsa<5g9mZ8%UqCle;ygF>At6_=-xbLfDddeKG642sZ= z{ZNNeaXkIn@o?b~6N<~q*p^=xy0OD9W=$h)dvcmEr1KfX*~GuRp{nll1AwZ^KYtUq zz&!EfZyOp7ynNy(B)({%U%AXd*OSg8&p1LrAAYE~4)gvsebhD7OMY1DmE*SjLwU|{ zS7mgq*NAGzYIBq@KR?HiMr2wx#d-E;x9{)3a?gYb5uD`b2t^Fu zj0BaJZgA@^&QmLDUf$UTEFe6W!ZN)4^N$0K|A(jY>qyL9LceK?S-GSIP7l&6|Exe6 zpFYXqQBC%6jKyD12dqn2*>w#G^Jy7XTa4<&Kj2~-a5I(>8g{Yd?~JBE4F&R_ts9^k zidxwfLCh#@Oy5-MWY+SCs;>y5!LMrh1vR(82Xiy!+wU~{Ls3iqC4i;+EW$lIGmmKV zALDSk8vy$j5%e~7R(F>I^u`%X8<}>i6FOrRK_xR%Yrf0o5jvk~8o4I&FVi}#pMFB# zZ|NGsvpDkexIl(3`+HQnmsQSg{#1WH)9ry*2MxCk;~!-Ud${??A=Fi6a(_yVOTDh= zImWM1NJcl^H&lq(vjK?Eh+=8NxRLBj{O^L8mg7m8oKyA%+Ck-+nE?syG|mRZOSglR zvByiEeiIx%%MuqFh9(4+Oyn`xcYVzo!ZbMQjhX(y$wZBZ6&|-8fhVmY3nO`TQY!8^ zrq*b@q$`{~-mxu0aAZ8AqY{qR_M$S@2ohn6r-#uSo+sbhME0$eaa<__N-BG6TDZ31-{d%czQv-{;f&JH6DjBKDXmgmqvU86^rHxDb7P4mh@>e$uyce)q; zNPf(o;u9`DWlKn*n@RkPMUd6$TD+5H&Z$0yjxsW;27j=BE^0nAl~Gy|X|9exj`q$k zD@*&RA+CQ|vvi;^Aa%1=94b`r)n;6xEc4#soc&~&d^vpb{H z1R4DLx6s$n>^C+sl^}_CJ4)@1H*4#$&_O}>H2+dxa|1i5{M6U0u5Zycaual73n=^( zDpKD^Ci1L*X?T|Cb#;B1GTs$KLI38%M z$w-ADWjJE-{@W*0iUd{>TXWNpAz=IgsW{Nf zdhh*&TS*)CA5i1>!)EdtLO!ySzUc{BTxvXiM?A`g4(jf=3JIOaP5Oc<4RxFq)sxdbtlPaGU@~R`|BisNhOVlg;FHOR z>^fu1)^Pr*MqK9I{I0^0%vUXAPWStf1DS6(zc*Qwe}Hul`1_GAJ4}7XGgzM)s0-4L z=bFJzh7nlIHGf4zVg1~&e`#PPaUw+SHT9x@y>IF-B0Ak%6SX;Y@ypzV{D$Or`{RS8 zSaM0lx`G89{O7-G;2%TKSaP#QIu~K3J)WUC1f6FF9OZrrwQKoeB>|#MQ}z+1HHLSq z&Ru_nKq8J#3mG;;-oVN+$s447kz(RU{Dq&*IE?#tO9qbQ6GPWyIN@X*$+remO=nVn zU`QGs@Hf<^{{=_-pJ5ok4TvlXa7dB%=P1XU^pyJ}5mG1mNZ$Grce~zl5l5`(kOWdg z9wq9JM^63oyZ(a2y6885%aUzSlDOqGSFNOOL)-eN)gH5VVmeDpjAXyT_jaA7q8XQ* z3Dx=&@8qO8jHfS-!sC~I$*X53zCN^nBKaEyX7D^^)QW;`J&PxzS2YfI|TW%UK|5k{<8i>8x(uU>; z>5e-;{qBsQl5nknFF)}ow&l;F?lG;iv8op@{htOh;sUkA8^FOR7G`vqj6%* z4p9VI>N9?d$U--5JHTvBFyA=NlRXpTKNXy5q-ti{bbh_k;q&PkV9Y-GY5B!;bMj$0 zl?qC__!p3!)}9`0Zse%I)Z4tY9kiPudHv~>&loNsGr1eGIW0noQZ&8C>J*S9jJ!v^ zFH%k}-kLCC^48okx6BPs*v~$H(>TDg9rQR(-EE|7NkpsP8lIf$wLGdaGzN>X=o3w_Ei#tA4<$ z9~9e-`XQ^{VbwdWdY5?Es2{QDd(>M0G4Z%jKVj7!M(w25Zt*11{S%+?0fk5eP_RG!jKj)Ba{*#>HymZ#;Mc^hQrX*~thj?=b-R+XoLKEwSqiXiUH=l8~)f_xEaVlz-*WU4qE(aT67#_QF$U{z)6q| zOQ_ceL!lZ*LJb@WewYkP3BR631mIXW1?Cf;4;p9#&xmIMc>~(@M7|3^?k#AC%mUR0 z&H~v6Sp~$qY;N`7B8NYFa^d14my2H9k;kpxJnSHD_2I(JMPDv|`W1|9gZ>5m+h9OJ zQ5y^_DB22xc=B!Fc^C$_!H|OOaBx*S40R2Q!65}(p+8lw;bwb44Dw?zq8&tm+5rVs zayyKyA}R|j+n^``DrQg#fkq`jqZu@YK!+wkV;OW9fyU9q1GmEX4j68=ToYn&_!{W5 z9lS)zM6Y7FTgBjih&C7>#}*Ug*pp%~d7UUs{T!#PFPTTfq*p6&YcV*|YqP+4N|6#A z<+T^M?F`plQ?|iWZ^m{gt#aGiVVc+B&Tu!ZJGa9zRc^fZxdSS^+59nwT<6VyFtHQfTyKxAvmeW|_ejj{ z&X(>Tm95ajn(twl=goFiZiD&W9_}7O#9)EDhijob)3qoD$GNj(P_+$?_vW}sy%&3X zx_eSD_r&0Y0(Z|CoXEOi@Zh8lIK`x06<84FgyvQTfts}uTY=k_*a;~Sf0qk z@p3Elm2NwKQQI>3-ZY!e3^MJGAS#hVI8T5`LpKZd})K!TrZ= z0S%wTckz92;E%Gmbb~{d$O?HZ)phcGc@fp?LYyvUiNA?TafYZ7XNqOw zED;ueXA|TcalSZLTqe$=W934zNnAv3{bKQyxJ0}vE)^eA&*x$_N^u1`#Z}lxT#JLm zKkyK79gY*%<3zCrr;4>$A#TJ);uiFYTd`i;hRx!3JWp)IYeXxq7kA*j;!b=}+=Wky zE%=gn4&N0o;``zy{8+q_l+U4* zucIcOBPl5I`7D>`#S7+vqizKWHuBf~Ob2UtXv3gFYd~!&a5b^Nbe(FHVM7y4Q;(#7 zIM^r^Wbw1jfz2H-$if`;A!6Gp~rx9A9=N0Y;iYgP4}8k?pXm zyf6l*Jq)K;up)ODPPuOf9U-p25mFIbMhwn~!I`bJL$cxyI&55jx4L|0SCNdtSw*h1 zV{lH9>s;4)F*v`-b%E=`7+h3DUijjF0@o!xAO@EfxGrOEP;+&gF<-ykbjZ0bCtxdN z6u7Q1@vdA$2cBYfx~?*~ceM$>hFq5GTC@ERbF0^_h5RDd^)XmO9!%?ies0aRHU>AW zAz$RWkp~kRO?6!>3@%Tw;wEAP?R#B<8+5`GVvjX+yt>vKOS15`Fohl9F_*f3c`aGG zYlG37isQN^MYgwgk?o&~>9+q#Ot)7svo{*dZncqKZ9V6RJM#efZGL<`kuvOefU<6XTAIfn61aJ_XiG$%L90FVM5ZHmk;Rzf8&*DgU z1qhBvFEs#dthQOvWi< z29}C)JX*}h8KMejiX}Kp_;I#ahUMZ^a!$=SN1Tas#RYgQIj?!-tSZTWNi8Dhbewn; ztHcwySUig-kTW__?8TGB8@NP#M$YUjtQJ3DjrbL7#c#L_B{tw8*of0GNSp{`Ek+2k z98bj+^lv4ei7j{muEI<4bi4}xhW{YQP55`b1<%4e@Ep7c&&92H9zKZY<4(eS5--FT z@gjT=FUEa%3GsF{eubBR%S^mNX5*Ez7hWa%;?>0M7sX3vfSK_nXdEHi?kR{tyF9`) zb$5Yl8_UZwb&3Sl5v@>eYQ+O<*cCiz_502KRwywIgSxg`U4eKPxrc`=n9qcn@vC87 z2U(W12D12AbnP&XQvY);;n6C#Ew-t4c&s9! zg^!c^k;Ub^p6J&4Oa;y^>fcj-QXhj3a;C=Q@%dt~+gzlTY%MYIlcst&h`VM~>|2xFdVUV1Y^fv&O80ljJ@}(~;plpK3Iw1EMhQg#y=$7O^pS$*bJz z0eD%Y$b*)7#TYYxy08N>3U{hojQE+bUu}hKiaK1cS#~H4p6#h}z1|LccexgMDb0DK zs!)z;hc~@8x6Sod4BqDKM)%sx_01K?;NM{q=s-KD74A%gjeSgoq3(B+-4~nP?-|4X zm4t`4!}}EXSbOeHC?8Z5xc+VWp$`jO`?$3gK3W4KTpt^M5vY-Iv>AHSXE!tUlQvEd z_87tX-d)C81+Gtd!+2MDf$K9K5a;vfru6s2|G#a96ihw&IYm!6*fbP{l0M2BSkz=ozgYG~%MVB_@~gRsJ9UwSYW-&H z|8a5n!tp4^8D?B^Dl#PQm=X3a(!YXc$v9Ec~vV+ zW>~J!;y@b%N0>l+9H=v}mofUk229Tt86-bSSYpC|v6gW&P#8I0$C~opGoZ z6Iq4~X#*XU{~G(qj_;#K%05_#jelLrA}1kbLoB(Xr!kqizAI(@T$3=v&^tt5>)c%< za&kqla!WdeouUJhPijZ5$V&(8oep?VI$$3Qc%O)elDVR@hUk!@72 z1%)?)4c9>y-VC|80S4kNa4_BqMR+?LiW^}Hw!%!j6DshZa01>9)p!py;uZ+wRyYUS z;4+NCb=VFY@Ikl@x5FLy5X5i?bl^_-9(M^19})fVaWN2|5Qk%jI0ko%Ih5Ee#HT2K z?s$gcj^`=nctJ$*MR7SLJ6GXrw6nbwbG%6j(tDHy{Y%`BABY|JZ_$AtQX=$`c%2fV zH}Mnk0e&j>;b#p~A0;Ki^;uev2;r4)gE_9E3mOF#HLN@V_`2f2Mfk z7o3g1;zIllPr%=?RtmgCB1I4quaydaZ;&>;McQ$r)Nzx{z%9~&+bGJ|DYNiN*#n=G zIrs`i8+&9Pz9V~6V%wLbFhEKL%H&{wbHM`{XLMQ=X3wQLC1BXnuL87L<2sr^&mu zGvs~R*YPnV0B-^w{WK7#5+qKW-HXFzXZGGi-+YtGXZMfWNE0McwEZ!3T8 z+p;b-dd)5Yq4H(0~0b^pKcr7d{Ncfl%@-HcYSOPxEItgh+*RwEJjJD3HlukK` z?_rIFH~evB|25E;+{Q?M(`{MAjv->zrsTJszU8J)2dLa++;#J{Z4mlV0{?GNavx;M zk048a3IpY5Fid_9h4M@A%KyL&`4yDOZ=gbc3n$C(V5R&Xu9ZK)eey@xO7Mr}&+xeX z1)h<=!prhEctidHZz%yED1=Xyg3px>->3}uNo7(T{;GJ*y00#Oq1*_m=1T+T8gN)! z*^(eG8zjlE2iR2(WGfd9-XmVO2G6EG7GfWq#CO*t+r^<3I=P9f0}u(c*C4o-bzVACb`4)ax#UC>VN?p9dQY9 z9cJaN1`0>xxndlD-)U-z@Jo)fwc@noi1E~uXG@9C#RN`AsEUch`DC_}{Jhr5TrjeK zOiXMO6S#jjWK!1=oM0wqn-pIxS4=j_Ba;B@+@lE-=tps{Jwe-mHKeawA$KB$Q8!Tu-;{VrCc#1c`slgCVRJvnG7>R zD*7mkiDSHalDb*ujAC|zKsSXwc+DRR}9oF`S`F;4C!?E>@%A zGBp;iQ-{GiH4bi9<6)!n!mDZ$e4&nnuhmgxw^M|FrltyqDiyhEhUl-35tCK9n6BoC z6VyCWuPQ}YEfA~KB5|8KPHa?FVzWA4bg0GRIdy_~U7aZ2RVRskYKizrRf|tm4cb*L zI#fOOQUM&LPQkHi8BSCUc(iK7V^t6rs}P>7nsAwF#I~ZH zo8m2h(_n2aWUwyUaf>Jy6>^*sUX3hmo2V-9BHQCFkuC0W?KN<#IH7}*?F8b9@gP*3 zkn#vbpC=hwyd*UpW~2(Mw}ULiYPO4$$EjAas^_39xDFR~h#;w)j|LTzql<}Z`l{it zn5gyYt>S36{s4t{@UU3Q`m;^c@lyNR0!IjfZ$w0lK)IHtKc+=J@octBAzTkI8 zJH=4A47anQ6~17=G6RrZ;C7mX!RridFrW^%lat^l7}D4YkEXlV?Z_3umvi{(bkd=^4NBZSmDLF>bqv(Dt&=%@%pt?kqYG>zIX6 z0c(Gc6&V+J9nd?^wvLYST+z%fM61ZN882i#*1)|~_3D5;s`Azu*-I}LW8OGLWAl@` zu-v??Ftvam)$-%2bK-WfqN*s5{Nzf1(@(Z=v8sa0(`Xr{lOp{Hzfa~VexOWDdb*{F zs|cep=6*f_On%3gYh75qGbR?E4-&}hws%!a@ThVsqPduwMq0;cZ*)?9&wP`EQY8pqCnjziWF^F zwTUBWvq!3J;u!USn5P~T3)Bv=MC}xQwM#UphsARBh&W9>D$Y}niHp^Lq@EYM)QjRZ^|E+Ry&^tTuZoY=9`UVuUHqVSqEPEGQ@xEn z)H~=_@1jS&hX<>F;c)dK7OQ=Dg!%}lsE=`m`V?oW&#*~-fv2l4$?g9KFHm3MYV|d) zRo~#v>RWtT{eUm2A91gL`U&4uKjVk$7yMlPiodAeB&y$KhWbNhYEtHDN)FUCIa|}E zU(1xIQmS&AmMyQ-awrAqNvVfR?$UB)ht^9zM=8t;l)}8Mx#d?{U->PiGQVj9m0KI6 zN;HoeqYYDsX~We_Enm&jMyP;RpqjLiDxwvUWZxF=SP|)Ju+u?*1TarjY!{bO1l2As zs~{(^x@x<)yozGeD|#LU?c&OIaaEfrD>%6Nviy=Q$%d7!$duZn-I28RYDVnLN|tFJZAqF(18GY` z9Vie&tb|Y?2CV=A2?>FgB+a7@NlKcgp=p{>nrHK9T9R|_%t~unPLut)(D6kb zU()dpI{s0|mvy|P<10G8s^e=q{z=EnI=-&spLKjg$G_fGt<3DtKmv8xA9Iqy@8E518&jhyOHAemy58sdD2MM(B&JPo4#gBOLV;+8@hB*FP z$4?X3ix-&uXF7h)@E1D%hv6@I=YQk)zXYzs>od-V41SeBw?JG7T|^S-5m8>p;zA~H zqtJ+pi1SRJd4IF0N+64~Y^opYB0*5h(S;GhxeD@d5fAftn9sw-36T^FnByfRoTyea zT`bhaBAzZzh!mdF#S&gD4QaQEWqfqGTE@ktx>%tLQx_|Bu}T-0>EiMP-XgBh#cGCY zbWsx*wQ*4w7i$HggI>Qtvi-O z13B-gXM0}Gbp#^r34x0Pe%6TJw4>W)*BpV8Qf}E<&~t zk`Gy#jDJ1kpR?UMU}sMBx+ht~tnG{vRW@hk-Trg#-KkJS6Y019i4m^Shi5NfIQPgJ{_fqAx`Rma!a5NF*RwCEh-MKW0ORRL!X<^ zyIcjDiDawUVD>PBf=zMn`HG2a9;WP8#1&~nGEoTGVW1Ep%e|YVzigc)Kc^ZTuxbKf`XlK`<>h=I@>!MXxVM|nmY>a2;Iay z_K^e4gZW~A&M^x`GW(#-GPQ*=6+NZ1<(Mr)R)!FiP9_&nvav_&LEEJC$h)H~Z0mu} z&Rwlt=1{>ssSqulJBe2(iN$sZIe)MKp_&8Ao0XYTm(6jMlK<<>zJfbA<*(qx8jpqR zAmKV)y2c*PxkZoiGO*_i3)Kwgtg^b^h+Sx^(6yElv6v^Tu-*2NfNrmE<($AyDgvyb zp}ei~G~*5qQEi?XI+a&h{dCy#8p_Pn!p0gX-(j@mO#RT7AK@1m>~059lOr0C|ZrCS<}sybJq9)buUH0$xMzJ zu3TBm?%pwKdRCuJZppYqqkln4o$JJN-9%AX4t6s2pzF*C>yGJ|t_YP{B`1ALS-QSl ze~~PH3Wh zo;*h!2CQLKATs$J*?3it?X5CLm~4t0*8;o1#tFm9@=kaGmjRnN7Jt!0=%+~N@ROy_Oz zSLJz}pxo%TLM>=*TM(Qb$i(P@YSVx1ulatC2lXnO;72sctI zL%qnlxVVlaR)6+T4TQK}Y&Aq$bQ$81s3%j+Y;VY_t(|PzL)0l8pnp64Tj@{74hwqv zMCz&Cd86o|wq&}enA639w=-;;E0`YWJx&!*VEL>qX?u>M)!}X`TEmU0MnPsf)Wg=# z*6p5$3R*F0RhQPZ{f1rLcgwoX+C?Ac7P$S~#%%KuMt@&c^V{_AtA8tDNsz`_2#=iq z5K)PwILn&0HilJHKg!Xvv_jMXN1rLHpEPC4sFfx2)m6~6(r1@GjNJOqhNQ@)BQxEx z>H=?wGDYxisZqi$obBPm8;fS!P&;wbCrGAbrQzN1eX@AggX-iQI=L&G^MeOctVX$M z%PjQ2gMR^HRNm>4IhPtC3YdbOO;e}Gdev4w{|0S`pDO%_EZCl+SX46`fijIZ;Eo6^ zx$r}boJy~-;E6T!2^J*H=Db0$_20shrcsD&%{uCDj{LlgaZVTai zLrCu_1?k18AUzrtyd#8E$rXHm2=5FbRZs=#1ES!)A*AP#f*%a|-ygycDHx;w8H|xs zA69!&g*jF?0Z}K$5vhxgBg#XpE-A;M)g|NO(Cd;_<4Dx49mkxyW#cgF8klqvb9*Lm zQGaq?3G?e7!yE$1i-WmQLNd94<|SM*j_QwrA8a3?aXkz`+K9>PQ6_?Lvzy^67N974R`2ao|NE|(hII4ii|QLH#4;v|MAuJXd2=ikOMhNk!ivtd&tp+2{8|>;3)Up=N4X%R}ANQk|`zS}N|1Q_ChEuAEw~<6%7yS54tI z@NhK`8>euacz6R3*OVR6Jc-Su;FjhXsk)U-qmfZ2aP2s@l`(oW#B85L3lZ;VmVYTZ ziPj!T=$$3(N=c&HR>JOXHQQdoo^Cq4wJ~!-%nZ}B-jzc z0}RVIX(??I*Y!jvaD55sl*aodbakuQ{t^xavyKuDcTb{Q1prC)#^!h`K8c>5v`K#w|Cz{_M$A3{;9*vf8tbCoG(km3RQhG|3(A!N=D8zK;Ua4HiX!dl9Nn_x(f zqQ8h`a+sojgrfc=w#ZZ1E^kJce6!dn9}wH*N5ysWL6MOUi@bb9oRVk7Er0S+ajPte zJLQD`sj#7aDf zzX`HXbcc206$;#&*hyz_2Y-R+X{=yFu-Qu}@J6z;1Wy%}F--7Ya%l;Ebn6&)E{h$z zmNDg|D^ip$=PVlz!nK5vkXd9Ih5O0rb%Lh1M8qL!)G)dFKG$9tj)!@w0SBl9uAG1BNNXd%xlS|?fTPrOHVZU)^txS`G@Hqnf#-4 zkCy!7bWc2aOS&VdcYpUmC(5;t1O<-_)*OpoJBE*h_N`y8YR20F<2EN!u~dT0^!AOi zTHcMfQf>T`YRT(3O;-g|y*hpu=2YuQk|5Sxu?*j^?V$a{EpiQdQ+T#fA5ls90W4p6p)x$bXc%k7Eg-B@xvYV5L@# zI&C2uv_)vrQfSspY|~cZuy#3)X;;A3R%1w8gPXM)yiKdcJG45yM_Y^AwR)V^8gQ@H zh%v1R4{7UgR=WyMXdCdHb~TyY#H-phbR*vz!N-0LP)i30&upr-NDcr1BpLt!P)h>@ z6aWYS2moT1bh9|;t}6p#mUNft5&I~$5(Q|g|ABUnj2sDFw~fTU(45T zr1`BhZwT&9H~!ARw>&Ti-$hP17-M? zV7`{G-@5S|4@|Miee1#R@Ow9Z{>uZ03g%G!w>1Beu^-&{qX&-EyAbdaLY_^;CnY6~ z%S~AxINF|&&Fjc5jp3#o57gi*Zt{3w9u1Pt_uLS<$@IWN%9RC!Wp18ync^TK!R6<` zB~&0?uQY{BorcI(defoI4Goj8;nIw7Q<0lSdSE5KVo)(d8YM(V%U6ki%oyV)pFv~Y zG|r%d3_4gw$IIvhH%*jIsRx2IDTn-2W>C3@DrmB7ImMu<9_Hi_X{O1phdS&q6K=6*$j-p!p(^1qRg$Tqww64XTsQB5CRcv)G^pfyYU+M4Co}nwSrK z+n}WeEtBn*%TCA3SFDe5g^^}yRv2`Wh~;D%T;-;KL90D*55DcD7K2(n za35LRr#5NY-PGZMUJ8mH*QDhm-L=w$(m3I1oit&CA_jE|>pwAnC@L@}Gve~ql>27wuTy%;wKb3i>vMObfG~P3B8M@xx_=4(q#s15#?TP&=rEb(oI)+;A1hetHpS(G3Z(kT}Ri8 zsJac>YS0Y^-DuE%O$Oa;&@Hm|X9nFW!?zjqbAxU-=nkRu3qkc5bf>_(47yw3HiNbc zyhoaQ4f>^lSIXyo23{`keuEwmk`GE}hk;uR>NW5R=_L%>Y0yIkJ#5e;GG~`Tj~eut zfmg}!ZiDt1c(r^!ZqO3~pOoe)X`VLlI$83JoAxpkQ`u*K;57zbE2GaEsE_xYf!zY1 zH*l-K7Yw{XPVy^*UUbt-qM?@!dPPM1Dn~DA#?h+=y(W`h_poDeh%BSuNb_5R-mrDZ z*7c^C(C@S{x#=wrR?*uMA>NUIk*i}xx^dIH9$bJQI+&zU8T5OD-s`uu4DI_5!acf>Qu+Bm-)&+P{v^|DU zxUz0dV0~apC=hO+(io2h!|gK=RJ3h1Q>t6iwz?r2iANZf!>Fc?s1;~M@Mf&BaXi6T zA8v8z=iB3f4e==&!=omTR!72d-q?yF3`x&OVR=@6L8}#88;^80wnQVLP(vWh#D=D) zrqMjt-5w3Lt`4*#j7ZOz&$u~(_PW5PNLQRE4O-n5k4M6?B!rM#Hz(cY(Y%&OINTTy z#Jgg3fz>i2gL94HNx6Zpc!w2^2U`O12(vz@u8I*!62tn8E)54a)tv8e=JRwz93oYOFTas1u)|OiS)IuxyMRX8-6hsfx~y27v7XjoEU-FcH8$3R#R}Db*#n5^4KS+wqzuyGaA{rX@Ned z{q3x1i$q(j20^f01lz-rXtI|dk9Ni4RiTg=3lm|c@-%8`G>H;6t<_!a&TtO1l=S?h zhw1JV8_U|vo*4`W1h*SghKv`G%l0}>)w)ujW(2fa|p zFu5)*Hkp{|gn`bEU`tF-RM9S`Gn9|q!sb>ViLMKTbWCZ9u)lfcZfvoV=08l_k!`ao z+*+0PDoY=GQ(p{o&yj72V-~WAN!ZrNo0SgCbFNHJIWH?dgJ;`6W!8w+NRq#QT0Ubi z5Mo0R@?wTod~UcUBBmeH3XWHI#ha{+aWO(GzND{TFoP`}R?FJ`(1T;~Kr}sDIAfd5 z=ns~d+7J+Lj$6@~cIXTQ!o&fNxMI>k?wc54T) zQjR2!;3!7SH4qPk=0>9u3H<|q(8<80RI9~0NQA$LO(4)N<`vVl-5l@Pr^WQGuozx# zxU)+_LFo#uunoa*D{D9uiD|Kn$xxWJo~>cZay?=imvv7vBGDzGs%Rv?Wt zZQSBcE1c1lZKUhasO3Wk+k$;)1k*TAW2B2cSAr+&i~Vs~(Ar={CkumrCf#!Zhd;6T5Id@6`7uF>wP*AWON1i4l|#y8jJk;!lwG z{uH+}mA==GiJNe0A0HQ!B}+kycYEvLVUh&GcR7P&!k8k)iKRY{w3h{v~{! zjH^ugw@BnatW^3zEa69P6i9=@(__-yDU6NL6vG_B>my5eBdaMQcSy>$l0wUH!8u)W zIU*cXZ^bu6qHBGYcx$CE9Pvekf-fHN**8t;}NF=Y*O}E;%QtH1S*( z9a{H1sihn!@_&t|KJGRxIT0i+dTs$p{e z@tR3n^|7vhP9YQXbvievkFk}DpeL*`?=nvfZxoFc}s^9(Vm+;p(w z?3n}I0xPuM5^AF0iKZ%5lT78ud)b0gQ)|PV%fw_tnW@TEg{dZsHl|23RRny9C^6s3 z5NyAHXJgDj#e$nP%2d-t`^vYGKM$4Y_kgUQE}nXrI^0x82+bqaQKqVtff?d{2@&Z| z>CRNMOf_2_?N-N_s!Cr`XcrY}jMyIP|D?D6BXj59qLq0nl_vtiH{MDx;@gm;7VeyhCx2iYQ zV%1>c`69hsUe-8w$+EdiWDw!ddMn5$i~6L?`$v6!CZu_br5R&?=+Zvdr?9H@P2?+o za-xr|QWN9z=SfoJtG71z?9_^t*KDzO9jBHsCykuL`I2>*i5JQho4Z)<8(*p#8=@yU z<(My(Mh>ZwDvRw`3NoKvHZX}@_^62&%Q2k^b_toDaEXi!wa08E>&-6GOuSUfr!ljf zH1TXnIW7~{JT<8r&crJPeL0@S!HA`Q-Kbd0TVxU*V&WBoR^zA5Ea?h|?P_-P zfMr8nFvi!1Mm~EhZpf`m5PW%#IwO(!~VE`Zbn8vnt^5sYQiCo%h@eXeVe5}_#Sj#xSYc;4%cKB`t4Rc zRjp@-tZ=*7hANe30+*EXOebo^<@s*xK+g&NTtGi)EVEO*MX`2y4$$FoQDBXJQ+0a5 zu=Mgau%B3cX19cbY#+(lPS2iQ5VqPQochMCw1?%(>r{21Gq5^;7~-_pirLoO)!D>O zV}-PyMy1wO^+~aGmdW>JFjgytc0d;g^_IL|1?0HH`#h4g1-e4WKbXt& zRJPO`@?biAU=Luqn88?8m`U@^wYcqo6Ib+e{iKk!C%E}wc5>&zDL@u^nXvI|Hp79k?l}jcP6OTK(v!mD#8@W+U?3#IaUuV_t4Yk%A1= z0?QUDYo-7DUyhZ2PNS7( zH^;JIi+=lEnIT(^6u)INuMP!b@(kR^Z#8m8W>##kVGJ*SX|zK6o~+e=nH|$z`$14w zE8=E$_zXpy8<=&i{mw}~?<^;qy^OMZzDtt+u{DP9%m!ChZxc!`* z&FN4e)c@VndFB_}DIW-b;8;|U9uW^{m#f6!gd=9vij@ucy2_f%x7pA&tW~W~G2m2Y z$P=|XLmcIQsw9LT`QKj=4;XvpvfwMy+9-~b73&O%B@Xm1I%&Y4xJ;H`#+&Gb|EG8_ z>zwRUM*w-j48}TjICWVYg@aszwu1 zJFwe-fm0tp@IYBw%s! zyI}_$mw+YGOF*MduBit`IqR$RdKQvxmVj-l}bRw7TiI9ax#Z<>bNI)JMGQwlQ-;T7hsTppKR49@E{|$zZ>HY<7AzvN8cbtu%@ZAz<_)aH2Zw8h9(?;fyJ;w!%A4K zVKcO9cpd}=(m3`rfi3J`+VpWSRI};d3WMM_7zVdVuqL5&JeFV;gUF>&{!u9YtQ+R?`Jqf+=6no!Zcpmn_oA4~W z2hYJL@Dh9lFT)S;3KIN(8gt+`m=AB@5O@4H^Lt|=Kcw{!N>Rje1fmRXZRs)oq0G^eH+JTMv}(z*l9wR5S}6HFoWWW z5Th(9vScmWn6V}uOGp#SVC+k_EZIdOTasN-*6dJB|$rc27Dsc&RptZg1d5*!nhjS|iz0Vz8Pj(aB!^boL_H29C z|4hsa{^J1)^F2JgimjC7A!E$%i3QGF;J##}czOTA5SQ+f|AZo~<*r2$=NOlxpVCXi zcN$_>_@BX0n)QR@+|c@t=Cv`sK;^Vrafw_njDr)xoQhCa5%O<8@i~BMIF{eRohB zk+yOCYUhXG3qhxA$x^#A^R_0p%HS1!rGaLAf(19+3rl=e%BSXfBOPwx3Kl+0RXx!z zNXfBfb0HuPjSmPuu#KNi%?F{t9TW)BJS{?X|b4Oq)ByU>Brr3I#dcWlG9fk^6p>qQ`bL41?cr@Buw-KYfp{JFB&PzN#V$Qh?RB%t~2 zavMp@ZD##K1dn>(j*(qM1W_ot9XLd&(HVSuS%>5B-oDXZ>m^4agadWN>+Kx;nC94 z8rdv5v~(k4(C(4AZYe8bqe&~~|n5c+x+W+8G6hhCJ)6`7){_v|Z1K!Bhh|UO3iK<*T$lZ05 zf(ON|*_9!7qCs0yqfCW$79U$hm)(s+Yl8?YI`&PYnfb8}a@$`!m=@7-cWB|w{od^c zKIt_-6GPWH4(Uh1yN=6_kmORFV1#doQdb;a@R>x$Vm=A;*Ieg08Z7t;i28A+Ze2ud zib?}zOU2kGGHv^m*rxs7i)P*%J1jENysv+)$O)_ICtg?oQ8%>ryu#$uS>Ma$_n2nL zEeq}J$fB4?gNp_0=$O?C62Vz(w-??kr&CQos;a2Q{jGXd6NroANnF(x2cByu z?5t*sZVq?hhV{NE&@G$43f_b_Ucd(yL*(BBbs6F!V|%Hwe=XOv_=Jnm?Oy0vXK+VL z#rD%TdDxUvebx?-^COztpq=ctuyKwb-puE$Dm_FN;&9axJriQzi(WVoOL`Aj+_+vf z@6I$@i2A9nHe45d%6twoY0r5hl|NQXKsst6lF~BLi6|RPUbl=dr8U_ODB0M3?suvh zs6zSNg_se}=JSpetq?X77JZe#wIhsen(Hp}BQ9itDPOBYw%~lPp2htFVQ=s1=y6V$ zp=3$rX_@dasR{0z<4?=Po!CB7FRi+c29agUt|2tw4!V=WZhzo0D7+(oyO4^E>s^iv z>}6HX9gvgW5Z25)H3ydUPYCasix%Y!^#iQ}p{;5Xu zOe)$Jc?3^JLCJ%7nU`O@I+nO!Wlm4~qOA$JIlJ1^XW_Q~hXp;70$X3dibq=+i{gw$ zze@%_v|#86Vv}Lym*M@P|7W5WblfyI5O2@qnD%HktBLE|mF+%YsqNZtu^>o?8brSygt!bFT2L@Z%aDNy zj%vHA4NIdvKZHd1IzvdmdEKaJaP*7iW%(yd z6;zCXK*zaS@(2IWLQB^tDJp{C!?_?}jSQ?R?d;MV99#zC9}Dy)1UAby)=k|Dr8^|br9(BFSiQT+!Fkk(UmFVc~X z$eCUU^3&@O`?RMj-fg{h{%M8EYss)~-$lCO(Q9Q{r}%OkP$t@_LXF-XCLm+u&NH>1 z(zC9{!Rk=g%8r3EJUqo5H_Qy5UF+<>?vo$e{G4Ew?)ahc>%4_Ae+OqWN&9)D)^n?u ziN0=(G8fB{*9+(TA1c*JwE~)B{f`de=le|4vKBrC#+o)Q=9^3_>0sb6dG&|VS6L_O zBCZuP8i2220^!b#$k$q z_)Y1r8Kp&josE`m$}!#4#_Ajs234mR)3sgM?*&62K;cfF8y_-;Q zqcYQypD?PTbxAY9zS_xx!rqRZ07>0v!xL%`fe`o;a{A2T@=ynQsMyW4X8%nTc6WhtnJJnT++yn5};@9V*UV)%%W*etg@b4}il zZXZ$gr9Ap|8h1J0HwCE?y??ITxg&k^7t_$a0_!=0YAJcyBURhGq5o=0yLn9Ar46=S zi*}I~|MMZ@Jx>sTEGYyis6@NUA_;xg5y?hbVdREZ5zc%qi)ZJk(phgGtfGM=dN?K-7oU+j0L3quR`=%&=DLyM z@@g@6BRZ#&L`Un}0{u|rjI&z{o5*~FEs~UK_CjmdaMWd*Y00aGMIu6tjl68^9Z4H&7~-aRti}H8A5wkLhGdyYhAdciL;lh%;NXyuS~0Uo#H2!isXsl8I@eTuiZ3) z%t#dW2SMZak;QWUP$IbqXWcET*(17So-$cnrQBRqhM9ZMPgS05So(^(EHrG4RW3k( zT*Unxl0?EJDpKA39`}clT|H^e5rIykBIW|PaUplU;cR$7$akCN%0Wn1p4iw$cQ$=r z>|x5^Wv4k5NVsdYDS!8dIr_^N-y3f4&t@2dY`hB#J?n@!cQkpd#*0^3tn~^l*^dk= z%BX!XTu--thFPGp|(UFq1^>ug1Rtf;1Hc(lC)uC^hHckwWf95+)931HbR*= zIC-VEJEx+Oymy$qDMvQj8toYwA1OSzOfK_$PoAI*`YhH625zk$f{(gq5;PLubn=5h z#H&Z$GhhfSi1i<4H4!TdMjZFgyp;v39A7NSf)$T1#O1(hw3OBwl*EW#%OufD4lKue zbZb$Yj(||$*UI!D5GUyOV}jTr2NpIzGFpi~t@W0|GNq>jftY@`0g3W~K&tL;ZZ6Jx zmd-Yg|D|L6D=d^2F*Xec0fAyETh_ClaAy}G>dS-qFC2-$k{yd?C|EQrN;E7dtlC5g zsiJJeTzN3vaSCJd+v>{1T6r+rnKd{Fq-KM4Bbv*D*^d+Yo#@SeVj3qR69Rnk_-QC0 zz%a;&9HCH-o#==FALI6jK1YMBC}J!E%zYdYkHbn*8zt@$O57YLrZT%hkhsA`T>Qs% z|H#!DO;AB!ASx>SZ$3>0Fbry|4+5bvZVz0XaYRc5nBzEsV>T>hXGt&{?d$uLWyHF8 zc@udMV9sON-^qX{Whd+jAMLq_2mdJ0D^g@(E<{m9F#mC0XvzS1fastI<~zQRI5Id7 z5c3tm=Z}?-`E$gtieNU#w{${MItTGk5lnY1`#aHz?L@YlnS{Db4zYhP>+htLlMekv zCnQ+V>S$GeM-`kj`ceo2>FeLncd>G?aWinyu@U?qT;<<7zyHK^^2P8iBNijUd=f`O z1Uz{}jlxq@pzst=3OS8Yglup)${O6Vv2wv$6Vni2R{kTWO(7Jdnv$y$_}}l`+BBua zgcZQNLPvJLx2&BkfaPBxkO9^mN90C;xqu^EcX@x*iV+yH@$oUPO> vojojZ|G!jzukMr1B7EQ@XQKx;o;KKjoT({A2?Fs_&PhtuNK^ks$piEsn5p{z delta 33678 zcmZs>V{j#3`0pEM;)!kB*2K1LW0HxvW82!9*tTsaJGSj)l1zB#_dmDlo^$W*e$h|$ ztFG!=pD)&`%7D&%g+fx6gM`8W`}Xg4sMSnF;)DF}AsY;7U#nR^cL@LAv#}Kc9qzyP z$7#Ve#s{u>Fb#C?s%8}@1Ev5lDysqIjbIpbP z>|*02mXUV@;4n%%(Sg6F<@@afqR>OB$s z_}fd24c?S5)lY?qrmG$@Pp2%OH|;Of@~uf@6|g=u&$Q?O-||)`CILn$G$gSKqQf($ zT`k|mh1*8;aqSH081%#J65B0;njSAj5St0mn>uDk<7#;%ZZ&G%aB&v`8M3;!2-)uA z`Q=cOF8-e8e;bvG;~N%vvyNj_rya{Xa%#|MQp35VCwCar*^Z&B2+@eYpmQAMe5K2y z2V~E7Y@rD-R>M-fbS$)2h!E1mV1s5Fb>_QFjPn3_2|{~q!J*hdE*144Lp{AgrpsmH z0+~T?S9py1ItY5sDhc(~4i1Vr#zi-@W#*%s$)lVY;02@Qh*VBjrw7?pOvjq2p=iO* zxYg#K^`16|O+2rrfNtiXGDkKsp+}(^;Am$4Qk%obsnFfkT;Rk~$|X)ZqBSzthoVXI zLJBnKKCjrRnAm7{fwWdL4F{tcS%riKkqRaveV1?awlII7xPD|~LBQ=b;Wm=dl6KEy z!MXxzk%_^!i}l)O@w49gcLfxy-pGMAZvf4WCM2^Bp*kzOWJMdI9Pzs+M5PxsV5P1F zj!5#yDRNP8J+U%3$}B+__Zmfhq7s^;cV==%r0s$(6Ma&Ow!JgaFNfRwUrt463|B$e ze=gq!)x(a+Q{*!C)x$c;5$+vpN0S7xruW}6NR`G_rErR6?MC9&R*=7u|UO9V`Z318yqT&I|{;4OTIvgBc}w( zTfC#hLWu1ml`aYDJ0eWy&=D3XCjXCbxZmY`l zcUAM349zcr#r4zH$@z;4j;+I2lQcckXoC_qZ@5=NC}b{cmv5gOl&Mqn-$vwbl=YSL z8MoMNw8ts4uzcSH)AF3KzJ?HQQnaG4PRAtWsGE|T~(sySKeX%4yqpUsUGRZO^bZh zgq{9;ndTP$_K_U<)X-J)%rMp}lB?L=YKLXAeLX@eZ8`Bs#Jgj09`2ZOeeP~L4oa~# zRVt7HhHP@FT2nRoFF&pkOU zognUx{eo1MgZ);HpUAon1qN0G3kLRo5KS&`!dlvL(KD$LC}F;?r;zGJeZLIKbbxe`JZq)$IF0 zN&7Z{16?Mk<<=CRV3=ZNweA)zxOZ`2GO4XUEI7!<&~Xp5#Dh^@mqv$1F9EBBL0+#+ z`<7u!o5wESHa{)orx{9$&AH5`HEA8GGDnyg`vMl8C0n*QXau}5G&GxGD)ZA4p;rI= zXQVf%Yl5RS>zE7F)q!8zZ^zg*GjeeUgWn1`h%NC-*70%SXt+(I*v=Z-Nb=+t8_hw) zZHb?0YrGEFScDuzs!j!DknYik)ij)FE zGbl-54>!47)TAj-)~c9D%dBCij1Na-yZ^ztI@pZodKW5A%}GgH5VehSVN=FGV($m% zI5037-E2Udh=_IlWUQXEoa2_C0FfLp3Z`m^|Ken3D+`0X9qFO6Z4Y}hLWn3eLT^Yz zbDByuF}cNJ45uji9qG+M;Lo%|_dHT5(TqS}#87#Jce$04R zplY6k=+TXL#K}veE{Ie;wi-ng*hXaWV^dS5WXU7iCJ#v(ELteL_`#=L&Ka`DDkF4o zk?EpX;4E;CM}1@Ipwdq6$HWIjPb^PKPcc?#E4);5@?JmDw1cHKdbRZEuzlM+~*8gLZ_H6ThFL}>u{+YpG2cfCvj z!~L*#qy;{4_jWJikrpr?b$bg^w<@s2gQJAL5PvCz&UV#aI0j1^?rA~loC|(3IUY{j zGn99@u)l{1k+1tt2z-gWOywwA!_LoyOm9?6$j=SR_%_no-L?)9DHBYTHj-G*Lv>$A z*0#Bt$5WzmF^4G%KK20YFxLfQNkW*}_Wa#$%2N(%^vzMIW?tO{GWv@nyJKS!Yp&>9 z#|IWlqs4XXgkB9>jOi;djUK`9o+4yXRoPX;rDINa@S!;PE`A=~G7Z5kBxnxW-LaaA zOXm~u@b>%(o7HN(rmOPuCF)QO`nQf;oE%%N_tWJvJ5C9Qoe%(ANwm&|E2sjkfz51< zQiHsEYP&;c42_>vr{#faht*WSi}lDs{Of&);~kkAkz}3R{zBHRHsxjk1%;-fnP*fq z{wmA4w!UxjkC?R#XGg?EO5elm<|K?LhD0)U=2VrK#TG%)=zpjSax<+WUXfqpcPXZg zeiVvOkQGrkf~5h@a-_&yoQMcBF9rB|F>GR0JClX%`g(&DdjcH&iCb&91?f0UEkv4NJG`0@N)NeI535q`tLZj-_c*?~P}kH>0H|#QA5_>e>yA(%b~y{=W~W0XM{vDlW*dV!~pv}-a{U@Sx%GRQgk2_ZM5M(U7hvW znl)^+Jn_}6fPGB#yFCrm8!2vyccrKoqtm0Wk_h7dqjzDP-S~a@Pa}fkc+yc~>ND&l zR|w`;;{O!y_ij?q5DXZYGvfcQc>mnL0NDR_q5hji-5O;{mtp=V8IaR7K>W|JN=FIx zUqnb^CI!s?#FxPM9C_*iZZXKLx~t}tlqWa!8;-IfQKnEZDTA=Y@YEbc*iykpb;6NG zm_Akd1NBfgy=&A-0~5TF(4569pR^;l+sQP}cfh;q2}6RQt2lmczgccSZ~H2}9X`Ls zgE8z^#2(zr7g1tSu%Shx=|rY8$nVDtC2bom9|Njlwd(B2gR~TK8d>3$vR5cHAGi5+ zQni!EY@WM@F1!I^`wHmT@`uo6creY?X?=+o7yL)rNA}hFJ2S6WmfAapm=PL5mU<-f z!gkQ9itP4))Fo@KS*ohA)L;C&*)1clUJ%zTOu7gcCU0GR`uDx3s>DubzGn2_ar96w z`T>$B57T*G)m=JfLu<(E#1|=bh7RARsK0a=IIDWDxcR1KooE*+YHn)ZVkfLb-gFOS z>&j~RGlumb4#L%-$^Ig74L?JRC$8|-b_LVsd=ChQvLui{D2j|mX4-2w_R=%nXPFIE zY{ugt#JEL9KP2cvu#94$;AtS#2ggo~><66WMLa_l9O=fYR4e2^ulKrXZEnKR3FKI- zPI7+SB(ceKI^X6Nj^{&^o5-?prvBXgcCH73@FjQt$)7okc%j#yK1^rFN>QIc_f5Nc z#?o$XNxVTBXB`{b$aSK5IUnY2)=0r`3^L=87$)L=KmP|nAbxvh&;);vGn)5Xjw#?q z4M)&?dL#VyP)uA_h5J0+)NzU#w`MPWjI!6fqof!1tbLitp1C_5b@mO8+<=GRYwRyX z>6&5?7#nIKjbd^j$6c)~mge{|$g69$mQHBzQxeDPDd2)Nu{-{ROW%$XYkF(&0~Uwz z$}Gm2w|Q~6?M)z?X%mwly|vJQKnK8;a>wXswOKeZm!IjZv6DQ}6^%-H6Lg(l1F1J| z@npqeNw4-Mn8(Fj?sTeJTEzzrERL0X}N@8W>*=Nt09?(4w+G^fpRftkGCRWHCcE z<-n?;B9I&un$M|x0z=KYx9s!EHs6|Ux{mZPH5i#W5)WV8-fF?zj9 z4_qsKOk7-U!cNlsUI)G7l^ot+K)Rbri&wM!afB6<-LWm-&1x8}X=e!{$Z1CUb`%|( z5{fNNk;l6+Y#jR{m8>>5f-y6LtKg(W|nlA8270SSnr?m5h@PhN)x>kQbc=y1KMz z<|nLHojLJK2G+~3ONO^d4e)u#Hx8mn}+c@cag7WNgZ z1Dv=>m@BNL2MU-!O(cdlJf((_DTT)frdbj${Qoa}7_uq&KLFS0`heINw3 zf-G$-J9GUzLOs_D+5@ih6QtO*CEn&FFuT)$SN)->A>XutVM zu$SKl6D~+6REp98K)=FhhJ5PYgdw&S=Th0)BQ&Vz?80VH3u~<)(2^d{LbdH9h`agI zLF7)nf{q3LuOJud8?~C+c*VXza|Bhk{f)3MEi_62nIV*STI>Q7^;VXiBv>gheRl-R}TAi)PfX2Sv>o)3Iv!_{6uzS$G|xBhp%6y zaaLt$b@63kdN}69W)Xft9G$VWPqdb+Ry?ypqnJ<7T&wBUb+t~(ez7QP+-<`>!_EQ< zcZSovwrTOIp6}dCgWf zT-10`{-*=1HKhQYd7%GekOF^ga-3LxKBFiCl(;--0Ry!fT09L4!KN&2cs~eq+)OBK zxo-|p-5Jrg-xK{7L_FEvO=x>>$g^Zj~RB^J<)cRg>?XPzj6Bt}}~Iu*9a zQbitvdK_vwrmSWF!B>UbY=ze$b-(1){)kIdJM1UqPyhj<{6Oz6}M z#td-;cXM>tpAcoY|2vWCJ4>(>hropMjfGPgUi@BN+^DnoD7t4-dFkpNsOmi?%!-p> z={6^bUJ`K6mY!U$my=UUlCx?>#ByK*B8q(Wsj-N!qK$myWr|eidBa?U`E@M9+{1d~ z6{ldTK|3kWPmXQi_@v`XTXfZa0Dms)!GD;s;xO(SRcnx`0CHQ>oowmK#^4ZVjx8$n zN{4VuPELZiq-M~gddL(xyJmp}4VCwBGjH7ic>!m1Wibt9Tx8uO)g9I@?L*om(oq=R zV`aRDI&oXnTPCB^V<|zy^Qv9->+|!9{I)IidzTI zQXQ&njS1mdVk{$L+9f{5pBy8ti zYx?so7AX9v>>l;;dNkc~KBL^s_^UBBXQWW1ekhbNhAxSvN%9oT&Xw+k1kT=th9$%F zh^r22!Sswo!zk`G1+o*Ib4$;?-Bz}=^L)6-F1MguCyQ|yAWY6E4@`J19QTRkq5~F# z7vi2$2$x>jZURSZ9oGY1)fz10zhnzO&B{5|$}?xu3@wYk(r>3VGuNt`&cK_}9(>^F zPsw}B2x5h%VFaZLf^uoCbB@_||75lBsy=GSh|p>4ji|`jB`1&bwR{~MAEB$Ec+#`NIyJUq$Ik}zys1!>0Nq;x~zG@d&AmQPIe_e-g{-TEJ_bopY|r3 zio+XcQI4Y)kmhsm1(9@GS|{aCj)oOS%29CXqK!IUf6V{d_bWO|tl?lU>fF7zi>#VA zM8Humh#B|G(HlXeOgd7_GPLC^hsw4;Zb1xdYhw)Ft|-)$UC^pb?#W%`RR_$EreG1g z{PaTwRX(#ak`RN!Zk<~J%%@WHp-ny!6ZsHyd!F`avhtZfpo1s0wSfT<&A07mdg`bb zJeHJZdkIP!xm17tY6n@&MXbxhn9hO!!7e+GFVh5w#=f$jFB-8LeIUs#?$pbFKr){H zwpRNhi*=BO0;iFqB|+YO#{g8o4!ly-NDq}5BQ}*KXK)5)(M}P4o6Q$h|>a8&H}h*Q&hZR z(~hmUo`P|5^MulZMsq-e`yIl?Sd}%Om$piVg8N3Ynl^8pDcXvA#lsSWW;K7Da;Yq6 z&NYcaVlGYtdt^`dby-wj!aqH6rxF!wQiZxeJ<3vC9Ko~z^U4%jGm@(c%h@%;9j{c+ zS&y|uC~FdaV4l6LrZ`{;T3_iD=DNSMEFKzowu}1*0dR1Ji_2~#m8(@~sIRom=M;Nd zwBg@T-52-uuPBB6HuzqJh4?Q<2E+fqz3YuN9UxK*5#JyN{6q2Pn8e8MtmgOsb>qz z?Jh5u*~{LqkH07ZR8!Wgp?h>q`!vDSxB|nwIKicmJTou2FkxY+L+V4233QT>($-~? zs({e)d>AtZwi+_bAG%_M445rp5@RfYpuoY=DtPXIoUkKlHkYJwT1;w=5SFQ^5=fr$ z7j>{wgqJl4|CvF=85YmnejOO*GEWsTc6#fPb}&QJ_g|QX{grrzgBN()ecAHe!$MsK zV4VN_Rwv!InzLblm$;&3BU{hxOb2{WH^6M9Xg-InO5A19O`d*U7X!DBu+@_qgutd~0e<4r8M?WL%WT5odaS+1A+cei&8Fybh%ntp5X(q*(ygSGMq9g! zAc=a@QLSXZ^`;eVZ%jT4+AoN=Q-0FbgZ^9iO>F*&q2{0oG$znppH6$uPWRrJ2_Q%Y zBsHUu$f=0TaV`1yHaW;pK~=Po>ymt^+m^4MgoVSp(o_w87PGFXt4gOC9xXB^bKljz zg??tb-dHPfm4lwVMYVw_S=g<@&&9Mw+Ns2Kr$*?9vsjPs!1u&rZ8g`QhwcEMcK}B0 zJzui#M@YOY2JI$s(xEtH9;TpL2H4>Kxl?8Q=@8#RNUor{g2M9@c{Z1qGnN@Q6~<#3 z?I;?CiQ*;E4CHxp4ixRGG@kmDmf|KVwB1&zbw7uIHiM+KF}En2{8fyeRiZ5>btpa7 zShmGwu1m^ID<1;o>aKf5FC z_!gKEd%Ip*-O>tW<45geEY^L%x?W18$Ndw8pw|Mhc2b~W@VkebZ)9!RILZPAg`57+ z%AzMQ>42O`BN@M_U~(+!kdkSO`$coqqpj)y9tM-4qtlu1S7G78{GFh`a^B@38gluI z%Ba$d&M-5d|Ix!wzMB0YK%8A$&4CBvSzG_QZMXbua%(G#2B!qV2e}!WBxGlUIrdYQ zj+XAFhr^u=ibRsJVPCT!EG_z8ZW5A_k?BlZIrfZ=PwlvFJe!Y9dHv$Nc0DAlvTfVUt+*edB z-<9h~OIJJNFog%ZWDJ)fryB+4V&YwySJH@`N}I`bmYf{D-K$*!-%7GJ0TbnJF=cjB zsr15_d65K>BSY$~kG8*5^Y%R4yp1d({6C-gAV;D+SSG<_$t)s<&aW0ShpsOH z7zrTP>hBITTWb|dz)MO&WJLk>XHch)%`0&2{HI2)Iy{%n2&Er_-dShWuF6#5EXS4L z?N24}R%|CJa1SgNh3aq{RId!nt-&{hmmeZED}$JiH-jP#3rdTWDI#_D=2)`gnIgEs zzhE#Cp@Ju*m4PCC!5WE@Sh{zx97&x)fBEUjM7GE$$+M-O0C+Zzq6qHFi1097JXl}_ z#F(bs72^2E(Sl{@SK4HJb*hi1z*DhcoFB%Qet=YO z^@1GNPe1gf!T!IEk9Sd<;?quM!wj}o-@76^_I5>^ElrLX&fiXL=bff2bQp5`liI_J z6Y;fm(Z|hj0nX_tuv$~5M~IrJ9+<3J=u`^%dpcF)W{kgsF1U{CKO>|ZN!lplVc$W) zRdn%n09#{BFYzulqSzSUr0t*g+h`^f9n%zTvZ*LIB{xnxUsVP0N+HUC682y%Pcw=UA zPW0dfmEVr)ug)Ea>2!4EO_7lIoJ2;Q7gQuYH{1jkGe!r!n!bC71b41RFE5j~DMVl>9$;k(sO&UT?q8UX0U)yMUkiX~;{Cq|78xEpPh*RlQ52be*CY5K?`W4_@9KaQ>X#R7(y55n+1o1+7Be|ix<@|?OTk3 zCHTAUJR|s=bMgN2_liG&h>tX@ZEk>8U%#*Td!;sl6K|h)KqaCAw@M4hN}H(UjD>M1 z-?h+GY1_=YcywK%NG-_tIaTu-Tx=0I=pbZbjTq&3Mw^lrKY?v#Bk7w1l1Y(iB@gjE zJNyLHG#7KE?OA#}tlb6>-wnyC;2p)Glg7&BZlCQC&PfVt1@YICprO+u!?q`_$I9D8 zhMIJ~8Lg?w&$y)(&CmcfWJ_bpIi!m2P|Py0ic#G!8@oiC3bA@uFcAXfn8^z0$P4Mbz>8`U`6!%bZoMjc+%H&5Rm z=7<-cry2#ta#hpxKB>EcHC|LmV%--=jMH_=*os#zu7!RbpqY1zk4oBzvlZ*4k^sv? zg9W^Sc$jI4rZc}tcl@$>$PhiFz7|J6$t&`%bP$H0&~4g2o2LK4iuIpT&LV+zwA%QLYD66jlN98+jjZbu2l@EG6>X$mSr?{ft(k)&ij1%YL*MTuZPJi(K z^k3i018Wx?3=HjGfAxQCoF?xS5(C(n%ICz#KBv=K=;(%SJ0v2@;*vMF2Rp8v8hL zlcx#uvYjhPXcw(mc!`$4}E) zNe-%FJS@7X4{~B$p@LDni2EhN;JNMiVr9av{LWmB_x^a08lSj05)vA=wjiKkHu9`)H@n(U4l!{ymG1#Kb(i7(u8 zAX?$7OJGKYA_mg6U z#jSodJh}bqNR=rv*l1!iTop3Q+F-|UN>q_KL1^h$$|mz~KCE&Gq69=yAxg|g1Y`K( zu3T)^5anva-e(bakbes!$BEpB)Hhv~Lz`{ataHh#bLZG<`Lo6q2E?}rS^iGvc$J`1 zKoAhU-Wen%tbs#(!Zj$ORLeM89h1Fu-pQfmNhVeP#}k8izX7L)g=PH=C$=xb6fq@N z@MQLnn{|*>HXD$3ixbe0b!}^@g>f*(a>+!F&EKES$c#lDJ1_(#rfRdcF2<{E#!-FO zMT~gF3KoqiR$ym0D@laPaA(guCE0u2#lN7cv(+U28R<(Xs)hZ$nW{e-;U)8cHcZHj zjKb2HM7Zcj*}T3w0~TgoYvIhF3L*?wYrWE@4{Iz$-^^nm_zswB4jJAGIXLW^xs$Ci zYJH3;OLmffly#``MbSw2EcTOWL;Pd$*4WfY|9EEOsB+Vs=F$LukC1WsH0u2&M%U>@ zoZk@Puy~=*`+A(HV*G9^GRqqXdds}9Cn{-KKJz)AduEq0nj6_It@j<#opg5akEvi4 z(jC+1dUtIwu?9T)%>U4OL+h@1L7snS8zP_I2*DAxF42ITCe2DsgRV<^F$?Jlr-{VE zqqm0X`LWqpz+cje8E%b{_GXQB|J?_t?j>i0i$YT{?BM;CxB-UV! z%O|=I4>cD}fEf{aJu;M-Hwziz_8U!HP$;02-N9-B&66hO! z0sp;=Dl|yYGi26~F-nGY3!A&k%)kaGSA{3sfa7l}sBH=9IZ?B3^@K`PfAJFP7iF}D zBw&VeyV2ndzlW((Xgvz85*)JRV-NuNA2u1`P%Dbq{cFIC;r@T%l&&ZX4hu-tG?4$_ z(bSYGOPDY*pz6-p(xR-~p&HGUx8=ZS>=3@!z+X4Dkg22U%l;%{^k#_;T1^+yMTY`W zy;$#8qTrz`aLkLND^v-`YUs@ZElfOgVh}Um9)K=AF2|cL*Y{^1dh}p?tc7{F220ih zYTyJ(&f0;*041%1Z*dc+Y5y>k5wi{Uim{j{H^Oe}uZj4<78lK1vdfD&#*?40^uVSF z@1#6}5OgGg>x?VL7G@DM<|#8W$)-3i4V8enn+i6=rrvG?vWaA~kEcev6JO5Qb7bQm z^1-PL}f;vOavWkKDZ#{ys!%E<=qx~u*k`(A*k&-RjIXZep$ zYMWQwL%B-Ge2Q@!P%UBWBL|?@E+Xf)#6|@VQd6gm*c?F&LA=6HUJJYq`T><#4sJ_R z++;n+g&E$VfjPogqh&8(jAJnw+zMB93buPLYyXuOd|O``MFa1~F10*rukL*{Fo-fj z6A%M4AM}CY3%w%YxFVFR9p0!bYkN*c!Ed}UHrZ)c}D!EjVI_cxi6IK2M`^h&gXS&Tx z@uA@#sBlnNd|RIQMS9+{7}3HM>!m{K?bWt&T?;)F`e7wejC$*r8n2rKt!0G#bi8X|N0t9T6$bMk zsMZ8Tn^D)xRvKT=vZW*g@1l7H4^sU6gj@t2%ofl144jb-%2hhl^(KB!PT*dY4K@F@ zT9m(!)CZh*B`Q(l2TKZ*PP;b6gDRscBaf*`h$6Q&Lw3dRtFvsL=Bt{RgPX&JLvA1= zlB`SXqbzsjLImmg%)I%X0whh=el#Y$txmH=&stxKn@0c#+bu!QBvI0(}(> zi8UFY@r(W=RrgxYw;i$yA(84))b9k9t5L3gn1EDhJf>51pH8>(q#f+48d9>|jWS#V zN#$yT0kOSQN_#Djxr#jTH%b8p#A2Z@lQWp>8rk#WU=#23Ji}pV!0#Uj^8DjHh7)@J zAswbF-A?o>V%{#vi0W3H!woEj zp0FMo>8ql;XCWm191bQINIHMF5=TNKUp{mL|AhX}NyXgY{q_3?E0_NdtfHDI0I7Vi zp6VLQCpm9a4{Tm=;~`*Tgx=q17XyOHzDND|CJh!F!9o#lPGP=36=HegS6vx|si!Fc z9SVmhp`~@{SKXP`>|rpu{zv$vn>$$sXHM96r~4V`bKQQD>wj}Q^z-=|CO{SQZWq35 z7!q`=Y2)}1fY91;=YDpRaIA>p2pGIt*gP8P6vP=K%r-tGm_Pg^A0c9#>eD-#d z;T`_#Vx+eCOOj-#9U72&%x&X;683}o@q40a zn2byEB%~BuJmUD=_!T(H8GtRhJXz|M0f>0k=r%E5o(+4vi=UYy=S6g{D)c+O<3c@8 z4F&fpr6gTZ2l@GX{p8axCJ>vdd@fEnu8; zh?bJ!#x0g>zoOa5y3wI?Nu6=%ma;nHT?9Uq^>X;zz))wKEFh+b0pMbid&KdmShmUf zI`V#*cm*k#GHxfLGz6x8!Uu0TuAUCAt3wMJLI zArtEsMVF9seIVTxBaTh3qQ=7PYyq@unIghb;krV!tL|l>K~bkoB<%Vb3lKTIN3xXM z{GynT@T|mw$TK1iuwc{vNbd@7`Kwp8R2O*e%I2m^$>Dk9O}f$7QJN4QSF*Isgbaw~ ztDY~H(MI66#zL4T@{Em3q$*HbRA5Ev66sK6lsQJnSUzu>fq=KVa9hs%zSui`+(g)?(*;C^83nYxXp+~6(9m2XSI%5xV08~8!5{*(57w zTb!jX=u^toE}!9{PB-%zl!CB;H7jQ@Ku6a{_vERqDz!>Q0O$-0==i5DcBcfie36c0X-Wd-cR>o@df=k5_y?U#tQ7@om+D9Dzi0XCiBRH++Ic zph33xaE^{DFY!`AKEd;nQ30M%x}tyIaj~*(XqA(2!PYxNvu@=5>vh%||8*=0_UN&nIl{qOjYvpzX}|#$cendg?6KaboN_ z08#@N+zcq3j6Wl@zVXgjxq68)EE7nKwSZR!<&UI&BUh%$TJ2`QV9F+nfwto2Y#n;} zVd;c~Uc^HFC`~r?GqQN*cjr^d)}vVwgoO{D}n8S=KPJCK0E z%Tci3=NC;CPQA1o$1+Zhfg!$L{G89vM1Xoow&}5VzVQJJKE8wgTO;Md8T+RB`tP;n zlf{t{cy_dd*jL6YQSZd5Sp+WV3r4~9No*;G_o0(_D$pl`@f~w(%l_<9bN!0 zk$$`!m(61+poz`1oYljnmRoEULP*kppZ8IOYvL$+RW)bfJZYh1tSFAE zcIKhEif1k_ZTBKuB{#<~-jsG(+KN`V9$EA8RD$)+hK*Y}1J^D5rukgwBOq7g1_TS^ zCrw;`;64YOb{wrS*@b?r7x_I`>i9a9H+zN<+*4GmT}@af<6>g|UKxml!**+}?_iu9 zGqAuR=Yq)AO*4XM->(a~BHM_p0I8I|#$Lp$meqJ`4>_A?S)8{BH$hkB0RkYsW}%+q zzhdQoeWuzNlh>FWoYGa;02nJZBbUq{AcTD^D3%upZt))pKjH`5IA3zf=X(mF@%^d2 zka1(d?Cl%ZPRTK2`>hvaqE`J`Zp{TOm@ipjaTfE^@g_%&sIsZ8re z9laJ~M~Oc}xC+e#H0Q@z_!YP#Q*>-8s(3d`8u~f=$jpSo=U}bB;Fb_Wdf>!zN9L_< zDbO|(OsB(s(Qj3=Aswmc#Kk=ko*-J(fmhh44pz-(>RoAWnJ4Ru9nmu5vxYxtTgSGq zZyJ~RE^R48SA^^R0dS}@zp8)t3p=lV#i^)0ABED+b6hgog+vrUj`wIA1zyIg>i2)J(_>RrmH3#b0yD6kPS>rkTZEgwtRi5}$d3@lK&m5%F@H3bMC263bPilt zgGEMV6VOYfFeyu{$bc5M8zB=*-KApPl&!PgjTX0*Iy39W!_Y+8e1RHgsFn z*l?xGJ0MnD0E$#9R+S5Ry~|i_88);RWB&46`~Waq{-m%zQ)*qAc$=Q$enOf2-h7&X#`AeZ`QTaflJ)dgV2({zJ z&pZypwt(liUXd-_mKv6A1^Y^RjYEZkc20!+vb$~+3qX}22SskJHWiBg+# z*N}W4bH+KBvUrSxH%VM5k3vo#`gMrwTpAIoIgX)HOKZ%tCr#9KiVjd zQEE;3{{UXrvL!YOBIeJH*DMk222&0h!UV{wm&x%NWK95mtG!GZcDLcC466a;JmD6? zZ$RA0EP!Qw;L2_@11me)U8yGSz%oWX&}7Lnr2H>`%CV8DB+qp{`-7*eI-)0J_J%s= zbTu6!r@`fRE3-x%*CHY*zbCU7(ZC+V`geT?DgcPZM^9~aHlJxgXYgh*uVXHAtBHF*qvK-nR)QeGNxXLokEjgRauHyR_|c#hpD?bX1$Q-r*Ri_ov)0;hRUD=B$WAAZ-RA?l0l< zy{J9YNEe-DNx}hP^~1?q!)OU2H%o^IH9)tpHZdZngjvhp3AO6W^Q}~(=}nld@iwf5tkll+@BGEpRTvI+(CfI=yGj%U z;7J^7Dvjle0_o#XdQ2FFlV;@Q52f2axIPvf%@y_MVvS6gQbW4a6?IspV#Z`{@_-^O z+t?kio<7}9Zr^}K7}Vror{r5(DO6SuR^_zTe5`q&@ycGmBUA*pzxY|j%+h{jxBMO{ z0f85Z^t%@nT*!C^Xy&bDcALsM4JvaJC7(k;Nu{AajK6VMw3Y+|TK<)yPE7;RN9?mv zp9pR123jj7KG8_cA+_-5EMkOA^?>4d;8W?n11|xb1LC?rJ0lL#5?gG8F)-uU--%}< znjxneNkEec1^)=oS#Y~gW;AXQwK0?akWb}TY-%AL{Zw2<+zE=q!gmI1(0Lr+qBZq?~U-6JX@B$c)0t z^?Q=S3TqXPX??-|?&gqCjF2+Z?jAd6+@j30;`w41mL(8|e zrC(yz%KAZG&jY58niaaO73?Xr5;JrviIeS}cKZ%Fe3yLl?t*XarRZb+S7*!MzYiM zf#mN$zW6}Bbn3Hi0_08_eROq5G!lvhtqcgK+9iCt*9euviNCO^8^wdo)*O3T7&w?<0oFoU6i{(Ogx746T;o^f6<86~ck$!6GImYN<^Ye31DyK8@ruOi zXt_W|$qVAQaMw;ZuNo)WW)2h#`=178W~B%_c$C-x3rwtO({n|{#!S{lRQgP$B?i;^P6e^ zmru<&IB75v&nnKOp87bI<6t--IraM>{94dI+C_(XQja9~5l z=laErEwfGi0q6K!pW$(qYs_oGwSLyjGA(B!$FQiaiF$nBR}m2+&&NYgiPf@gB~DA8 zc3mz06l-lw4w$4BM#BGw{xmuKNmT1|SzK)^RM&2VzKx)_YKI8BcI#7WWo{GtXPp2+ zivx;$MubzyI`q(qeZ=s5&X2 zTJBSEeHWVTAvPt0^6EHgXscwTJ~E#qE#2m8Xw>(=2S}d^5dIAjD|!2;g-mVnJC?}w zo3om4A7{mr`KrH98Ei_0q#buV0-(!zZW?8%9fCeu$`7Qf-Z_lDy3=bV+l4~Tv$bsz zE-R=(6)ae*!Y0k)c-Z1o8u@=1rddWe7hAKp%Z1Hcy<-xM;#W6$kaeHq%W(Eku`Un| zthK-&0P;+ZYf0UNB$feke{mjIe19LW{R!O}oGcAzB;F8>t>kDhSK)$q zJavEfm)Z@3WBMN=64NhslObcg<#=1whmtQ9S_h)5fEJR0b@6JuhBZXl?S<^8b{QmD*{T$)z9&7@2rmRR3tG}FKA0s)8Uw8<51JTd`<2n}?mIR&xC)GR z6pR~B+6nGKN}wTDPszgek^8l(I8fa|8=$~M6-XC^{9yY{^2FKK^_!%_+PYL) zqTg<$&tHSA2+p?%SK+8*?P0?xgFo{1(=%WHPWB7k=+$i55f4WW8T?&yb5=`%?ADwN>m`om_R{->IY*`fi z(0oiNDfN9yg8R+U9W8ksA|&DGA-YqL1e~iaGlzY|4l!Wa6}i0$36!{EDJwyO@d^J| zyv!q?4gx(g1h4VK_nc|$AsH5~!%;aa2%~H>`V*J<^LgOtP?c$eCzA41An>O1SaIeu zlzRzT+))rcB)6TNaeCprn*n0HHv*))Xl=8Y;gS3%_7M2&XsfV8q)te_zh8B(fAy$? zGphy0kj-xt1#Ez0w{a{#2ZDExl_Cg$eCC)k2yUAO`#FU?@a5sm{|fX}@yH|LT(MM- zq_4qX2HM{|8nBQj98B7TXJXlF5+K95KDc$lzGQX3`DdVyrN*}t`~}nm_W*C{Aia9@ zk0vV}Lx+N3O$yu6g(_n29diDs0yv9{tmlxqL8!KA&9euHtIVva0KT30U_t&;Z}K))KiSf z1qq@0JFjTaKX+H8-2v>XH7pFYmacqK$6rdCZRJ-qDxVCS2{|T8_SB(>vP37Xp`Y!} z&^lt?svmg-Q=J$Pe_--2(>-08y4SF|*VJF?ALL=joJeaS2OC2mhC_OCffbsdi5>sa zgHtmmnhJns3Ey%MT5KHTtm6;crO}>V9GF8K?X#GJXzlZIA_fS+{a;+YWmFu&7A>4X zg9mqaceen+-QC^YrLjPQySuwP1REr{2M7|}-8DRJ-nZ7f_v@J-eb$_+I;Uz@_w>|0 zdrz4Nbp=9S(B1_))>A{=Nf6)lZ7!jV)e9>OfwaB`=mm#3;Ue!z@r4#{v&1-kCHNt+ zL8%qGxGB|z6j@Iwdr8a#p9`*kfR6!lI|~H#sde|kJ)kQTAtEYqDdZFJB!_Lg(e>kU zz+0;DP8QH=NjEwZF@m9+AW(|c+u{Jc`ix&&n{H&krYXHB^uxvu=ma8ahIgAVkFBUP zZg{w+RdEWiFRXkpHRt%-V3Z>cZ>&I~ zw;lh0l^9uc;BvhDwa#|H{E1USXd#V7(;!0iBhK79CpAf(;f8RB9AJDGNpb z2O4rw)KL$1u#JeyH6kqt-xw>WcPVwt(B4Chs4=lmnOTw0N|K&_Ra>ab2i4{M=%+d&G$DI@}U`@)xQ_s1-EKO<;v?{H&?eQA6$l*kL~X28{$ zVG$Cx-gsdH`jZ6;4>7X^U25N{7w>>G`)asmKiCUX;HxHB){F54p|y9#3(_x&yI<1_ z{pF|bTTE*~rr>gKby_&k>dMiUNZ!kJ_jEcwwRUpJUkBm2C1(frZj0O&xy<*$@MF+o%5+u6{#-xb=Q|ZcQayv)d8_?2fL--NYY!LwK@VhTFrir^1C*UaO z<`Ct~-UEZ3A45Tm&Bh)<#_4j3nGemGB)VHo_k8pnx^;}c1WUINV-q}eQ=E08Wr$H= zB$WPWe)FdiJXUtrTCTQsFrcGdZ08650j!jg!priLbhatxJe83mx7Lm644~g^IaU6U zrnjq-L+g&Vb^<>9&fvi19kMv);2Lusd~!Jj*Eg=^IJNLIpf0Wcu~sHr>O13FS!*rD zD>zkOc5bWu>DvmnBk)j5UWMdGrAw6Al;8Rl(MNv&dGF`i?_0l52(1$duKXtzm+Nyd z_d*-`IMcuLe^?aZy<7ESZC&@n#-5*LlQN|dcE{G4j1E+k+&`0WRzLkn1p zQ)q&Bpu6bhqKoWY*b6oHJf7^F2=_Ell3T>^{2lx8sHYJJq@(`i6FX&kf%2co6vnoP2(f{sdqR7@Fyx*T%HlK@!G%{)(F= z3G5jo5skdMJ_rR2yk5GIWkYnT{pY_h=hMf+4kdjEBKOjWO5e6OX;<5vFYEa(8{eWF zgTmf|2>f6>wmVrq{s~cj5K7vHWy!Xl?29#K4H)7N099VfTJ_a#e0gEcivH8@{XnSq z?JdOi!nX|)2;{zyd>{ZU)&szZFNCmYzy^+J*5}YfX=l!ZEg7Z#3g*O0A(WazhSi_i zTV9iBrOHG(V9cGtd35f06vw>vw&W+Htf#Hlc@*M;zYiEl1N&Aie>1~2o;fgt3ydG& zG_!K&KEC8sP8wQMw3nrID8peY(cTs+b7V`*5#WibbEII+@aV{FTk|F-N~0fG0U1)P z@Y66E11|h&3Y))Q?J{Jzr#U*(HP=PhX%yHG12V)>SihE93%w>{O?NiM1r$;0c@UMb zS(P72NLH*j$=wzf&VSS?A5y92i#t+-{yMM6r=vb+;||4Hu{&R7f}uXFESLR-@d#0; zlBp>A2#rreUwXK*XGZ!+flqw!5KwbR$u9YQ=+>M$sf02IeT3Vg^y3S5`TYUfExLXU zseXRDb>m(>Jtwn%HBz2!vq+OTzU-pyu3HFKuEV^|A(cJhT2;1e_3!2zZhP#t0zs)( z8>-fo&Cw(y|}qlOwqlvf_;1&GA1`iaSp7V=Gf!JrY^T8 z^tzTJ>Ae-UyRiu=9I?q)Hn?f$1BA;k*($7T|5SGoiZB@_qlv3JR*nXselrMW@WFLC z#Qa&RnGgG8GO2dUD09@8vp3meu|vT|09t| z&0B&ViFs7AK>&S$2sv(S2YWT`?k>JkU#$#{;boIBQvsgASmbt#q5dg z+BtC0E+6q#pbPD3#0kjjn)HGf&=iefZtOJ`23rZ~e_;<`-+|i?*?HW*zxFnzI^5Iq(<^sV3fhBHg?Pap8(2C_>^xR3sZy-T{M zxAcbIPrRou7Ct_yzi)JKHyOW_21TQSL9d{JwV-2Dn+|(Q+1so9YO9)#xV7?ZsRsUn zbODlBQ}7aQ0Y6v6|3Y;EyGIG~0(Q6b%!cGvCB!NaPfpzCW3;B&p%G_PN#!PoA*SmA zeZCK8gxIQ;jv{bAGh#!KdxO`Vqa~DHpW{C}#%d-=T}P*0W86D9*@OT)bzJb9G-fEw zqaE#TB?x@yG?DX#Acy9olh&vyF@UAhB1G0)fmK9j>4DN2&Ta=TaH+=R-a~3rdXl;% zvNMUqr*)?sZs5VX*8HySXkz`@aWGxzm53pcyWZMFs1tBf>)js1Fde<}E@Jo7e&qSx za43))k7LnPKx$~3#rz;YJ*0D&a>!nxv*`+oYW%<}E(EqfG(bJ@LO8m_RnZV8i@Q?r zk~>q#r6#5xa5f>)P2O+n-|apL&SJgVNsav_X6hhvrmjSiYnqVTRijK26uio#Ak&Y0 z?@s@-841W)bfqz?@b2zftFblb+89e*M4xpCWi!m#Lk!0lSu*MP+*sySeJ?d+4~Bg7 z;w{}Z5{Y51?EyC##D$1xK3d$X4*oqYMG>7m!=Xq|k~jJ=Z( zPwM~y4&0Q-GW{u*DZUUdNBB*;@QatGAYN!^5j^CCnT5n}HL;gAhzI26i=hnZ@nXx^ z#%4#4*uVFOkC0J!w#j^bb0<^d?Dg!;#E9JX6PDDb%CLJ2qvtHFT@$97n8gqlk+T?Po16P>F<+bM$&ib>sdgN_rWMpb>f zVh>Dc13FPdFm9~~qn;=8GGGkTTtM@ZB}D#Hj`twKC|(>hfY?lMJr93U6TGClutlOi zjJh&_rXGu~4oOrd>Q$!`?W#u3q-N_>Z!@%egu|f@^(0Zqsb_!VUy%07<-;XbD&3Mja`ThT4mvMqzZ7%l3MicHdn-5nxF9;J zf~~~Oq~L!dBc@2|X zu>n)6i=TRF$@3E#sG<#LbkRE&dw{GhD^a1gf6j7a6?E4dxM7d(Vj6V#*eCqhhtyc(mMO+UF!LhOV z`NkV9r3-=53yZ$F3^NR?5{P%!3z#7bM}YGP2Hy|EXCg@uWFEJl-7liuyGK$o6Clnd zFeJ-pS9Kd-|HX2d_uNqbBNp@odMYP2hKNPc5C(JHBFJg>^fTPzA9#_koAqpo0HwdC zXcBIgl(#G|m_C3nEFRSpopr1493K=bjWm^@?hL=r#Wr;QL-yl+tZ90P;Gp>MAyE9k zv6TNo_WNvv{HrET*n9d1=YQR!0O0%x%rW19&Oa8^iHChHD;_IN*-gdrvji<)v1UVB z4n;`hBc;(*V>}x8rAyYv2bPzMKp>F;AE)x4>Z7DwDwxVYB@n~CNFd+~f&;nNKN6LB z9s9Cpnyr+SJwKn`cW?Wj|2ThJzwhQ&d^x^GfhbG39{dVPx+0{I)#(2BGV9l?$?UOIj3@ZIGb+R%SgF6^QID8H8o z?_>ID_8~Bw4$>H?)I&%X01r74s+aybFCcE=s4Yo4h5cmWO0DSJiw$#!fFo|@7rDME z^{Qd=@xKVrJ!Vhz&^;DU@U<^g5t`~88_lM7d(bZ$gB~wT5r60(LLyu*_+sC126NR; z26DAW@mHV6oHO1kwgd=_r3^GKxJv-di&%lzQpNU1Z0@%bi9q~(AR_K#;uq2p9@I&M))VNG?3|$U(8gKb_%`D==Ik#~mZD44^#b(yba0c(a#@ZdC zax`|hYO@DIc}7O(I6H}!rFf=cqQp)y{ICUw&^m)Q!1tFMtcQhM>Whkj$R~N$1fsqM zup2*N>#!W$I5TnU%n7@Ftw+dIL;7>KSM}J9UlL>I9BP_@0c*VLf(7+4)dV9JeGDfz zHy8hif63yO9l&mzrVl1nuGoBi2n?%qY7Vn?YVM`Q_Y-ixOV1$?PCZK(#2^l{ErxYt z<23rouMTExQ!$#Ol58bZw>Qc(emU**#Oy&<%e=8xWpO}{6^IpWiQ&JdeYvG-s9$g!abYip zBMiY?pRkZ8a-G0hJYdBIv$<@siVV&naIA)ALVp$+znuBpz4iEY$Gbxd4>?jCLUtjW zD;x%LX7~x_BZ_J(jh!Go^V*@By5Ji*qxF)b;@;z_<&C|g}l}28+w*icU^wI22_;^SiBgnS_Ncp3iOAVXmWFQe={c*)?<9ru}zZG4Lu3=U~l|Szq^6i2b-kPCqDat2R__jFKY4unAyl zzp4IvbxpDj#{mP;xlYx0$^t!f%z_3MbLews!GM*iUrvlQh1hlLz&B36I7!u40p(9n zctWAa9QA5ym`A@8Jf4Q#)v|Ti4}yY96!JemsoZ_$g!_kHcX}GYoI%#j={$Y zKFwbrxgZe_-DYT!DxiLgCGK@rEx`v4u)cAij<5NRs=oh{&Rd+IE@&%g6|X9yR;)rR zwcc`@ysH$qR;!vB(5Y8IxBSK?U$yU7gPC=wH@dh#2Nq=((^j)1iS!qEabx0&u#unN zF3eb>kb$c(CB_$R?*5*?COzWI|B8QTsQA{LvBc0aErTg2q&t{?BNbKpn1BVu^vORa z6n{Rri}~Sp551?LMZ%$TL$UNYTaYYUxNb045>a3iEV}oQKcF%K`c)XbY8p^&jaH9M&hr+U`hsY=kTLbc%e&R zT$3uJnfPd3!=f?zG_`wG&y@g7v*)i%UlK9en|8H48F)m*xkpjwqjtNU*{SIGyp8w1 zApDg{nnc$t(IUN2=+?>N+>`(;;Z9ex8oKg$l6Si^f64W}0Ut&Vom-hZ*9`a1*wbq`&=LrF${^Rqwe-ehl_PV?sc zY>$!bA>@}{LI*eXk4$tpwY}0e>Wa|R5BE6&f^ns4i%&^(p1CTQXLGh!NiJ=Q!fB<% zqpG9XLdB)vQtmz4OLGX);g0*_oSU>X*KVvxiZ>#gCyQMH=I|5OEmZcpOF4z#pzee=+i;2sYXlq%e zy6G`C5fo(PR#qq|+f@XU3SYbg!-u$fG;_f%d9A$RB`v6c-Mzkq#%US73`X=u*4>is z?tD4eYBK-p&DqZFt}3>?zM??2m{p;%E>C!CbVVdp0W_?w;umzbaDDqPzPbWK5nB-VN$%Bdy<)8}zGE_rKd;`PIuB zkaX-2ZAyvVj3GOha}0u(X=_sTx44!W&r(v_6iWsR8zcqjeFvwC=?xOKFT+j{#LWP! zgjM2*u}D#b-NAevZ)vOME{^$k)~nOF)NrOa%}_bOn{xEP0AOfiE?@+}h9z~4OT6LE zkntDtX;U9qR(Vf$zb>T^+&wM=pTJ#MnTcY2T^^q@Wp;Di1=xL@eP}rLujK1Pa3=aj z5D=0R+SV`YW!C6L3+8*`Jzt(dhBGVL@jC+OUW7_vDe3& zoH8|Y^Jhp~++IymxKnf&5^;*>2A4N>%ujGzZjvy~`A{JSl;WuGMOGI!^T_kX`wl7C zm<6Rl{8Q@mcx63r^r+Z@Bg*g{ck9^FXIH?N!o%3rSNWu1@6PIkaN=>?jT&Q1&&M$? z<6|8kt^xPA&g%z_3H?d9jja!>e4M1{bbW3kqf!DcAJ64}E)`#XjHP`tH5bwRE{Re= zQA6-$hGcR-2v1W(r6+2C-Ye<((u<>Jm6tDqO{|NCs2xEa4mWn-u%N54hQ~29w}c5O zq*4~h$oiQ!ME{QZ!SrshKm1|pbUtVo{OtO13|2|vd#Q@hH=D;#yBCrN1_EL1JKI*t zibk=1XeEB|Kdz43qyiw%QxvxY{a`dl9MMjuwx}K%SDAXEMIH%P$#aJ-cM-fkcYk9Z zOZ|8?d=T&&#}Sal5$1Fc{Nu#X48Vr!-+Jd&WWfIaKP!da*3kc_3ObdO6hsEV`pv6f zJ&bozJWuRpw&cs`#-VY+(d3!X;E6_tev*=VY!Br*ac zKImb@f6h>vlVd3;ICFh=!?1Y6eck=aAHr>Zk%I8Y zBV^d%l^?r%J1pp-1~K5g|9+Kafas;~>v^Yfn&3n4SK1N4-#ow8*K>Z>uc1Nr>Gk zd$~-bE@0NA2?QERCw&2o2=52QAl!B*=-sQh)!7|ZcQ$kS<)o{0e7d+=QR@gjwG*;f ze2uMZm}DnK$k3mkAMq#voDhAEfxLVszMpxeN>#s#gv$s^m0{p= z4Ca+LSY<&h&*xXmCgyOfAD7UkLl)5>J=g-8_%0Wlvc zkuvB*yl2O;e?o*{$rzGPu+B2Dm8CrPE+XmJDP`NWe(|VCtu-yy9<3;X3Bg0sp^74) zpHK-&iPX~gx#P@a!*<}sEf84SX;myj-DZrR{nM0BIwMivEdsw|gxN(+9!zhq>M$hVkx9lHKFtG7{ta7Y%ygtcp6 zGF=SOHJ&%N<_4`#ThKn5SBcaylxK_7F`0La)FI;J$ZJm;Pg7|>x`NhB zrkRU+7V=h#de-vzi+WTuIuScoddGHM8-r41fLIZI(JKSoRZEga=boU{5vxcMT_m60 zJXj4n_E06t&+8EI? z1>^K-;Un|hM4ouRbv&3MZE7c4R+4Y>INFJ$!W6NpC=Jm$w3t+G$KQp0=0JmAcm~Va z8R2mPNEUjUwj4`cqkke;D5C2Fja^@=oBtxk$MBHvRv&#ECO6hb6a876ok(BOi7Nb=SBpaDI)sRLdou7Ye)!y`C*@%@)yY2c-2SXu^c*NPsK%i%cZ;ceT8ycJf zL2+qq|5=K`()s~x`^w5IRU}9h6{?L3-7I?oOcl+$K;|1gS9}xx%}}LI4Lf3u*$lx} zKM((tkP>dg<-n;S?6UYEuQo<%W&~ zeo{$|x#rps0)sK@G-`A`#_!DKUnZ{ASij0J?d&6`;D##6^QGp)c8AG=7Bu|2g?q_X zfWWu~tnc;J7R{0cCJmfXeZSBe3v8>)kl0P_;~Mw{4iCTnZB zdd!Jtq;EkJSle}jS{h5nG;mduI|=%qAx}3|j+>C_u`J6vd2z05;kA*Fni&qDuko~% z7i5o)_SCO69V9u_h?{kSj~_c3i5z1W09&E8___rgJyXVp2d(zgnV(Nc2)D~8jSO5JsvWTf)d^cFJgoPQMLSijvl&(9`*0*i1KAp;2UMSMup(AL{Lq9iB*+&Vom{ zk}%WQ*>RAEEU#&0sF^HTH6=5&zkh9JsP2g2tgNys%u1xDpsVwceTIYc$&WL30SI+e zg3}H?|K7D2k(8jSH-#J`?vTSS^&gSVaQ=-$CJ*}9ndZCx6qwxfAhH!?7o)zpSJ6bS z{j`MdBbMfiYyn9i8z(N;&-Hn|stL%sh8EndtvW``u}{UQBAtk*066`I@`MLEu&+$K zHT(>CKB3xTS8f=)OLooZ5My^X0$Z}aoe=CeR*evq_mJ2FTYs(aba_nKCvdQ(aH{Vk zA&0B2@E+u_#}4=MFlF_pX9&|o2OQ2ny+4f_ z(A(*=td8R$i<{^$6tZDhRGZtTb%~OXCp!L+&Ho_^OU;FWEH?OFN42X6mcwr;T7$Pl zG{?u~NLB(ZM_Zogrzy(4e}4$Eom>d z$~H#6Z5GJ%x=bsVRea4P>V z#N>#_k%OSX=x<Ut*K!j zRhUz>bncu`Vt1Z@x{kC&bW?_Cyt_1(V*xXJ>FmgNx!2_Z)oI6B&HhE_C9_$>FJypu z@$8=gwD+4gzV%-w0l;0>wUdQQMitQ&sy32gH@a%*+bSvTq73{y@M+)e9X09Xl#OYK z{k`T+XRA7S-DvOkr51w}@fZ(+fD<}NBv1*B%dsAYJiSl#J9!Ah#j z^WdZlIF7tv$fHkL`W6CP6HHI3(r+biCq1(BI_Sorf#8W0?z|s@?S$w~GqF^!6ajZU zLVe1;oos{;ReR|2&|a!>J-1Ykd?y zY&KTMPFGhST)M-eMKuS3OiZ2;HSem==A*O5VvhE~d;oH~UhW6BWu7z}UA7=sHLUXlW!PfrMAh_gAe`a z;}YI-RPBKiyQEaD-4gyEHA*}9rLXrHHi0SCcvcl6HY_VIf0x#=g#Vz*t)+_S7gT6k zR$&kO}L7IqCQdl!t@(xQ=3*ggo?jH|w$j8*N zh2vDd5Glbc3CpyBS_fk#iB`k8GNGe~#+Tp~Yf%=8@fxJDK4stxn8o>mVql zb%3-oU}RPzmG8Hjx=qaY{cng@%WQaijQT>3<#J?l)s4a9hV%4dC1|&IqEhFdWZ!S< zXVW=zm1Gq+3LB9Q!KwDL=-a9oGB(@QjlaB4p}wn6o7KmvRkn{yLt2`wn}N)?yj_&{ znB#T9nRJCPRurW%S0xF3AlG666Z#~XQNWh^O>PTy)p!fqMGm&F=5_WX_UP(o-$|H; zo71DwfygF5JhtP{=u>e6n0a%D%;G|*4MO|nk5mR^QeI`>Q{l9tGud*( z6K}B>Q?;oT(}9L^tTNuLPsMbcjOVSOh z&0x1(`rjL|5@M4r&S3v)jzwwLA6gHrHmKp5kjpYxE{pRgziqqKBrl^@iZl>)CeK&J zN^}@LxjGC@yqA`5!MkUfmr+)%4-DU&QuJ}ws4_SrEZWp_4XF)B*sc|&Sd`Euh!;2D zERa0HTWXh>!YRzEE^VxGOzwhtF9AJ%_o+}!p7f5z$y9l{Z<<{2!a1*%GZab)M%I!% zcA7clPx6Y(wJZ_uH2@=2S@eqf z$H5bqTud-8o1Zh2OrTXFO0JDUt&3j?y?R>fqc}6#YX6wSe#)`U4w%xO%HiPVG)do0 z`ZYg)AQ`OEX$u#&6n2$$FYxR=VibcP;{5t+`V6JYqWueFJ9m~=VpY&D7X?#c)}0l~ zg6x^$oeP3SupQ*?>%#MM&U-!?pt8( zR%-~TYww3vIaMx&(IqDc$&Nadpf_(_b#Qg`%=W}091Mr=dhoUI`~v8TJG*VMo)s4q zb0%qUQj|CO?$9f-JxDOjo~2Cq$?-dR?3yKb&eq@?lh*+xAoPSGwi+3wAH0&=+6i3y%jx@hto__v+V4X^h=X#j~t=7Db-#9J;PATbbh07H)%GO&WiD<9Snh6ttY5 z54pn=iGZ?me4zLmp1DOeD=b2~b#%?h2?n*%X29;r|98^BKuINnRHaVi0yEwDMvTrW zDYC9QT4L$jJ#`l(jOzEle*4NqGOh(FTt3QCrV5 zF;0c|X?4cLYX9=tB*_htNs^~~Y%O2E6uez5*IQX`h60`dMDxrECU>U#7NbV!LQ;g| zpbITM_(af-J<5Zy_xjwci(dZocAfP7@V3laZXos1UkU;3`_eqa`%0F)XNxAcsokuz z6_&DRRp;h2u{Mc&&YGRAkZ)A9kMwTcf1p`9gW z#I8S=KTw;k9g8kN4A;Wu( z(jdS_bWy?9QSPz{oLLjT@V35wa6fMaAsqf7D`hKfu0VUs6E(tKb>;^eH%WU!=ZH!$ z=xipQJJ6g#fQL^o*gL}0=?}v|FT8c%QTWR6VXp5#Jrey!g1x+Fc_dm#B7g9uD2zRV z0nQb0)<%Mtp-s)MHXLw{!45do5O~ZJP`D{F>@yaOiY*pYeqAMUzmh!JJNfg-K#8+# zRzdlz5|3`qDPSF%P*EBb1B<#h!%8 zi0m0s+6II*wy}ZOHS3HlE*-hHi74A7J;l_ujk(9;OMa&q*qtNdW8N)vAWnL(Q&xFIy?LZ&6O+j737hx#7`jrcXk`#AoL0h1%^%P(l~H*V+O$!k z?Md+FEX%a+i*GP=uT);x#Ri}3Y*!l`fVjl zoP-CQ`uU~Dbd4(48b0fDCIHY%l^5+CZehJMle~<`-;B;goRJ;4fFky@kqTtI=@Q%0 zOqU$^jj=6c*9>`g-dXXgX(jWWrT7n+srS9#l_JF=TUZ$YYGa&ecEe@31E^5NrK~5W zv#?98O^2o+wZ_9gFy2o5h{624bZdj_p4@VwzC1+keR6HsSpELfA5nUpFG#XJtmGlJ zG-3;l2XuzKx>08#!~zXdf-u6SKqtNj`f!r{B?eIbuNG;RT8g z%v*u#hA=}AF)frZs%5(yI@(&0wj1|e-4}=bPoMczs@zPT`dZkt)}X;Ql%c0zAy|7| zmp*ioblSCQ1b+F1-If^K4CcoQK@i*+Lc6$NmE17G`6_0NNEGVH5(9NRhkHCZpK_eV zZxuG>>Hsm>7!5cE+WYOVtU>FugxX*9GZ89CP;8K$b-}fz1*N+Ey;0|@dQ2ni4Izac z78QyK0r3z?n9w>J!fe+OjMhVxTzOI|oDELud$mp=-`44yv+iUjF&boSmZugAF1UKn zc21hk(`P`5m+-XcFC*OwO{w2mFHO`a%ybMHOd$RMGC11KD z0;J$hM6k5d?T-X6l(_9si}dTNM;i4por&(8AcziUn_6!gDM0*e9&1py3Rv}RdJW&M z?79cW-075=+5YYSPYvu*E6ThWm z<|S7fv12&3RvYt1HbE=5YgBjm_QekZ;N0@J{)_p(mS;nn`1F|n&ywZmB!3jG`BkLY zWNi7vFnyPXhMoG+JN~)tcc_b0Zh3;MORpqJCi;}$`e=wC3zX;8GSM#0JxJUt6)}Nv=M+mz za^u@>>}($N*qFYiUmMyu-_U|CH2oyIAfO-c%X&49DZ4?`+nLi*j>T18jHYY36{?d) z7L;uS_WP{iOZcaUJ91e)58Pe=>`8OyKKey)HhKFg|B3jd9)*Y>t-Gas2)T;qFC2w_ zkZ_>M%cr4j$?>US79?TwOMe*lOU0Ad-0PQ=B4H8qYf>8`OIJ3Q!S7~fw_OusU27&9 z2em3INV_jW?Q0?=_os_pYuqdtJzqB;2&0D1jT!#z1nR1;a9nZuAsiwC?w{wjEd9(? ze4Ix4^Ix=??2krstCxOcJL@U+^CDh2mYtpI!-#Ofn%10s@1=kqOo9e~Gk*Adm9u@+ zFZ2`RhuA6ms{BEyv4?ph*XwKT`YweiX%AomF%DINFcXs5qe>#?7`Po>T z2d(U>ut6&7V;2CzP$EqNoE%&}VS=TudU5bRZ1XDehK8BZ@XP*v2c?D~5GX$JOe{ah z`-v<+y+*sidAW;ECP8&kVQLY#8H1_M!q2<~L5?S|yA)5YcLx)%AHCOq17At$*IOie zj%5sp&dqp+I$NltWO<`a3lSfFlsWn7q_n{Q3A%r1JMV+-XcgxHB$;fl8a_%kenhc| zj}BQ@gOBDw4c-ayP&j8QaCzWW@3qK4)U}2eP*mM?&wz29GrmA2T$k-aDJFR1m%Pkm z8(4wEzeh&|lJBTlY82M_<9Z)#O#rfOPQd9)N=oX!f4qD}$r*jJZTmOqziU;`Q5%wt zT6B%tbdrr~6-F??L=dkU((s(#w`l<_S%eKaosZbFtWLO$!IkA$eAdok97=yvSyyHn z98ENht;=Hlgr;DHUb8kvkAfLAuEN*&^7*})OEFI%h$%NrVYePBK)^|;Uhe)JlpodV z`^64OplmkZ;x^~sbPc*35X#+;>_&g4kY9xoUp-x+Q0oRT=)xBi?y>u z6eOgRT^?7>$B(iJe$MIpwQvu*)Ho*QG8yE4IkoI1e_TqE$1iTUg{J;I=l+$*Q1#Do ze5MYdlRfS%0Kq+U;|FY<0~qbM_rj0QhT^I>_dSo#!Yw!ehK=x}%%>;n`^4CNrERj2 z)`p%&KYoD47A5JSh`G;>DT!6Gw*p^3%Hl>ASs(E-DcQ&YMyjmCzJj2f)e+_4tBnC% z24!09$R2NCaCcxo$LCmYC9@tMD{;8b9ACX#5^!o|o1Wl+q6O{XLF+2C8#9_FC|SG7 zwxd3fZ|{yeC6ChHLte;|xKka67>=ve)lZG9pWc8=w}}39nwn9L!2K%CGW>#(!bY zL5E={Yq5B)ySvGS&zc#Ud&3tmeXmoo@sITa!ZmM?^=!g9`_wnW!a~U*PGpNi$~!zb zU*rLn;Fxd~9k{szsInclN17`zgbs9Mo1Q}+7Eg@MCWcLj1-$4t4X^}L{!~7Tp4_Pu zb2iKh4YJ@osMDIUOYV3>osV$6hHaVW}ABxa1(RS6tgw&n0$%02NK$h2-nyWy{kwr*>5AhfzJ z|HZK%`r(GsEqA}g??&9MsC$Xv^P#5%R(eK^Bd}$L=eL6DfpJBtgN}k=QxH)x!Xax% zu*XdF4TXKdnj5~LxaZv5%?Cm7($v+7>&vaI&-c6O;~Rk=^32n)H)Q^UaXoWmbeVvG zGUZJMo^N;+|LwR?cAH^|6tqTG^lAP0>ql$nM<4t$OH0%-LlTx;9Zdv3(?2*lr z+L~x?IsbvHJIbjl$_)0A^OK68ykWWE4fd_=Q{|K3tGvI|pSqHkZLk8{4W;CPT|2@_ zn&uw8tdX_;paBl29vjwh-)NJeyd3bfV2Qbcv6#c|EkF5<*8KOU(OZ(^B-$0a#=k2n zs~$mQ6h?y{m% z@uwJN_#<_!rg8$FZZnpZPj?HjO^*ZBs+$^UH z&mR>Db1utt$i@~nbZC|jFon$QQ)+`7Dnw3|Xf#TY#({WH;Dt}?dHl&*hFb#N95Rpf zuqjLF*DR$&6|-MWy8re!FlBr4bGAdKUg;BAs_forJTIsnUAoQICfadkwBv#aoY)G7 z`Z)&SqVZ6gZ6G*kh%NiRV`we{{Cb=RpS8}4lwiGj2(mtVn+wwfCAQ()?!TI%^DMWd z_#wlEQ(P!970oMTC0N*??Xaqbi`Hbo!XNJ>g5@`UHP>=n0{Yz78hZ*^8NJqBsv5P~ZhSRZERdX4-*j-Qj*QZPibV`h3mVae zhOc+hu>92Kf144Jx8)PWeY_!1TI<=0KBL`_ow!=ux=u>aXwW}o4PQ>u8%Oa4B|D+1 zl_hGU2BhU{h&0=TL05cD70mDvOdGeLxVyJic7lkF^9*XJBFbW7zQJYw;6*|1HwSmT z3j(k;xM(FZWqch z<|q?;V#Lh_CNzfTlC@<^U)ANiiLw%Vk1+L52ymMuO01Lbt4o|~YD%09ba>qLgoAXz z72oRue=mP5u!C~uQE{(JtodrXz-Og#Oj^a&yKFtYIEKd`A>)*ug}S(7clNHGKx7)ncZBQbMQRGh zDDoi2xayH;7J%yjs4uf-Yi#*MP-21uan#POjb>jP&4Ptg?MJJ{sUuIf7kFvC95okW zVF*6Bs-s-DCz3Cl+6~1v;tKa!Fzn>Y*f*>$e+d=|icxCYd85`?p6m$6Y`_jH+fVAMAJX2bQ!)Nu+xN36>Qr(G5E=1* zyzq1E>h|9$>P_FZ(9r+KD>T*Y-RWQS|8y8rVE0Ac;h<-gU` zu>Pk9lGIHJ5aqv#fRhB_gA!9IB|+r>Y}t1kVuU}{N)kl)FAgHx%j~iDXxHDPeFq2q z*MXi|BnhJW*J|QFy^yCKN`e^w*|<_5d<1;e4<8hr+^iiPTvJ&kLD>Hy{-?f^YA6N5 zgwr&6Uosa*FYnYiSr87%f2RMx)foPFumY>ZzgD=ZlTx66nhdFH?;}8rI;1{Hfyn+1 zNi6*y!nag@X%Oi@+wk3n7z;@ClLoyrK)v_e{w46=H7EbOYG}2o12P~|lK-r2V&wh0 z*t_Ti@4M*4|8^BVmkKTW|1AZ*?0W`C%ZVs^n5p`*AjE$IXa@X0pw|C>_uzl0ewPIi z|4Y8|KTYZPQ-8{W2qpi|KsF+06MhsQ-VtJC2+K Applet parameter. This is +# a cert to authenticate the VNC server against. To create that +# string with this tool specify -certonly as the first argument. + +certonly="" +if [ "X$1" = "X-certonly" ]; then + shift + certonly=1 +fi in=$1 der=/tmp/1time$$.der @@ -43,5 +57,9 @@ rm -f "$der" n=`grep -n 'BEGIN CERTIFICATE' $in | awk -F: '{print $1}' | head -1` str2=`tail +$n $in | $pbinhex` -echo "$str1,$str2" +if [ "X$certonly" = "X1" ]; then + echo "$str2" +else + echo "$str1,$str2" +fi rm -f $pbinhex diff --git a/classes/ssl/tightvnc-1.3dev7_javasrc-vncviewer-ssl.patch b/classes/ssl/tightvnc-1.3dev7_javasrc-vncviewer-ssl.patch index f35a4e9..be5a22a 100644 --- a/classes/ssl/tightvnc-1.3dev7_javasrc-vncviewer-ssl.patch +++ b/classes/ssl/tightvnc-1.3dev7_javasrc-vncviewer-ssl.patch @@ -73,8 +73,8 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/RfbProto.java vnc_javasrc/RfbProto serverMajor = (b[4] - '0') * 100 + (b[5] - '0') * 10 + (b[6] - '0'); diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSLSocketToMe.java --- vnc_javasrc.orig/SSLSocketToMe.java 1969-12-31 19:00:00.000000000 -0500 -+++ vnc_javasrc/SSLSocketToMe.java 2010-02-22 20:03:11.000000000 -0500 -@@ -0,0 +1,1712 @@ ++++ vnc_javasrc/SSLSocketToMe.java 2010-03-19 12:52:08.000000000 -0400 +@@ -0,0 +1,2055 @@ +/* + * SSLSocketToMe.java: add SSL encryption to Java VNC Viewer. + * @@ -118,7 +118,9 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + String host; + int port; + VncViewer viewer; ++ + boolean debug = true; ++ boolean debug_certs = false; + + /* sockets */ + SSLSocket socket = null; @@ -126,11 +128,11 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + + /* fallback for Proxy connection */ + boolean proxy_in_use = false; -+ boolean proxy_is_https = false; + boolean proxy_failure = false; + public DataInputStream is = null; + public OutputStream os = null; + ++ /* strings from user WRT proxy: */ + String proxy_auth_string = null; + String proxy_dialog_host = null; + int proxy_dialog_port = 0; @@ -142,21 +144,28 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + /* trust contexts */ + SSLContext trustloc_ctx; + SSLContext trustall_ctx; ++ SSLContext trustsrv_ctx; + SSLContext trusturl_ctx; + SSLContext trustone_ctx; + ++ /* corresponding trust managers */ + TrustManager[] trustAllCerts; ++ TrustManager[] trustSrvCert; + TrustManager[] trustUrlCert; + TrustManager[] trustOneCert; + -+ boolean use_url_cert_for_auth = true; ++ /* client-side SSL auth key (oneTimeKey=...) */ ++ KeyManager[] mykey = null; ++ + boolean user_wants_to_see_cert = true; -+ boolean debug_certs = false; ++ String cert_fail = null; + -+ /* cert(s) we retrieve from VNC server */ ++ /* cert(s) we retrieve from Web server, VNC server, or serverCert param: */ + java.security.cert.Certificate[] trustallCerts = null; ++ java.security.cert.Certificate[] trustsrvCerts = null; + java.security.cert.Certificate[] trusturlCerts = null; + ++ /* utility to decode hex oneTimeKey=... and serverCert=... */ + byte[] hex2bytes(String s) { + byte[] bytes = new byte[s.length()/2]; + for (int i=0; i 0) { + int idx = viewer.oneTimeKey.indexOf(","); + @@ -367,15 +462,18 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + KeyFactory kf = KeyFactory.getInstance("RSA"); + PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec ( key ); + PrivateKey ff = kf.generatePrivate (keysp); -+ //dbg("ff " + ff); -+ String cert_str = new String(cert); ++ if (debug_certs) { ++ dbg("one time key " + ff); ++ } + + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + Collection c = cf.generateCertificates(new ByteArrayInputStream(cert)); + Certificate[] certs = new Certificate[c.toArray().length]; + if (c.size() == 1) { + Certificate tmpcert = cf.generateCertificate(new ByteArrayInputStream(cert)); -+ //dbg("tmpcert" + tmpcert); ++ if (debug_certs) { ++ dbg("one time cert" + tmpcert); ++ } + certs[0] = tmpcert; + } else { + certs = (Certificate[]) c.toArray(); @@ -391,12 +489,54 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + mykey = kmf.getKeyManagers(); + } + ++ /* ++ * build serverCert cert if supplied in applet parameter: ++ */ ++ if (viewer.serverCert != null) { ++ CertificateFactory cf = CertificateFactory.getInstance("X.509"); ++ byte[] cert = hex2bytes(viewer.serverCert); ++ Collection c = cf.generateCertificates(new ByteArrayInputStream(cert)); ++ trustsrvCerts = new Certificate[c.toArray().length]; ++ if (c.size() == 1) { ++ Certificate tmpcert = cf.generateCertificate(new ByteArrayInputStream(cert)); ++ trustsrvCerts[0] = tmpcert; ++ } else { ++ trustsrvCerts = (Certificate[]) c.toArray(); ++ } ++ } + -+ /* trust loc certs: */ ++ /* the trust loc certs context: */ + try { + trustloc_ctx = SSLContext.getInstance("SSL"); -+ trustloc_ctx.init(mykey, null, new -+ java.security.SecureRandom()); ++ ++ /* ++ * below is a failed attempt to get jvm's default ++ * trust manager using null (below) makes it so ++ * for HttpsURLConnection the server cannot be ++ * verified (no prompting.) ++ */ ++ if (false) { ++ boolean didit = false; ++ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); ++ tmf.init((KeyStore) null); ++ TrustManager [] tml = tmf.getTrustManagers(); ++ for (int i = 0; i < tml.length; i++) { ++ TrustManager tm = tml[i]; ++ if (tm instanceof X509TrustManager) { ++ TrustManager tm1[] = new TrustManager[1]; ++ tm1[0] = tm; ++ trustloc_ctx.init(mykey, tm1, null); ++ didit = true; ++ break; ++ } ++ } ++ if (!didit) { ++ trustloc_ctx.init(mykey, null, null); ++ } ++ } else { ++ /* we have to set trust manager to null */ ++ trustloc_ctx.init(mykey, null, null); ++ } + + } catch (Exception e) { + String msg = "SSL trustloc_ctx FAILED."; @@ -404,7 +544,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + throw new Exception(msg); + } + -+ /* trust all certs: */ ++ /* the trust all certs context: */ + try { + trustall_ctx = SSLContext.getInstance("SSL"); + trustall_ctx.init(mykey, trustAllCerts, new @@ -416,7 +556,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + throw new Exception(msg); + } + -+ /* trust url certs: */ ++ /* the trust url certs context: */ + try { + trusturl_ctx = SSLContext.getInstance("SSL"); + trusturl_ctx.init(mykey, trustUrlCert, new @@ -428,99 +568,138 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + throw new Exception(msg); + } + -+ /* trust the one cert from server: */ ++ /* the trust srv certs context: */ + try { -+ trustone_ctx = SSLContext.getInstance("SSL"); -+ trustone_ctx.init(mykey, trustOneCert, new ++ trustsrv_ctx = SSLContext.getInstance("SSL"); ++ trustsrv_ctx.init(mykey, trustSrvCert, new + java.security.SecureRandom()); + + } catch (Exception e) { -+ String msg = "SSL trustone_ctx FAILED."; ++ String msg = "SSL trustsrv_ctx FAILED."; + dbg(msg); + throw new Exception(msg); + } -+ } -+ -+ boolean browser_cert_match() { -+ String msg = "Browser URL accept previously accepted cert"; + -+ if (user_wants_to_see_cert) { -+ return false; -+ } ++ /* the trust the one cert from server context: */ ++ try { ++ trustone_ctx = SSLContext.getInstance("SSL"); ++ trustone_ctx.init(mykey, trustOneCert, new ++ java.security.SecureRandom()); + -+ if (trustallCerts != null && trusturlCerts != null) { -+ if (trustallCerts.length == 1 && trusturlCerts.length == 1) { -+ if (trustallCerts[0].equals(trusturlCerts[0])) { -+ System.out.println(msg); -+ return true; -+ } -+ } ++ } catch (Exception e) { ++ String msg = "SSL trustone_ctx FAILED."; ++ dbg(msg); ++ throw new Exception(msg); + } -+ return false; + } + -+ public void check_for_proxy() { ++ /* ++ * we call this early on to 1) check for a proxy, 2) grab ++ * Browser/JVM accepted HTTPS cert. ++ */ ++ public void check_for_proxy_and_grab_vnc_server_cert() { + -+ boolean result = false; -+ + trusturlCerts = null; + proxy_in_use = false; ++ + if (viewer.ignoreProxy) { ++ /* applet param says skip it. */ ++ /* the downside is we do not set trusturlCerts for comparison later... */ ++ /* nor do we autodetect x11vnc for GET=1. */ + return; + } + ++ dbg("------------------------------------------------"); ++ dbg("Into check_for_proxy_and_grab_vnc_server_cert():"); ++ ++ dbg("TRYING HTTPS:"); + String ustr = "https://" + host + ":"; + if (viewer.httpsPort != null) { + ustr += viewer.httpsPort; + } else { -+ ustr += port; // hmmm ++ ustr += port; + } + ustr += viewer.urlPrefix + "/check.https.proxy.connection"; + dbg("ustr is: " + ustr); + -+ + try { ++ /* prepare for an HTTPS URL connection to host:port */ + URL url = new URL(ustr); -+ HttpsURLConnection https = (HttpsURLConnection) -+ url.openConnection(); ++ HttpsURLConnection https = (HttpsURLConnection) url.openConnection(); ++ ++ if (mykey != null) { ++ /* with oneTimeKey (mykey) we can't use the default SSL context */ ++ if (trustsrvCerts != null) { ++ dbg("passing trustsrv_ctx to HttpsURLConnection to provide client cert."); ++ https.setSSLSocketFactory(trustsrv_ctx.getSocketFactory()); ++ } else if (trustloc_ctx != null) { ++ dbg("passing trustloc_ctx to HttpsURLConnection to provide client cert."); ++ https.setSSLSocketFactory(trustloc_ctx.getSocketFactory()); ++ } ++ } + + https.setUseCaches(false); + https.setRequestMethod("GET"); + https.setRequestProperty("Pragma", "No-Cache"); -+ https.setRequestProperty("Proxy-Connection", -+ "Keep-Alive"); ++ https.setRequestProperty("Proxy-Connection", "Keep-Alive"); + https.setDoInput(true); + ++ dbg("trying https.connect()"); + https.connect(); + ++ dbg("trying https.getServerCertificates()"); + trusturlCerts = https.getServerCertificates(); ++ + if (trusturlCerts == null) { -+ dbg("set trusturlCerts to null..."); ++ dbg("set trusturlCerts to null!"); + } else { + dbg("set trusturlCerts to non-null"); + } + + if (https.usingProxy()) { + proxy_in_use = true; -+ proxy_is_https = true; -+ dbg("HTTPS proxy in use. There may be connection problems."); ++ dbg("An HTTPS proxy is in use. There may be connection problems."); + } ++ ++ dbg("trying https.getContent()"); + Object output = https.getContent(); ++ dbg("trying https.disconnect()"); + https.disconnect(); -+ result = true; ++ if (! viewer.GET) { ++ String header = https.getHeaderField("VNC-Server"); ++ if (header != null && header.startsWith("x11vnc")) { ++ dbg("detected x11vnc server (1), setting GET=1"); ++ viewer.GET = true; ++ } ++ } + + } catch(Exception e) { + dbg("HttpsURLConnection: " + e.getMessage()); + } + + if (proxy_in_use) { ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); ++ return; ++ } else if (trusturlCerts != null && !viewer.forceProxy) { ++ /* Allow user to require HTTP check? use forceProxy for now. */ ++ dbg("SKIPPING HTTP PROXY CHECK: got trusturlCerts, assuming proxy info is correct."); ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); + return; + } + ++ /* ++ * XXX need to remember scenario where this extra check ++ * gives useful info. User's Browser proxy settings? ++ */ ++ dbg("TRYING HTTP:"); + ustr = "http://" + host + ":" + port; + ustr += viewer.urlPrefix + "/index.vnc"; ++ dbg("ustr is: " + ustr); + + try { ++ /* prepare for an HTTP URL connection to the same host:port (but not httpsPort) */ + URL url = new URL(ustr); + HttpURLConnection http = (HttpURLConnection) + url.openConnection(); @@ -528,45 +707,64 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + http.setUseCaches(false); + http.setRequestMethod("GET"); + http.setRequestProperty("Pragma", "No-Cache"); -+ http.setRequestProperty("Proxy-Connection", -+ "Keep-Alive"); ++ http.setRequestProperty("Proxy-Connection", "Keep-Alive"); + http.setDoInput(true); + ++ dbg("trying http.connect()"); + http.connect(); + + if (http.usingProxy()) { + proxy_in_use = true; -+ proxy_is_https = false; -+ dbg("HTTP proxy in use. There may be connection problems."); ++ dbg("An HTTP proxy is in use. There may be connection problems."); + } ++ dbg("trying http.getContent()"); + Object output = http.getContent(); ++ dbg("trying http.disconnect()"); + http.disconnect(); -+ ++ if (! viewer.GET) { ++ String header = http.getHeaderField("VNC-Server"); ++ if (header != null && header.startsWith("x11vnc")) { ++ dbg("detected x11vnc server (2), setting GET=1"); ++ viewer.GET = true; ++ } ++ } + } catch(Exception e) { -+ dbg("HttpURLConnection: " + e.getMessage()); ++ dbg("HttpURLConnection: " + e.getMessage()); + } ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); + } + + public Socket connectSock() throws IOException { -+ + /* + * first try a https connection to detect a proxy, and -+ * also grab the VNC server cert. ++ * grab the VNC server cert at the same time: + */ -+ check_for_proxy(); ++ check_for_proxy_and_grab_vnc_server_cert(); ++ ++ boolean srv_cert = false; + -+ if (viewer.trustAllVncCerts) { ++ if (trustsrvCerts != null) { ++ /* applet parameter suppled serverCert */ ++ dbg("viewer.trustSrvCert-0 using trustsrv_ctx"); ++ factory = trustsrv_ctx.getSocketFactory(); ++ srv_cert = true; ++ } else if (viewer.trustAllVncCerts) { ++ /* trust all certs (no checking) */ + dbg("viewer.trustAllVncCerts-0 using trustall_ctx"); + factory = trustall_ctx.getSocketFactory(); -+ } else if (use_url_cert_for_auth && trusturlCerts != null) { ++ } else if (trusturlCerts != null) { ++ /* trust certs the Browser/JVM accepted in check_for_proxy... */ + dbg("using trusturl_ctx"); + factory = trusturl_ctx.getSocketFactory(); + } else { ++ /* trust the local defaults */ + dbg("using trustloc_ctx"); + factory = trustloc_ctx.getSocketFactory(); + } + + socket = null; ++ + try { + if (proxy_in_use && viewer.forceProxy) { + throw new Exception("forcing proxy (forceProxy)"); @@ -585,7 +783,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + + } catch (Exception esock) { -+ dbg("esock: " + esock.getMessage()); ++ dbg("socket error: " + esock.getMessage()); + if (proxy_in_use || viewer.CONNECT != null) { + proxy_failure = true; + if (proxy_in_use) { @@ -596,14 +794,17 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + try { + socket = proxy_socket(factory); + } catch (Exception e) { -+ dbg("err proxy_socket: " + e.getMessage()); ++ dbg("proxy_socket error: " + e.getMessage()); + } ++ } else { ++ /* n.b. socket is left in error state to cause ex. below. */ + } + } + + try { + socket.startHandshake(); -+ dbg("Server Connection Verified on 1st try."); ++ ++ dbg("The Server Connection Verified OK on 1st try."); + + java.security.cert.Certificate[] currentTrustedCerts; + BrowserCertsDialog bcd; @@ -612,9 +813,13 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + currentTrustedCerts = sess.getPeerCertificates(); + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-1"); ++ dbg("viewer.trustAllVncCerts-1 keeping socket."); + } else if (currentTrustedCerts == null || currentTrustedCerts.length < 1) { -+ socket.close(); ++ try { ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy."); ++ } + socket = null; + throw new SSLHandshakeException("no current certs"); + } @@ -628,20 +833,28 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-2"); ++ dbg("viewer.trustAllVncCerts-2 skipping browser certs dialog"); ++ user_wants_to_see_cert = false; ++ } else if (viewer.serverCert != null && trustsrvCerts != null) { ++ dbg("viewer.serverCert-1 skipping browser certs dialog"); + user_wants_to_see_cert = false; + } else if (viewer.trustUrlVncCert) { -+ dbg("viewer.trustUrlVncCert-1"); ++ dbg("viewer.trustUrlVncCert-1 skipping browser certs dialog"); + user_wants_to_see_cert = false; + } else { ++ /* have a dialog with the user: */ + bcd = new BrowserCertsDialog(serv, host + ":" + port); -+ dbg("browser certs dialog START"); ++ dbg("browser certs dialog begin."); + bcd.queryUser(); -+ dbg("browser certs dialog DONE"); ++ dbg("browser certs dialog finished."); ++ + if (bcd.showCertDialog) { + String msg = "user wants to see cert"; + dbg(msg); + user_wants_to_see_cert = true; ++ if (cert_fail == null) { ++ cert_fail = "user-view"; ++ } + throw new SSLHandshakeException(msg); + } else { + user_wants_to_see_cert = false; @@ -650,18 +863,37 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + + } catch (SSLHandshakeException eh) { -+ dbg("Could not automatically verify Server."); ++ dbg("SSLHandshakeException: could not automatically verify Server."); + dbg("msg: " + eh.getMessage()); ++ ++ ++ /* send a cleanup string just in case: */ + String getoutstr = "GET /index.vnc HTTP/1.0\r\nConnection: close\r\n\r\n"; + -+ OutputStream os = socket.getOutputStream(); -+ os.write(getoutstr.getBytes()); -+ socket.close(); ++ try { ++ OutputStream os = socket.getOutputStream(); ++ os.write(getoutstr.getBytes()); ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy!"); ++ } ++ ++ /* reload */ ++ + socket = null; + ++ String reason = null; ++ ++ if (srv_cert) { ++ /* for serverCert usage we make this a fatal error. */ ++ throw new IOException("Fatal: VNC Server's Cert does not match Applet Parameter 'serverCert=...'"); ++ /* see below in TrustDialog were we describe this case to user anyway */ ++ } ++ + /* + * Reconnect, trusting any cert, so we can grab -+ * the cert to show it to the user. The connection ++ * the cert to show it to the user in a dialog ++ * for him to manually accept. This connection + * is not used for anything else. + */ + factory = trustall_ctx.getSocketFactory(); @@ -671,9 +903,18 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + socket = (SSLSocket) factory.createSocket(host, port); + } + ++ if (debug_certs) { ++ dbg("trusturlCerts: " + trusturlCerts); ++ dbg("trustsrvCerts: " + trustsrvCerts); ++ } ++ if (trusturlCerts == null && cert_fail == null) { ++ cert_fail = "missing-certs"; ++ } ++ + try { + socket.startHandshake(); -+ dbg("TrustAll Server Connection Verified."); ++ ++ dbg("The TrustAll Server Cert-grab Connection (trivially) Verified OK."); + + /* grab the cert: */ + try { @@ -683,17 +924,24 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + throw new Exception("Could not get " + + "Peer Certificate"); + } ++ if (debug_certs) { ++ dbg("trustallCerts: " + trustallCerts); ++ } + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-3"); ++ dbg("viewer.trustAllVncCerts-3. skipping dialog, trusting everything."); + } else if (! browser_cert_match()) { + /* + * close socket now, we will reopen after + * dialog if user agrees to use the cert. + */ -+ os = socket.getOutputStream(); -+ os.write(getoutstr.getBytes()); -+ socket.close(); ++ try { ++ OutputStream os = socket.getOutputStream(); ++ os.write(getoutstr.getBytes()); ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy!!"); ++ } + socket = null; + + /* dialog with user to accept cert or not: */ @@ -701,7 +949,27 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + TrustDialog td= new TrustDialog(host, port, + trustallCerts); + -+ if (! td.queryUser()) { ++ if (cert_fail == null) { ++ ; ++ } else if (cert_fail.equals("user-view")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " You Asked to View the Certificate."; ++ } else if (cert_fail.equals("server-cert-mismatch")) { ++ /* this is now fatal error, see above. */ ++ reason = "Reason for this Dialog:\n\n" ++ + " The VNC Server's Certificate does not match the Certificate\n" ++ + " specified in the supplied 'serverCert' Applet Parameter."; ++ } else if (cert_fail.equals("cert-mismatch")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " The VNC Server's Certificate does not match the Website's\n" ++ + " HTTPS Certificate (that you previously accepted; either\n" ++ + " manually or automatically via Certificate Authority.)"; ++ } else if (cert_fail.equals("missing-certs")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " Not all Certificates could be obtained to check."; ++ } ++ ++ if (! td.queryUser(reason)) { + String msg = "User decided against it."; + dbg(msg); + throw new IOException(msg); @@ -709,24 +977,26 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + + } catch (Exception ehand2) { -+ dbg("** Could not TrustAll Verify Server."); ++ dbg("** Could not TrustAll Verify Server!"); + + throw new IOException(ehand2.getMessage()); + } + ++ /* reload again: */ ++ + if (socket != null) { + try { + socket.close(); + } catch (Exception e) { -+ ; ++ dbg("socket is grumpy!!!"); + } + socket = null; + } + + /* + * Now connect a 3rd time, using the cert -+ * retrieved during connection 2 (that the user -+ * likely blindly agreed to). ++ * retrieved during connection 2 (sadly, that ++ * the user likely blindly agreed to...) + */ + + factory = trustone_ctx.getSocketFactory(); @@ -738,15 +1008,18 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + + try { + socket.startHandshake(); -+ dbg("TrustAll Server Connection Verified #3."); ++ dbg("TrustAll/TrustOne Server Connection Verified #3."); + + } catch (Exception ehand3) { -+ dbg("** Could not TrustAll Verify Server #3."); ++ dbg("** Could not TrustAll/TrustOne Verify Server #3."); + + throw new IOException(ehand3.getMessage()); + } + } + ++ /* we have socket (possibly null) at this point, so proceed: */ ++ ++ /* handle x11vnc GET=1, if applicable: */ + if (socket != null && viewer.GET) { + String str = "GET "; + str += viewer.urlPrefix; @@ -754,9 +1027,11 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + str += " HTTP/1.0\r\n"; + str += "Pragma: No-Cache\r\n"; + str += "\r\n"; ++ + System.out.println("sending GET: " + str); + OutputStream os = socket.getOutputStream(); + String type = "os"; ++ + if (type == "os") { + os.write(str.getBytes()); + os.flush(); @@ -787,9 +1062,56 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + + dbg("SSL returning socket to caller."); ++ dbg(""); ++ ++ /* could be null, let caller handle that. */ + return (Socket) socket; + } + ++ boolean browser_cert_match() { ++ String msg = "Browser URL accept previously accepted cert"; ++ ++ if (user_wants_to_see_cert) { ++ return false; ++ } ++ ++ if (viewer.serverCert != null || trustsrvCerts != null) { ++ if (cert_fail == null) { ++ cert_fail = "server-cert-mismatch"; ++ } ++ } ++ if (trustallCerts != null && trusturlCerts != null) { ++ if (trustallCerts.length == trusturlCerts.length) { ++ boolean ok = true; ++ /* check toath trustallCerts (socket) equals trusturlCerts (browser) */ ++ for (int i = 0; i < trusturlCerts.length; i++) { ++ if (! trustallCerts[i].equals(trusturlCerts[i])) { ++ dbg("BCM: cert mismatch at i=" + i); ++ dbg("BCM: cert mismatch url" + trusturlCerts[i]); ++ dbg("BCM: cert mismatch all" + trustallCerts[i]); ++ ok = false; ++ } ++ } ++ if (ok) { ++ System.out.println(msg); ++ if (cert_fail == null) { ++ cert_fail = "did-not-fail"; ++ } ++ return true; ++ } else { ++ if (cert_fail == null) { ++ cert_fail = "cert-mismatch"; ++ } ++ return false; ++ } ++ } ++ } ++ if (cert_fail == null) { ++ cert_fail = "missing-certs"; ++ } ++ return false; ++ } ++ + private void dbg(String s) { + if (debug) { + System.out.println(s); @@ -807,6 +1129,8 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + return n; + } + ++ /* this will do the proxy CONNECT negotiation and hook us up. */ ++ + private void proxy_helper(String proxyHost, int proxyPort) { + + boolean proxy_auth = false; @@ -814,14 +1138,15 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + String hp = host + ":" + port; + dbg("proxy_helper: " + proxyHost + ":" + proxyPort + " hp: " + hp); + ++ /* we loop here a few times trying for the password case */ + for (int k=0; k < 2; k++) { -+ dbg("proxy_in_use psocket:"); ++ dbg("proxy_in_use psocket: " + k); + + if (proxySock != null) { + try { + proxySock.close(); + } catch (Exception e) { -+ ; ++ dbg("proxy socket is grumpy."); + } + } + @@ -834,7 +1159,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + String req1 = "CONNECT " + hp + " HTTP/1.1\r\n" + + "Host: " + hp + "\r\n"; + -+ dbg("requesting: " + req1); ++ dbg("requesting via proxy: " + req1); + + if (proxy_auth) { + if (proxy_auth_string == null) { @@ -843,10 +1168,13 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + proxy_auth_string = pp.getAuth(); + } + //dbg("auth1: " + proxy_auth_string); ++ + String auth2 = Base64Coder.encodeString(proxy_auth_string); + //dbg("auth2: " + auth2); ++ + req1 += "Proxy-Authorization: Basic " + auth2 + "\r\n"; + //dbg("req1: " + req1); ++ + dbg("added Proxy-Authorization: Basic ... to request"); + } + req1 += "\r\n"; @@ -869,9 +1197,10 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + } + } catch(Exception e) { -+ dbg("sock prob: " + e.getMessage()); ++ dbg("some proxy socket problem: " + e.getMessage()); + } + ++ /* read the rest of the HTTP headers */ + while (true) { + String line = readline(proxy_is); + dbg("proxy line: " + line.trim()); @@ -891,6 +1220,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + } + if (!proxy_auth || proxy_auth_basic_realm.equals("")) { ++ /* we only try once for the non-password case: */ + break; + } + } @@ -908,6 +1238,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + try { + props = System.getProperties(); + } catch (Exception e) { ++ /* sandboxed applet might not be able to read it. */ + dbg("props failed: " + e.getMessage()); + } + if (viewer.proxyHost != null) { @@ -924,6 +1255,8 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + props.list(System.out); + dbg("\n---------------\n\n"); + ++ /* scrape throught properties looking for proxy info: */ ++ + for (Enumeration e = props.propertyNames(); e.hasMoreElements(); ) { + String s = (String) e.nextElement(); + String v = System.getProperty(s); @@ -1046,7 +1379,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + } + } + } catch(Exception e) { -+ dbg("sock prob2: " + e.getMessage()); ++ dbg("proxy socket problem-2: " + e.getMessage()); + } + + while (true) { @@ -1130,7 +1463,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + msg = "VNC Server " + host + ":" + port + " Not Verified"; + } + -+ public boolean queryUser() { ++ public boolean queryUser(String reason) { + + /* create and display the dialog for unverified cert. */ + @@ -1143,6 +1476,9 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + CertInfo ci = new CertInfo(trustallCerts[0]); + infostr = ci.get_certinfo("all"); + } ++ if (reason != null) { ++ reason += "\n\n"; ++ } + + text = "\n" ++ "Unable to verify the identity of\n" @@ -1153,28 +1489,38 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL ++ "\n" ++ "as a trusted VNC server.\n" ++ "\n" -++ "This may be due to:\n" +++ reason +++ "In General not being able to verify the VNC Server and/or your seeing this Dialog\n" +++ "is due to one of the following:\n" ++ "\n" ++ " - Your requesting to View the Certificate before accepting.\n" ++ "\n" -++ " - The VNC server using a Self-Signed Certificate.\n" +++ " - The VNC server is using a Self-Signed Certificate or a Certificate\n" +++ " Authority not recognized by your Web Browser or Java Plugin runtime.\n" +++ "\n" +++ " - The use of an Apache SSL portal scheme employing CONNECT proxying AND\n" +++ " the Apache Web server has a certificate *different* from the VNC server's.\n" ++ "\n" -++ " - The VNC server using a Certificate Authority not recognized by your\n" -++ " Browser or Java Plugin runtime.\n" +++ " - No previously accepted Certificate (via Web Broswer/Java Plugin) could be\n" +++ " obtained by this applet to compare the VNC Server Certificate against.\n" ++ "\n" -++ " - The use of an Apache SSL portal employing CONNECT proxying and the\n" -++ " Apache web server has a certificate different from the VNC server's. \n" +++ " - The VNC Server's Certificate does not match the one specified in the\n" +++ " supplied 'serverCert' Java Applet Parameter.\n" ++ "\n" -++ " - A Man-In-The-Middle attack impersonating as the VNC server you wish\n" +++ " - A Man-In-The-Middle attack impersonating as the VNC server that you wish\n" ++ " to connect to. (Wouldn't that be exciting!!)\n" ++ "\n" -++ "By safely copying the VNC server's Certificate (or using a common\n" -++ "Certificate Authority certificate) you can configure your Web Browser or\n" -++ "Java Plugin to automatically authenticate this Server.\n" +++ "By safely copying the VNC server's Certificate (or using a common Certificate\n" +++ "Authority certificate) you can configure your Web Browser and Java Plugin to\n" +++ "automatically authenticate this VNC Server.\n" +++ "\n" +++ "If you do so, then you will only have to click \"Yes\" when this VNC Viewer\n" +++ "applet asks you whether to trust your Browser/Java Plugin's acceptance of the\n" +++ "certificate (except for the Apache portal case above where they don't match.)\n" ++ "\n" -++ "If you do so, then you will only have to click \"Yes\" when this VNC\n" -++ "Viewer applet asks you whether to trust your Browser/Java Plugin's\n" -++ "acceptance of the certificate. (except for the Apache portal case above.)\n" +++ "You can also set the applet parameter 'trustUrlVncCert=yes' to automatically\n" +++ "accept certificates already accepted/trusted by your Web Browser/Java Plugin,\n" +++ "and thereby see no dialog from this VNC Viewer applet.\n" +; + + /* the accept / do-not-accept radio buttons: */ @@ -1210,7 +1556,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL + label.setFont(new Font("Helvetica", Font.BOLD, 16)); + + /* textarea in the middle */ -+ textarea = new TextArea(text, 36, 64, ++ textarea = new TextArea(text, 38, 64, + TextArea.SCROLLBARS_VERTICAL_ONLY); + textarea.setEditable(false); + @@ -1562,22 +1908,19 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL +m += "\n"; +m += "on its own.\n"; +m += "\n"; -+m += "However, it has noticed that your Web Browser or Java VM Plugin\n"; ++m += "However, it has noticed that your Web Browser and/or Java VM Plugin\n"; +m += "has previously accepted the same certificate. You may have set\n"; +m += "this up permanently or just for this session, or the server\n"; +m += "certificate was signed by a CA cert that your Web Browser or\n"; +m += "Java VM Plugin has.\n"; +m += "\n"; ++m += "If the VNC Server connection times out while you are reading this\n"; ++m += "dialog, then restart the connection and try again.\n"; ++m += "\n"; +m += "Should this VNC Viewer applet now connect to the above VNC server?\n"; +m += "\n"; + -+// String m = "\nShould this VNC Viewer applet use your Browser/JVM certs to\n"; -+// m += "authenticate the VNC Server:\n"; -+// m += "\n " + hostport + "\n\n " + vncServer + "\n\n"; -+// m += "(NOTE: this *includes* any certs you have Just Now accepted in a\n"; -+// m += "dialog box with your Web Browser or Java Applet Plugin)\n\n"; -+ -+ TextArea textarea = new TextArea(m, 20, 64, ++ TextArea textarea = new TextArea(m, 22, 64, + TextArea.SCROLLBARS_VERTICAL_ONLY); + textarea.setEditable(false); + yes = new Button("Yes"); @@ -1789,8 +2132,16 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/SSLSocketToMe.java vnc_javasrc/SSL +} diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncViewer.java --- vnc_javasrc.orig/VncViewer.java 2004-03-04 08:34:25.000000000 -0500 -+++ vnc_javasrc/VncViewer.java 2010-02-22 19:25:19.000000000 -0500 -@@ -80,7 +80,7 @@ ++++ vnc_javasrc/VncViewer.java 2010-03-20 19:49:14.000000000 -0400 +@@ -29,6 +29,7 @@ + import java.awt.event.*; + import java.io.*; + import java.net.*; ++import java.util.*; + + public class VncViewer extends java.applet.Applet + implements java.lang.Runnable, WindowListener { +@@ -80,7 +81,7 @@ // Variables read from parameter values. String socketFactory; String host; @@ -1799,7 +2150,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncView boolean showControls; boolean offerRelogin; boolean showOfflineDesktop; -@@ -88,6 +88,20 @@ +@@ -88,6 +89,21 @@ int deferCursorUpdates; int deferUpdateRequests; @@ -1809,6 +2160,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncView + String urlPrefix; + String httpsPort; + String oneTimeKey; ++ String serverCert; + String proxyHost; + String proxyPort; + boolean forceProxy; @@ -1820,9 +2172,12 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncView // Reference to this applet for inter-applet communication. public static java.applet.Applet refApplet; -@@ -591,8 +605,25 @@ +@@ -590,9 +606,28 @@ + fatalError("HOST parameter not specified"); } } ++ Date d = new Date(); ++ System.out.println("-\nSSL VNC Java Applet starting. " + d); - String str = readParameter("PORT", true); - port = Integer.parseInt(str); @@ -1848,7 +2203,7 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncView if (inAnApplet) { str = readParameter("Open New Window", false); -@@ -626,6 +657,101 @@ +@@ -626,6 +661,106 @@ // SocketFactory. socketFactory = readParameter("SocketFactory", false); @@ -1891,7 +2246,12 @@ diff -x VncCanvas.java -Naur vnc_javasrc.orig/VncViewer.java vnc_javasrc/VncView + + oneTimeKey = readParameter("oneTimeKey", false); + if (oneTimeKey != null) { -+ System.out.println("oneTimeKey: is set"); ++ System.out.println("oneTimeKey is set."); ++ } ++ ++ serverCert = readParameter("serverCert", false); ++ if (serverCert != null) { ++ System.out.println("serverCert is set."); + } + + forceProxy = false; diff --git a/classes/ssl/ultravnc-102-JavaViewer-ssl-etc.patch b/classes/ssl/ultravnc-102-JavaViewer-ssl-etc.patch index 369a221..8bb6f85 100644 --- a/classes/ssl/ultravnc-102-JavaViewer-ssl-etc.patch +++ b/classes/ssl/ultravnc-102-JavaViewer-ssl-etc.patch @@ -2644,8 +2644,8 @@ diff -Naur JavaViewer.orig/RfbProto.java JavaViewer/RfbProto.java // } diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java --- JavaViewer.orig/SSLSocketToMe.java 1969-12-31 19:00:00.000000000 -0500 -+++ JavaViewer/SSLSocketToMe.java 2010-02-22 20:03:11.000000000 -0500 -@@ -0,0 +1,1712 @@ ++++ JavaViewer/SSLSocketToMe.java 2010-03-19 12:52:08.000000000 -0400 +@@ -0,0 +1,2055 @@ +/* + * SSLSocketToMe.java: add SSL encryption to Java VNC Viewer. + * @@ -2689,7 +2689,9 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + String host; + int port; + VncViewer viewer; ++ + boolean debug = true; ++ boolean debug_certs = false; + + /* sockets */ + SSLSocket socket = null; @@ -2697,11 +2699,11 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + + /* fallback for Proxy connection */ + boolean proxy_in_use = false; -+ boolean proxy_is_https = false; + boolean proxy_failure = false; + public DataInputStream is = null; + public OutputStream os = null; + ++ /* strings from user WRT proxy: */ + String proxy_auth_string = null; + String proxy_dialog_host = null; + int proxy_dialog_port = 0; @@ -2713,21 +2715,28 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + /* trust contexts */ + SSLContext trustloc_ctx; + SSLContext trustall_ctx; ++ SSLContext trustsrv_ctx; + SSLContext trusturl_ctx; + SSLContext trustone_ctx; + ++ /* corresponding trust managers */ + TrustManager[] trustAllCerts; ++ TrustManager[] trustSrvCert; + TrustManager[] trustUrlCert; + TrustManager[] trustOneCert; + -+ boolean use_url_cert_for_auth = true; ++ /* client-side SSL auth key (oneTimeKey=...) */ ++ KeyManager[] mykey = null; ++ + boolean user_wants_to_see_cert = true; -+ boolean debug_certs = false; ++ String cert_fail = null; + -+ /* cert(s) we retrieve from VNC server */ ++ /* cert(s) we retrieve from Web server, VNC server, or serverCert param: */ + java.security.cert.Certificate[] trustallCerts = null; ++ java.security.cert.Certificate[] trustsrvCerts = null; + java.security.cert.Certificate[] trusturlCerts = null; + ++ /* utility to decode hex oneTimeKey=... and serverCert=... */ + byte[] hex2bytes(String s) { + byte[] bytes = new byte[s.length()/2]; + for (int i=0; i 0) { + int idx = viewer.oneTimeKey.indexOf(","); + @@ -2938,15 +3033,18 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + KeyFactory kf = KeyFactory.getInstance("RSA"); + PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec ( key ); + PrivateKey ff = kf.generatePrivate (keysp); -+ //dbg("ff " + ff); -+ String cert_str = new String(cert); ++ if (debug_certs) { ++ dbg("one time key " + ff); ++ } + + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + Collection c = cf.generateCertificates(new ByteArrayInputStream(cert)); + Certificate[] certs = new Certificate[c.toArray().length]; + if (c.size() == 1) { + Certificate tmpcert = cf.generateCertificate(new ByteArrayInputStream(cert)); -+ //dbg("tmpcert" + tmpcert); ++ if (debug_certs) { ++ dbg("one time cert" + tmpcert); ++ } + certs[0] = tmpcert; + } else { + certs = (Certificate[]) c.toArray(); @@ -2962,12 +3060,54 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + mykey = kmf.getKeyManagers(); + } + ++ /* ++ * build serverCert cert if supplied in applet parameter: ++ */ ++ if (viewer.serverCert != null) { ++ CertificateFactory cf = CertificateFactory.getInstance("X.509"); ++ byte[] cert = hex2bytes(viewer.serverCert); ++ Collection c = cf.generateCertificates(new ByteArrayInputStream(cert)); ++ trustsrvCerts = new Certificate[c.toArray().length]; ++ if (c.size() == 1) { ++ Certificate tmpcert = cf.generateCertificate(new ByteArrayInputStream(cert)); ++ trustsrvCerts[0] = tmpcert; ++ } else { ++ trustsrvCerts = (Certificate[]) c.toArray(); ++ } ++ } + -+ /* trust loc certs: */ ++ /* the trust loc certs context: */ + try { + trustloc_ctx = SSLContext.getInstance("SSL"); -+ trustloc_ctx.init(mykey, null, new -+ java.security.SecureRandom()); ++ ++ /* ++ * below is a failed attempt to get jvm's default ++ * trust manager using null (below) makes it so ++ * for HttpsURLConnection the server cannot be ++ * verified (no prompting.) ++ */ ++ if (false) { ++ boolean didit = false; ++ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); ++ tmf.init((KeyStore) null); ++ TrustManager [] tml = tmf.getTrustManagers(); ++ for (int i = 0; i < tml.length; i++) { ++ TrustManager tm = tml[i]; ++ if (tm instanceof X509TrustManager) { ++ TrustManager tm1[] = new TrustManager[1]; ++ tm1[0] = tm; ++ trustloc_ctx.init(mykey, tm1, null); ++ didit = true; ++ break; ++ } ++ } ++ if (!didit) { ++ trustloc_ctx.init(mykey, null, null); ++ } ++ } else { ++ /* we have to set trust manager to null */ ++ trustloc_ctx.init(mykey, null, null); ++ } + + } catch (Exception e) { + String msg = "SSL trustloc_ctx FAILED."; @@ -2975,7 +3115,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + throw new Exception(msg); + } + -+ /* trust all certs: */ ++ /* the trust all certs context: */ + try { + trustall_ctx = SSLContext.getInstance("SSL"); + trustall_ctx.init(mykey, trustAllCerts, new @@ -2987,7 +3127,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + throw new Exception(msg); + } + -+ /* trust url certs: */ ++ /* the trust url certs context: */ + try { + trusturl_ctx = SSLContext.getInstance("SSL"); + trusturl_ctx.init(mykey, trustUrlCert, new @@ -2999,99 +3139,138 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + throw new Exception(msg); + } + -+ /* trust the one cert from server: */ ++ /* the trust srv certs context: */ + try { -+ trustone_ctx = SSLContext.getInstance("SSL"); -+ trustone_ctx.init(mykey, trustOneCert, new ++ trustsrv_ctx = SSLContext.getInstance("SSL"); ++ trustsrv_ctx.init(mykey, trustSrvCert, new + java.security.SecureRandom()); + + } catch (Exception e) { -+ String msg = "SSL trustone_ctx FAILED."; ++ String msg = "SSL trustsrv_ctx FAILED."; + dbg(msg); + throw new Exception(msg); + } -+ } + -+ boolean browser_cert_match() { -+ String msg = "Browser URL accept previously accepted cert"; -+ -+ if (user_wants_to_see_cert) { -+ return false; -+ } ++ /* the trust the one cert from server context: */ ++ try { ++ trustone_ctx = SSLContext.getInstance("SSL"); ++ trustone_ctx.init(mykey, trustOneCert, new ++ java.security.SecureRandom()); + -+ if (trustallCerts != null && trusturlCerts != null) { -+ if (trustallCerts.length == 1 && trusturlCerts.length == 1) { -+ if (trustallCerts[0].equals(trusturlCerts[0])) { -+ System.out.println(msg); -+ return true; -+ } -+ } ++ } catch (Exception e) { ++ String msg = "SSL trustone_ctx FAILED."; ++ dbg(msg); ++ throw new Exception(msg); + } -+ return false; + } + -+ public void check_for_proxy() { ++ /* ++ * we call this early on to 1) check for a proxy, 2) grab ++ * Browser/JVM accepted HTTPS cert. ++ */ ++ public void check_for_proxy_and_grab_vnc_server_cert() { + -+ boolean result = false; -+ + trusturlCerts = null; + proxy_in_use = false; ++ + if (viewer.ignoreProxy) { ++ /* applet param says skip it. */ ++ /* the downside is we do not set trusturlCerts for comparison later... */ ++ /* nor do we autodetect x11vnc for GET=1. */ + return; + } + ++ dbg("------------------------------------------------"); ++ dbg("Into check_for_proxy_and_grab_vnc_server_cert():"); ++ ++ dbg("TRYING HTTPS:"); + String ustr = "https://" + host + ":"; + if (viewer.httpsPort != null) { + ustr += viewer.httpsPort; + } else { -+ ustr += port; // hmmm ++ ustr += port; + } + ustr += viewer.urlPrefix + "/check.https.proxy.connection"; + dbg("ustr is: " + ustr); + -+ + try { ++ /* prepare for an HTTPS URL connection to host:port */ + URL url = new URL(ustr); -+ HttpsURLConnection https = (HttpsURLConnection) -+ url.openConnection(); ++ HttpsURLConnection https = (HttpsURLConnection) url.openConnection(); ++ ++ if (mykey != null) { ++ /* with oneTimeKey (mykey) we can't use the default SSL context */ ++ if (trustsrvCerts != null) { ++ dbg("passing trustsrv_ctx to HttpsURLConnection to provide client cert."); ++ https.setSSLSocketFactory(trustsrv_ctx.getSocketFactory()); ++ } else if (trustloc_ctx != null) { ++ dbg("passing trustloc_ctx to HttpsURLConnection to provide client cert."); ++ https.setSSLSocketFactory(trustloc_ctx.getSocketFactory()); ++ } ++ } + + https.setUseCaches(false); + https.setRequestMethod("GET"); + https.setRequestProperty("Pragma", "No-Cache"); -+ https.setRequestProperty("Proxy-Connection", -+ "Keep-Alive"); ++ https.setRequestProperty("Proxy-Connection", "Keep-Alive"); + https.setDoInput(true); + ++ dbg("trying https.connect()"); + https.connect(); + ++ dbg("trying https.getServerCertificates()"); + trusturlCerts = https.getServerCertificates(); ++ + if (trusturlCerts == null) { -+ dbg("set trusturlCerts to null..."); ++ dbg("set trusturlCerts to null!"); + } else { + dbg("set trusturlCerts to non-null"); + } + + if (https.usingProxy()) { + proxy_in_use = true; -+ proxy_is_https = true; -+ dbg("HTTPS proxy in use. There may be connection problems."); ++ dbg("An HTTPS proxy is in use. There may be connection problems."); + } ++ ++ dbg("trying https.getContent()"); + Object output = https.getContent(); ++ dbg("trying https.disconnect()"); + https.disconnect(); -+ result = true; ++ if (! viewer.GET) { ++ String header = https.getHeaderField("VNC-Server"); ++ if (header != null && header.startsWith("x11vnc")) { ++ dbg("detected x11vnc server (1), setting GET=1"); ++ viewer.GET = true; ++ } ++ } + + } catch(Exception e) { + dbg("HttpsURLConnection: " + e.getMessage()); + } + + if (proxy_in_use) { ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); ++ return; ++ } else if (trusturlCerts != null && !viewer.forceProxy) { ++ /* Allow user to require HTTP check? use forceProxy for now. */ ++ dbg("SKIPPING HTTP PROXY CHECK: got trusturlCerts, assuming proxy info is correct."); ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); + return; + } + ++ /* ++ * XXX need to remember scenario where this extra check ++ * gives useful info. User's Browser proxy settings? ++ */ ++ dbg("TRYING HTTP:"); + ustr = "http://" + host + ":" + port; + ustr += viewer.urlPrefix + "/index.vnc"; ++ dbg("ustr is: " + ustr); + + try { ++ /* prepare for an HTTP URL connection to the same host:port (but not httpsPort) */ + URL url = new URL(ustr); + HttpURLConnection http = (HttpURLConnection) + url.openConnection(); @@ -3099,45 +3278,64 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + http.setUseCaches(false); + http.setRequestMethod("GET"); + http.setRequestProperty("Pragma", "No-Cache"); -+ http.setRequestProperty("Proxy-Connection", -+ "Keep-Alive"); ++ http.setRequestProperty("Proxy-Connection", "Keep-Alive"); + http.setDoInput(true); + ++ dbg("trying http.connect()"); + http.connect(); + + if (http.usingProxy()) { + proxy_in_use = true; -+ proxy_is_https = false; -+ dbg("HTTP proxy in use. There may be connection problems."); ++ dbg("An HTTP proxy is in use. There may be connection problems."); + } ++ dbg("trying http.getContent()"); + Object output = http.getContent(); ++ dbg("trying http.disconnect()"); + http.disconnect(); -+ ++ if (! viewer.GET) { ++ String header = http.getHeaderField("VNC-Server"); ++ if (header != null && header.startsWith("x11vnc")) { ++ dbg("detected x11vnc server (2), setting GET=1"); ++ viewer.GET = true; ++ } ++ } + } catch(Exception e) { -+ dbg("HttpURLConnection: " + e.getMessage()); ++ dbg("HttpURLConnection: " + e.getMessage()); + } ++ dbg("exit check_for_proxy_and_grab_vnc_server_cert():"); ++ dbg("------------------------------------------------"); + } + + public Socket connectSock() throws IOException { -+ + /* + * first try a https connection to detect a proxy, and -+ * also grab the VNC server cert. ++ * grab the VNC server cert at the same time: + */ -+ check_for_proxy(); ++ check_for_proxy_and_grab_vnc_server_cert(); ++ ++ boolean srv_cert = false; + -+ if (viewer.trustAllVncCerts) { ++ if (trustsrvCerts != null) { ++ /* applet parameter suppled serverCert */ ++ dbg("viewer.trustSrvCert-0 using trustsrv_ctx"); ++ factory = trustsrv_ctx.getSocketFactory(); ++ srv_cert = true; ++ } else if (viewer.trustAllVncCerts) { ++ /* trust all certs (no checking) */ + dbg("viewer.trustAllVncCerts-0 using trustall_ctx"); + factory = trustall_ctx.getSocketFactory(); -+ } else if (use_url_cert_for_auth && trusturlCerts != null) { ++ } else if (trusturlCerts != null) { ++ /* trust certs the Browser/JVM accepted in check_for_proxy... */ + dbg("using trusturl_ctx"); + factory = trusturl_ctx.getSocketFactory(); + } else { ++ /* trust the local defaults */ + dbg("using trustloc_ctx"); + factory = trustloc_ctx.getSocketFactory(); + } + + socket = null; ++ + try { + if (proxy_in_use && viewer.forceProxy) { + throw new Exception("forcing proxy (forceProxy)"); @@ -3156,7 +3354,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + + } catch (Exception esock) { -+ dbg("esock: " + esock.getMessage()); ++ dbg("socket error: " + esock.getMessage()); + if (proxy_in_use || viewer.CONNECT != null) { + proxy_failure = true; + if (proxy_in_use) { @@ -3167,14 +3365,17 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + try { + socket = proxy_socket(factory); + } catch (Exception e) { -+ dbg("err proxy_socket: " + e.getMessage()); ++ dbg("proxy_socket error: " + e.getMessage()); + } ++ } else { ++ /* n.b. socket is left in error state to cause ex. below. */ + } + } + + try { + socket.startHandshake(); -+ dbg("Server Connection Verified on 1st try."); ++ ++ dbg("The Server Connection Verified OK on 1st try."); + + java.security.cert.Certificate[] currentTrustedCerts; + BrowserCertsDialog bcd; @@ -3183,9 +3384,13 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + currentTrustedCerts = sess.getPeerCertificates(); + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-1"); ++ dbg("viewer.trustAllVncCerts-1 keeping socket."); + } else if (currentTrustedCerts == null || currentTrustedCerts.length < 1) { -+ socket.close(); ++ try { ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy."); ++ } + socket = null; + throw new SSLHandshakeException("no current certs"); + } @@ -3199,20 +3404,28 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-2"); ++ dbg("viewer.trustAllVncCerts-2 skipping browser certs dialog"); ++ user_wants_to_see_cert = false; ++ } else if (viewer.serverCert != null && trustsrvCerts != null) { ++ dbg("viewer.serverCert-1 skipping browser certs dialog"); + user_wants_to_see_cert = false; + } else if (viewer.trustUrlVncCert) { -+ dbg("viewer.trustUrlVncCert-1"); ++ dbg("viewer.trustUrlVncCert-1 skipping browser certs dialog"); + user_wants_to_see_cert = false; + } else { ++ /* have a dialog with the user: */ + bcd = new BrowserCertsDialog(serv, host + ":" + port); -+ dbg("browser certs dialog START"); ++ dbg("browser certs dialog begin."); + bcd.queryUser(); -+ dbg("browser certs dialog DONE"); ++ dbg("browser certs dialog finished."); ++ + if (bcd.showCertDialog) { + String msg = "user wants to see cert"; + dbg(msg); + user_wants_to_see_cert = true; ++ if (cert_fail == null) { ++ cert_fail = "user-view"; ++ } + throw new SSLHandshakeException(msg); + } else { + user_wants_to_see_cert = false; @@ -3221,18 +3434,37 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + + } catch (SSLHandshakeException eh) { -+ dbg("Could not automatically verify Server."); ++ dbg("SSLHandshakeException: could not automatically verify Server."); + dbg("msg: " + eh.getMessage()); ++ ++ ++ /* send a cleanup string just in case: */ + String getoutstr = "GET /index.vnc HTTP/1.0\r\nConnection: close\r\n\r\n"; + -+ OutputStream os = socket.getOutputStream(); -+ os.write(getoutstr.getBytes()); -+ socket.close(); ++ try { ++ OutputStream os = socket.getOutputStream(); ++ os.write(getoutstr.getBytes()); ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy!"); ++ } ++ ++ /* reload */ ++ + socket = null; + ++ String reason = null; ++ ++ if (srv_cert) { ++ /* for serverCert usage we make this a fatal error. */ ++ throw new IOException("Fatal: VNC Server's Cert does not match Applet Parameter 'serverCert=...'"); ++ /* see below in TrustDialog were we describe this case to user anyway */ ++ } ++ + /* + * Reconnect, trusting any cert, so we can grab -+ * the cert to show it to the user. The connection ++ * the cert to show it to the user in a dialog ++ * for him to manually accept. This connection + * is not used for anything else. + */ + factory = trustall_ctx.getSocketFactory(); @@ -3242,9 +3474,18 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + socket = (SSLSocket) factory.createSocket(host, port); + } + ++ if (debug_certs) { ++ dbg("trusturlCerts: " + trusturlCerts); ++ dbg("trustsrvCerts: " + trustsrvCerts); ++ } ++ if (trusturlCerts == null && cert_fail == null) { ++ cert_fail = "missing-certs"; ++ } ++ + try { + socket.startHandshake(); -+ dbg("TrustAll Server Connection Verified."); ++ ++ dbg("The TrustAll Server Cert-grab Connection (trivially) Verified OK."); + + /* grab the cert: */ + try { @@ -3254,17 +3495,24 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + throw new Exception("Could not get " + + "Peer Certificate"); + } ++ if (debug_certs) { ++ dbg("trustallCerts: " + trustallCerts); ++ } + + if (viewer.trustAllVncCerts) { -+ dbg("viewer.trustAllVncCerts-3"); ++ dbg("viewer.trustAllVncCerts-3. skipping dialog, trusting everything."); + } else if (! browser_cert_match()) { + /* + * close socket now, we will reopen after + * dialog if user agrees to use the cert. + */ -+ os = socket.getOutputStream(); -+ os.write(getoutstr.getBytes()); -+ socket.close(); ++ try { ++ OutputStream os = socket.getOutputStream(); ++ os.write(getoutstr.getBytes()); ++ socket.close(); ++ } catch (Exception e) { ++ dbg("socket is grumpy!!"); ++ } + socket = null; + + /* dialog with user to accept cert or not: */ @@ -3272,7 +3520,27 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + TrustDialog td= new TrustDialog(host, port, + trustallCerts); + -+ if (! td.queryUser()) { ++ if (cert_fail == null) { ++ ; ++ } else if (cert_fail.equals("user-view")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " You Asked to View the Certificate."; ++ } else if (cert_fail.equals("server-cert-mismatch")) { ++ /* this is now fatal error, see above. */ ++ reason = "Reason for this Dialog:\n\n" ++ + " The VNC Server's Certificate does not match the Certificate\n" ++ + " specified in the supplied 'serverCert' Applet Parameter."; ++ } else if (cert_fail.equals("cert-mismatch")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " The VNC Server's Certificate does not match the Website's\n" ++ + " HTTPS Certificate (that you previously accepted; either\n" ++ + " manually or automatically via Certificate Authority.)"; ++ } else if (cert_fail.equals("missing-certs")) { ++ reason = "Reason for this Dialog:\n\n" ++ + " Not all Certificates could be obtained to check."; ++ } ++ ++ if (! td.queryUser(reason)) { + String msg = "User decided against it."; + dbg(msg); + throw new IOException(msg); @@ -3280,24 +3548,26 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + + } catch (Exception ehand2) { -+ dbg("** Could not TrustAll Verify Server."); ++ dbg("** Could not TrustAll Verify Server!"); + + throw new IOException(ehand2.getMessage()); + } + ++ /* reload again: */ ++ + if (socket != null) { + try { + socket.close(); + } catch (Exception e) { -+ ; ++ dbg("socket is grumpy!!!"); + } + socket = null; + } + + /* + * Now connect a 3rd time, using the cert -+ * retrieved during connection 2 (that the user -+ * likely blindly agreed to). ++ * retrieved during connection 2 (sadly, that ++ * the user likely blindly agreed to...) + */ + + factory = trustone_ctx.getSocketFactory(); @@ -3309,15 +3579,18 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + + try { + socket.startHandshake(); -+ dbg("TrustAll Server Connection Verified #3."); ++ dbg("TrustAll/TrustOne Server Connection Verified #3."); + + } catch (Exception ehand3) { -+ dbg("** Could not TrustAll Verify Server #3."); ++ dbg("** Could not TrustAll/TrustOne Verify Server #3."); + + throw new IOException(ehand3.getMessage()); + } + } + ++ /* we have socket (possibly null) at this point, so proceed: */ ++ ++ /* handle x11vnc GET=1, if applicable: */ + if (socket != null && viewer.GET) { + String str = "GET "; + str += viewer.urlPrefix; @@ -3325,9 +3598,11 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + str += " HTTP/1.0\r\n"; + str += "Pragma: No-Cache\r\n"; + str += "\r\n"; ++ + System.out.println("sending GET: " + str); + OutputStream os = socket.getOutputStream(); + String type = "os"; ++ + if (type == "os") { + os.write(str.getBytes()); + os.flush(); @@ -3358,9 +3633,56 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + + dbg("SSL returning socket to caller."); ++ dbg(""); ++ ++ /* could be null, let caller handle that. */ + return (Socket) socket; + } + ++ boolean browser_cert_match() { ++ String msg = "Browser URL accept previously accepted cert"; ++ ++ if (user_wants_to_see_cert) { ++ return false; ++ } ++ ++ if (viewer.serverCert != null || trustsrvCerts != null) { ++ if (cert_fail == null) { ++ cert_fail = "server-cert-mismatch"; ++ } ++ } ++ if (trustallCerts != null && trusturlCerts != null) { ++ if (trustallCerts.length == trusturlCerts.length) { ++ boolean ok = true; ++ /* check toath trustallCerts (socket) equals trusturlCerts (browser) */ ++ for (int i = 0; i < trusturlCerts.length; i++) { ++ if (! trustallCerts[i].equals(trusturlCerts[i])) { ++ dbg("BCM: cert mismatch at i=" + i); ++ dbg("BCM: cert mismatch url" + trusturlCerts[i]); ++ dbg("BCM: cert mismatch all" + trustallCerts[i]); ++ ok = false; ++ } ++ } ++ if (ok) { ++ System.out.println(msg); ++ if (cert_fail == null) { ++ cert_fail = "did-not-fail"; ++ } ++ return true; ++ } else { ++ if (cert_fail == null) { ++ cert_fail = "cert-mismatch"; ++ } ++ return false; ++ } ++ } ++ } ++ if (cert_fail == null) { ++ cert_fail = "missing-certs"; ++ } ++ return false; ++ } ++ + private void dbg(String s) { + if (debug) { + System.out.println(s); @@ -3378,6 +3700,8 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + return n; + } + ++ /* this will do the proxy CONNECT negotiation and hook us up. */ ++ + private void proxy_helper(String proxyHost, int proxyPort) { + + boolean proxy_auth = false; @@ -3385,14 +3709,15 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + String hp = host + ":" + port; + dbg("proxy_helper: " + proxyHost + ":" + proxyPort + " hp: " + hp); + ++ /* we loop here a few times trying for the password case */ + for (int k=0; k < 2; k++) { -+ dbg("proxy_in_use psocket:"); ++ dbg("proxy_in_use psocket: " + k); + + if (proxySock != null) { + try { + proxySock.close(); + } catch (Exception e) { -+ ; ++ dbg("proxy socket is grumpy."); + } + } + @@ -3405,7 +3730,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + String req1 = "CONNECT " + hp + " HTTP/1.1\r\n" + + "Host: " + hp + "\r\n"; + -+ dbg("requesting: " + req1); ++ dbg("requesting via proxy: " + req1); + + if (proxy_auth) { + if (proxy_auth_string == null) { @@ -3414,10 +3739,13 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + proxy_auth_string = pp.getAuth(); + } + //dbg("auth1: " + proxy_auth_string); ++ + String auth2 = Base64Coder.encodeString(proxy_auth_string); + //dbg("auth2: " + auth2); ++ + req1 += "Proxy-Authorization: Basic " + auth2 + "\r\n"; + //dbg("req1: " + req1); ++ + dbg("added Proxy-Authorization: Basic ... to request"); + } + req1 += "\r\n"; @@ -3440,9 +3768,10 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + } + } catch(Exception e) { -+ dbg("sock prob: " + e.getMessage()); ++ dbg("some proxy socket problem: " + e.getMessage()); + } + ++ /* read the rest of the HTTP headers */ + while (true) { + String line = readline(proxy_is); + dbg("proxy line: " + line.trim()); @@ -3462,6 +3791,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + } + if (!proxy_auth || proxy_auth_basic_realm.equals("")) { ++ /* we only try once for the non-password case: */ + break; + } + } @@ -3479,6 +3809,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + try { + props = System.getProperties(); + } catch (Exception e) { ++ /* sandboxed applet might not be able to read it. */ + dbg("props failed: " + e.getMessage()); + } + if (viewer.proxyHost != null) { @@ -3495,6 +3826,8 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + props.list(System.out); + dbg("\n---------------\n\n"); + ++ /* scrape throught properties looking for proxy info: */ ++ + for (Enumeration e = props.propertyNames(); e.hasMoreElements(); ) { + String s = (String) e.nextElement(); + String v = System.getProperty(s); @@ -3617,7 +3950,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + } + } + } catch(Exception e) { -+ dbg("sock prob2: " + e.getMessage()); ++ dbg("proxy socket problem-2: " + e.getMessage()); + } + + while (true) { @@ -3701,7 +4034,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + msg = "VNC Server " + host + ":" + port + " Not Verified"; + } + -+ public boolean queryUser() { ++ public boolean queryUser(String reason) { + + /* create and display the dialog for unverified cert. */ + @@ -3714,6 +4047,9 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + CertInfo ci = new CertInfo(trustallCerts[0]); + infostr = ci.get_certinfo("all"); + } ++ if (reason != null) { ++ reason += "\n\n"; ++ } + + text = "\n" ++ "Unable to verify the identity of\n" @@ -3724,28 +4060,38 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java ++ "\n" ++ "as a trusted VNC server.\n" ++ "\n" -++ "This may be due to:\n" +++ reason +++ "In General not being able to verify the VNC Server and/or your seeing this Dialog\n" +++ "is due to one of the following:\n" ++ "\n" ++ " - Your requesting to View the Certificate before accepting.\n" ++ "\n" -++ " - The VNC server using a Self-Signed Certificate.\n" +++ " - The VNC server is using a Self-Signed Certificate or a Certificate\n" +++ " Authority not recognized by your Web Browser or Java Plugin runtime.\n" +++ "\n" +++ " - The use of an Apache SSL portal scheme employing CONNECT proxying AND\n" +++ " the Apache Web server has a certificate *different* from the VNC server's.\n" ++ "\n" -++ " - The VNC server using a Certificate Authority not recognized by your\n" -++ " Browser or Java Plugin runtime.\n" +++ " - No previously accepted Certificate (via Web Broswer/Java Plugin) could be\n" +++ " obtained by this applet to compare the VNC Server Certificate against.\n" ++ "\n" -++ " - The use of an Apache SSL portal employing CONNECT proxying and the\n" -++ " Apache web server has a certificate different from the VNC server's. \n" +++ " - The VNC Server's Certificate does not match the one specified in the\n" +++ " supplied 'serverCert' Java Applet Parameter.\n" ++ "\n" -++ " - A Man-In-The-Middle attack impersonating as the VNC server you wish\n" +++ " - A Man-In-The-Middle attack impersonating as the VNC server that you wish\n" ++ " to connect to. (Wouldn't that be exciting!!)\n" ++ "\n" -++ "By safely copying the VNC server's Certificate (or using a common\n" -++ "Certificate Authority certificate) you can configure your Web Browser or\n" -++ "Java Plugin to automatically authenticate this Server.\n" +++ "By safely copying the VNC server's Certificate (or using a common Certificate\n" +++ "Authority certificate) you can configure your Web Browser and Java Plugin to\n" +++ "automatically authenticate this VNC Server.\n" ++ "\n" -++ "If you do so, then you will only have to click \"Yes\" when this VNC\n" -++ "Viewer applet asks you whether to trust your Browser/Java Plugin's\n" -++ "acceptance of the certificate. (except for the Apache portal case above.)\n" +++ "If you do so, then you will only have to click \"Yes\" when this VNC Viewer\n" +++ "applet asks you whether to trust your Browser/Java Plugin's acceptance of the\n" +++ "certificate (except for the Apache portal case above where they don't match.)\n" +++ "\n" +++ "You can also set the applet parameter 'trustUrlVncCert=yes' to automatically\n" +++ "accept certificates already accepted/trusted by your Web Browser/Java Plugin,\n" +++ "and thereby see no dialog from this VNC Viewer applet.\n" +; + + /* the accept / do-not-accept radio buttons: */ @@ -3781,7 +4127,7 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java + label.setFont(new Font("Helvetica", Font.BOLD, 16)); + + /* textarea in the middle */ -+ textarea = new TextArea(text, 36, 64, ++ textarea = new TextArea(text, 38, 64, + TextArea.SCROLLBARS_VERTICAL_ONLY); + textarea.setEditable(false); + @@ -4133,22 +4479,19 @@ diff -Naur JavaViewer.orig/SSLSocketToMe.java JavaViewer/SSLSocketToMe.java +m += "\n"; +m += "on its own.\n"; +m += "\n"; -+m += "However, it has noticed that your Web Browser or Java VM Plugin\n"; ++m += "However, it has noticed that your Web Browser and/or Java VM Plugin\n"; +m += "has previously accepted the same certificate. You may have set\n"; +m += "this up permanently or just for this session, or the server\n"; +m += "certificate was signed by a CA cert that your Web Browser or\n"; +m += "Java VM Plugin has.\n"; +m += "\n"; ++m += "If the VNC Server connection times out while you are reading this\n"; ++m += "dialog, then restart the connection and try again.\n"; ++m += "\n"; +m += "Should this VNC Viewer applet now connect to the above VNC server?\n"; +m += "\n"; + -+// String m = "\nShould this VNC Viewer applet use your Browser/JVM certs to\n"; -+// m += "authenticate the VNC Server:\n"; -+// m += "\n " + hostport + "\n\n " + vncServer + "\n\n"; -+// m += "(NOTE: this *includes* any certs you have Just Now accepted in a\n"; -+// m += "dialog box with your Web Browser or Java Applet Plugin)\n\n"; -+ -+ TextArea textarea = new TextArea(m, 20, 64, ++ TextArea textarea = new TextArea(m, 22, 64, + TextArea.SCROLLBARS_VERTICAL_ONLY); + textarea.setEditable(false); + yes = new Button("Yes"); @@ -4483,8 +4826,16 @@ diff -Naur JavaViewer.orig/VncCanvas.java JavaViewer/VncCanvas.java result = 0; // Transparent pixel diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java --- JavaViewer.orig/VncViewer.java 2006-05-24 15:14:40.000000000 -0400 -+++ JavaViewer/VncViewer.java 2010-02-22 21:58:51.000000000 -0500 -@@ -80,11 +80,11 @@ ++++ JavaViewer/VncViewer.java 2010-03-20 19:50:16.000000000 -0400 +@@ -41,6 +41,7 @@ + import java.io.*; + import java.net.*; + import javax.swing.*; ++import java.util.Date; + + public class VncViewer extends java.applet.Applet + implements java.lang.Runnable, WindowListener { +@@ -80,11 +81,11 @@ GridBagLayout gridbag; ButtonPanel buttonPanel; AuthPanel authenticator; @@ -4498,7 +4849,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java // Control session recording. Object recordingSync; -@@ -96,7 +96,7 @@ +@@ -96,7 +97,7 @@ // Variables read from parameter values. String host; @@ -4507,7 +4858,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java String passwordParam; String encPasswordParam; boolean showControls; -@@ -115,28 +115,71 @@ +@@ -115,28 +116,72 @@ int i; // mslogon support 2 end @@ -4518,6 +4869,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java +String urlPrefix; +String httpsPort; +String oneTimeKey; ++String serverCert; +String ftpDropDown; +String proxyHost; +String proxyPort; @@ -4585,7 +4937,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java // authenticator = new AuthPanel(false); // mslogon support : go to connectAndAuthenticate() if (RecordingFrame.checkSecurity()) rec = new RecordingFrame(this); -@@ -147,10 +190,11 @@ +@@ -147,10 +192,11 @@ cursorUpdatesDef = null; eightBitColorsDef = null; @@ -4599,7 +4951,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java rfbThread = new Thread(this); rfbThread.start(); } -@@ -186,6 +230,30 @@ +@@ -186,6 +232,30 @@ gbc.weightx = 1.0; gbc.weighty = 1.0; @@ -4630,7 +4982,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java // Add ScrollPanel to applet mode // Create a panel which itself is resizeable and can hold -@@ -286,6 +354,24 @@ +@@ -286,6 +356,24 @@ void connectAndAuthenticate() throws Exception { @@ -4655,7 +5007,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java // If "ENCPASSWORD" parameter is set, decrypt the password into // the passwordParam string. -@@ -336,7 +422,22 @@ +@@ -336,7 +424,22 @@ // @@ -4679,7 +5031,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java authenticator = new AuthPanel(mslogon); -@@ -390,6 +491,10 @@ +@@ -390,6 +493,10 @@ break; //mslogon support end @@ -4690,7 +5042,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java // Retry on authentication failure. authenticator.retry(); } -@@ -405,9 +510,11 @@ +@@ -405,9 +512,11 @@ void prologueDetectAuthProtocol() throws Exception { @@ -4704,7 +5056,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java System.out.println("RFB server supports protocol version " + rfb.serverMajor + "." + rfb.serverMinor); -@@ -431,16 +538,36 @@ +@@ -431,16 +540,36 @@ boolean tryAuthenticate(String us, String pw) throws Exception { @@ -4747,7 +5099,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java switch (authScheme) { -@@ -629,6 +756,10 @@ +@@ -629,6 +758,10 @@ void doProtocolInitialisation() throws IOException { @@ -4758,9 +5110,12 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java rfb.writeClientInit(); rfb.readServerInit(); -@@ -775,8 +906,25 @@ +@@ -774,9 +907,28 @@ + fatalError("HOST parameter not specified"); } } ++ Date d = new Date(); ++ System.out.println("-\nSSL VNC Java Applet starting. " + d); - String str = readParameter("PORT", true); - port = Integer.parseInt(str); @@ -4786,7 +5141,7 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java if (inAnApplet) { str = readParameter("Open New Window", false); -@@ -804,6 +952,138 @@ +@@ -804,6 +956,143 @@ deferScreenUpdates = readIntParameter("Defer screen updates", 20); deferCursorUpdates = readIntParameter("Defer cursor updates", 10); deferUpdateRequests = readIntParameter("Defer update requests", 50); @@ -4840,7 +5195,12 @@ diff -Naur JavaViewer.orig/VncViewer.java JavaViewer/VncViewer.java + + oneTimeKey = readParameter("oneTimeKey", false); + if (oneTimeKey != null) { -+ System.out.println("oneTimeKey: is set"); ++ System.out.println("oneTimeKey is set."); ++ } ++ ++ serverCert = readParameter("serverCert", false); ++ if (serverCert != null) { ++ System.out.println("serverCert is set."); + } + + forceProxy = false; diff --git a/x11vnc/ChangeLog b/x11vnc/ChangeLog index fb6f8ad..0117e45 100644 --- a/x11vnc/ChangeLog +++ b/x11vnc/ChangeLog @@ -1,3 +1,16 @@ +2010-03-20 Karl Runge + * classes/ssl: Many improvements to Java SSL applet, onetimekey + serverCert param, debugging printout, user dialogs, catch + socket exceptions, autodetect x11vnc for GET=1. + * x11vnc: misc/scripts: desktop.cgi, inet6to4, panner.pl. + X11VNC_HTTPS_DOWNLOAD_WAIT_TIME, -unixpw %xxx documented, and + can run user cmd in UNIXPW_CMD. FD_XDMCP_IF for create script, + autodetect dm on udp6 only. Queries: pointer_x, pointer_y, + pointer_same, pointer_root. Switch on -xkd if keysyms per key > + 4 in all cases. daemon mode improvements for connect_switch, + inet6to4, ultravnc_repeater.pl. Dynamic change of -clip do + not create new fb if WxH is unchanged. + 2010-02-22 Karl Runge * classes/ssl: Java SSL applet viewer now works with certificate chains. diff --git a/x11vnc/README b/x11vnc/README index 6aa88b4..a291367 100644 --- a/x11vnc/README +++ b/x11vnc/README @@ -2,7 +2,7 @@ Copyright (C) 2002-2010 Karl J. Runge All rights reserved. -x11vnc README file Date: Mon Feb 22 22:22:33 EST 2010 +x11vnc README file Date: Sat Mar 20 23:15:32 EDT 2010 The following information is taken from these URLs: @@ -42,8 +42,8 @@ x11vnc: a VNC server for real X displays passwords where the user does not need to memorize his VNC display/port number. Normally a virtual X session (Xvfb) is created for each user, but it also works with X sessions on physical hardware. - See the [21]tsvnc terminal services mode of the SSVNC viewer that - takes advantage of this mode. + See the [21]tsvnc terminal services mode of the SSVNC viewer for one + way to take advantage of this mode. I wrote x11vnc back in 2002 because x0rfbserver was basically impossible to build on Solaris and had poor performance. The primary @@ -63,7 +63,7 @@ x11vnc: a VNC server for real X displays massive, but you can often use your browser's find-in-page search action using a keyword to find the answer to your problem or question. - Please help [27]beta test the new performance speedup feature using + Please help [27]test the performance speedup feature using [28]viewer-side pixel caching "ncache". SSVNC: An x11vnc side-project provides an [29]Enhanced TightVNC @@ -192,8 +192,10 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick remote shell. Then fix this with the tips [44]below. Note as of Feb/2007 you can also try the [45]-find option instead of - "-display ..." and see if that finds your display and Xauthority. (End - of Common Gotcha) + "-display ..." and see if that finds your display and Xauthority. Note + as of Dec/2009 the [46]-findauth and "[47]-auth guess" options may be + helpful as well. + (End of Common Gotcha) When x11vnc starts up there will then be much chatter printed out (use "-q" to quiet it), until it finally says something like: @@ -210,10 +212,11 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick Step 3. At the place where you are sitting (sitting-here.west in this example) you now want to run a VNC viewer program. There are VNC viewers for Unix, Windows, MacOS, Java-enabled web browsers, and even - for PDA's like the Palm Pilot! You can use any of them to connect to - x11vnc (see the above VNC links under "Background:" on how to obtain a - viewer for your platform or see [46]this FAQ. For Solaris, vncviewer - is available in the [47]Companion CD package SFWvnc.) + for PDA's like the Palm Pilot and Cell Phones! You can use any of them + to connect to x11vnc (see the above VNC links under "Background:" on + how to obtain a viewer for your platform or see [48]this FAQ. For + Solaris, vncviewer is available in the [49]Companion CD package + SFWvnc.) In this example we'll use the Unix vncviewer program on sitting-here by typing the following command in a second terminal window: @@ -223,36 +226,36 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick That should pop up a viewer window on sitting-here.west showing and allowing interaction with the far-away.east:0 X11 desktop. Pretty nifty! When finished, exit the viewer: the remote x11vnc process will - shutdown automatically (or you can use the [48]-forever option to have + shutdown automatically (or you can use the [50]-forever option to have it wait for additional viewer connections.) - Common Gotcha: Nowadays there will likely be a host-level [49]firewall + Common Gotcha: Nowadays there will likely be a host-level [51]firewall on the x11vnc side that is blocking remote access to the VNC port (e.g. 5900.) You will either have to open up that port (or a range of - ports) in your firewall administration tool, or try the [50]SSH + ports) in your firewall administration tool, or try the [52]SSH tunnelling method below (even still the firewall must allow in the SSH port, 22.) Shortcut: Of course if you left x11vnc running on far-away.east:0 in a - terminal window with the [51]-forever option or as a [52]service, + terminal window with the [53]-forever option or as a [54]service, you'd only have to do Step 3 as you moved around. Be sure to use a VNC - [53]Password or [54]other measures if you do that. + [55]Password or [56]other measures if you do that. Super Shortcut: Here is a potentially very easy way to get all of it working. * Have x11vnc (0.9.3 or later) available to run on the remote host (i.e. in $PATH.) - * Download and unpack a [55]SSVNC bundle (1.0.19 or later, e.g. - [56]ssvnc_no_windows-1.0.23.tar.gz) on the Viewer-side machine. + * Download and unpack a [57]SSVNC bundle (1.0.19 or later, e.g. + [58]ssvnc_no_windows-1.0.23.tar.gz) on the Viewer-side machine. * Start the SSVNC Terminal Services mode GUI: ./ssvnc/bin/tsvnc * Enter your remote username@hostname (e.g. fred@far-away.east) in the "VNC Terminal Server" entry. * Click "Connect". That will do an SSH to username@hostname and start up x11vnc and then - connect a VNC Viewer through the SSH [57]encrypted tunnel. + connect a VNC Viewer through the SSH [59]encrypted tunnel. There are a number of things assumed here, first that you are able to SSH into the remote host; i.e. that you have a Unix account there and @@ -261,7 +264,7 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick plink binary is included in the SSVNC bundle.) Finally, it is assumed that you are already logged into an X session on the remote machine, e.g. your workstation (otherwise, a virtual X server, e.g. Xvfb, will - be [58]started for you.) + be [60]started for you.) In some cases the remote SSH server will not run commands with the same $PATH that you normally have in your shell there. In this case @@ -283,7 +286,7 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick For these cases it should be obvious how it is done. The above steps will work, but more easily the user sitting at far-away.east:0 simply starts up x11vnc from a terminal window, after which the guests would - start their VNC viewers. For this usage mode the "[59]-connect + start their VNC viewers. For this usage mode the "[61]-connect host1,host2" option may be of use to automatically connect to the vncviewers in "-listen" mode on the list of hosts. _________________________________________________________________ @@ -319,7 +322,7 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick Note that "x11vnc -localhost ..." limits incoming vncviewer connections to only those from the same machine. This is very natural for ssh tunnelling (the redirection appears to come from the same - machine.) Use of a [60]VNC password is also strongly recommended. + machine.) Use of a [62]VNC password is also strongly recommended. Note also the -t we used above (force allocate pseudoterminal), it actually seems to improve interactive typing response via VNC! @@ -335,16 +338,16 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick Some VNC viewers will do the ssh tunnelling for you automatically, the TightVNC Unix vncviewer does this when the "-via far-away.east" option is supplied to it (this requires x11vnc to be already running on - far-away.east or having it started by [61]inetd(8).) See the 3rd - script example [62]below for more info. + far-away.east or having it started by [63]inetd(8).) See the 3rd + script example [64]below for more info. - SSVNC: You may also want to look at the [63]Enhanced TightVNC Viewer + SSVNC: You may also want to look at the [65]Enhanced TightVNC Viewer (ssvnc) bundles because they contain scripts and GUIs to automatically set up SSH tunnels (e.g. the GUI, "ssvnc", does it automatically and so does this command: "ssvnc_cmd -ssh user@far-away.east:0") and can even start up x11vnc as well. - The [64]Terminal Services mode of SSVNC is perhaps the easiest way to + The [66]Terminal Services mode of SSVNC is perhaps the easiest way to use x11vnc. You just need to have x11vnc available in $PATH on the remote side (and can SSH to the host), and then on the viewer-side you type something like: @@ -368,13 +371,13 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick Once logged in, you'll need to do a second login (ssh, rsh, etc.) to the workstation machine 'OtherHost' and then start up x11vnc on it (if - it isn't already running.) (The "[65]-connect gateway:59xx" option may + it isn't already running.) (The "[67]-connect gateway:59xx" option may be another alternative here with the viewer already in -listen mode.) For an automatic way to use a gateway and have all the network traffic - encrypted (including inside the firewall) see [66]Chaining SSH's. + encrypted (including inside the firewall) see [68]Chaining SSH's. These gateway access modes also can be done automatically for you via - the "Proxy/Gateway" setting in [67]SSVNC (including the Chaining SSH's + the "Proxy/Gateway" setting in [69]SSVNC (including the Chaining SSH's case, "Double Proxy".) Firewalls/Routers: @@ -390,7 +393,7 @@ to: http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick One thing that can be done is to redirect a port on the Firewall/Router to, say, the SSH port (22) on an inside machine (how to do this depends on your particular Firewall/Router, often the - router config URL is http://192.168.100.1 See [68]www.portforward.com + router config URL is http://192.168.100.1 See [70]www.portforward.com for more info.) This way you reach these computers from anywhere on the Internet and use x11vnc to view X sessions running on them. @@ -408,7 +411,7 @@ nc -localhost -display :0' Where far-away.east means the hostname (or IP) that the Router/Firewall is using (for home setups this is usually the IP - gotten from your ISP via DHCP, the site [69]http://www.whatismyip.com/ + gotten from your ISP via DHCP, the site [71]http://www.whatismyip.com/ is a convenient way to determine what it is.) It is a good idea to add some obscurity to accessing your system via @@ -419,7 +422,7 @@ nc -localhost -display :0' Port 22 -> 192.168.1.3, Port 22 (SSH) Again, this SSH gateway access can be done automatically for you via - the "Proxy/Gateway" setting in [70]SSVNC. And under the "Remote SSH + the "Proxy/Gateway" setting in [72]SSVNC. And under the "Remote SSH Command" setting you can enter the x11vnc -localhost -display :0. Host-Level-Firewalls: even with the hardware Firewall/Router problem @@ -436,7 +439,7 @@ nc -localhost -display :0' Port 5901 -> 192.168.1.4, Port 5900 (VNC) (where 192.168.1.3 is "jills-pc" and 192.168.1.4 is "freds-pc".) This - could be used for normal, unencrypted connections and also for [71]SSL + could be used for normal, unencrypted connections and also for [73]SSL encrypted ones. The the VNC displays to enter in the VNC viewer would be, say, @@ -450,7 +453,7 @@ nc -localhost -display :0' vncviewer 24.56.78.93:0 The IP address would need to be communicated to the person running the - VNC Viewer. The site [72]http://www.whatismyip.com/ can help here. + VNC Viewer. The site [74]http://www.whatismyip.com/ can help here. _________________________________________________________________ @@ -459,7 +462,7 @@ nc -localhost -display :0' above port and display numbers may change a bit (e.g. -> 5901 and :1). However, if you "know" port 5900 will be free on the local and remote machines, you can easily automate the above two steps by using the - x11vnc option [73]-bg (forks into background after connection to the + x11vnc option [75]-bg (forks into background after connection to the display is set up) or using the -f option of ssh. Some example scripts are shown below. Feel free to try the ssh -C to enable its compression and see if that speeds things up noticeably. @@ -492,7 +495,7 @@ done #2. Another method is to start the VNC viewer in listen mode "vncviewer -listen" and have x11vnc initiate a reverse connection - using the [74]-connect option: + using the [76]-connect option: #!/bin/sh # usage: x11vnc_ssh : # e.g.: x11vnc_ssh snoopy.peanuts.com:0 @@ -535,7 +538,7 @@ export VNC_VIA_CMD vncviewer -via $host localhost:0 # must be TightVNC vncviewer. Of course if you already have the x11vnc running waiting for - connections (or have it started out of [75]inetd(8)), you can simply + connections (or have it started out of [77]inetd(8)), you can simply use the TightVNC "vncviewer -via gateway host:port" in its default mode to provide secure ssh tunnelling. _________________________________________________________________ @@ -543,38 +546,38 @@ vncviewer -via $host localhost:0 # must be TightVNC vncviewer. VNC password file: Also note in the #1. example script that the - [76]option "-rfbauth .vnc/passwd" provides additional protection by + [78]option "-rfbauth .vnc/passwd" provides additional protection by requiring a VNC password for every VNC viewer that connects. The - vncpasswd or storepasswd programs, or the x11vnc [77]-storepasswd + vncpasswd or storepasswd programs, or the x11vnc [79]-storepasswd option can be used to create the password file. x11vnc also has the - slightly less secure [78]-passwdfile and "-passwd XXXXX" [79]options + slightly less secure [80]-passwdfile and "-passwd XXXXX" [81]options to specify passwords. Very Important: It is up to YOU to tell x11vnc to use password protection (-rfbauth or -passwdfile), it will NOT do it for you - automatically or force you to (use [80]-usepw if you want to be forced + automatically or force you to (use [82]-usepw if you want to be forced to.) The same goes for encrypting the channel between the viewer and - x11vnc: it is up to you to use ssh, stunnel, [81]-ssl mode, a VPN, - etc. (use the [82]Enhanced TightVNC Viewer (SSVNC) GUI if you want to + x11vnc: it is up to you to use ssh, stunnel, [83]-ssl mode, a VPN, + etc. (use the [84]Enhanced TightVNC Viewer (SSVNC) GUI if you want to be forced to use SSL or SSH.) For additional safety, also look into - the -allow and -localhost [83]options and building x11vnc with - [84]tcp_wrappers support to limit host access. + the -allow and -localhost [85]options and building x11vnc with + [86]tcp_wrappers support to limit host access. _________________________________________________________________ Tunnelling x11vnc via SSL/TLS: One can also encrypt the VNC traffic using an SSL/TLS tunnel such as - [85]stunnel.mirt.net (also [86]stunnel.org) or using the built-in - (Mar/2006) [87]-ssl openssl mode. A SSL-enabled Java applet VNC Viewer + [87]stunnel.mirt.net (also [88]stunnel.org) or using the built-in + (Mar/2006) [89]-ssl openssl mode. A SSL-enabled Java applet VNC Viewer is also provided in the x11vnc package (and https can be used to download it.) Although not as ubiquitous as ssh, SSL tunnelling still provides a - useful alternative. See [88]this FAQ on -ssl and -stunnel modes for + useful alternative. See [90]this FAQ on -ssl and -stunnel modes for details and examples. - The [89]Enhanced TightVNC Viewer (SSVNC) bundles contain some + The [91]Enhanced TightVNC Viewer (SSVNC) bundles contain some convenient utilities to automatically set up an SSL tunnel from the viewer-side (i.e. to connect to "x11vnc -ssl ...".) And many other enhancements too. @@ -582,29 +585,29 @@ vncviewer -via $host localhost:0 # must be TightVNC vncviewer. Downloading x11vnc: - x11vnc is a contributed program to the [90]LibVNCServer project at + x11vnc is a contributed program to the [92]LibVNCServer project at SourceForge.net. I use libvncserver for all of the VNC aspects; I couldn't have done without it. The full source code may be found and downloaded (either file-release tarball or GIT tree) from the above - link. As of Dec 2009, the [91]x11vnc-0.9.9.tar.gz source package is - released (recommended download). The [92]x11vnc 0.9.9 release notes. + link. As of Dec 2009, the [93]x11vnc-0.9.9.tar.gz source package is + released (recommended download). The [94]x11vnc 0.9.9 release notes. The x11vnc package is the subset of the libvncserver package needed to build the x11vnc program. Also, you can get a copy of my latest, - bleeding edge [93]x11vnc-0.9.10.tar.gz tarball to build the most up to - date one. + bleeding edge [95]x11vnc-0.9.10-dev.tar.gz tarball to build the most + up to date one. - Precompiled Binaries/Packages: See the [94]FAQ below for information + Precompiled Binaries/Packages: See the [96]FAQ below for information about where you might obtain a precompiled x11vnc binary from 3rd parties and some ones I create. VNC Viewers: To obtain VNC viewers for the viewing side (Windows, Mac OS, or Unix) try these links: - * [95]http://www.tightvnc.com/download.html - * [96]http://www.realvnc.com/download-free.html - * [97]http://sourceforge.net/projects/cotvnc/ - * [98]http://www.ultravnc.com/ - * [99]Our Enhanced TightVNC Viewer (SSVNC) + * [97]http://www.tightvnc.com/download.html + * [98]http://www.realvnc.com/download-free.html + * [99]http://sourceforge.net/projects/cotvnc/ + * [100]http://www.ultravnc.com/ + * [101]Our Enhanced TightVNC Viewer (SSVNC) [ssvnc.gif] @@ -617,16 +620,16 @@ vncviewer -via $host localhost:0 # must be TightVNC vncviewer. rx11vnc.pl that attempts to tunnel the vnc traffic through an ssh port redirection (and does not assume port 5900 is free.) Have a look at them to see what they do and customize as needed: - * [100]rx11vnc wrapper script - * [101]rx11vnc.pl wrapper script to tunnel traffic thru ssh + * [102]rx11vnc wrapper script + * [103]rx11vnc.pl wrapper script to tunnel traffic thru ssh _________________________________________________________________ Building x11vnc: - Make sure you have all the needed [102]build/compile/development + Make sure you have all the needed [104]build/compile/development packages installed (e.g. Linux distributions foolishly don't install - them by default.) + them by default.) See this [105]build FAQ for more details. If your OS has libjpeg.so and libz.so in standard locations you can build as follows (example given for the 0.9.9 release of x11vnc: @@ -653,8 +656,8 @@ vncviewer -via $host localhost:0 # must be TightVNC vncviewer. Note: Currently gcc is recommended to build libvncserver. In some cases it will build with non-gcc compilers, but the resulting binary sometimes fails to run properly. For Solaris pre-built gcc binaries - are at [103]http://www.sunfreeware.com/. Some Solaris pre-built x11vnc - binaries are [104]here. + are at [106]http://www.sunfreeware.com/. Some Solaris pre-built x11vnc + binaries are [107]here. However, one user reports it does work fine when built with Sun Studio 10, so YMMV. In fact, here is a little build script to do this on @@ -674,12 +677,12 @@ export MAKE AM_CFLAGS $MAKE In general you can use the "make -e" trick if you don't like - libvncserver's choice of AM_CFLAGS. See the [105]build scripts below + libvncserver's choice of AM_CFLAGS. See the [108]build scripts below for more ideas. Scripts similar to the above have been shown to work with vendor C compilers on HP-UX (ccom: HP92453-01) and Tru64 (Compaq C V6.5-011.) - You can find information on [106]Misc. Build problems here. + You can find information on [109]Misc. Build problems here. _________________________________________________________________ @@ -717,9 +720,9 @@ r/sfw; make' If your system does not have these libraries at all you can get the source for the libraries to build them: libjpeg is available at - [107]ftp://ftp.uu.net/graphics/jpeg/ and zlib at - [108]http://www.gzip.org/zlib/. See also - [109]http://www.sunfreeware.com/ for Solaris binary packages of these + [110]ftp://ftp.uu.net/graphics/jpeg/ and zlib at + [111]http://www.gzip.org/zlib/. See also + [112]http://www.sunfreeware.com/ for Solaris binary packages of these libraries as well as for gcc. Normally they will install into /usr/local but you can install them anywhere with the --prefix=/path/to/anywhere, etc. @@ -789,10 +792,10 @@ ls -l ./x11vnc/x11vnc --with-zlib=DIR" options are handy if you want to avoid making a script. - If you need to link OpenSSL libssl.a on Solaris see this [110]method. + If you need to link OpenSSL libssl.a on Solaris see this [113]method. If you need to build on Solaris 2.5.1 or earlier or other older Unix - OS's, see [111]this workaround FAQ. + OS's, see [114]this workaround FAQ. Building on FreeBSD, OpenBSD, ...: The jpeg libraries seem to be in @@ -852,7 +855,7 @@ make is something like "/usr/bin/X11/X -force -vfb -ac :1". - Building on Mac OS X: There is now [112]native Mac OS X support for + Building on Mac OS X: There is now [115]native Mac OS X support for x11vnc by using the raw framebuffer feature. This mode does not use or need X11 at all. To build you may need to disable X11: ./configure --without-x ... @@ -866,7 +869,7 @@ make OpenSSL: Starting with version 0.8.3 x11vnc can now be built with - [113]SSL/TLS support. For this to be enabled the libssl.so library + [116]SSL/TLS support. For this to be enabled the libssl.so library needs to be available at build time. So you may need to have additional CPPFLAGS and LDFLAGS items if your libssl.so is in a non-standard place. As of x11vnc 0.9.4 there is also the @@ -892,34 +895,72 @@ make Spring 2010. The version 0.9.10 beta tarball is kept here: - [114]x11vnc-0.9.10.tar.gz + [117]x11vnc-0.9.10-dev.tar.gz There are also some Linux, Solaris, Mac OS X, and other OS test - binaries [115]here. Please kick the tires and report bugs, performance - regressions, undesired behavior, etc. to [116]me. + binaries [118]here. Please kick the tires and report bugs, performance + regressions, undesired behavior, etc. to [119]me. - To aid testing of the [117]built-in SSL/TLS support for x11vnc, a + To aid testing of the [120]built-in SSL/TLS support for x11vnc, a number of VNC Viewer packages for Unix, Mac OS X, and Windows have been created that provide SSL Support for the TightVNC Viewer (this is - done by [118]wrapper scripts and a GUI that starts [119]STUNNEL.) It + done by [121]wrapper scripts and a GUI that starts [122]STUNNEL.) It should be pretty convenient for automatic SSL and SSH connections. It - is described in detail at and can be downloaded from the [120]Enhanced + is described in detail at and can be downloaded from the [123]Enhanced TightVNC Viewer (SSVNC) page. The SSVNC Unix viewer also supports - x11vnc's symmetric key [121]encryption ciphers (see the 'UltraVNC DSM + x11vnc's symmetric key [124]encryption ciphers (see the 'UltraVNC DSM Encryption Plugin' settings panel.) Here are some features that will appear in the 0.9.10 release: - * The [122]Xdummy wrapper script for Xorg's dummy driver is updated + * The included SSL enabled Java applet viewer now supports Chained + SSL Certificates. The debugCerts=yes applet parameter aids + troubleshooting certificate validation. The x11vnc [125]-ssl mode + has always supported [126]chained SSL certificates (simply put the + intermediate certificates, in order, after the server certificate + in the pem file.) + * A bug has been fixed that would prevent the Java applet viewer + from being downloaded successfully in single-port HTTPS/VNC inetd + mode. The env. var. X11VNC_HTTPS_DOWNLOAD_WAIT_TIME can be used to + adjust for how many seconds a [127]-inetd or [128]-https httpd + download is waited for (default 15 seconds.) + * The [129]-sslScripts option prints out the SSL certificate + management scripts. + * A demo CGI script [130]desktop.cgi shows how to create a + multi-user x11vnc web login desktop service. The user logs into a + secure web site and gets his/her own virtual desktop ([131]Xvfb.) + x11vnc's SSL enabled Java Viewer Applet is launched by the web + browser for secure viewing (and so no software needs to be + installed on the viewer-side.) One can use the desktop.cgi script + for ideas to create their own fancier or customized web login + desktop service (e.g. user-creation, PHP, SQL, specialized desktop + application, etc.) More info [132]here. There is also an optional + 'port redirection' mode that allows redirection to other SSL + enabled VNC servers running inside the firewall. + * The [133]Xdummy wrapper script for Xorg's dummy driver is updated and no longer requires being run as root. New service options are provided to select Xdummy over Xvfb as the virtual X server to be created. + * The "%" unix password verification tricks for the [134]-unixpw + option are now documented. They have also been extended to run a + command as the user if one sets the environment variable + UNIXPW_CMD. The desktop.cgi demo script takes advantage of this + new feature. + * The TightVNC sercurity type (TightVNC features enabler) now works + for RFB version 3.8. + * A transitional tool is provided in [135]inet6to4 to allow x11vnc + to receive connections over [136]IPv6. + * The X property X11VNC_TRAP_XRANDR can be set on a desktop to force + x11vnc to use the [137]-xrandr screen size change trapping code. + * New remote control query options: pointer_x, pointer_y, + pointer_same, and pointer_root. A demo script using them + misc/panner.pl is provided. Here are some features that appeared in the 0.9.9 release (Dec/2009): - * The [123]-unixpw_system_greeter option, when used in combined + * The [138]-unixpw_system_greeter option, when used in combined unixpw and XDMCP FINDCREATEDISPLAY mode (for example: - [124]-xdmsvc), enables the user to press Escape to jump directly + [139]-xdmsvc), enables the user to press Escape to jump directly to the XDM/GDM/KDM login greeter screen. This way the user avoids entering his unix password twice at X session creation time. Also, the unixpw login panel now has a short help displayed if the user @@ -929,10 +970,10 @@ make clients like Eggplant and JollysFastVNC continuously spray these requests at VNC servers (regardless of whether they have received any updates or not.) Under some circumstances this could lead to - x11vnc falling behind. The [125]-extra_fbur option allows one to + x11vnc falling behind. The [140]-extra_fbur option allows one to fine tune the setting. Additionally, one may also dial down - delays: e.g. "[126]-defer 5" and "[127]-wait 5" (or to 1 or even - 0) or [128]-nonap or [129]-allinput to keep up with these VNC + delays: e.g. "[141]-defer 5" and "[142]-wait 5" (or to 1 or even + 0) or [143]-nonap or [144]-allinput to keep up with these VNC clients at the expense of increased system load. * Heuristics are applied to try to determine if the X display is currently in a Display Manager Greeter Login panel (e.g. GDM) If @@ -944,9 +985,9 @@ make the use of the XFIXES cursor fetching functionality; this avoids an Xorg bug that causes Xorg to crash right after the user logs in. - * A new option [130]-findauth runs the FINDDISPLAY script that + * A new option [145]-findauth runs the FINDDISPLAY script that applies heuristics that try to determine the XAUTHORITY file. The - use of '[131]-auth guess' will use the XAUTHORITY that -findauth + use of '[146]-auth guess' will use the XAUTHORITY that -findauth reveals. This can be handy in with the lastest GDM where the ability to store cookies in ~/.Xauthority has been removed. If x11vnc is running as root (e.g. inetd) and you add -env FD_XDM=1 @@ -954,28 +995,28 @@ make the correct XAUTHORITY for the given display (this works for XDM/GDM/KDM if the login greeter panel is up or if someone has already logged into an X session.) - * The FINDDISPLAY and FINDCREATEDISPLAY modes (i.e. "[132]-display - WAIT:cmd=...", [133]-find, [134]-create) now work correctly for - the user-supplied login program scheme "[135]-unixpw_cmd ...", as + * The FINDDISPLAY and FINDCREATEDISPLAY modes (i.e. "[147]-display + WAIT:cmd=...", [148]-find, [149]-create) now work correctly for + the user-supplied login program scheme "[150]-unixpw_cmd ...", as long as the login program supports running commands specified in the environment variable "RFB_UNIXPW_CMD_RUN" as the logged-in - user. The mode "[136]-unixpw_nis ..." has also been made more + user. The mode "[151]-unixpw_nis ..." has also been made more consistent. - * The [137]-stunnel option (like [138]-ssl but uses stunnel as an - external helper program) now works with the [139]-ssl "SAVE" and - "TMP" special certificate names. The [140]-sslverify and - [141]-sslCRL options now work correctly in [142]-stunnel mode. + * The [152]-stunnel option (like [153]-ssl but uses stunnel as an + external helper program) now works with the [154]-ssl "SAVE" and + "TMP" special certificate names. The [155]-sslverify and + [156]-sslCRL options now work correctly in [157]-stunnel mode. Single port HTTPS connections are also supported for this mode. * There is an experimental Application Sharing mode that improves - upon the -id/-sid single window sharing: [143]-appshare (run + upon the -id/-sid single window sharing: [158]-appshare (run "x11vnc -appshare -help" for more info.) It is still very primitive and approximate, but at least it displays multiple top-level windows. - * The remote control command [144]-R can be used to instruct x11vnc + * The remote control command [159]-R can be used to instruct x11vnc to resend its most recent copy of the Clipboard, Primary, or Cutbuffer selections: "x11vnc -R resend_clipboard", "x11vnc -R resend_primary", and "x11vnc -R resend_cutbuffer". - * The fonts in the GUI ([145]-gui) can now by set via environment + * The fonts in the GUI ([160]-gui) can now by set via environment variables, e.g. -env X11VNC_FONT_BOLD='Helvetica -16 bold' and -env X11VNC_FONT_FIXED='Courier -14'. * The XDAMAGE mechanism is now automatically disabled for a period @@ -985,18 +1026,18 @@ make * There is an experimental workaround: "-env X11VNC_WATCH_DX_DY=1" that tries to avoid problems with poorly constructed menu themes that place the initial position of the mouse cursor inside a menu - item's active zone. More information [146]can be found here. + item's active zone. More information [161]can be found here. Here are some features that appeared in the 0.9.8 release (Jul/2009): - * Stability improvements to [147]-threads mode. Running x11vnc this + * Stability improvements to [162]-threads mode. Running x11vnc this way is more reliable now. Threaded operation sometimes gives better interactive response and faster updates: try it out. The threaded mode now supports multiple VNC viewers using the same VNC encoding. The threaded mode can also yield a performance enhancement in the many client case (e.g. class-room broadcast.) We have tested with 30 to 50 simultaneous clients. See also - [148]-reflect. + [163]-reflect. For simultaneous clients: the ZRLE encoding is thread safe on all platforms, and the Tight and Zlib encodings are currently only thread safe on Linux where thread local storage, __thread, is @@ -1005,12 +1046,12 @@ make connected client, all encodings are safe on all platforms. Note that some features (e.g. scroll detection and -ncache) may be disabled or run with reduced functionality in -threads mode. - * Automatically tries to work around an [149]Xorg server bug + * Automatically tries to work around an [164]Xorg server bug involving infinitely repeating keys when turning off key - repeating. Use [150]-repeat if the automatic workaround fails. + repeating. Use [165]-repeat if the automatic workaround fails. * Improved reliability of the Single Port SSL VNC and HTTPS java viewer applet delivery mechanism. - * The [151]-clip mode works under [152]-rawfb. + * The [166]-clip mode works under [167]-rawfb. Here are some features that appeared in the 0.9.7 release (Mar/2009): @@ -1020,38 +1061,38 @@ make case the special file /dev/vcsa2 is used to retrieve vt2's current text. Text and colors are shown, but no graphics. * Support for less than 8 bits per pixel framebuffers (e.g. 4 or 1 - bpp) in the [153]-rawfb mode. + bpp) in the [168]-rawfb mode. * The SSL enabled UltraVNC Java viewer applet now has a [Home] entry in the "drives" drop down menu. This menu can be configured with the ftpDropDown applet parameter. All of the applet parameters are documented in classes/ssl/README. - * Experimental support for [154]VirtualGL's [155]TurboVNC (an + * Experimental support for [169]VirtualGL's [170]TurboVNC (an enhanced TightVNC for fast LAN high framerate usage.) * The CUPS Terminal Services helper mode has been improved. - * Improvements to the [156]-ncache_cr that allows smooth opaque + * Improvements to the [171]-ncache_cr that allows smooth opaque window motions using the 'copyrect' encoding when using - [157]-ncache mode. - * The [158]-rmflag option enables a way to indicate to other + [172]-ncache mode. + * The [173]-rmflag option enables a way to indicate to other processes x11vnc has exited. * Reverse connections using anonymous Diffie Hellman SSL encryption now work. Here are some features that appeared in the 0.9.6 release (Dec/2008): - * Support for [159]VeNCrypt SSL/TLS encrypted connections. It is - enabled by default in the [160]-ssl mode. VNC Viewers like - vinagre, gvncviewer/gtk-vnc, the vencrypt package, [161]SSVNC, and + * Support for [174]VeNCrypt SSL/TLS encrypted connections. It is + enabled by default in the [175]-ssl mode. VNC Viewers like + vinagre, gvncviewer/gtk-vnc, the vencrypt package, [176]SSVNC, and others support this encryption mode. It can also be used with the - [162]-unixpw option to enable Unix username and password + [177]-unixpw option to enable Unix username and password authentication (VeNCrypt's "*Plain" modes.) A similar but older VNC security type "ANONTLS" (used by vino) is supported as well. - See the [163]-vencrypt and [164]-anontls options for additional + See the [178]-vencrypt and [179]-anontls options for additional control. The difference between x11vnc's normal -ssl mode and VeNCrypt is that the former wraps the entire VNC connection in SSL (like HTTPS does for HTTP, i.e. "vncs://") while VeNCrypt switches on the SSL/TLS at a certain point during the VNC handshake. Use - [165]-sslonly to disable both VeNCrypt and ANONTLS (vino.) - * The "[166]-ssl ANON" option enables Anonymous Diffie-Hellman (ADH) + [180]-sslonly to disable both VeNCrypt and ANONTLS (vino.) + * The "[181]-ssl ANON" option enables Anonymous Diffie-Hellman (ADH) key exchange for x11vnc's normal SSL/TLS operation. Note that Anonymous Diffie-Hellman uses encryption for privacy, but provides no authentication and so is susceptible to Man-In-The-Middle @@ -1059,17 +1100,17 @@ make SAVE", etc. and have the VNC viewer verify the cert.) The ANONTLS mode (vino) only supports ADH. VeNCrypt mode supports both ADH and regular X509 SSL certificates modes. For these ADH is enabled by - default. See [167]-vencrypt and [168]-anontls for how to disable + default. See [182]-vencrypt and [183]-anontls for how to disable ADH. * For x11vnc's SSL/TLS modes, one can now specify a Certificate - Revocation List (CRL) with the [169]-sslCRL option. This will only + Revocation List (CRL) with the [184]-sslCRL option. This will only be useful for wide deployments: say a company-wide x11vnc SSL access deployment using a central Certificate Authority (CA) via - [170]-sslGenCA and [171]-sslGenCert. This way if a user has his + [185]-sslGenCA and [186]-sslGenCert. This way if a user has his laptop lost or stolen, you only have to revoke his key instead of creating a new Certificate Authority and redeploying new keys to all users. - * The default SSL/TLS mode, "[172]-ssl" (no pem file parameter + * The default SSL/TLS mode, "[187]-ssl" (no pem file parameter supplied), is now the same as "-ssl SAVE" and will save the generated self-signed cert in "~/.vnc/certs/server.pem". Previously "-ssl" would create a temporary self-signed cert that @@ -1079,45 +1120,45 @@ make same x11vnc server. Use "-ssl TMP" to regain the previous behavior. Use "-ssl SAVE_NOPROMPT" to avoid being prompted about using passphrase when the certificate is created. - * The option [173]-http_oneport enables single-port HTTP connections + * The option [188]-http_oneport enables single-port HTTP connections via the Java VNC Viewer. So, for example, the web browser URL "http://myhost.org:5900" works the same as "http://myhost.org:5800", but with the convenience of only involving one port instead of two. This works for both unencrypted - connections and for SSH tunnels (see [174]-httpsredir if the + connections and for SSH tunnels (see [189]-httpsredir if the tunnel port differs.) Note that HTTPS single-port operation in - [175]-ssl SSL encrypted mode has been available since x11vnc + [190]-ssl SSL encrypted mode has been available since x11vnc version 0.8.3. - * For the [176]-avahi/[177]-zeroconf Service Advertizing mode, if + * For the [191]-avahi/[192]-zeroconf Service Advertizing mode, if x11vnc was not compiled with the avahi-client library, then an external helper program, either avahi-publish(1) (on Unix) or dns-sd(1) (on Mac OS X), is used instead. - * The "[178]-rfbport PROMPT" option will prompt the user via the GUI + * The "[193]-rfbport PROMPT" option will prompt the user via the GUI to select the VNC port (e.g. 5901) to listen on, and a few other basic settings. This enables a handy GUI mode for naive users: x11vnc -gui tray=setpass -rfbport PROMPT -logfile $HOME/.x11vnc.log.%VNCDISP LAY suitable for putting in a launcher or menu, e.g. - [179]x11vnc.desktop. The [180]-logfile expansion is new too. In + [194]x11vnc.desktop. The [195]-logfile expansion is new too. In the GUI, the tray=setpass Properties panel has been improved. - * The [181]-solid solid background color option now works for the + * The [196]-solid solid background color option now works for the Mac OS X console. - * The [182]-reopen option instructs x11vnc to try to reopen the X + * The [197]-reopen option instructs x11vnc to try to reopen the X display if it is prematurely closed by, say, the display manager - (e.g. [183]GDM.) + (e.g. [198]GDM.) Here are some features that appeared in the 0.9.5 release (Oct/2008): - * Symmetric key [184]encryption ciphers. ARC4, AES-128, AES-256, + * Symmetric key [199]encryption ciphers. ARC4, AES-128, AES-256, blowfish, and 3des are supported. Salt and initialization vector seeding is provided. These compliment the more widely used SSL and - SSH encryption access methods. [185]SSVNC also supports these + SSH encryption access methods. [200]SSVNC also supports these encryption modes. * Scaling differently along the X- and Y-directions. E.g. - "[186]-scale 1280x1024" or "-scale 0.8x0.75" Also, - "[187]-geometry WxH" is an alias for "-scale WxH" + "[201]-scale 1280x1024" or "-scale 0.8x0.75" Also, + "[202]-geometry WxH" is an alias for "-scale WxH" * By having SSVNC version 1.0.21 or later available in your $PATH, - the [188]-chatwindow option allows a UltraVNC Text Chat window to + the [203]-chatwindow option allows a UltraVNC Text Chat window to appear on the local X11 console/display (this way the remote viewer can chat with the person at the physical display; e.g. helpdesk mode.) This also works on the Mac OS X console if the @@ -1129,47 +1170,47 @@ LAY Here are some features that appeared in the 0.9.4 release (Sep/2008): - * Improvements to the [189]-find and [190]-create X session finding + * Improvements to the [204]-find and [205]-create X session finding or creating modes: new desktop types and service redirection options. Personal cupsd daemon and SSH port redirection helper for - use with [191]SSVNC's Terminal Services feature. - * Reverse VNC connections via [192]-connect work in the [193]-find, - [194]-create and related [195]-display WAIT:... modes. + use with [206]SSVNC's Terminal Services feature. + * Reverse VNC connections via [207]-connect work in the [208]-find, + [209]-create and related [210]-display WAIT:... modes. * Reverse VNC connections (either normal or SSL) can use a Web Proxy or a SOCKS proxy, or a SSH connection, or even a CGI URL to make - the outgoing connection. See: [196]-proxy. Forward connections can - also use: [197]-ssh. - * Reverse VNC connections via the [198]UltraVNC repeater proxy + the outgoing connection. See: [211]-proxy. Forward connections can + also use: [212]-ssh. + * Reverse VNC connections via the [213]UltraVNC repeater proxy (either normal or SSL) are supported. Use either the - "[199]-connect repeater=ID:NNNN+host:port" or "[200]-connect - repeater://host:port+ID:NNNN" notation. The [201]SSVNC VNC viewer + "[214]-connect repeater=ID:NNNN+host:port" or "[215]-connect + repeater://host:port+ID:NNNN" notation. The [216]SSVNC VNC viewer also supports the UltraVNC repeater. Also, a perl repeater - implemention is here: [202]ultravnc_repeater.pl + implemention is here: [217]ultravnc_repeater.pl * Support for indexed colormaps (PseudoColor) with depths other than 8 (from 1 to 16 now work) for non-standard hardware. Option - "[203]-advertise_truecolor" to handle some workaround in this + "[218]-advertise_truecolor" to handle some workaround in this mode. * Support for the ZYWRLE encoding, this is the RealVNC ZRLE encoding extended to do motion video and photo regions more efficiently by way of a Wavelet based transformation. - * The [204]-finddpy and [205]-listdpy utilities help to debug and - configure the [206]-find, [207]-create, and [208]-display WAIT:... + * The [219]-finddpy and [220]-listdpy utilities help to debug and + configure the [221]-find, [222]-create, and [223]-display WAIT:... modes. * Some automatic detection of screen resizes are handled even if the - [209]-xrandr option is not supplied. - * The [210]-autoport options gives more control over the VNC port + [224]-xrandr option is not supplied. + * The [225]-autoport options gives more control over the VNC port x11vnc chooses. - * The [211]-ping secs can be used to help keep idle connections + * The [226]-ping secs can be used to help keep idle connections alive. * Pasting of the selection/clipboard into remote applications (e.g. Java) has been improved. * Fixed a bug if a client disconnects during the 'speed-estimation' phase. * To unset Caps_Lock, Num_Lock and raise all keys in the X server - use [212]-clear_all. + use [227]-clear_all. * Usage with dvorak keyboards has been improved. See also: - [213]-xkb. - * The [214]Java Viewer applet source code is now included in the + [228]-xkb. + * The [229]Java Viewer applet source code is now included in the x11vnc-0.9.*.tar.gz tarball. This means you can now build the Java viewer applet jar files from source. If you stopped shipping the Java viewer applet jar files due to lack of source code, you can @@ -1177,7 +1218,7 @@ LAY Here are some features that appeared in the 0.9.3 release (Oct/2007): - * [215]Viewer-side pixmap caching. A large area of pixels (at least + * [230]Viewer-side pixmap caching. A large area of pixels (at least 2-3 times as big as the framebuffer itself; the bigger the better... default is 10X) is placed below the framebuffer to act as a buffer/cache area for pixel data. The VNC CopyRect encoding @@ -1185,7 +1226,7 @@ LAY Until we start modifying viewers you will be able to see the cache area if you scroll down (this makes it easier to debug!) For testing the default is "-ncache 10". The unix Enhanced TightVNC - Viewer [216]ssvnc has a nice [217]-ycrop option to help hide the + Viewer [231]ssvnc has a nice [232]-ycrop option to help hide the pixel cache area from view. @@ -1198,14 +1239,14 @@ LAY * If UltraVNC file transfer or chat is detected, then VNC clients are "pinged" more often to prevent these side channels from becoming serviced too infrequently. - * In [218]-unixpw mode in the username and password dialog no text + * In [233]-unixpw mode in the username and password dialog no text will be echoed if the first character sent is "Escape". This enables a convenience feature in SSVNC to send the username and password automatically. Here are some features that appeared in the 0.9.1 release (May/2007): - * The [219]UltraVNC Java viewer has been enhanced to support SSL (as + * The [234]UltraVNC Java viewer has been enhanced to support SSL (as the TightVNC viewer had been previously.) The UltraVNC Java supports ultravnc filetransfer, and so can be used as a VNC viewer on Unix that supports ultravnc filetransfer. It is in the @@ -1216,12 +1257,12 @@ LAY Some other bugs in the UltraVNC Java viewer were fixed and a few improvements to the UI made. * A new Unix username login mode for VNC Viewers authenticated via a - Client SSL Certificate: "[220]-users sslpeer=". The emailAddress + Client SSL Certificate: "[235]-users sslpeer=". The emailAddress subject field is inspected for username@hostname and then acts as though "-users +username" has been supplied. This way the Unix username is identified by (i.e. simply extracted from) the Client - SSL Certificate. This could be useful with [221]-find, - [222]-create and [223]-svc modes if you are also have set up and + SSL Certificate. This could be useful with [236]-find, + [237]-create and [238]-svc modes if you are also have set up and use VNC Client SSL Certificate authentication. * For external display finding/creating programs (e.g. WAIT:cmd=...) if the VNC Viewer is authenticated via a Client SSL Certificate, @@ -1230,41 +1271,41 @@ LAY Here are some features that appeared in the 0.9 release (Apr/2007): - * [224]VNC Service advertising via mDNS / ZeroConf / BonJour with - the [225]Avahi client library. Enable via "[226]-avahi" or - "[227]-zeroconf". + * [239]VNC Service advertising via mDNS / ZeroConf / BonJour with + the [240]Avahi client library. Enable via "[241]-avahi" or + "[242]-zeroconf". * Implementations of UltraVNC's TextChat, SingleWindow, and - ServerInput extensions (requires ultravnc viewer or [228]ssvnc + ServerInput extensions (requires ultravnc viewer or [243]ssvnc Unix viewer.) They toggle the selection of a single window - ([229]-id), and disable (friendly) user input and viewing (monitor + ([244]-id), and disable (friendly) user input and viewing (monitor blank) at the VNC server. - * Short aliases "[230]-find", "[231]-create", "[232]-svc", and - "[233]-xdmsvc" for commonly used FINDCREATEDISPLAY usage modes. + * Short aliases "[245]-find", "[246]-create", "[247]-svc", and + "[248]-xdmsvc" for commonly used FINDCREATEDISPLAY usage modes. * Reverse VNC connections (viewer listening) now work in SSL - ([234]-ssl) mode. + ([249]-ssl) mode. * New options to control the Monitor power state and keyboard/mouse - grabbing: [235]-forcedpms, [236]-clientdpms, [237]-noserverdpms, - and [238]-grabalways. + grabbing: [250]-forcedpms, [251]-clientdpms, [252]-noserverdpms, + and [253]-grabalways. * A simple way to emulate inetd(8) to some degree via the - "[239]-loopbg" option. - * Monitor the accuracy of XDAMAGE and apply "[240]-noxdamage" if it - is not working well. OpenGL applications like like [241]beryl and + "[254]-loopbg" option. + * Monitor the accuracy of XDAMAGE and apply "[255]-noxdamage" if it + is not working well. OpenGL applications like like [256]beryl and MythTv have been shown to make XDAMAGE not work properly. * For Java SSL connections involving a router/firewall port - redirection, an option [242]-httpsredir to spare the user from + redirection, an option [257]-httpsredir to spare the user from needing to include &PORT=NNN in the browser URL. Here are some features that appeared in the 0.8.4 release (Feb/2007): - * Native [243]Mac OS X Aqua/Quartz support. (i.e. OSXvnc + * Native [258]Mac OS X Aqua/Quartz support. (i.e. OSXvnc alternative; some activities are faster) - * A [244]new login mode: "-display WAIT:cmd=FINDCREATEDISPLAY + * A [259]new login mode: "-display WAIT:cmd=FINDCREATEDISPLAY -unixpw ..." that will Create a new X session (either virtual or real and with or without a display manager, e.g. kdm) for the user if it cannot find the user's X session display via the FINDDISPLAY - method. See the [245]-svc and the [246]-xdmsvc aliases. - * x11vnc can act as a VNC [247]reflector/repeater using the - "[248]-reflect host:N" option. Instead of polling an X display, + method. See the [260]-svc and the [261]-xdmsvc aliases. + * x11vnc can act as a VNC [262]reflector/repeater using the + "[263]-reflect host:N" option. Instead of polling an X display, the remote VNC Server host:N is connected to and re-exported via VNC. This is intended for use in broadcasting a display to many (e.g. > 16; classroom or large demo) VNC viewers where bandwidth @@ -1272,16 +1313,16 @@ LAY number of repeaters. * Wireframe copyrect detection for local user activity (e.g. someone sitting at the physical display moving windows) Use - [249]-nowireframelocal to disable. - * The "[250]-N" option couples the VNC Display number to the X + [264]-nowireframelocal to disable. + * The "[265]-N" option couples the VNC Display number to the X Display number. E.g. if your X DISPLAY is :2 then the VNC display will be :2 (i.e. using port 5902.) If that port is taken x11vnc will exit. - * Option [251]-nodpms to avoid problems with programs like KDE's + * Option [266]-nodpms to avoid problems with programs like KDE's kdesktop_lock that keep restarting the screen saver every few seconds. * To automatically fix the common mouse motion problem on XINERAMA - (multi-headed) displays, the [252]-xwarppointer option is enabled + (multi-headed) displays, the [267]-xwarppointer option is enabled by default when XINERAMA is active. If you have a Mac please try out the native Mac OS X support, build @@ -1291,62 +1332,62 @@ LAY Here are some features that appeared in the 0.8.3 release (Nov/2006): - * The [253]-ssl option provides SSL encryption and authentication - natively via the [254]www.openssl.org library. One can use from a + * The [268]-ssl option provides SSL encryption and authentication + natively via the [269]www.openssl.org library. One can use from a simple self-signed certificate server certificate up to full CA and client certificate authentication schemes. - * Similar to -ssl, the [255]-stunnel option starts up a SSL tunnel + * Similar to -ssl, the [270]-stunnel option starts up a SSL tunnel server stunnel (that must be installed separately on the system: - [256]stunnel.mirt.net ) to allow only encrypted SSL connections + [271]stunnel.mirt.net ) to allow only encrypted SSL connections from the network. - * The [257]-sslverify option allows for authenticating VNC clients + * The [272]-sslverify option allows for authenticating VNC clients via their certificates in either -ssl or -stunnel modes. * Certificate creation and management tools are provide in the - [258]-sslGenCert, [259]-sslGenCA, and [260]related options. + [273]-sslGenCert, [274]-sslGenCA, and [275]related options. * An SSL enabled Java applet VNC Viewer applet is provided by x11vnc in classes/ssl/VncViewer.jar. In addition to normal HTTP, the applet may be loaded into the web browser via HTTPS (HTTP over SSL.) (one can use the VNC port, e.g. https://host:5900/, or also - the separate [261]-https port option.) A wrapper shell script - [262]ss_vncviewer is also provided that sets up a stunnel - client-side tunnel on Unix systems. See [263]Enhanced TightVNC + the separate [276]-https port option.) A wrapper shell script + [277]ss_vncviewer is also provided that sets up a stunnel + client-side tunnel on Unix systems. See [278]Enhanced TightVNC Viewer (SSVNC) for other SSL/SSH viewer possibilities. - * The [264]-unixpw option supports Unix username and password - authentication (a simpler variant is the [265]-unixpw_nis option + * The [279]-unixpw option supports Unix username and password + authentication (a simpler variant is the [280]-unixpw_nis option that works in environments where the encrypted passwords are - readable, e.g. NIS.) The [266]-ssl or [267]-localhost + - [268]-stunnel options are enforced in this mode to prevent + readable, e.g. NIS.) The [281]-ssl or [282]-localhost + + [283]-stunnel options are enforced in this mode to prevent password sniffing. As a convenience, these requirements are lifted if a SSH tunnel can be deduced (but -localhost still applies.) - * Coupling [269]-unixpw with "[270]-display WAIT:cmd=FINDDISPLAY" or + * Coupling [284]-unixpw with "[285]-display WAIT:cmd=FINDDISPLAY" or "-display WAIT:cmd=FINDCREATEDISPLAY" provides a way to allow a user to login with their UNIX password and have their display - connected to [271]automatically. See the [272]-svc and the - [273]-xdmsvc aliases. - * Hooks are provided in the [274]-unixpw_cmd and "[275]-passwdfile + connected to [286]automatically. See the [287]-svc and the + [288]-xdmsvc aliases. + * Hooks are provided in the [289]-unixpw_cmd and "[290]-passwdfile cmd:,custom:..." options to allow you to supply your own authentication and password lookup programs. * x11vnc can be configured and built to not depend on X11 libraries - "./configure --without-x" for [276]-rawfb only operation (e.g. + "./configure --without-x" for [291]-rawfb only operation (e.g. embedded linux console devices.) - * The [277]-rotate option enables you to rotate or reflect the + * The [292]-rotate option enables you to rotate or reflect the screen before exporting via VNC. This is intended for use on handhelds and other devices where the rotation orientation is not "natural". - * The "[278]-ultrafilexfer" alias is provided and improved UltraVNC + * The "[293]-ultrafilexfer" alias is provided and improved UltraVNC filetransfer rates have been achieved. - * Under the "[279]-connect_or_exit host" option x11vnc will exit + * Under the "[294]-connect_or_exit host" option x11vnc will exit immediately unless the reverse connection to host succeeds. The "-rfbport 0" option disables TCP listening for connections (useful for this mode.) - * The "[280]-rawfb rand" and "-rawfb none" options are useful for + * The "[295]-rawfb rand" and "-rawfb none" options are useful for testing automation scripts, etc., without requiring a full desktop. - * Reduced spewing of information at startup, use "[281]-verbose" + * Reduced spewing of information at startup, use "[296]-verbose" (also "-v") to turn it back on for debugging or if you are going to send me a problem report. - Here are some [282]Previous Release Notes + Here are some [297]Previous Release Notes _________________________________________________________________ Some Notes: @@ -1373,13 +1414,13 @@ LAY protocol.) I suggest using xsetroot, dtstyle or similar utility to set a solid background while using x11vnc. You can turn the pretty background image back on when you are using the display directly. - Update: As of Feb/2005 x11vnc has the [283]-solid [color] option that + Update: As of Feb/2005 x11vnc has the [298]-solid [color] option that works on recent GNOME, KDE, and CDE and also on classic X (background image is on the root window.) Update: As of Oct/2007 x11vnc has the - [284]-ncache option that does a reasonable job caching the background + [299]-ncache option that does a reasonable job caching the background (and other) pixmap data on the viewer side. - I also find the [285]TightVNC encoding gives the best response for my + I also find the [300]TightVNC encoding gives the best response for my usage (Unix <-> Unix over cable modem.) One needs a tightvnc-aware vncviewer to take advantage of this encoding. @@ -1391,17 +1432,17 @@ LAY is X11's default listening port.) Had port 5900 been taken by some other application, x11vnc would have next tried 5901. That would mean the viewer command above should be changed to vncviewer - far-away.east:1. You can force the port with the "[286]-rfbport NNNN" + far-away.east:1. You can force the port with the "[301]-rfbport NNNN" option where NNNN is the desired port number. If that port is already - taken, x11vnc will exit immediately. The "[287]-N" option will try to + taken, x11vnc will exit immediately. The "[302]-N" option will try to match the VNC display number to the X display. (also see the "SunRay Gotcha" note below) Options: x11vnc has (far too) many features that may be activated - via its [288]command line options. Useful options are, e.g., -scale to + via its [303]command line options. Useful options are, e.g., -scale to do server-side scaling, and -rfbauth passwd-file to use VNC password protection (the vncpasswd or storepasswd programs, or the x11vnc - [289]-storepasswd option can be used to create the password file.) + [304]-storepasswd option can be used to create the password file.) Algorithm: How does x11vnc do it? Rather brute-forcedly: it continuously polls the X11 framebuffer for changes using @@ -1429,7 +1470,7 @@ LAY first testing out the programs. You get an interesting recursive/feedback effect where vncviewer images keep popping up each one contained in the previous one and slightly shifted a bit by the - window manager decorations. There will be an [290]even more + window manager decorations. There will be an [305]even more interesting effect if -scale is used. Also, if the XKEYBOARD is supported and the XBell "beeps" once, you get an infinite loop of beeps going off. Although all of this is mildly exciting it is not @@ -1439,8 +1480,8 @@ LAY Sun Ray Notes: - You can run x11vnc on your (connected or disconnected) [291]SunRay - session. Here are some [292]notes on SunRay usage with x11vnc. + You can run x11vnc on your (connected or disconnected) [306]SunRay + session. Here are some [307]notes on SunRay usage with x11vnc. _________________________________________________________________ @@ -1452,7 +1493,7 @@ LAY than you normally do to minimize the effects (e.g. do fullpage paging rather than line-by-line scrolling, and move windows in a single, quick motion.) Recent work has provided the - [293]-scrollcopyrect and [294]-wireframe speedups using the + [308]-scrollcopyrect and [309]-wireframe speedups using the CopyRect VNC encoding and other things, but they only speed up some activities, not all. * A rate limiting factor for x11vnc performance is that graphics @@ -1511,18 +1552,19 @@ LAY but we mention it because it may be of use for special purpose applications. You may need to use the "-cc 4" option to force Xvfb to use a TrueColor visual instead of DirectColor. See also the - description of the [295]-create option that does all of this - automatically for you. + description of the [310]-create option that does all of this + automatically for you (be sure to install the Xvfb package, e.g. + apt-get install xvfb.) Also, a faster and more accurate way is to use the "dummy" Xorg/XFree86 device driver (or our Xdummy wrapper script.) See - [296]this FAQ for details. + [311]this FAQ for details. * Somewhat surprisingly, the X11 mouse (cursor) shape is write-only and cannot be queried from the X server. So traditionally in x11vnc the cursor shape stays fixed at an arrow. (see the "-cursor - X" and "-cursor some" [297]options, however, for a partial hack + X" and "-cursor some" [312]options, however, for a partial hack for the root window, etc.) However, on Solaris using the SUN_OVL overlay extension, x11vnc can show the correct mouse cursor when - the [298]-overlay option is also supplied. A similar thing is done + the [313]-overlay option is also supplied. A similar thing is done on IRIX as well when -overlay is supplied. More generally, as of Dec/2004 x11vnc supports the new XFIXES extension (in Xorg and Solaris 10) to query the X server for the @@ -1530,18 +1572,18 @@ LAY with transparency (alpha channel) need to approximated to solid RGB values (some cursors look worse than others.) * Audio from applications is of course not redirected (separate - redirectors do exist, e.g. esd, see [299]the FAQ on this below.) + redirectors do exist, e.g. esd, see [314]the FAQ on this below.) The XBell() "beeps" will work if the X server supports the XKEYBOARD extension. (Note that on Solaris XKEYBOARD is disabled by default. Passing +kb to Xsun enables it.) - * The scroll detection algorithm for the [300]-scrollcopyrect option + * The scroll detection algorithm for the [315]-scrollcopyrect option can give choppy or bunched up transient output and occasionally painting errors. * Using -threads can expose some bugs/crashes in libvncserver. - Please feel free to [301]contact me if you have any questions, + Please feel free to [316]contact me if you have any questions, problems, or comments about x11vnc, etc. - Also, some people ask if they can make a donation, see [302]this link + Also, some people ask if they can make a donation, see [317]this link for that. References @@ -1591,263 +1633,278 @@ References 43. http://www.karlrunge.com/x11vnc/faq.html#faq-xperms 44. http://www.karlrunge.com/x11vnc/faq.html#faq-xperms 45. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 46. http://www.karlrunge.com/x11vnc/faq.html#faq-viewer-download - 47. http://www.sun.com/software/solaris/freeware/ - 48. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forever - 49. http://www.karlrunge.com/x11vnc/index.html#firewalls - 50. http://www.karlrunge.com/x11vnc/index.html#tunnelling - 51. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forever - 52. http://www.karlrunge.com/x11vnc/faq.html#faq-service - 53. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd - 54. http://www.karlrunge.com/x11vnc/index.html#vnc_password_file - 55. http://www.karlrunge.com/x11vnc/ssvnc.html#download - 56. http://downloads.sourceforge.net/ssvnc/ssvnc_no_windows-1.0.23.tar.gz?use_mirror - 57. http://www.karlrunge.com/x11vnc/index.html#tunnelling - 58. http://www.karlrunge.com/x11vnc/ssvnc.html#tsvnc - 59. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 60. http://www.karlrunge.com/x11vnc/index.html#vnc_password_file - 61. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd - 62. http://www.karlrunge.com/x11vnc/index.html#tightvnc_via - 63. http://www.karlrunge.com/x11vnc/ssvnc.html - 64. http://www.karlrunge.com/x11vnc/ssvnc.html#tsvnc - 65. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 66. http://www.karlrunge.com/x11vnc/chainingssh.html - 67. http://www.karlrunge.com/x11vnc/ssvnc.html - 68. http://www.portforward.com/routers.htm - 69. http://www.whatismyip.com/ - 70. http://www.karlrunge.com/x11vnc/ssvnc.html - 71. http://www.karlrunge.com/x11vnc/index.html#ssl-tunnel - 72. http://www.whatismyip.com/ - 73. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-bg - 74. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 75. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd - 76. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbauth - 77. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd - 78. http://www.karlrunge.com/x11vnc/faq.html#faq-passwdfile - 79. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile - 80. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-usepw - 81. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 82. http://www.karlrunge.com/x11vnc/ssvnc.html - 83. http://www.karlrunge.com/x11vnc/faq.html#faq-allow-opt - 84. http://www.karlrunge.com/x11vnc/faq.html#faq-tcp_wrappers - 85. http://stunnel.mirt.net/ - 86. http://www.stunnel.org/ - 87. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 88. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int - 89. http://www.karlrunge.com/x11vnc/ssvnc.html - 90. http://sourceforge.net/projects/libvncserver/ - 91. http://sourceforge.net/projects/libvncserver/files/x11vnc/0.9.9/ - 92. http://sourceforge.net/projects/libvncserver/files/x11vnc/0.9.9/release-notes-0.9.9.txt/view - 93. http://x11vnc.sourceforge.net/dev/x11vnc-0.9.10.tar.gz - 94. http://www.karlrunge.com/x11vnc/faq.html#faq-binaries - 95. http://www.tightvnc.com/download.html - 96. http://www.realvnc.com/products/free/4.1/download.html - 97. http://sourceforge.net/projects/cotvnc/ - 98. http://www.ultravnc.com/ - 99. http://www.karlrunge.com/x11vnc/ssvnc.html - 100. http://www.karlrunge.com/x11vnc/rx11vnc - 101. http://www.karlrunge.com/x11vnc/rx11vnc.pl - 102. http://www.karlrunge.com/x11vnc/faq.html#faq-build - 103. http://www.sunfreeware.com/ - 104. http://www.karlrunge.com/x11vnc/bins - 105. http://www.karlrunge.com/x11vnc/index.html#solarisbuilding - 106. http://www.karlrunge.com/x11vnc/miscbuild.html - 107. ftp://ftp.uu.net/graphics/jpeg/ - 108. http://www.gzip.org/zlib/ - 109. http://www.sunfreeware.com/ - 110. http://www.karlrunge.com/x11vnc/index.html#build-openssl - 111. http://www.karlrunge.com/x11vnc/faq.html#faq-solaris251build - 112. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx - 113. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int - 114. http://x11vnc.sourceforge.net/dev/x11vnc-0.9.10.tar.gz - 115. http://www.karlrunge.com/x11vnc/bins - 116. mailto:xvml@karlrunge.com - 117. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int - 118. http://www.karlrunge.com/x11vnc/faq.html#infaq_ss_vncviewer - 119. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-ext - 120. http://www.karlrunge.com/x11vnc/ssvnc.html - 121. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-enc - 122. http://www.karlrunge.com/x11vnc/Xdummy - 123. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_system_greeter - 124. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 125. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-extra_fbur - 126. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer - 127. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait - 128. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nonap - 129. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-allinput - 130. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-findauth - 131. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth - 132. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 133. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 134. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 135. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_cmd - 136. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_nis - 137. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel - 138. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 139. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 140. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify - 141. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslCRL - 142. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel - 143. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-appshare - 144. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remote - 145. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-gui - 146. http://ubuntuforums.org/showthread.php?t=1223490 - 147. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads - 148. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect - 149. http://bugs.freedesktop.org/show_bug.cgi?id=21454 - 150. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-repeat - 151. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clip - 152. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 153. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 154. http://www.virtualgl.org/ - 155. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc - 156. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_cr - 157. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache - 158. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rmflag - 159. http://sourceforge.net/projects/vencrypt/ - 160. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 161. http://www.karlrunge.com/x11vnc/ssvnc.html - 162. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 163. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vencrypt - 164. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-anontls - 165. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslonly - 166. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 167. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vencrypt - 168. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-anontls - 169. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslCRL - 170. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCA - 171. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert - 172. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 173. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http_oneport - 174. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpsredir + 46. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-findauth + 47. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 48. http://www.karlrunge.com/x11vnc/faq.html#faq-viewer-download + 49. http://www.sun.com/software/solaris/freeware/ + 50. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forever + 51. http://www.karlrunge.com/x11vnc/index.html#firewalls + 52. http://www.karlrunge.com/x11vnc/index.html#tunnelling + 53. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forever + 54. http://www.karlrunge.com/x11vnc/faq.html#faq-service + 55. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd + 56. http://www.karlrunge.com/x11vnc/index.html#vnc_password_file + 57. http://www.karlrunge.com/x11vnc/ssvnc.html#download + 58. http://downloads.sourceforge.net/ssvnc/ssvnc_no_windows-1.0.23.tar.gz?use_mirror + 59. http://www.karlrunge.com/x11vnc/index.html#tunnelling + 60. http://www.karlrunge.com/x11vnc/ssvnc.html#tsvnc + 61. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 62. http://www.karlrunge.com/x11vnc/index.html#vnc_password_file + 63. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd + 64. http://www.karlrunge.com/x11vnc/index.html#tightvnc_via + 65. http://www.karlrunge.com/x11vnc/ssvnc.html + 66. http://www.karlrunge.com/x11vnc/ssvnc.html#tsvnc + 67. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 68. http://www.karlrunge.com/x11vnc/chainingssh.html + 69. http://www.karlrunge.com/x11vnc/ssvnc.html + 70. http://www.portforward.com/routers.htm + 71. http://www.whatismyip.com/ + 72. http://www.karlrunge.com/x11vnc/ssvnc.html + 73. http://www.karlrunge.com/x11vnc/index.html#ssl-tunnel + 74. http://www.whatismyip.com/ + 75. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-bg + 76. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 77. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd + 78. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbauth + 79. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd + 80. http://www.karlrunge.com/x11vnc/faq.html#faq-passwdfile + 81. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile + 82. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-usepw + 83. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 84. http://www.karlrunge.com/x11vnc/ssvnc.html + 85. http://www.karlrunge.com/x11vnc/faq.html#faq-allow-opt + 86. http://www.karlrunge.com/x11vnc/faq.html#faq-tcp_wrappers + 87. http://stunnel.mirt.net/ + 88. http://www.stunnel.org/ + 89. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 90. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int + 91. http://www.karlrunge.com/x11vnc/ssvnc.html + 92. http://sourceforge.net/projects/libvncserver/ + 93. http://sourceforge.net/projects/libvncserver/files/x11vnc/0.9.9/ + 94. http://sourceforge.net/projects/libvncserver/files/x11vnc/0.9.9/release-notes-0.9.9.txt/view + 95. http://x11vnc.sourceforge.net/dev/x11vnc-0.9.10-dev.tar.gz + 96. http://www.karlrunge.com/x11vnc/faq.html#faq-binaries + 97. http://www.tightvnc.com/download.html + 98. http://www.realvnc.com/products/free/4.1/download.html + 99. http://sourceforge.net/projects/cotvnc/ + 100. http://www.ultravnc.com/ + 101. http://www.karlrunge.com/x11vnc/ssvnc.html + 102. http://www.karlrunge.com/x11vnc/rx11vnc + 103. http://www.karlrunge.com/x11vnc/rx11vnc.pl + 104. http://www.karlrunge.com/x11vnc/faq.html#faq-build + 105. http://www.karlrunge.com/x11vnc/faq.html#faq-build + 106. http://www.sunfreeware.com/ + 107. http://www.karlrunge.com/x11vnc/bins + 108. http://www.karlrunge.com/x11vnc/index.html#solarisbuilding + 109. http://www.karlrunge.com/x11vnc/miscbuild.html + 110. ftp://ftp.uu.net/graphics/jpeg/ + 111. http://www.gzip.org/zlib/ + 112. http://www.sunfreeware.com/ + 113. http://www.karlrunge.com/x11vnc/index.html#build-openssl + 114. http://www.karlrunge.com/x11vnc/faq.html#faq-solaris251build + 115. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx + 116. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int + 117. http://x11vnc.sourceforge.net/dev/x11vnc-0.9.10-dev.tar.gz + 118. http://www.karlrunge.com/x11vnc/bins + 119. mailto:xvml@karlrunge.com + 120. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int + 121. http://www.karlrunge.com/x11vnc/faq.html#infaq_ss_vncviewer + 122. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-ext + 123. http://www.karlrunge.com/x11vnc/ssvnc.html + 124. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-enc + 125. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 126. http://www.karlrunge.com/x11vnc/ssl.html#chained-certificates + 127. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-inetd + 128. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-https + 129. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslScripts + 130. http://www.karlrunge.com/x11vnc/desktop.cgi.pl + 131. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 132. http://www.karlrunge.com/x11vnc/faq.html#faq-web-login + 133. http://www.karlrunge.com/x11vnc/Xdummy + 134. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 135. http://www.karlrunge.com/x11vnc/inet6to4 + 136. http://www.karlrunge.com/x11vnc/faq.html#faq-ipv6 + 137. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xrandr + 138. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_system_greeter + 139. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 140. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-extra_fbur + 141. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer + 142. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait + 143. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nonap + 144. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-allinput + 145. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-findauth + 146. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 147. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 148. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 149. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 150. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_cmd + 151. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_nis + 152. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel + 153. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 154. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 155. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify + 156. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslCRL + 157. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel + 158. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-appshare + 159. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remote + 160. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-gui + 161. http://ubuntuforums.org/showthread.php?t=1223490 + 162. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads + 163. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect + 164. http://bugs.freedesktop.org/show_bug.cgi?id=21454 + 165. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-repeat + 166. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clip + 167. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 168. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 169. http://www.virtualgl.org/ + 170. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc + 171. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_cr + 172. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache + 173. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rmflag + 174. http://sourceforge.net/projects/vencrypt/ 175. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 176. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi - 177. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf - 178. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport - 179. http://www.karlrunge.com/x11vnc/x11vnc.desktop - 180. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-o - 181. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid - 182. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reopen - 183. http://www.karlrunge.com/x11vnc/faq.html#infaq_gdm - 184. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-enc - 185. http://www.karlrunge.com/x11vnc/ssvnc.html - 186. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale - 187. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-geometry - 188. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-chatwindow - 189. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 190. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 191. http://www.karlrunge.com/x11vnc/ssvnc.html - 192. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect - 193. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 194. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 195. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 196. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy - 197. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssh - 198. http://www.uvnc.com/addons/repeater.html - 199. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect - 200. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 201. http://www.karlrunge.com/x11vnc/ssvnc.html - 202. http://www.karlrunge.com/x11vnc/ultravnc_repeater.pl - 203. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-advertise_truecolor - 204. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-finddpy - 205. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-listdpy - 206. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 207. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 208. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 209. http://www.karlrunge.com/x11vnc/faq.html#faq-xrandr - 210. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-autoport - 211. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ping - 212. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all - 213. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb - 214. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-viewers - 215. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching + 176. http://www.karlrunge.com/x11vnc/ssvnc.html + 177. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 178. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vencrypt + 179. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-anontls + 180. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslonly + 181. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 182. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vencrypt + 183. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-anontls + 184. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslCRL + 185. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCA + 186. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert + 187. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 188. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http_oneport + 189. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpsredir + 190. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 191. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi + 192. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf + 193. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport + 194. http://www.karlrunge.com/x11vnc/x11vnc.desktop + 195. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-o + 196. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid + 197. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reopen + 198. http://www.karlrunge.com/x11vnc/faq.html#infaq_gdm + 199. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-enc + 200. http://www.karlrunge.com/x11vnc/ssvnc.html + 201. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale + 202. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-geometry + 203. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-chatwindow + 204. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 205. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 206. http://www.karlrunge.com/x11vnc/ssvnc.html + 207. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect + 208. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 209. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 210. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 211. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy + 212. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssh + 213. http://www.uvnc.com/addons/repeater.html + 214. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect + 215. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect 216. http://www.karlrunge.com/x11vnc/ssvnc.html - 217. http://www.karlrunge.com/x11vnc/ssvnc.html#ycrop - 218. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 219. http://www.ultravnc.com/ - 220. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users - 221. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 217. http://www.karlrunge.com/x11vnc/ultravnc_repeater.pl + 218. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-advertise_truecolor + 219. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-finddpy + 220. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-listdpy + 221. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find 222. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 223. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 224. http://www.karlrunge.com/x11vnc/faq.html#faq-avahi - 225. http://www.avahi.org/ - 226. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi - 227. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf - 228. http://www.karlrunge.com/x11vnc/ssvnc.html - 229. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 230. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 231. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 232. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 233. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 234. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 235. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forcedpms - 236. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clientdpms - 237. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noserverdpms - 238. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-grabalways - 239. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop - 240. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage - 241. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl - 242. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpsredir - 243. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx - 244. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 245. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 246. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 247. http://www.karlrunge.com/x11vnc/faq.html#faq-reflect - 248. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect - 249. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nowireframelocal - 250. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N - 251. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodpms - 252. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer - 253. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 254. http://www.openssl.org/ - 255. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel - 256. http://stunnel.mirt.net/ - 257. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify - 258. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert - 259. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCA - 260. http://www.karlrunge.com/x11vnc/ssl.html - 261. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-https - 262. http://www.karlrunge.com/x11vnc/faq.html#infaq_ss_vncviewer - 263. http://www.karlrunge.com/x11vnc/ssvnc.html - 264. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 265. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_nis - 266. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 267. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost - 268. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel - 269. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 270. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 271. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin - 272. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 273. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 274. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_cmd - 275. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile - 276. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 277. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rotate - 278. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ultrafilexfer - 279. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect_or_exit - 280. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 281. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-v, - 282. http://www.karlrunge.com/x11vnc/prevrels.html - 283. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid - 284. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache - 285. http://www.tightvnc.com/ - 286. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport - 287. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N - 288. http://www.karlrunge.com/x11vnc/x11vnc_opts.html - 289. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd - 290. http://www.karlrunge.com/x11vnc/recurse_x11vnc.jpg - 291. http://www.sun.com/sunray/index.html - 292. http://www.karlrunge.com/x11vnc/sunray.html - 293. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 294. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 295. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 296. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb - 297. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor - 298. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-overlay - 299. http://www.karlrunge.com/x11vnc/faq.html#faq-sound - 300. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 301. mailto:xvml@karlrunge.com - 302. http://www.karlrunge.com/x11vnc/faq.html#faq-thanks + 223. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 224. http://www.karlrunge.com/x11vnc/faq.html#faq-xrandr + 225. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-autoport + 226. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ping + 227. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all + 228. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb + 229. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-viewers + 230. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching + 231. http://www.karlrunge.com/x11vnc/ssvnc.html + 232. http://www.karlrunge.com/x11vnc/ssvnc.html#ycrop + 233. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 234. http://www.ultravnc.com/ + 235. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users + 236. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 237. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 238. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 239. http://www.karlrunge.com/x11vnc/faq.html#faq-avahi + 240. http://www.avahi.org/ + 241. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi + 242. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf + 243. http://www.karlrunge.com/x11vnc/ssvnc.html + 244. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 245. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 246. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 247. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 248. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 249. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 250. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-forcedpms + 251. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clientdpms + 252. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noserverdpms + 253. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-grabalways + 254. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 255. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage + 256. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl + 257. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpsredir + 258. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx + 259. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 260. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 261. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 262. http://www.karlrunge.com/x11vnc/faq.html#faq-reflect + 263. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect + 264. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nowireframelocal + 265. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N + 266. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodpms + 267. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer + 268. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 269. http://www.openssl.org/ + 270. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel + 271. http://stunnel.mirt.net/ + 272. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify + 273. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert + 274. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCA + 275. http://www.karlrunge.com/x11vnc/ssl.html + 276. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-https + 277. http://www.karlrunge.com/x11vnc/faq.html#infaq_ss_vncviewer + 278. http://www.karlrunge.com/x11vnc/ssvnc.html + 279. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 280. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_nis + 281. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 282. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost + 283. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel + 284. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 285. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 286. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + 287. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 288. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 289. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw_cmd + 290. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile + 291. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 292. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rotate + 293. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ultrafilexfer + 294. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect_or_exit + 295. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 296. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-v, + 297. http://www.karlrunge.com/x11vnc/prevrels.html + 298. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid + 299. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache + 300. http://www.tightvnc.com/ + 301. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport + 302. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N + 303. http://www.karlrunge.com/x11vnc/x11vnc_opts.html + 304. http://www.karlrunge.com/x11vnc/faq.html#faq-passwd + 305. http://www.karlrunge.com/x11vnc/recurse_x11vnc.jpg + 306. http://www.sun.com/sunray/index.html + 307. http://www.karlrunge.com/x11vnc/sunray.html + 308. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 309. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 310. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 311. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 312. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor + 313. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-overlay + 314. http://www.karlrunge.com/x11vnc/faq.html#faq-sound + 315. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 316. mailto:xvml@karlrunge.com + 317. http://www.karlrunge.com/x11vnc/faq.html#faq-thanks ======================================================================= http://www.karlrunge.com/x11vnc/faq.html: @@ -2096,150 +2153,153 @@ http://www.karlrunge.com/x11vnc/faq.html: [68]Q-66: Can reverse connections be made to go through a Web or SOCKS proxy or SSH? - [69]Q-67: Can I use x11vnc as a replacement for Xvnc? (i.e. not for a + [69]Q-67: Can x11vnc provide a multi-user desktop web login service as + an Apache CGI or PHP script? + + [70]Q-68: Can I use x11vnc as a replacement for Xvnc? (i.e. not for a real display, but for a virtual one I keep around.) - [70]Q-68: How can I use x11vnc on "headless" machines? Why might I + [71]Q-69: How can I use x11vnc on "headless" machines? Why might I want to? [Resource Usage and Performance] - [71]Q-69: I have lots of memory, but why does x11vnc fail with + [72]Q-70: I have lots of memory, but why does x11vnc fail with shmget: No space left on device or Minor opcode of failed request: 1 (X_ShmAttach)? - [72]Q-70: How can I make x11vnc use less system resources? + [73]Q-71: How can I make x11vnc use less system resources? - [73]Q-71: How can I make x11vnc use MORE system resources? + [74]Q-72: How can I make x11vnc use MORE system resources? - [74]Q-72: I use x11vnc over a slow link with high latency (e.g. dialup + [75]Q-73: I use x11vnc over a slow link with high latency (e.g. dialup modem or broadband), is there anything I can do to speed things up? - [75]Q-73: Does x11vnc support the X DAMAGE Xserver extension to find + [76]Q-74: Does x11vnc support the X DAMAGE Xserver extension to find modified regions of the screen quickly and efficiently? - [76]Q-74: My OpenGL application shows no screen updates unless I + [77]Q-75: My OpenGL application shows no screen updates unless I supply the -noxdamage option to x11vnc. - [77]Q-75: When I drag windows around with the mouse or scroll up and + [78]Q-76: When I drag windows around with the mouse or scroll up and down things really bog down (unless I do the drag in a single, quick motion.) Is there anything to do to improve things? - [78]Q-76: Why not do something like wireframe animations to avoid the + [79]Q-77: Why not do something like wireframe animations to avoid the windows "lurching" when being moved or resized? - [79]Q-77: Can x11vnc try to apply heuristics to detect when a window + [80]Q-78: Can x11vnc try to apply heuristics to detect when a window is scrolling its contents and use the CopyRect encoding for a speedup? - [80]Q-78: Can x11vnc do client-side caching of pixel data? I.e. so + [81]Q-79: Can x11vnc do client-side caching of pixel data? I.e. so when that pixel data is needed again it does not have to be retransmitted over the network. - [81]Q-79: Does x11vnc support TurboVNC? + [82]Q-80: Does x11vnc support TurboVNC? [Mouse Cursor Shapes] - [82]Q-80: Why isn't the mouse cursor shape (the little icon shape + [83]Q-81: Why isn't the mouse cursor shape (the little icon shape where the mouse pointer is) correct as I move from window to window? - [83]Q-81: When using XFIXES cursorshape mode, some of the cursors look + [84]Q-82: When using XFIXES cursorshape mode, some of the cursors look really bad with extra black borders around the cursor and other cruft. How can I improve their appearance? - [84]Q-82: In XFIXES mode, are there any hacks to handle cursor + [85]Q-83: In XFIXES mode, are there any hacks to handle cursor transparency ("alpha channel") exactly? [Mouse Pointer] - [85]Q-83: Why does the mouse arrow just stay in one corner in my + [86]Q-84: Why does the mouse arrow just stay in one corner in my vncviewer, whereas my cursor (that does move) is just a dot? - [86]Q-84: Can I take advantage of the TightVNC extension to the VNC + [87]Q-85: Can I take advantage of the TightVNC extension to the VNC protocol where Cursor Positions Updates are sent back to all connected clients (i.e. passive viewers can see the mouse cursor being moved around by another viewer)? - [87]Q-85: Is it possible to swap the mouse buttons (e.g. left-handed + [88]Q-86: Is it possible to swap the mouse buttons (e.g. left-handed operation), or arbitrarily remap them? How about mapping button clicks to keystrokes, e.g. to partially emulate Mouse wheel scrolling? [Keyboard Issues] - [88]Q-86: How can I get my AltGr and Shift modifiers to work between + [89]Q-87: How can I get my AltGr and Shift modifiers to work between keyboards for different languages? - [89]Q-87: When I try to type a "<" (i.e. less than) instead I get ">" + [90]Q-88: When I try to type a "<" (i.e. less than) instead I get ">" (i.e. greater than)! Strangely, typing ">" works OK!! - [90]Q-88: Extra Character Inserted, E.g.: When I try to type a "<" + [91]Q-89: Extra Character Inserted, E.g.: When I try to type a "<" (i.e. less than) instead I get "<," (i.e. an extra comma.) - [91]Q-89: I'm using an "international" keyboard (e.g. German "de", or + [92]Q-90: I'm using an "international" keyboard (e.g. German "de", or Danish "dk") and the -modtweak mode works well if the VNC viewer is run on a Unix/Linux machine with a similar keyboard. But if I run the VNC viewer on Unix/Linux with a different keyboard (e.g. "us") or Windows with any keyboard, I can't type some keys like: "@", "$", "<", ">", etc. How can I fix this? - [92]Q-90: When typing I sometimes get double, triple, or more of my + [93]Q-91: When typing I sometimes get double, triple, or more of my keystrokes repeated. I'm sure I only typed them once, what can I do? - [93]Q-91: The x11vnc -norepeat mode is in effect, but I still get + [94]Q-92: The x11vnc -norepeat mode is in effect, but I still get repeated keystrokes!! - [94]Q-92: After using x11vnc for a while, I find that I cannot type + [95]Q-93: After using x11vnc for a while, I find that I cannot type some (or any) characters or my mouse clicks and drags no longer have any effect, or they lead to strange effects. What happened? - [95]Q-93: The machine where I run x11vnc has an AltGr key, but the + [96]Q-94: The machine where I run x11vnc has an AltGr key, but the local machine where I run the VNC viewer does not. Is there a way I can map a local unused key to send an AltGr? How about a Compose key as well? - [96]Q-94: I have a Sun machine I run x11vnc on. Its Sun keyboard has + [97]Q-95: I have a Sun machine I run x11vnc on. Its Sun keyboard has just one Alt key labelled "Alt" and two Meta keys labelled with little diamonds. The machine where I run the VNC viewer only has Alt keys. How can I send a Meta keypress? (e.g. emacs needs this) - [97]Q-95: Running x11vnc on HP-UX I cannot type "#" I just get a "3" + [98]Q-96: Running x11vnc on HP-UX I cannot type "#" I just get a "3" instead. - [98]Q-96: Can I map a keystroke to a mouse button click on the remote + [99]Q-97: Can I map a keystroke to a mouse button click on the remote machine? - [99]Q-97: How can I get Caps_Lock to work between my VNC viewer and + [100]Q-98: How can I get Caps_Lock to work between my VNC viewer and x11vnc? [Screen Related Issues and Features] - [100]Q-98: The remote display is larger (in number of pixels) than the + [101]Q-99: The remote display is larger (in number of pixels) than the local display I am running the vncviewer on. I don't like the vncviewer scrollbars, what I can do? - [101]Q-99: Does x11vnc support server-side framebuffer scaling? (E.g. + [102]Q-100: Does x11vnc support server-side framebuffer scaling? (E.g. to make the desktop smaller.) - [102]Q-100: Does x11vnc work with Xinerama? (i.e. multiple monitors + [103]Q-101: Does x11vnc work with Xinerama? (i.e. multiple monitors joined together to form one big, single screen.) - [103]Q-101: Can I use x11vnc on a multi-headed display that is not + [104]Q-102: Can I use x11vnc on a multi-headed display that is not Xinerama (i.e. separate screens :0.0, :0.1, ... for each monitor)? - [104]Q-102: Can x11vnc show only a portion of the display? (E.g. for a + [105]Q-103: Can x11vnc show only a portion of the display? (E.g. for a special purpose application or a very large screen.) - [105]Q-103: Does x11vnc support the XRANDR (X Resize, Rotate and + [106]Q-104: Does x11vnc support the XRANDR (X Resize, Rotate and Reflection) extension? Whenever I rotate or resize the screen x11vnc just seems to crash. - [106]Q-104: Independent of any XRANDR, can I have x11vnc rotate and/or + [107]Q-105: Independent of any XRANDR, can I have x11vnc rotate and/or reflect the screen that the VNC viewers see? (e.g. for a handheld whose screen is rotated 90 degrees.) - [107]Q-105: Why is the view in my VNC viewer completely black? Or why + [108]Q-106: Why is the view in my VNC viewer completely black? Or why is everything flashing around randomly? - [108]Q-106: I use Linux Virtual Terminals (VT's) to implement 'Fast + [109]Q-107: I use Linux Virtual Terminals (VT's) to implement 'Fast User Switching' between users' sessions (e.g. Betty is on Ctrl-Alt-F7, Bobby is on Ctrl-Alt-F8, and Sid is on Ctrl-Alt-F1: they use those keystrokes to switch between their sessions.) How come the view in a @@ -2247,83 +2307,83 @@ http://www.karlrunge.com/x11vnc/faq.html: otherwise all messed up unless the X session x11vnc is attached to is in the active VT? - [109]Q-107: I am using x11vnc where my local machine has "popup/hidden + [110]Q-108: I am using x11vnc where my local machine has "popup/hidden taskbars" and the remote display where x11vnc runs also has "popup/hidden taskbars" and they interfere and fight with each other. What can I do? - [110]Q-108: Help! x11vnc and my KDE screensaver keep switching each + [111]Q-109: Help! x11vnc and my KDE screensaver keep switching each other on and off every few seconds. - [111]Q-109: I am running the beryl 3D window manager (or compiz, + [112]Q-110: I am running the beryl 3D window manager (or compiz, MythTv, Google Earth, or some other OpenGL app) and I do not get screen updates in x11vnc. - [112]Q-110: Can I use x11vnc to view my VMWare session remotely? + [113]Q-111: Can I use x11vnc to view my VMWare session remotely? [Exporting non-X11 devices via VNC] - [113]Q-111: Can non-X devices (e.g. a raw framebuffer) be viewed (and + [114]Q-112: Can non-X devices (e.g. a raw framebuffer) be viewed (and even controlled) via VNC with x11vnc? - [114]Q-112: Can I export the Linux Console (Virtual Terminals) via VNC + [115]Q-113: Can I export the Linux Console (Virtual Terminals) via VNC using x11vnc? - [115]Q-113: Can I export via VNC a Webcam or TV tuner framebuffer + [116]Q-114: Can I export via VNC a Webcam or TV tuner framebuffer using x11vnc? - [116]Q-114: Can I connect via VNC to a Qt-embedded/Qtopia application + [117]Q-115: Can I connect via VNC to a Qt-embedded/Qtopia application running on my handheld or PC using the Linux console framebuffer (i.e. not X11)? - [117]Q-115: Now that non-X11 devices can be exported via VNC using + [118]Q-116: Now that non-X11 devices can be exported via VNC using x11vnc, can I build it with no dependencies on X11 header files and libraries? - [118]Q-116: Does x11vnc support Mac OS X Aqua/Quartz displays natively + [119]Q-117: Does x11vnc support Mac OS X Aqua/Quartz displays natively (i.e. no X11 involved)? - [119]Q-117: Can x11vnc be used as a VNC reflector/repeater to improve + [120]Q-118: Can x11vnc be used as a VNC reflector/repeater to improve performance for the case of a large number of simultaneous VNC viewers (e.g. classroom broadcasting or a large demo)? - [120]Q-118: Can x11vnc be used during a Linux, Solaris, etc. system + [121]Q-119: Can x11vnc be used during a Linux, Solaris, etc. system Installation so the Installation can be done remotely? [Misc: Clipboard, File Transfer/Sharing, Printing, Sound, Beeps, Thanks, etc.] - [121]Q-119: Does the Clipboard/Selection get transferred between the + [122]Q-120: Does the Clipboard/Selection get transferred between the vncviewer and the X display? - [122]Q-120: Can I use x11vnc to record a Shock Wave Flash (or other + [123]Q-121: Can I use x11vnc to record a Shock Wave Flash (or other format) video of my desktop, e.g. to record a tutorial or demo? - [123]Q-121: Can I transfer files back and forth with x11vnc? + [124]Q-122: Can I transfer files back and forth with x11vnc? - [124]Q-122: Which UltraVNC extensions are supported? + [125]Q-123: Which UltraVNC extensions are supported? - [125]Q-123: Can x11vnc emulate UltraVNC's Single Click helpdesk mode + [126]Q-124: Can x11vnc emulate UltraVNC's Single Click helpdesk mode for Unix? I.e. something very simple for a naive user to initiate a reverse vnc connection from their Unix desktop to a helpdesk operator's VNC Viewer. - [126]Q-124: Can I (temporarily) mount my local (viewer-side) + [127]Q-125: Can I (temporarily) mount my local (viewer-side) Windows/Samba File share on the machine where x11vnc is running? - [127]Q-125: Can I redirect CUPS print jobs from the remote desktop + [128]Q-126: Can I redirect CUPS print jobs from the remote desktop where x11vnc is running to a printer on my local (viewer-side) machine? - [128]Q-126: How can I hear the sound (audio) from the remote + [129]Q-127: How can I hear the sound (audio) from the remote applications on the desktop I am viewing via x11vnc? - [129]Q-127: Why don't I hear the "Beeps" in my X session (e.g. when + [130]Q-128: Why don't I hear the "Beeps" in my X session (e.g. when typing tput bel in an xterm)? - [130]Q-128: Does x11vnc work with IPv6? + [131]Q-129: Does x11vnc work with IPv6? - [131]Q-129: Thanks for your program or for your help! Can I make a + [132]Q-130: Thanks for your program or for your help! Can I make a donation? _________________________________________________________________ @@ -2336,7 +2396,7 @@ http://www.karlrunge.com/x11vnc/faq.html: For the former error, you need to specify the X display to connect to (it also needs to be on the same machine the x11vnc process is to run - on.) Set your DISPLAY environment variable (or use the [132]-display + on.) Set your DISPLAY environment variable (or use the [133]-display option) to specify it. Nearly always the correct value will be ":0" (in fact, x11vnc will now assume :0 if given no other information.) @@ -2353,9 +2413,9 @@ http://www.karlrunge.com/x11vnc/faq.html: working when you try to start x11vnc via, say, a remote shell. How to Solve: See the xauth(1), Xsecurity(7), and xhost(1) man pages - or [133]this Howto for much info on X11 permissions. For example, you + or [134]this Howto for much info on X11 permissions. For example, you may need to set your XAUTHORITY environment variable (or use the - [134]-auth option) to point to the correct MIT-MAGIC-COOKIE file (e.g. + [135]-auth option) to point to the correct MIT-MAGIC-COOKIE file (e.g. /home/joe/.Xauthority or /var/gdm/:0.Xauth or /var/lib/kdm/A:0-crWk72K or /tmp/.gdmzndVlR, etc, etc.), or simply be sure you run x11vnc as the correct user (i.e. the user who is logged into the X session you @@ -2377,10 +2437,10 @@ http://www.karlrunge.com/x11vnc/faq.html: x11vnc -display :0 -auth /var/gdm/:0.Xauth (this is for the display manager gdm and requires root permission to - read the gdm cookie file, see [135]this faq for other display manager + read the gdm cookie file, see [136]this faq for other display manager cookie file names.) - Note as of Feb/2007 you can also try the [136]-find option instead of + Note as of Feb/2007 you can also try the [137]-find option instead of "-display ..." and see if that finds your display and Xauthority. Less safe, but to avoid figuring out where the correct XAUTHORITY file @@ -2389,7 +2449,7 @@ http://www.karlrunge.com/x11vnc/faq.html: (from the same machine.) The person could then type "xhost -localhost" after x11vnc has connected to go back to the default permissions. Also, for some situations the "-users lurk=" option may soon be of use - (please read the documentation on the [137]-users option.) + (please read the documentation on the [138]-users option.) To test out your X11 permissions from a remote shell, set DISPLAY and possibly XAUTHORITY (see your shell's man page, bash(1), tcsh(1), on @@ -2408,7 +2468,7 @@ http://www.karlrunge.com/x11vnc/faq.html: properly.) Firewalls: Speaking of permissions, it should go without saying that - the host-level [138]firewall will need to be configured to allow + the host-level [139]firewall will need to be configured to allow connections in on a port. E.g. 5900 (default VNC port) or 22 (default SSH port for tunnelling VNC.) Most systems these days have firewalls turned on by default, so you will actively have to do something to @@ -2457,63 +2517,56 @@ libssl.so libcrypto.so libcrypt.so See `config.log' for more details. there is quite a bit wrong with the build environment. Hopefully - simply adding -dev packages and/or gcc will fix it. + simply adding -dev packages and/or gcc or make will fix it. For Debian the list seems to be: gcc make libc6-dev - libjpeg62-dev + libjpeg8-dev (formerly libjpeg62-dev) libx11-dev + x11proto-core-dev (formerly x-dev) libxext-dev + libxtst-dev + libxdamage-dev + libxfixes-dev libxrandr-dev libxinerama-dev - libxtst-dev - x-dev - xlibs-static-dev + libxss-dev (formerly xlibs-static-dev) zlib1g-dev libssl-dev + libavahi-client-dev + linux-libc-dev (only needed for linux console rawfb support) - (note that depending on your OS version the above names may have been - changed and/or additional packages may be needed.) + Note that depending on your OS version the above names may have been + changed and/or additional packages may be needed. For Redhat the list seems to be: gcc make glibc-devel libjpeg-devel - xorg-x11-devel or XFree86-devel + libX11-devel + xorg-x11-proto-devel + libXdamage-devel + libXfixes-devel + libXrandr-devel zlib-devel - openssl097a - - (there are probably some more now; send us a list for recent Redhat if - you have it building and see the need to add more -devel packages.) + openssl-devel + avahi-devel + kernel-headers (only needed for linux console rawfb support) For other distros or OS's the package names may not be the same but will look similar. Also, distros tend to rename packages as well so the above list may be out of date. So only use the above lists as hints for the package names that are needed. - Have a look at [139]Misc. Build Problems for additional fixes. + Have a look at [140]Misc. Build Problems for additional fixes. Note: there is growing trend in Linux and other distros to slice up core X11 software into more and smaller packages. So be prepared for more headaches compiling software... - libssl: One user pointed out that if you use a precompiled binary - (either one you downloaded or built on another machine) there is a - chance it won't work because that x11vnc binary requires libssl0.9.7 - but the system only has libssl0.9.8 (which evidently is incompatible - with 0.9.7 and has a different SONAME.) Your distro should allow you - do have both runtimes installed on your system: - % dpkg -l libssl0.9.7 libssl0.9.8 - ... - ii libssl0.9.7 0.9.7g-5ubuntu SSL shared libraries - ii libssl0.9.8 0.9.8a-7ubuntu SSL shared libraries - - (in fact it should have installed both by default if it knew what it - was doing.) See [140]here too. - Q-3: I just built x11vnc successfully, but when I use it my keystrokes and mouse button clicks are ignored (I am able to move the mouse @@ -4152,7 +4205,7 @@ exec @ARGV; channel using an external tool like stunnel? It is possible to use a "lighter weight" encryption setup than SSH or - IPSEC. SSL tunnels such as [318]stunnel (also [319]stunnel.mirt.net) + IPSEC. SSL tunnels such as [318]stunnel (also [319]stunnel.org) provide an encrypted channel without the need for Unix users, passwords, and key passphrases required for ssh (and at the other extreme SSL can also provide a complete signed certificate chain of @@ -4438,7 +4491,7 @@ connect = 5900 tunnel for you using stunnel. The -ssl method is the preferred way, but for historical reference we keep the -stunnel info here. - The [358]-stunnel mode requires the [359]www.stunnel.org command + The [358]-stunnel mode requires the [359]stunnel.mirt.net command stunnel(8) to be installed on the system. Some -stunnel examples: @@ -4834,15 +4887,19 @@ connect = 5900 SSL from the Internet with a Web browser to x11vnc running on their workstations behind a firewall? Yes. You will need to configure apache to forward these connections. - It is discussed [390]here. This provides a clean alternative to the - traditional method where the user uses SSH to log in through the - gateway to create the encrypted port redirection to x11vnc running on - her desktop. + It is discussed [390]here. This SSL VNC portal provides a clean + alternative to the traditional method where the user uses SSH to log + in through the gateway to create the encrypted port redirection to + x11vnc running on her desktop. + + Also see the [391]desktop.cgi CGI script method that achieves much of + what this Apache VNC SSL portal method does (as long as desktop.cgi's + 'port redirection' mode is enabled.) Q-57: Can I create and use my own SSL Certificate Authority (CA) with x11vnc? - Yes, see [391]this page for how to do this and the utility commands + Yes, see [392]this page for how to do this and the utility commands x11vnc provides to create and manage many types of certificates and private keys. @@ -4861,14 +4918,14 @@ connect = 5900 need to have sufficient permissions to connect to the X display. Here are some ideas: - * Use the description under "Continuously" in the [392]FAQ on x11vnc + * Use the description under "Continuously" in the [393]FAQ on x11vnc and Display Managers - * Use the description in the [393]FAQ on x11vnc and inetd(8) - * Use the description in the [394]FAQ on Unix user logins and + * Use the description in the [394]FAQ on x11vnc and inetd(8) + * Use the description in the [395]FAQ on Unix user logins and inetd(8) * Start x11vnc from your $HOME/.xsession (or $HOME/.xinitrc or autostart script or ...) - * Although less reliable, see the [395]x11vnc_loop rc.local hack + * Although less reliable, see the [396]x11vnc_loop rc.local hack below. The display manager scheme will not be specific to which user has the @@ -4890,9 +4947,9 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg X startup scripts (traditionally .xsession/.xinitrc) may have to be in a different directory or have a different basename. One user recommends the description under 'Running Scripts Automatically' at - [396]this link. + [397]this link. - Firewalls: note all methods will require the host-level [397]firewall + Firewalls: note all methods will require the host-level [398]firewall to be configured to allow connections in on a port. E.g. 5900 (default VNC port) or 22 (default SSH port for tunnelling VNC.) Most systems these days have firewalls turned on by default, so you will actively @@ -4916,23 +4973,30 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg It is usually possible to do this by just adjusting the XAUTHORITY environment variable to point to the correct MIT-COOKIE auth file - while running x11vnc as root, e.g. for the gnome display manager, gdm: + while running x11vnc as root, e.g. for the gnome display manager, GDM: x11vnc -auth /var/gdm/:0.Xauth -display :0 - (the [398]-auth option sets the XAUTHORITY variable for you.) + (the [399]-auth option sets the XAUTHORITY variable for you.) - There will be a similar thing for xdm using however a different auth - directory path (perhaps something like - /var/lib/xdm/authdir/authfiles/A:0-XQvaJk for xdm or + There will be a similar thing to do for xdm using however a different + auth directory path (perhaps something like + /var/lib/xdm/authdir/authfiles/A:0-XQvaJk) for the xdm greeter or /var/lib/kdm/A:0-crWk72 (or /var/run/xauth/A:0-qQPftr, etc. etc) for - kdm, where the random characters in the basename will vary.) Read your - system docs to find out where the display manager cookie files are - kept. + the kdm greeter. Of course, the random characters in the file basename + will vary and you will need to use the actual filename on your system. + Read your system docs to find out where the display manager cookie + files are kept. Trick: sometimes ps(1) can reveal the X server process -auth argument - (e.g. "ps wwwaux | grep auth") and hence the path to the auth file. + (e.g. "ps wwaux | grep auth") and hence the path to the auth file. + + x11vnc must be run as root for this because the /var/gdm/:0.Xauth, + /var/lib/kdm/A:0-crWk72, etc. auth files are only readable by root. If + you do not want to run x11vnc as root, you can copy (as root or sudo) + the auth file to some location and make it readable by your userid. + Then run x11vnc as your userid with -auth pointed to the copied file. - Update Dec/2009: use "[399]-auth guess" to have x11vnc try to guess + Update Dec/2009: use "[400]-auth guess" to have x11vnc try to guess the location of the auth file for you. You next connect to x11vnc with a VNC viewer, give your username and @@ -4950,10 +5014,10 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg (BTW, the auth file should be in /var/dt), you'll also need to add something like Dtlogin*grabServer:False to the Xconfig file (/etc/dt/config/Xconfig or /usr/dt/config/Xconfig on Solaris, see - [400]the example at the end of this FAQ.) Then restart dtlogin, e.g.: + [401]the example at the end of this FAQ.) Then restart dtlogin, e.g.: /etc/init.d/dtlogin stop; /etc/init.d/dtlogin start or reboot. - Update Nov/2008: Regarding GDM KillInitClients: see the [401]-reopen + Update Nov/2008: Regarding GDM KillInitClients: see the [402]-reopen option for another possible workaround. Update Oct/2009: Regarding GDM KillInitClients: starting with x11vnc @@ -4980,7 +5044,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg Please consider the security implications of this! The VNC display for the X session always accessible (but hopefully password protected.) - Add [402]-localhost if you only plan to access via a [403]SSH tunnel. + Add [403]-localhost if you only plan to access via a [404]SSH tunnel. The name of the display manager startup script file depends on desktop used and seem to be: @@ -5018,7 +5082,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg -forever -bg where you should customize the exact command to your needs (e.g. - [404]-localhost for SSH tunnel-only access; [405]-ssl SAVE for SSL + [405]-localhost for SSH tunnel-only access; [406]-ssl SAVE for SSL access; etc.) Happy, happy, joy, joy: Note that we do not need to specify -display @@ -5026,7 +5090,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg and XAUTHORITY environment variables for the Xsetup script!!! You may also want to force the VNC port with something like "-rfbport - 5900" (or [406]-N) to avoid autoselecting one if 5900 is already + 5900" (or [407]-N) to avoid autoselecting one if 5900 is already taken. _________________________________________________________________ @@ -5042,7 +5106,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg Then restart: /usr/sbin/gdm-restart (or reboot.) The KillInitClients=false setting is important: without it x11vnc will be - killed immediately after the user logs in. Here are [407]full details + killed immediately after the user logs in. Here are [408]full details on how to configure gdm _________________________________________________________________ @@ -5084,16 +5148,16 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg If you do not want to deal with any display manager startup scripts, here is a kludgey script that can be run manually or out of a boot - file like rc.local: [408]x11vnc_loop It will need some local + file like rc.local: [409]x11vnc_loop It will need some local customization before running. Because the XAUTHORITY auth file must be guessed by this script, use of the display manager script method - described above is greatly preferred. There is also the [409]-loop + described above is greatly preferred. There is also the [410]-loop option that does something similar. If the machine is a traditional Xterminal you may want to read - [410]this FAQ. + [411]this FAQ. - Firewalls: note all methods will require the host-level [411]firewall + Firewalls: note all methods will require the host-level [412]firewall to be configured to allow connections in on a port. E.g. 5900 (default VNC port) or 22 (default SSH port for tunnelling VNC.) Most systems these days have firewalls turned on by default, so you will actively @@ -5109,7 +5173,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg 5900 stream tcp nowait root /usr/sbin/tcpd /usr/local/bin/x11vnc_sh - where the shell script /usr/local/bin/x11vnc_sh uses the [412]-inetd + where the shell script /usr/local/bin/x11vnc_sh uses the [413]-inetd option and looks something like (you'll need to customize to your settings.) #!/bin/sh @@ -5122,7 +5186,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg and that confuses it greatly, causing it to abort.) If you do not use a wrapper script as above but rather call x11vnc directly in /etc/inetd.conf and do not redirect stderr to a file, then you must - specify the -q (aka [413]-quiet) option: "/usr/local/bin/x11vnc -q + specify the -q (aka [414]-quiet) option: "/usr/local/bin/x11vnc -q -inetd ...". When you supply both -q and -inet and no "-o logfile" then stderr will automatically be closed (to prevent, e.g. library stderr messages leaking out to the viewer.) The recommended practice @@ -5130,12 +5194,12 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg script with "2>logfile" redirection because the errors and warnings printed out are very useful in troubleshooting problems. - Note also the need to set XAUTHORITY via [414]-auth to point to the + Note also the need to set XAUTHORITY via [415]-auth to point to the MIT-COOKIE auth file to get permission to connect to the X display (setting and exporting the XAUTHORITY variable accomplishes the same thing.) See the x11vnc_loop file in the previous question for more ideas on what that auth file may be, etc. The scheme described in the - [415]FAQ on Unix user logins and inetd(8) works around the XAUTHORITY + [416]FAQ on Unix user logins and inetd(8) works around the XAUTHORITY issue nicely. Note: On Solaris you cannot have the bare number 5900 in @@ -5201,8 +5265,8 @@ service x11vncservice #!/bin/sh COLUMNS=256 export COLUMNS -authfile=`ps wwwaux | grep '/X.*-auth' | grep -v grep | sed -e 's/^.*-auth *//' - -e 's/ .*$//' | head -n 1` +authfile=`ps wwaux | grep '/X.*-auth' | grep -v grep | sed -e 's/^.*-auth *//' +-e 's/ .*$//' | head -n 1` if [ -r "$authfile" ]; then exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -display :0 -a @@ -5220,9 +5284,9 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 it automatically? Yes, as of Feb/2007 x11vnc supports mDNS / Zeroconf advertising of its - service via the Avahi client library. Use the option [416]-avahi (same - as [417]-mdns or [418]-zeroconf) to enable it. Depending on your setup - you may need to install [419]Avahi (including the development/build + service via the Avahi client library. Use the option [417]-avahi (same + as [418]-mdns or [419]-zeroconf) to enable it. Depending on your setup + you may need to install [420]Avahi (including the development/build packages), enable the server: avahi-daemon and avahi-dnsconfd, and possibly open up UDP port 5353 on your firewall. @@ -5251,11 +5315,11 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 machine and then attach to it? How about starting an X session if one cannot be found? - The easiest way to do this is via [420]inetd(8) using the [421]-unixpw - and [422]-display WAIT options. The reason inetd(8) makes this easier + The easiest way to do this is via [421]inetd(8) using the [422]-unixpw + and [423]-display WAIT options. The reason inetd(8) makes this easier is that it starts a new x11vnc process for each new user connection. Otherwise a wrapper would have to listen for connections and spawn new - x11vnc's (see [423]this example and also the [424]-loopbg option.) + x11vnc's (see [424]this example and also the [425]-loopbg option.) inetd(8) is not required for this, but it makes some aspects more general. @@ -5263,23 +5327,23 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 hostname:0, and do not need to memorize a special VNC display number just for their personal use, etc. - Update: Use the [425]-find, [426]-create, [427]-svc, and [428]-xdmsvc + Update: Use the [426]-find, [427]-create, [428]-svc, and [429]-xdmsvc options that are shorthand for common FINDCREATEDISPLAY usage modes (e.g. terminal services) described below. (i.e. simply use "-svc" instead of the cumbersome "-display WAIT:cmd=FINDCREATEDISPLAY-Xvfb -unixpw -users unixpw= -ssl SAVE") - The [429]-display WAIT option makes x11vnc wait until a VNC viewer is + The [430]-display WAIT option makes x11vnc wait until a VNC viewer is connected before attaching to the X display. Additionally it can be used to run an external command that returns the DISPLAY and XAUTHORITY data. We provide some useful builtin ones (FINDDISPLAY and FINDCREATEDISPLAY below), but in principle one could supply his own script: "-display WAIT:cmd=/path/to/find_display" where - the script find_display might look something like [430]this. + the script find_display might look something like [431]this. A default script somewhat like the above is used under "-display - WAIT:cmd=FINDDISPLAY" (same as [431]-find) The format for any such + WAIT:cmd=FINDDISPLAY" (same as [432]-find) The format for any such command is that it returns DISPLAY=:disp as the first line and any remaining lines are either XAUTHORITY=file or raw xauth data (the above example does the latter.) If applicable (-unixpw mode), the @@ -5290,10 +5354,10 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 only the X server process ID is known it appends ",XPID=n" (a chvt will be attempted by x11vnc.) - Tip: Note that the [432]-find option is an alias for "-display + Tip: Note that the [433]-find option is an alias for "-display WAIT:cmd=FINDDISPLAY". Use it! - The [433]-unixpw option allows [434]UNIX password logins. It + The [434]-unixpw option allows [435]UNIX password logins. It conveniently knows the Unix username whose X display should be found. Here are a couple /etc/inetd.conf examples of this usage: 5900 stream tcp nowait nobody /usr/sbin/tcpd /usr/local/bin/x11vnc -inetd @@ -5303,19 +5367,19 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 -unixpw \ -find -o /var/log/x11vnc.log -ssl SAVE -users unixpw= - Note we have used the [435]-find alias and the very long lines have + Note we have used the [436]-find alias and the very long lines have been split. An alternative is to use a wrapper script, e.g. /usr/local/bin/x11vnc.sh that has all of the options. (see also the - [436]-svc alias.) + [437]-svc alias.) In the first inetd line x11vnc is run as user "nobody" and stays user nobody during the whole session. The permissions of the log files and certs directory will need to be set up to allow "nobody" to use them. In the second one x11vnc is run as root and switches to the user that - logs in due to the "[437]-users unixpw=" option. + logs in due to the "[438]-users unixpw=" option. - Note that [438]SSL is required for this mode because otherwise the + Note that [439]SSL is required for this mode because otherwise the Unix password would be passed in clear text over the network. In general -unixpw is not required for this sort of scheme, but it is convenient because it determines exactly who the Unix user is whose @@ -5323,17 +5387,17 @@ exec /usr/local/bin/x11vnc -inetd -o /var/log/x11vnc.log -find -env FD_XDM=1 to use some method to work out DISPLAY, XAUTHORITY, etc (perhaps you use multiple inetd ports and hardwire usernames for different ports.) - If you really want to disable the SSL or SSH [439]-localhost + If you really want to disable the SSL or SSH [440]-localhost constraints (this is not recommended unless you really know what you are doing: Unix passwords sent in clear text is a very bad idea...) - read the [440]-unixpw documentation. + read the [441]-unixpw documentation. A inetd(8) scheme for a fixed user that doesn't use SSL or unix passwds could be: /usr/local/bin/x11vnc -inetd -users =fred -find -rfbauth /home/fred/.vnc/pass wd -o /var/log/x11vnc.log - The "[441]-users =fred" option will cause x11vnc to switch to user + The "[442]-users =fred" option will cause x11vnc to switch to user fred and then find his X display. The VNC password (-rfbauth) as opposed to Unix password (-unixpw) is used to authenticate the VNC client. @@ -5350,8 +5414,11 @@ wd -o /var/log/x11vnc.log tries to start up an X server (normally it just attaches to an existing one.) + For virtual sessions you will need to install the Xvfb program (e.g. + apt-get install xvfb) or our Xdummy program (see below.) + By default it will only try to start up virtual (non-hardware) X - servers: first [442]Xvfb and if that is not available then Xdummy + servers: first [443]Xvfb and if that is not available then Xdummy (included in the x11vnc source code.) Note that Xdummy only works on Linux whereas Xvfb works just about everywhere (and in some situations Xdummy must be run as root.) An advantage of Xdummy over Xvfb is that @@ -5365,16 +5432,16 @@ wd -o /var/log/x11vnc.log -ssl SAVE -unixpw -users unixpw= -display WAIT:cmd=FINDCREATEDISPLAY Where the very long lines have been split. See below where that long - and cumbersome last line is replaced by the [443]-svc alias. + and cumbersome last line is replaced by the [444]-svc alias. - The above mode will allow direct SSL (e.g. [444]ss_vncviewer or - [445]SSVNC) access and also Java Web browers access via: + The above mode will allow direct SSL (e.g. [445]ss_vncviewer or + [446]SSVNC) access and also Java Web browers access via: https://hostname:5900/. - Tip: Note that the [446]-create option is an alias for "-display + Tip: Note that the [447]-create option is an alias for "-display WAIT:cmd=FINDCREATEDISPLAY-Xvfb". - Tip: Note that [447]-svc is a short hand for the long "-ssl SAVE + Tip: Note that [448]-svc is a short hand for the long "-ssl SAVE -unixpw -users unixpw= -display WAIT:cmd=FINDCREATEDISPLAY" part. Unlike -create, this alias also sets up SSL encryption and Unix password login. @@ -5386,7 +5453,7 @@ wd -o /var/log/x11vnc.log Tip: In addition to the usual unixpw parameters, inside the VNC viewer the user can specify after his username (following a ":" see - [448]-display WAIT for details) for FINDCREATEDISPLAY they can add + [449]-display WAIT for details) for FINDCREATEDISPLAY they can add "geom=WxH" or "geom=WxHxD" to specify the width, height, and optionally the color depth. E.g. "fred:geom=800x600" at the login: prompt. Also if the env. var X11VNC_CREATE_GEOM is set to the desired @@ -5420,10 +5487,10 @@ bin/x11vnc -svc To print out the script in this case use "-display WAIT:cmd=FINDCREATEDISPLAY-print". To change the preference of Xservers and which to try list them, e.g.: "-display - WAIT:cmd=FINDCREATEDISPLAY-X,Xvfb,Xdummy" or use "[449]-create_xsrv + WAIT:cmd=FINDCREATEDISPLAY-X,Xvfb,Xdummy" or use "[450]-create_xsrv X,Xvfb,Xdummy". The "X" one means to try to start up a real, hardware X server, e.g. startx(1) (if there is already a real X server running - this may only work on Linux and the chvt program may [450]need to be + this may only work on Linux and the chvt program may [451]need to be run to switch to the correct Linux virtual terminal.) x11vnc will try to run chvt automatically if it can determine which VT should be switched to. @@ -5452,7 +5519,7 @@ bin/x11vnc -svc will also typically block UDP (port 177 for XDMCP) by default effectively limiting the UDP connections to localhost. - Tip: Note that [451]-xdmsvc is a short hand alias for the long "-ssl + Tip: Note that [452]-xdmsvc is a short hand alias for the long "-ssl SAVE -unixpw -users unixpw= -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb.xdmcp". So we simply use: service x11vnc @@ -5521,15 +5588,15 @@ t:5 Q-63: Can I have x11vnc restart itself after it terminates? One could do this in a shell script, but now there is an option - [452]-loop that makes it easier. Of course when x11vnc restarts it + [453]-loop that makes it easier. Of course when x11vnc restarts it needs to have permissions to connect to the (potentially new) X display. This mode could be useful if the X server restarts often. Use e.g. "-loop5000" to sleep 5000 ms between restarts. Also "-loop2000,5" to sleep 2000 ms and only restart 5 times. - One can also use the [453]-loopbg to emulate inetd(8) to some degree, + One can also use the [454]-loopbg to emulate inetd(8) to some degree, where each connected process runs in the background. It could be - combined, say, with the [454]-svc option to provide simple terminal + combined, say, with the [455]-svc option to provide simple terminal services without using inetd(8). @@ -5537,7 +5604,7 @@ t:5 web browser? To have x11vnc serve up a Java VNC viewer applet to any web browsers - that connect to it, run x11vnc with this [455]option: + that connect to it, run x11vnc with this [456]option: -httpdir /path/to/the/java/classes/dir (this directory will contain the files index.vnc and, for example, @@ -5556,7 +5623,7 @@ t:5 then you can connect to that URL with any Java enabled browser. Feel free to customize the default index.vnc file in the classes directory. - As of May/2005 the [456]-http option will try to guess where the Java + As of May/2005 the [457]-http option will try to guess where the Java classes jar file is by looking in expected locations and ones relative to the x11vnc binary. @@ -5565,7 +5632,7 @@ t:5 either the java or appletviewer commands to run the program. java -cp ./VncViewer.jar VncViewer HOST far-away.east PORT 5900 - Proxies: See the [457]discussion here if the web browser must use a + Proxies: See the [458]discussion here if the web browser must use a web proxy to connect to the internet. It is tricky to get Java applets to work in this case: a signed applet must be used so it can connect to the proxy and ask for the redirection to the VNC server. One way to @@ -5581,7 +5648,7 @@ t:5 As of Mar/2004 x11vnc supports reverse connections. On Unix one starts the VNC viewer in listen mode: "vncviewer -listen" (see your documentation for Windows, etc), and then starts up x11vnc with the - [458]-connect option. To connect immediately at x11vnc startup time + [459]-connect option. To connect immediately at x11vnc startup time use the "-connect host:port" option (use commas for a list of hosts to connect to.) The ":port" is optional (default is VNC listening port is 5500.) @@ -5590,11 +5657,11 @@ t:5 file is checked periodically (about once a second) for new hosts to connect to. - The [459]-remote control option (aka -R) can also be used to do this + The [460]-remote control option (aka -R) can also be used to do this during an active x11vnc session, e.g.: x11vnc -display :0 -R connect:hostname.domain - Use the "[460]-connect_or_exit" option to have x11vnc exit if the + Use the "[461]-connect_or_exit" option to have x11vnc exit if the reverse connection fails. Also, note the "-rfbport 0" option disables TCP listening for connections (potentially useful for reverse connection mode, assuming you do not want any "forward" connections.) @@ -5607,7 +5674,7 @@ x11vnc -display :0 -R connect:hostname.domain X11VNC_REVERSE_CONNECTION_NO_AUTH=1" to x11vnc. Vncconnect command: To use the vncconnect(1) program (from the core - VNC package at www.realvnc.com) specify the [461]-vncconnect option to + VNC package at www.realvnc.com) specify the [462]-vncconnect option to x11vnc (Note: as of Dec/2004 -vncconnect is now the default.) vncconnect(1) must be pointed to the same X11 DISPLAY as x11vnc (since it uses X properties to communicate with x11vnc.) If you do not have @@ -5626,7 +5693,7 @@ xprop -root -f VNC_CONNECT 8s -set VNC_CONNECT "$1" proxy or SSH? Yes, as of Oct/2007 x11vnc supports reverse connections through - proxies: use the "[462]-proxy host:port" option. The default is to + proxies: use the "[463]-proxy host:port" option. The default is to assume the proxy is a Web proxy. Note that most Web proxies only allow proxy destination connections to ports 443 (HTTPS) and 563 (SNEWS) and so this might not be too useful unless the proxy has been modified @@ -5646,11 +5713,11 @@ xprop -root -f VNC_CONNECT 8s -set VNC_CONNECT "$1" connections. An experimental mode is "-proxy http://host:port/..." where the URL - (e.g. a CGI script) is retrieved via the GET method. See [463]-proxy + (e.g. a CGI script) is retrieved via the GET method. See [464]-proxy for more info. Another experimental mode is "-proxy ssh://user@host" in which case a - SSH tunnel is used for the proxying. See [464]-proxy for more info. + SSH tunnel is used for the proxying. See [465]-proxy for more info. Up to 3 proxies may be chained together by listing them by commas e.g.: "-proxy http://host1:port1,socks5://host2:port2" in case one @@ -5658,7 +5725,34 @@ xprop -root -f VNC_CONNECT 8s -set VNC_CONNECT "$1" listening viewer. - Q-67: Can I use x11vnc as a replacement for Xvnc? (i.e. not for a real + Q-67: Can x11vnc provide a multi-user desktop web login service as an + Apache CGI or PHP script? + Yes. See the example script [466]desktop.cgi for ideas. It is in the + source tree in the directory x11vnc/misc. It serves x11vnc's SSL + enabled Java Applet to the web browser with the correct connection + information for the user's virtual desktop (an [467]Xvfb session via + [468]-create; be sure to add the Xvfb package.) HTTPS/SSL enabled + Apache should be used to serve the script to avoid unix and vnc + passwords from being sent in cleartext and sniffed. + + By default it uses a separate VNC port for each user desktop (either + by autoprobing in a range of ports or using a port based on the userid + number.) The web server's firewall must allow incoming connections to + these ports. + + It is somewhat difficult to do all of this with x11vnc listening on a + single port, however there is also a 'fixed port' scheme described in + the script based on [469]-loopbg that works fairly well (but more + experience is needed to see what problems contention for the same port + causes; however at worst one user may need to re-login.) + + There is also an optional 'port redirection' mode for desktop.cgi that + allows redirection to other machines inside the firewall already + running SSL enabled VNC servers. This provides much of the + functionality as the [470]SSL Portal and is easier to set up. + + + Q-68: Can I use x11vnc as a replacement for Xvnc? (i.e. not for a real display, but for a virtual one I keep around.) You can, but you would not be doing this for performance reasons (for @@ -5672,14 +5766,17 @@ xprop -root -f VNC_CONNECT 8s -set VNC_CONNECT "$1" Another method, faster and more accurate, is to use the "dummy" Device Driver in XFree86/Xorg (see below.) + For these virtual sessions you will need to install the Xvfb program + (e.g. apt-get install xvfb) or our Xdummy program (see below.) + In either case, one can view this desktop both remotely and also - [465]locally using vncviewer. Make sure vncviewer's "-encodings raw" + [471]locally using vncviewer. Make sure vncviewer's "-encodings raw" is in effect for local viewing (compression seems to slow things down locally.) For local viewing you set up a "bare" window manager that - just starts up vncviewer and nothing else ([466]See how below.) + just starts up vncviewer and nothing else ([472]See how below.) Here is one way to start up Xvfb: - xinit -- /usr/X11R6/bin/Xvfb :1 -cc 4 -screen 0 1024x768x16 + xinit -- /usr/bin/Xvfb :1 -cc 4 -screen 0 1024x768x16 This starts up a 16bpp virtual display. To export it via VNC use x11vnc -display :1 ... @@ -5696,19 +5793,19 @@ xprop -root -f VNC_CONNECT 8s -set VNC_CONNECT "$1" "screen scrape" it very efficiently (more than, say, 100X faster than normal video hardware.) - Update Nov/2006: See the [467]FINDCREATEDISPLAY discussion of the - "[468]-display WAIT:cmd=FINDDISPLAY" option where virtual (Xvfb or + Update Nov/2006: See the [473]FINDCREATEDISPLAY discussion of the + "[474]-display WAIT:cmd=FINDDISPLAY" option where virtual (Xvfb or Xdummy, or even real ones by changing an option) X servers are started automatically for new users connecting. This provides a "desktop service" for the machine. You either get your real X session or your virtual (Xvfb/Xdummy) one whenever you connect to the machine - (inetd(8) is a nice way to provide this service.) The [469]-find, - [470]-create, [471]-svc, and [472]-xdmsvc aliases can also come in + (inetd(8) is a nice way to provide this service.) The [475]-find, + [476]-create, [477]-svc, and [478]-xdmsvc aliases can also come in handy here. There are some annoyances WRT Xvfb however. The default keyboard mapping seems to be very poor. One should run x11vnc with - [473]-add_keysyms option to have keysyms added automatically. Also, to + [479]-add_keysyms option to have keysyms added automatically. Also, to add the Shift_R and Control_R modifiers something like this is needed: #!/bin/sh xmodmap -e "keycode any = Shift_R" @@ -5720,7 +5817,7 @@ xmodmap -e "keycode any = Alt_R" xmodmap -e "keycode any = Meta_L" xmodmap -e "add Mod1 = Alt_L Alt_R Meta_L" - (note: these are applied automatically in the [474]FINDCREATEDISPLAY + (note: these are applied automatically in the [480]FINDCREATEDISPLAY mode of x11vnc.) Perhaps the Xvfb options -xkbdb or -xkbmap could be used to get a better default keyboard mapping... @@ -5735,11 +5832,11 @@ xmodmap -e "add Mod1 = Alt_L Alt_R Meta_L" The main drawback to this method (besides requiring extra configuration and possibly root permission) is that it also does the - Linux Virtual Console/Terminal (VC/VT) [475]switching even though it + Linux Virtual Console/Terminal (VC/VT) [481]switching even though it does not need to (since it doesn't use a real framebuffer.) There are some "dual headed" (actually multi-headed/multi-user) patches to the X server that turn off the VT usage in the X server. Update: As of - Jul/2005 we have an LD_PRELOAD script [476]Xdummy that allows you to + Jul/2005 we have an LD_PRELOAD script [482]Xdummy that allows you to use a stock (i.e. unpatched) Xorg or XFree86 server with the "dummy" driver and not have any VT switching problems! An advantage of Xdummy over Xvfb is that Xdummy supports RANDR dynamic screen resizing. @@ -5766,7 +5863,7 @@ x11vnc -display :5 -rfbport 5905 -bg vncviewer -geometry +0+0 -encodings raw -passwd $HOME/.vnc/passwd localhost:5 The display numbers (VNC and X) will likely be different (you could - also try [477]-find), and you may not need the -passwd. Recent RealVNC + also try [483]-find), and you may not need the -passwd. Recent RealVNC viewers might be this: #!/bin/sh x11vnc -display :5 -rfbport 5905 -bg @@ -5784,10 +5881,10 @@ t:5 XDM/GDM/KDM One-Shot X sessions: For the general replacement of Xvnc by Xvfb+x11vnc, one user describes a similar setup he created where the X sessions are one-shot's (destroyed after the vncviewer - disconnects) and it uses the XDM/GDM/KDM login greeter [478]here. + disconnects) and it uses the XDM/GDM/KDM login greeter [484]here. - Q-68: How can I use x11vnc on "headless" machines? Why might I want + Q-69: How can I use x11vnc on "headless" machines? Why might I want to? An interesting application of x11vnc is to let it export displays of @@ -5799,7 +5896,7 @@ t:5 An X server can be started on the headless machine (sometimes this requires configuring the X server to not fail if it cannot detect a keyboard or mouse, see the next paragraph.) Then you can export that X - display via x11vnc (e.g. see [479]this FAQ) and access it from + display via x11vnc (e.g. see [485]this FAQ) and access it from anywhere on the network via a VNC viewer. Some tips on getting X servers to start on machines without keyboard @@ -5823,15 +5920,15 @@ t:5 cards as it can hold to provide multiple simultaneous access or testing on different kinds of video hardware. - See also the [480]FINDCREATEDISPLAY discussion of the "[481]-display + See also the [486]FINDCREATEDISPLAY discussion of the "[487]-display WAIT:cmd=FINDDISPLAY" option where virtual Xvfb or Xdummy, or real X servers are started automatically for new users connecting. The - [482]-find, [483]-create, [484]-svc, and [485]-xdmsvc aliases can also + [488]-find, [489]-create, [490]-svc, and [491]-xdmsvc aliases can also come in handy here. [Resource Usage and Performance] - Q-69: I have lots of memory, but why does x11vnc fail with shmget: + Q-70: I have lots of memory, but why does x11vnc fail with shmget: No space left on device or Minor opcode of failed request: 1 (X_ShmAttach)? @@ -5849,7 +5946,7 @@ t:5 19/03/2004 10:10:58 error creating tile-row shm for len=4 19/03/2004 10:10:58 reverting to single_copytile mode - Here is a shell script [486]shm_clear to list and prompt for removal + Here is a shell script [492]shm_clear to list and prompt for removal of your unattached shm segments (attached ones are skipped.) I use it while debugging x11vnc (I use "shm_clear -y" to assume "yes" for each prompt.) If x11vnc is regularly not cleaning up its shm segments, @@ -5883,49 +5980,49 @@ ied) in /etc/system. See the next paragraph for more workarounds. To minimize the number of shm segments used by x11vnc try using the - [487]-onetile option (corresponds to only 3 shm segments used, and + [493]-onetile option (corresponds to only 3 shm segments used, and adding -fs 1.0 knocks it down to 2.) If you are having much trouble with shm segments, consider disabling shm completely via the - [488]-noshm option. Performance will be somewhat degraded but when + [494]-noshm option. Performance will be somewhat degraded but when done over local machine sockets it should be acceptable (see an - [489]earlier question discussing -noshm.) + [495]earlier question discussing -noshm.) - Q-70: How can I make x11vnc use less system resources? + Q-71: How can I make x11vnc use less system resources? - The [490]-nap (now on by default; use -nonap to disable) and - "[491]-wait n" (where n is the sleep between polls in milliseconds, + The [496]-nap (now on by default; use -nonap to disable) and + "[497]-wait n" (where n is the sleep between polls in milliseconds, the default is 30 or so) option are good places to start. In addition, - something like "[492]-sb 15" will cause x11vnc to go into a deep-sleep + something like "[498]-sb 15" will cause x11vnc to go into a deep-sleep mode after 15 seconds of no activity (instead of the default 60.) Reducing the X server bits per pixel depth (e.g. to 16bpp or even 8bpp) will further decrease memory I/O and network I/O. The ShadowFB X server setting will make x11vnc's screen polling less severe. Using - the [493]-onetile option will use less memory and use fewer shared - memory slots (add [494]-fs 1.0 for one less slot.) + the [499]-onetile option will use less memory and use fewer shared + memory slots (add [500]-fs 1.0 for one less slot.) - Q-71: How can I make x11vnc use MORE system resources? + Q-72: How can I make x11vnc use MORE system resources? - You can try [495]-threads (note this mode can be unstable and/or + You can try [501]-threads (note this mode can be unstable and/or crash; and as of May/2008 is strongly discouraged, see the option description) or dial down the wait time (e.g. -wait 1) and possibly - dial down [496]-defer as well. Note that if you try to increase the + dial down [502]-defer as well. Note that if you try to increase the "frame rate" too much you can bog down the server end with the extra work it needs to do compressing the framebuffer data, etc. That said, it is possible to "stream" video via x11vnc if the video window is small enough. E.g. a 256x192 xawtv TV capture window (using - the x11vnc [497]-id option) can be streamed over a LAN or wireless at + the x11vnc [503]-id option) can be streamed over a LAN or wireless at a reasonable frame rate. If the graphics card's framebuffer read rate - is [498]faster than normal then the video window size and frame rate - can be much higher. The use of [499]TurboVNC and/or TurboJPEG can make + is [504]faster than normal then the video window size and frame rate + can be much higher. The use of [505]TurboVNC and/or TurboJPEG can make the frame rate somewhat higher still (but most of this hinges on the graphics card's read rate.) - Q-72: I use x11vnc over a slow link with high latency (e.g. dialup + Q-73: I use x11vnc over a slow link with high latency (e.g. dialup modem or broadband), is there anything I can do to speed things up? Some things you might want to experiment with (many of which will help @@ -5937,7 +6034,7 @@ ied) * Use a smaller desktop size (e.g. 1024x768 instead of 1280x1024) * Make sure the desktop background is a solid color (the background is resent every time it is re-exposed.) Consider using the - [500]-solid [color] option to try to do this automatically. + [506]-solid [color] option to try to do this automatically. * Configure your window manager or desktop "theme" to not use fancy images, shading, and gradients for the window decorations, etc. Disable window animations, etc. Maybe your desktop has a "low @@ -5946,9 +6043,9 @@ ied) -> Use Smooth Scrolling (deselect it.) * Avoid small scrolls of large windows using the Arrow keys or scrollbar. Try to use PageUp/PageDown instead. (not so much of a - problem in x11vnc 0.7.2 if [501]-scrollcopyrect is active and + problem in x11vnc 0.7.2 if [507]-scrollcopyrect is active and detecting scrolls for the application.) - * If the [502]-wireframe option is not available (earlier than + * If the [508]-wireframe option is not available (earlier than x11vnc 0.7.2 or you have disabled it via -nowireframe) then Disable Opaque Moves and Resizes in the window manager/desktop. * However if -wireframe is active (on by default in x11vnc 0.7.2) @@ -5971,7 +6068,7 @@ ied) noticed. VNC viewer parameters: - * Use a [503]TightVNC enabled viewer! (Actually, RealVNC 4.x viewer + * Use a [509]TightVNC enabled viewer! (Actually, RealVNC 4.x viewer with ZRLE encoding is not too bad either; some claim it is faster.) * Make sure the tight (or zrle) encoding is being used (look at @@ -5979,7 +6076,7 @@ ied) * Request 8 bits per pixel using -bgr233 (up to 4X speedup over depth 24 TrueColor (32bpp), but colors will be off) * RealVNC 4.x viewer has some extremely low color modes (only 64 and - even 8 colors.) [504]SSVNC does too. The colors are poor, but it + even 8 colors.) [510]SSVNC does too. The colors are poor, but it is usually noticeably faster than bgr233 (256 colors.) * Try increasing the TightVNC -compresslevel (compresses more on server side before sending, but uses more CPU) @@ -5993,39 +6090,39 @@ ied) file. x11vnc parameters: - * Make sure the [505]-wireframe option is active (it should be on by + * Make sure the [511]-wireframe option is active (it should be on by default) and you have Opaque Moves/Resizes Enabled in the window manager. - * Make sure the [506]-scrollcopyrect option is active (it should be + * Make sure the [512]-scrollcopyrect option is active (it should be on by default.) This detects scrolls in many (but not all) applications an applies the CopyRect encoding for a big speedup. * Enforce a solid background when VNC viewers are connected via - [507]-solid - * Try x11vnc's client-side caching [508]client-side caching scheme: - [509]-ncache - * Specify [510]-speeds modem to force the wireframe and + [513]-solid + * Try x11vnc's client-side caching [514]client-side caching scheme: + [515]-ncache + * Specify [516]-speeds modem to force the wireframe and scrollcopyrect heuristic parameters (and any future ones) to those of a dialup modem connection (or supply the rd,bw,lat numerical values that characterize your link.) * If wireframe and scrollcopyrect aren't working, try using the more - drastic [511]-nodragging (no screen updates when dragging mouse, + drastic [517]-nodragging (no screen updates when dragging mouse, but sometimes you miss visual feedback) - * Set [512]-fs 1.0 (disables fullscreen updates) - * Try increasing [513]-wait or [514]-defer (reduces the maximum + * Set [518]-fs 1.0 (disables fullscreen updates) + * Try increasing [519]-wait or [520]-defer (reduces the maximum "frame rate", but won't help much for large screen changes) - * Try the [515]-progressive pixelheight mode with the block + * Try the [521]-progressive pixelheight mode with the block pixelheight 100 or so (delays sending vertical blocks since they may change while viewer is receiving earlier ones) - * If you just want to watch one (simple) window use [516]-id or - [517]-appshare (cuts down extraneous polling and updates, but can + * If you just want to watch one (simple) window use [522]-id or + [523]-appshare (cuts down extraneous polling and updates, but can be buggy or insufficient) - * Set [518]-nosel (disables all clipboard selection exchange) - * Use [519]-nocursor and [520]-nocursorpos (repainting the remote + * Set [524]-nosel (disables all clipboard selection exchange) + * Use [525]-nocursor and [526]-nocursorpos (repainting the remote cursor position and shape takes resources and round trips) * On very slow links (e.g. <= 28.8) you may need to increase the - [521]-readtimeout n setting if it sometimes takes more than 20sec + [527]-readtimeout n setting if it sometimes takes more than 20sec to paint the full screen, etc. - * Do not use [522]-fixscreen to automatically refresh the whole + * Do not use [528]-fixscreen to automatically refresh the whole screen, tap three Alt_L's then the screen has painting errors (rare problem.) @@ -6076,7 +6173,7 @@ ied) * TBD. - Q-73: Does x11vnc support the X DAMAGE Xserver extension to find + Q-74: Does x11vnc support the X DAMAGE Xserver extension to find modified regions of the screen quickly and efficiently? Yes, as of Mar/2005 x11vnc will use the X DAMAGE extension by default @@ -6094,7 +6191,7 @@ ied) Note that the DAMAGE extension does not speed up the actual reading of pixels from the video card framebuffer memory, by, say, mirroring them - in main memory. So reading the fb is still painfully [523]slow (e.g. + in main memory. So reading the fb is still painfully [529]slow (e.g. 5MB/sec), and so even using X DAMAGE when large changes occur on the screen the bulk of the time is still spent retrieving them. Not ideal, but use of the ShadowFB XFree86/Xorg option speeds up the reading @@ -6112,45 +6209,45 @@ ied) DAMAGE rectangles to contain real damage. The larger rectangles are only used as hints to focus the traditional scanline polling (i.e. if a scanline doesn't intersect a recent DAMAGE rectangle, the scan is - skipped.) You can use the "[524]-xd_area A" option to adjust the size + skipped.) You can use the "[530]-xd_area A" option to adjust the size of the trusted DAMAGE rectangles. The default is 20000 pixels (e.g. a 140x140 square, etc.) Use "-xd_area 0" to disable the cutoff and trust all DAMAGE rectangles. - The option "[525]-xd_mem f" may also be of use in tuning the - algorithm. To disable using DAMAGE entirely use "[526]-noxdamage". + The option "[531]-xd_mem f" may also be of use in tuning the + algorithm. To disable using DAMAGE entirely use "[532]-noxdamage". - Q-74: My OpenGL application shows no screen updates unless I supply + Q-75: My OpenGL application shows no screen updates unless I supply the -noxdamage option to x11vnc. One user reports in his environment (MythTV using the NVIDIA OpenGL drivers) he gets no updates after the initial screen is drawn unless - he uses the "[527]-noxdamage" option. + he uses the "[533]-noxdamage" option. This seems to be a bug in the X DAMAGE implementation of that driver. You may have to use -noxdamage as well. A way to autodetect this will be tried, probably the best it will do is automatically stop using X DAMAGE. - A developer for [528]MiniMyth reports that the 'alphapulse' tag of the + A developer for [534]MiniMyth reports that the 'alphapulse' tag of the theme G.A.N.T. can also cause problems, and should be avoided when using VNC. - Update: see [529]this FAQ too. + Update: see [535]this FAQ too. - Q-75: When I drag windows around with the mouse or scroll up and down + Q-76: When I drag windows around with the mouse or scroll up and down things really bog down (unless I do the drag in a single, quick motion.) Is there anything to do to improve things? - This problem is primarily due to [530]slow hardware read rates from + This problem is primarily due to [536]slow hardware read rates from video cards: as you scroll or move a large window around the screen changes are much too rapid for x11vnc to keep up them (it can usually only read the video card at about 5-10 MB/sec, so it can take a good fraction of a second to read the changes induce from moving a large window, if this to be done a number of times in succession the window or scroll appears to "lurch" forward.) See the description in the - [531]-pointer_mode option for more info. The next bottleneck is + [537]-pointer_mode option for more info. The next bottleneck is compressing all of these changes and sending them out to connected viewers, however the VNC protocol is pretty much self-adapting with respect to that (updates are only packaged and sent when viewers ask @@ -6160,27 +6257,27 @@ ied) default should now be much better than before and dragging small windows around should no longer be a huge pain. If for some reason these changes make matters worse, you can go back to the old way via - the "[532]-pointer_mode 1" option. + the "[538]-pointer_mode 1" option. - Also added was the [533]-nodragging option that disables all screen + Also added was the [539]-nodragging option that disables all screen updates while dragging with the mouse (i.e. mouse motion with a button held down.) This gives the snappiest response, but might be undesired in some circumstances when you want to see the visual feedback while dragging (e.g. menu traversal or text selection.) - As of Dec/2004 the [534]-pointer_mode n option was introduced. n=1 is + As of Dec/2004 the [540]-pointer_mode n option was introduced. n=1 is the original mode, n=2 an improvement, etc.. See the -pointer_mode n help for more info. - Also, in some circumstances the [535]-threads option can improve + Also, in some circumstances the [541]-threads option can improve response considerably. Be forewarned that if more than one vncviewer is connected at the same time then libvncserver may not be thread safe (try to get the viewers to use different VNC encodings, e.g. tight and ZRLE.) This option can be unstable and so as of Feb/2008 it is disabled by default. Set env. X11VNC_THREADED=1 to re-enable. - As of Apr/2005 two new options (see the [536]wireframe FAQ and - [537]scrollcopyrect FAQ below) provide schemes to sweep this problem + As of Apr/2005 two new options (see the [542]wireframe FAQ and + [543]scrollcopyrect FAQ below) provide schemes to sweep this problem under the rug for window moves or resizes and for some (but not all) window scrolls. These are the preferred way of avoiding the "lurching" problem, contact me if they are not working. Note on SuSE and some @@ -6193,7 +6290,7 @@ Section "Module" EndSection - Q-76: Why not do something like wireframe animations to avoid the + Q-77: Why not do something like wireframe animations to avoid the windows "lurching" when being moved or resized? Nice idea for a hack! As of Apr/2005 x11vnc by default will apply @@ -6204,8 +6301,8 @@ EndSection the window move/resize stops, it returns to normal processing: you should only see the window appear in the new position. This spares you from interacting with a "lurching" window between all of the - intermediate steps. BTW the lurching is due to [538]slow video card - read rates (see [539]here too.) A displacement, even a small one, of a + intermediate steps. BTW the lurching is due to [544]slow video card + read rates (see [545]here too.) A displacement, even a small one, of a large window requires a non-negligible amount of time, a good fraction of a second, to read in from the hardware framebuffer. @@ -6213,7 +6310,7 @@ EndSection for -wireframe to do any good. The mode is currently on by default because most people are afflicted - with the problem. It can be disabled with the [540]-nowireframe option + with the problem. It can be disabled with the [546]-nowireframe option (aka -nowf.) Why might one want to turn off the wireframing? Since x11vnc is merely guessing when windows are being moved/resized, it may guess poorly for your window-manager or desktop, or even for the way @@ -6259,13 +6356,13 @@ EndSection * Maximum time to show a wireframe animation. * Minimum time between sending wireframe outlines. - See the [541]"-wireframe tweaks" option for more details. On a slow + See the [547]"-wireframe tweaks" option for more details. On a slow link, e.g. dialup modem, the parameters may be automatically adjusted for better response. CopyRect encoding: In addition to the above there is the - [542]"-wirecopyrect mode" option. It is also on by default. This + [548]"-wirecopyrect mode" option. It is also on by default. This instructs x11vnc to not only show the wireframe animation, but to also instruct all connected VNC viewers to locally translate the window image data from the original position to the new position on the @@ -6296,7 +6393,7 @@ EndSection -nowirecopyrect if this or other painting errors are unacceptable. - Q-77: Can x11vnc try to apply heuristics to detect when a window is + Q-78: Can x11vnc try to apply heuristics to detect when a window is scrolling its contents and use the CopyRect encoding for a speedup? Another nice idea for a hack! As of May/2005 x11vnc will by default @@ -6313,7 +6410,7 @@ EndSection requiring the image data to be transmitted over the network. For fast links the speedup is primarily due to x11vnc not having to read the scrolled framebuffer data from the X server (recall that reading from - the hardware framebuffer is [543]slow.) + the hardware framebuffer is [549]slow.) To do this x11vnc uses the RECORD X extension to snoop the X11 protocol between the X client with the focus window and the X server. @@ -6340,10 +6437,10 @@ EndSection the X server display: if one falls too far behind it could become a mess... - The initial implementation of [544]-scrollcopyrect option is useful in + The initial implementation of [550]-scrollcopyrect option is useful in that it detects many scrolls and thus gives a much nicer working - environment (especially when combined with the [545]-wireframe - [546]-wirecopyrect [547]options, which are also on by default; and if + environment (especially when combined with the [551]-wireframe + [552]-wirecopyrect [553]options, which are also on by default; and if you are willing to enable the ShadowFB things are very fast.) The fact that there aren't long delays or lurches during scrolling is the primary improvement. @@ -6376,10 +6473,10 @@ EndSection One can tap the Alt_L key (Left "Alt" key) 3 times in a row to signal x11vnc to refresh the screen to all viewers. Your VNC-viewer may have its own screen refresh hot-key or button. See - also: [548]-fixscreen + also: [554]-fixscreen * Some applications, notably OpenOffice, do XCopyArea scrolls in weird ways that assume ancestor window clipping is taking place. - See the [549]-scr_skip option for ways to tweak this on a + See the [555]-scr_skip option for ways to tweak this on a per-application basis. * Selecting text while dragging the mouse may be slower, especially if the Button-down event happens near the window's edge. This is @@ -6396,7 +6493,7 @@ EndSection because it fails to detect scrolls in it. Sometimes clicking inside the application window or selecting some text in it to force the focus helps. - * When using the [550]-scale option there will be a quick CopyRect + * When using the [556]-scale option there will be a quick CopyRect scroll, but it needs to be followed by a slower "cleanup" update. This is because for a fixed finite screen resolution (e.g. 75 dpi) scaling and copyrect-ing are not exactly independent. Scaling @@ -6409,7 +6506,7 @@ EndSection If you find the -scrollcopyrect behavior too approximate or distracting you can go back to the standard polling-only update method - with the [551]-noscrollcopyrect (or -noscr for short.) If you find + with the [557]-noscrollcopyrect (or -noscr for short.) If you find some extremely bad and repeatable behavior for -scrollcopyrect please report a bug. @@ -6430,13 +6527,13 @@ EndSection errors. - Q-78: Can x11vnc do client-side caching of pixel data? I.e. so when + Q-79: Can x11vnc do client-side caching of pixel data? I.e. so when that pixel data is needed again it does not have to be retransmitted over the network. - As of Dec/2006 in the [552]0.9 development tarball there is an + As of Dec/2006 in the [558]0.9 development tarball there is an experimental client-side caching implementation enabled by the - "[553]-ncache n" option. In fact, during the test period it was on by + "[559]-ncache n" option. In fact, during the test period it was on by default with n set to 10. To disable it use "-noncache". It is a simple scheme where a (very large) lower portion of the @@ -6463,7 +6560,7 @@ EndSection there is a bug: you can scroll down in your viewer and see a strange "history" of windows on your desktop. This is working as intended. One will need to try to adjust the size of his VNC Viewer window so the - cache area cannot be seen. [554]SSVNC (see below) can do this + cache area cannot be seen. [560]SSVNC (see below) can do this automatically. At some point LibVNCServer may implement a "rfbFBCrop" pseudoencoding @@ -6473,7 +6570,7 @@ EndSection rendering...) The Enhanced TightVNC Viewer (SSVNC) Unix viewer has a nice - [555]-ycrop option to help hide the pixel cache area from view. It + [561]-ycrop option to help hide the pixel cache area from view. It will turn on automatically if the framebuffer appears to be very tall (height more than twice the width), or you can supply the actual value for the height. If the screen is resized by scaling, etc, the ycrop @@ -6504,7 +6601,7 @@ EndSection an additional factor of 2 in memory use. However, even in the smallest usage mode with n equal 2 and - [556]-ncache_no_rootpixmap set (this requires only 2X additional + [562]-ncache_no_rootpixmap set (this requires only 2X additional framebuffer memory) there is still a noticable improvement for many activities, although it is not as dramatic as with, say n equal 12 and rootpixmap (desktop background) caching enabled. @@ -6515,7 +6612,7 @@ EndSection be tuned to use less, or the VNC community will extend the protocol to allow caching and replaying of compressed blobs of data. - Another option to experiment with is "[557]-ncache_cr". By specifying + Another option to experiment with is "[563]-ncache_cr". By specifying it, x11vnc will try to do smooth opaque window moves instead of its wireframe. This can give a very nice effect (note: on Unix the realvnc viewer seems to be smoother than the tightvnc viewer), but can lead to @@ -6568,28 +6665,28 @@ EndSection improving VNC performance by client side caching. - Q-79: Does x11vnc support TurboVNC? + Q-80: Does x11vnc support TurboVNC? As of Feb/2009 (development tarball) there is an experimental kludge to let you build x11vnc using TurboVNC's modified TightVNC encoding. - [558]TurboVNC is part of the [559]VirtualGL project. It does two main + [564]TurboVNC is part of the [565]VirtualGL project. It does two main things to speed up the TightVNC encoding: * It eliminates bottlenecks, overheads, wait-times in the TightVNC encoding implementation and instead only worries about sending very well (and quickly) compressed JPEG data. * A fast proprietary JPEG implemention is used (Intel IPP on x86) - instead of the usual libjpeg implementation. [560]TurboJPEG is an + instead of the usual libjpeg implementation. [566]TurboJPEG is an interface library, libturbojpeg, provided by the project that achieves this. TurboVNC works very well over LAN and evidently fast Broadband too. When using it with x11vnc in such a situation you may want to dial - down the delays, e.g. "[561]-wait 5" and "[562]-defer 5" (or even a + down the delays, e.g. "[567]-wait 5" and "[568]-defer 5" (or even a smaller setting) to poll and pump things out more quickly. See the instructions in "x11vnc/misc/turbovnc/README" for how to build x11vnc with TurboVNC support. You will also need to download the - [563]TurboJPEG software. + [569]TurboJPEG software. In brief, the steps look like this: cd x11vnc-x.y.z/x11vnc/misc/turbovnc @@ -6601,22 +6698,22 @@ EndSection where you replace "/DIR" with the directory containing libturbojpeg.so you downloaded separately. If it works out well enough TurboVNC support will be integrated into x11vnc and more of its tuning features - will be implemented. Support for TurboVNC in [564]SSVNC viewer has + will be implemented. Support for TurboVNC in [570]SSVNC viewer has been added as an experiment as well. If you try either one, let us know how it went. There also may be some Linux.i686 and Darwin.i386 x11vnc binaries with - TurboVNC support in the [565]misc. bins directory. For other platforms + TurboVNC support in the [571]misc. bins directory. For other platforms you will need to compile yourself. On relatively cheap and old hardware (Althon64 X2 5000+ / GeForce - 6200) x11vnc and [566]SSVNC, both TurboVNC enabled, were able to + 6200) x11vnc and [572]SSVNC, both TurboVNC enabled, were able to sustain 13.5 frames/sec (fps) and 15 Megapixels/sec using the VirtualGL supplied OpenGL benchmark program glxspheres. VirtualGL on - higher-end hardware can sustain [567]20-30 fps with the glxspheres + higher-end hardware can sustain [573]20-30 fps with the glxspheres benchmark. - Potential Slowdown: As we describe [568]elsewhere, unless you use + Potential Slowdown: As we describe [574]elsewhere, unless you use x11vnc with an X server using, say, NVidia proprietary drivers (or a virtual X server like Xvfb or Xdummy, or in ShadowFB mode), then the read rate from the graphics card can be rather slow (e.g. 10 MB/sec) @@ -6641,7 +6738,7 @@ EndSection [Mouse Cursor Shapes] - Q-80: Why isn't the mouse cursor shape (the little icon shape where + Q-81: Why isn't the mouse cursor shape (the little icon shape where the mouse pointer is) correct as I move from window to window? On X servers supporting XFIXES or Solaris/IRIX Overlay extensions it @@ -6656,23 +6753,23 @@ EndSection this is because the cursor shape is often downloaded to the graphics hardware (video card), but I could be mistaken. - A simple kludge is provided by the "[569]-cursor X" option that + A simple kludge is provided by the "[575]-cursor X" option that changes the cursor when the mouse is on the root background (or any window has the same cursor as the root background.) Note that desktops like GNOME or KDE often cover up the root background, so this won't - work for those cases. Also see the "[570]-cursor some" option for + work for those cases. Also see the "[576]-cursor some" option for additional kludges. Note that as of Aug/2004 on Solaris using the SUN_OVL overlay extension and IRIX, x11vnc can show the correct mouse cursor when the - [571]-overlay option is supplied. See [572]this FAQ for more info. + [577]-overlay option is supplied. See [578]this FAQ for more info. Also as of Dec/2004 XFIXES X extension support has been added to allow exact extraction of the mouse cursor shape. XFIXES fixes the problem of the cursor-shape being write-only: x11vnc can now query the X server for the current shape and send it back to the connected viewers. XFIXES is available on recent Linux Xorg based distros and - [573]Solaris 10. + [579]Solaris 10. The only XFIXES issue is the handling of alpha channel transparency in cursors. If a cursor has any translucency then in general it must be @@ -6680,10 +6777,10 @@ EndSection situations where the cursor transparency can also handled exactly: when the VNC Viewer requires the cursor shape be drawn into the VNC framebuffer or if you apply a patch to your VNC Viewer to extract - hidden alpha channel data under 32bpp. [574]Details can be found here. + hidden alpha channel data under 32bpp. [580]Details can be found here. - Q-81: When using XFIXES cursorshape mode, some of the cursors look + Q-82: When using XFIXES cursorshape mode, some of the cursors look really bad with extra black borders around the cursor and other cruft. How can I improve their appearance? @@ -6713,17 +6810,17 @@ EndSection for most cursor themes and you don't have to worry about it. In case it still looks bad for your cursor theme, there are (of - course!) some tunable parameters. The "[575]-alphacut n" option lets + course!) some tunable parameters. The "[581]-alphacut n" option lets you set the threshold "n" (between 0 and 255): cursor pixels with alpha values below n will be considered completely transparent while values equal to or above n will be completely opaque. The default is - 240. The "[576]-alphafrac f" option tries to correct individual + 240. The "[582]-alphafrac f" option tries to correct individual cursors that did not fare well with the default -alphacut value: if a cursor has less than fraction f (between 0.0 and 1.0) of its pixels selected by the default -alphacut, the threshold is lowered until f of its pixels are selected. The default fraction is 0.33. - Finally, there is an option [577]-alpharemove that is useful for + Finally, there is an option [583]-alpharemove that is useful for themes where many cursors are light colored (e.g. "whiteglass".) XFIXES returns the cursor data with the RGB values pre-multiplied by the alpha value. If the white cursors look too grey, specify @@ -6741,7 +6838,7 @@ EndSection heavily on redglass) look fine with the apparent default of alphacut:255. - Q-82: In XFIXES mode, are there any hacks to handle cursor + Q-83: In XFIXES mode, are there any hacks to handle cursor transparency ("alpha channel") exactly? As of Jan/2005 libvncserver has been modified to allow an alpha @@ -6749,10 +6846,10 @@ EndSection alpha channel data to libvncserver. However, this data will only be used for VNC clients that do not support the CursorShapeUpdates VNC extension (or have disabled it.) It can be disabled for all clients - with the [578]-nocursorshape x11vnc option. In this case the cursor is + with the [584]-nocursorshape x11vnc option. In this case the cursor is drawn, correctly blended with the background, into the VNC framebuffer before being sent out to the client. So the alpha blending is done on - the x11vnc side. Use the [579]-noalphablend option to disable this + the x11vnc side. Use the [585]-noalphablend option to disable this behavior (always approximate transparent cursors with opaque RGB values.) @@ -6776,17 +6873,17 @@ EndSection example on how to change the Windows TightVNC viewer to achieve the same thing (send me the patch if you get that working.) - This patch is applied to the [580]Enhanced TightVNC Viewer (SSVNC) + This patch is applied to the [586]Enhanced TightVNC Viewer (SSVNC) package we provide. [Mouse Pointer] - Q-83: Why does the mouse arrow just stay in one corner in my + Q-84: Why does the mouse arrow just stay in one corner in my vncviewer, whereas my cursor (that does move) is just a dot? - This default takes advantage of a [581]tightvnc extension + This default takes advantage of a [587]tightvnc extension (CursorShapeUpdates) that allows specifying a cursor image shape for - the local VNC viewer. You may disable it with the [582]-nocursor + the local VNC viewer. You may disable it with the [588]-nocursor option to x11vnc if your viewer does not have this extension. Note: as of Aug/2004 this should be fixed: the default for @@ -6795,22 +6892,22 @@ EndSection can also be disabled via -nocursor. - Q-84: Can I take advantage of the TightVNC extension to the VNC + Q-85: Can I take advantage of the TightVNC extension to the VNC protocol where Cursor Positions Updates are sent back to all connected clients (i.e. passive viewers can see the mouse cursor being moved around by another viewer)? - Use the [583]-cursorpos option when starting x11vnc. A VNC viewer must + Use the [589]-cursorpos option when starting x11vnc. A VNC viewer must support the Cursor Positions Updates for the user to see the mouse motions (the TightVNC viewers support this.) As of Aug/2004 -cursorpos - is the default. See also [584]-nocursorpos and [585]-nocursorshape. + is the default. See also [590]-nocursorpos and [591]-nocursorshape. - Q-85: Is it possible to swap the mouse buttons (e.g. left-handed + Q-86: Is it possible to swap the mouse buttons (e.g. left-handed operation), or arbitrarily remap them? How about mapping button clicks to keystrokes, e.g. to partially emulate Mouse wheel scrolling? - You can remap the mouse buttons via something like: [586]-buttonmap + You can remap the mouse buttons via something like: [592]-buttonmap 13-31 (or perhaps 12-21.) Also, note that xmodmap(1) lets you directly adjust the X server's button mappings, but in some circumstances it might be more desirable to have x11vnc do it. @@ -6818,7 +6915,7 @@ EndSection One user had an X server with only one mouse button(!) and was able to map all of the VNC client mouse buttons to it via: -buttonmap 123-111. - Note that the [587]-debug_pointer option prints out much info for + Note that the [593]-debug_pointer option prints out much info for every mouse/pointer event and is handy in solving problems. To map mouse button clicks to keystrokes you can use the alternate @@ -6840,7 +6937,7 @@ EndSection Exactly what keystroke "scrolling" events they should be bound to depends on one's taste. If this method is too approximate, one could - consider not using [588]-buttonmap but rather configuring the X server + consider not using [594]-buttonmap but rather configuring the X server to think it has a mouse with 5 buttons even though the physical mouse does not. (e.g. 'Option "ZAxisMapping" "4 5"'.) @@ -6867,10 +6964,10 @@ EndSection "click" usually gives a multi-line scroll.) [Keyboard Issues] - Q-86: How can I get my AltGr and Shift modifiers to work between + Q-87: How can I get my AltGr and Shift modifiers to work between keyboards for different languages? - The option [589]-modtweak should help here. It is a mode that monitors + The option [595]-modtweak should help here. It is a mode that monitors the state of the Shift and AltGr Modifiers and tries to deduce the correct keycode to send, possibly by sending fake modifier key presses and releases in addition to the actual keystroke. @@ -6879,25 +6976,25 @@ EndSection to get the old behavior.) This was done because it was noticed on newer XFree86 setups even on bland "us" keyboards like "pc104 us" XFree86 included a "ghost" key with both "<" and ">" it. This key does - not exist on the keyboard (see [590]this FAQ for more info.) Without + not exist on the keyboard (see [596]this FAQ for more info.) Without -modtweak there was then an ambiguity in the reverse map keysym => keycode, making it so the "<" symbol could not be typed. - Also see the [591]FAQ about the -xkb option for a more powerful method + Also see the [597]FAQ about the -xkb option for a more powerful method of modifier tweaking for use on X servers with the XKEYBOARD extension. When trying to resolve keyboard mapping problems, note that the - [592]-debug_keyboard option prints out much info for every keystroke + [598]-debug_keyboard option prints out much info for every keystroke and so can be useful debugging things. Note that one user had a strange setup and none of the above helped. - His solution was to disable all of the above and use [593]-nomodtweak. + His solution was to disable all of the above and use [599]-nomodtweak. This is the simplest form of keystroke insertion and it actually solved the problem. Try it if the other options don't help. - Q-87: When I try to type a "<" (i.e. less than) instead I get ">" + Q-88: When I try to type a "<" (i.e. less than) instead I get ">" (i.e. greater than)! Strangely, typing ">" works OK!! Does your keyboard have a single key with both "<" and ">" on it? Even @@ -6905,9 +7002,9 @@ EndSection (e.g. pc105 in the XF86Config file when it should be something else, say pc104.) - Short Cut: Try the [594]-xkb or [595]-sloppy_keys options and see if + Short Cut: Try the [600]-xkb or [601]-sloppy_keys options and see if that helps the situation. The discussion below is a bit outdated (e.g. - [596]-modtweak is now the default) but it is useful reference for + [602]-modtweak is now the default) but it is useful reference for various tricks and so is kept. @@ -6950,25 +7047,25 @@ EndSection -remap less-comma These are convenient in that they do not modify the actual X server - settings. The former ([597]-modtweak) is a mode that monitors the + settings. The former ([603]-modtweak) is a mode that monitors the state of the Shift and AltGr modifiers and tries to deduce the correct keycode sequence to send. Since Jul/2004 -modtweak is now the default. - The latter ([598]-remap less-comma) is an immediate remapping of the + The latter ([604]-remap less-comma) is an immediate remapping of the keysym less to the keysym comma when it comes in from a client (so when Shift is down the comma press will yield "<".) - See also the [599]FAQ about the -xkb option as a possible workaround + See also the [605]FAQ about the -xkb option as a possible workaround using the XKEYBOARD extension. - Note that the [600]-debug_keyboard option prints out much info for + Note that the [606]-debug_keyboard option prints out much info for every keystroke to aid debugging keyboard problems. - Q-88: Extra Character Inserted, E.g.: When I try to type a "<" (i.e. + Q-89: Extra Character Inserted, E.g.: When I try to type a "<" (i.e. less than) instead I get "<," (i.e. an extra comma.) This is likely because you press "Shift" then "<" but then released - the Shift key before releasing the "<". Because of a [601]keymapping + the Shift key before releasing the "<". Because of a [607]keymapping ambiguity the last event "< up" is interpreted as "," because that key unshifted is the comma. @@ -6976,16 +7073,16 @@ EndSection characters: in general it can happen whenever the Shift key is released early. - This should not happen in [602]-xkb mode, because it works hard to + This should not happen in [608]-xkb mode, because it works hard to resolve the ambiguities. If you do not want to use -xkb, try the - option [603]-sloppy_keys to attempt a similar type of algorithm. + option [609]-sloppy_keys to attempt a similar type of algorithm. One user had this problem for Italian and German keyboards with the key containing ":" and "." When he typed ":" he would get an extra "." inserted after the ":". The solution was -sloppy_keys. - Q-89: I'm using an "international" keyboard (e.g. German "de", or + Q-90: I'm using an "international" keyboard (e.g. German "de", or Danish "dk") and the -modtweak mode works well if the VNC viewer is run on a Unix/Linux machine with a similar keyboard. But if I run the VNC viewer on Unix/Linux with a different keyboard (e.g. "us") or @@ -7006,7 +7103,7 @@ EndSection In both cases no AltGr is sent to the VNC server, but we know AltGr is needed on the physical international keyboard to type a "@". - This all worked fine with x11vnc running with the [604]-modtweak + This all worked fine with x11vnc running with the [610]-modtweak option (it figures out how to adjust the Modifier keys (Shift or AltGr) to get the "@".) However it fails under recent versions of XFree86 (and the X.org fork.) These run the XKEYBOARD extension by @@ -7023,7 +7120,7 @@ EndSection * there is a new option -xkb to use the XKEYBOARD extension API to do the Modifier key tweaking. - The [605]-xkb option seems to fix all of the missing keys: "@", "<", + The [611]-xkb option seems to fix all of the missing keys: "@", "<", ">", etc.: it is recommended that you try it if you have this sort of problem. Let us know if there are any remaining problems (see the next paragraph for some known problems.) If you specify the -debug_keyboard @@ -7031,7 +7128,7 @@ EndSection debugging output (send it along with any problems you report.) Update: as of Jun/2005 x11vnc will try to automatically enable - [606]-xkb if it appears that would be beneficial (e.g. if it sees any + [612]-xkb if it appears that would be beneficial (e.g. if it sees any of "@", "<", ">", "[" and similar keys are mapped in a way that needs the -xkb to access them.) To disable this automatic check use -noxkb. @@ -7046,7 +7143,7 @@ EndSection was attached to keycode 93 (no physical key generates this keycode) while ISO_Level3_Shift was attached to keycode 113. The keycode skipping option was used to disable the ghost key: - [607]-skip_keycodes 93 + [613]-skip_keycodes 93 * In implementing -xkb we noticed that some characters were still not getting through, e.g. "~" and "^". This is not really an XKEYBOARD problem. What was happening was the VNC viewer was @@ -7064,16 +7161,16 @@ EndSection What to do? In general the VNC protocol has not really solved this problem: what should be done if the VNC viewer sends a keysym not recognized by the VNC server side? Workarounds can possibly be - created using the [608]-remap x11vnc option: + created using the [614]-remap x11vnc option: -remap asciitilde-dead_tilde,asciicircum-dead_circumflex etc. Use -remap filename if the list is long. Please send us your workarounds for this problem on your keyboard. Perhaps we can have x11vnc adjust automatically at some point. Also see the - [609]-add_keysyms option in the next paragraph. - Update: for convenience "[610]-remap DEAD" does many of these + [615]-add_keysyms option in the next paragraph. + Update: for convenience "[616]-remap DEAD" does many of these mappings at once. - * To complement the above workaround using the [611]-remap, an - option [612]-add_keysyms was added. This option instructs x11vnc + * To complement the above workaround using the [617]-remap, an + option [618]-add_keysyms was added. This option instructs x11vnc to bind any unknown Keysyms coming in from VNC viewers to unused Keycodes in the X server. This modifies the global state of the X server. When x11vnc exits it removes the extra keymappings it @@ -7084,7 +7181,7 @@ EndSection disable. - Q-90: When typing I sometimes get double, triple, or more of my + Q-91: When typing I sometimes get double, triple, or more of my keystrokes repeated. I'm sure I only typed them once, what can I do? This may be due to an interplay between your X server's key autorepeat @@ -7092,7 +7189,7 @@ EndSection Short answer: disable key autorepeating by running the command "xset r off" on the Xserver where x11vnc is run (restore via "xset r on") or - use the new (Jul/2004) [613]-norepeat x11vnc option. You will still + use the new (Jul/2004) [619]-norepeat x11vnc option. You will still have autorepeating because that is taken care of on your VNC viewer side. @@ -7116,18 +7213,18 @@ EndSection off", does the problem go away? The workaround is to manually apply "xset r off" and "xset r on" as - needed, or to use the [614]-norepeat (which has since Dec/2004 been + needed, or to use the [620]-norepeat (which has since Dec/2004 been made the default.) Note that with X server autorepeat turned off the VNC viewer side of the connection will (nearly always) do its own autorepeating so there is no big loss here, unless someone is also working at the physical display and misses his autorepeating. - Q-91: The x11vnc -norepeat mode is in effect, but I still get repeated + Q-92: The x11vnc -norepeat mode is in effect, but I still get repeated keystrokes!! Are you using x11vnc to log in to an X session via display manager? - (as described in [615]this FAQ) If so, x11vnc is starting before your + (as described in [621]this FAQ) If so, x11vnc is starting before your session and it disables autorepeat when you connect, but then after you log in your session startup (GNOME, KDE, ...) could be resetting the autorepeat to be on. Or it could be something inside your desktop @@ -7147,7 +7244,7 @@ EndSection should figure out how to disable that somehow. - Q-92: After using x11vnc for a while, I find that I cannot type some + Q-93: After using x11vnc for a while, I find that I cannot type some (or any) characters or my mouse clicks and drags no longer have any effect, or they lead to strange effects. What happened? @@ -7188,11 +7285,11 @@ EndSection desktop manages these "warps". If the viewer is not notified it cannot know it needs to release the modifiers. - You can also use the [616]-clear_mods option to try to clear all of + You can also use the [622]-clear_mods option to try to clear all of the modifier keys at x11vnc startup. You will still have to be careful that you do not leave the modifier key pressed down during your session. It is difficult to prevent this problem from occurring (short - of using [617]-remap to prevent sending all of the problem modifier + of using [623]-remap to prevent sending all of the problem modifier keys, which would make the destkop pretty unusable.) During a session these x11vnc remote control commands can also help: @@ -7205,16 +7302,16 @@ EndSection Num_Lock down. When these are locked on the remote side it can sometimes lead to strange desktop behavior (e.g. cannot drag or click on windows.) As above you may not notice this because the lock isn't - down on the local (Viewer) side. See [618]this FAQ on lock keys - problem. These options may help avoid the problem: [619]-skip_lockkeys - and [620]-capslock. See also [621]-clear_all. + down on the local (Viewer) side. See [624]this FAQ on lock keys + problem. These options may help avoid the problem: [625]-skip_lockkeys + and [626]-capslock. See also [627]-clear_all. - Q-93: The machine where I run x11vnc has an AltGr key, but the local + Q-94: The machine where I run x11vnc has an AltGr key, but the local machine where I run the VNC viewer does not. Is there a way I can map a local unused key to send an AltGr? How about a Compose key as well? - Something like "[622]-remap Super_R-Mode_switch" x11vnc option may + Something like "[628]-remap Super_R-Mode_switch" x11vnc option may work. Note that Super_R is the "Right Windoze(tm) Flaggie" key; you may want to choose another. The -debug_keyboard option comes in handy in finding keysym names (so does xev(1).) @@ -7225,7 +7322,7 @@ EndSection specify remappings from a file. - Q-94: I have a Sun machine I run x11vnc on. Its Sun keyboard has just + Q-95: I have a Sun machine I run x11vnc on. Its Sun keyboard has just one Alt key labelled "Alt" and two Meta keys labelled with little diamonds. The machine where I run the VNC viewer only has Alt keys. How can I send a Meta keypress? (e.g. emacs needs this) @@ -7237,13 +7334,13 @@ EndSection Since xmodmap(1) modifies the X server mappings you may not want to do this (because it affects local work on that machine.) Something like - the [623]-remap Alt_L-Meta_L to x11vnc may be sufficient for ones + the [629]-remap Alt_L-Meta_L to x11vnc may be sufficient for ones needs, and does not modify the X server environment. Note that you cannot send Alt_L in this case, maybe -remap Super_L-Meta_L would be a better choice if the Super_L key is typically unused in Unix. - Q-95: Running x11vnc on HP-UX I cannot type "#" I just get a "3" + Q-96: Running x11vnc on HP-UX I cannot type "#" I just get a "3" instead. One user reports this problem on HP-UX Rel_B.11.23. The problem was @@ -7257,7 +7354,7 @@ EndSection and similar triple mappings (with two in the AltGr/Mode_switch group) of a keysum to a single keycode. - Use the [624]-nomodtweak option as a workaround. You can also use + Use the [630]-nomodtweak option as a workaround. You can also use xmodmap to correct these mappings in the server, e.g.: xmodmap -e "keycode 47 = 3 numbersign" @@ -7266,12 +7363,12 @@ EndSection handle these mappings better. - Q-96: Can I map a keystroke to a mouse button click on the remote + Q-97: Can I map a keystroke to a mouse button click on the remote machine? This can be done directly in some X servers using AccessX and Pointer_EnableKeys, but is a bit awkward. It may be more convenient to - have x11vnc do the remapping. This can be done via the [625]-remap + have x11vnc do the remapping. This can be done via the [631]-remap option using the fake "keysyms" Button1, Button2, etc. as the "to" keys (i.e. the ones after the "-") @@ -7280,7 +7377,7 @@ EndSection button "paste" because (using XFree86/Xorg Emulate3Buttons) you have to click both buttons on the touch pad at the same time. This remapping: - [626]-remap Super_R-Button2 + [632]-remap Super_R-Button2 maps the Super_R "flag" key press to the Button2 click, thereby making X pasting a bit easier. @@ -7289,7 +7386,7 @@ EndSection are generated immediately on the x11vnc side. When the key is released (i.e. goes up) no events are generated. - Q-97: How can I get Caps_Lock to work between my VNC viewer and + Q-98: How can I get Caps_Lock to work between my VNC viewer and x11vnc? This is a little tricky because it is possible to get the Caps_Lock @@ -7299,13 +7396,13 @@ EndSection Caps_Lock in the viewer your local machine goes into the Caps_Lock on state and sends keysym "A" say when you press "a". x11vnc will then fake things up so that Shift is held down to generate "A". The - [627]-skip_lockkeys option should help to accomplish this. For finer - grain control use something like: "[628]-remap Caps_Lock-None". + [633]-skip_lockkeys option should help to accomplish this. For finer + grain control use something like: "[634]-remap Caps_Lock-None". - Also try the [629]-nomodtweak and [630]-capslock options. + Also try the [635]-nomodtweak and [636]-capslock options. Another useful option that turns off any Lock keys on the remote side - at startup and end is the [631]-clear_all option. During a session you + at startup and end is the [637]-clear_all option. During a session you can run these remote control commands to modify the Lock keys: x11vnc -R clear_locks x11vnc -R clear_all @@ -7315,7 +7412,7 @@ EndSection etc.) [Screen Related Issues and Features] - Q-98: The remote display is larger (in number of pixels) than the + Q-99: The remote display is larger (in number of pixels) than the local display I am running the vncviewer on. I don't like the vncviewer scrollbars, what I can do? @@ -7334,15 +7431,15 @@ EndSection There may also be scaling viewers out there (e.g. TightVNC or UltraVNC on Windows) that automatically shrink or expand the remote framebuffer to fit the local display. Especially for hand-held devices. See also - [632]the next FAQ on x11vnc scaling. + [638]the next FAQ on x11vnc scaling. - Q-99: Does x11vnc support server-side framebuffer scaling? (E.g. to + Q-100: Does x11vnc support server-side framebuffer scaling? (E.g. to make the desktop smaller.) As of Jun/2004 x11vnc provides basic server-side scaling. It is a global scaling of the desktop, not a per-client setting. To enable it - use the "[633]-scale fraction" option. "fraction" can either be a + use the "[639]-scale fraction" option. "fraction" can either be a floating point number (e.g. -scale 0.75) or the alternative m/n fraction notation (e.g. -scale 3/4.) Note that if fraction is greater than one the display is magnified. @@ -7367,7 +7464,7 @@ EndSection One can also use the ":nb" with an integer scale factor (say "-scale 2:nb") to use x11vnc as a screen magnifier for vision impaired - [634]applications. Since with integer scale factors the framebuffers + [640]applications. Since with integer scale factors the framebuffers become huge and scaling operations time consuming, be sure to use ":nb" for the fastest response. @@ -7393,7 +7490,7 @@ EndSection If one desires per-client scaling for something like 1:1 from a workstation and 1:2 from a smaller device (e.g. handheld), currently the only option is to run two (or more) x11vnc processes with - different scalings listening on separate ports ([635]-rfbport option, + different scalings listening on separate ports ([641]-rfbport option, etc.) Update: As of May/2006 x11vnc also supports the UltraVNC server-side @@ -7403,8 +7500,8 @@ EndSection "-rfbversion 3.6" for this to be recognized by UltraVNC viewers. BTW, whenever you run two or more x11vnc's on the same X display and - use the [636]GUI, then to avoid all of the x11vnc's simultaneously - answering the gui you will need to use something like [637]"-connect + use the [642]GUI, then to avoid all of the x11vnc's simultaneously + answering the gui you will need to use something like [643]"-connect file1 -gui ..." with different connect files for each x11vnc you want to control via the gui (or remote-control.) The "-connect file1" usage gives separate communication channels between a x11vnc process and the @@ -7413,12 +7510,12 @@ EndSection Update: As of Mar/2005 x11vnc now scales the mouse cursor with the same scale factor as the screen. If you don't want that, use the - [638]"-scale_cursor frac" option to set the cursor scaling to a + [644]"-scale_cursor frac" option to set the cursor scaling to a different factor (e.g. use "-scale_cursor 1" to keep the cursor at its natural unscaled size.) - Q-100: Does x11vnc work with Xinerama? (i.e. multiple monitors joined + Q-101: Does x11vnc work with Xinerama? (i.e. multiple monitors joined together to form one big, single screen.) Yes, it should generally work because it simply polls the big @@ -7441,26 +7538,26 @@ EndSection screen is not rectangular (e.g. 1280x1024 and 1024x768 monitors joined together), then there will be "non-existent" areas on the screen. The X server will return "garbage" image data for these areas and so they - may be distracting to the viewer. The [639]-blackout x11vnc option + may be distracting to the viewer. The [645]-blackout x11vnc option allows you to blacken-out rectangles by manually specifying their WxH+X+Y geometries. If your system has the libXinerama library, the - [640]-xinerama x11vnc option can be used to have it automatically + [646]-xinerama x11vnc option can be used to have it automatically determine the rectangles to be blackened out. (Note on 8bpp PseudoColor displays the fill color may not be black.) Update: - [641]-xinerama is now on by default. + [647]-xinerama is now on by default. Some users have reported that the mouse does not behave properly for their Xinerama display: i.e. the mouse cannot be moved to all regions - of the large display. If this happens try using the [642]-xwarppointer + of the large display. If this happens try using the [648]-xwarppointer option. This instructs x11vnc to fake mouse pointer motions using the XWarpPointer function instead of the XTestFakeMotionEvent XTEST function. (This may be due to a bug in the X server for XTEST when - Xinerama is enabled.) Update: As of Dec/2006 [643]-xwarppointer will + Xinerama is enabled.) Update: As of Dec/2006 [649]-xwarppointer will be applied automatically if Xinerama is detected. To disable use: -noxwarppointer - Q-101: Can I use x11vnc on a multi-headed display that is not Xinerama + Q-102: Can I use x11vnc on a multi-headed display that is not Xinerama (i.e. separate screens :0.0, :0.1, ... for each monitor)? You can, but it is a little bit awkward: you must start separate @@ -7478,32 +7575,32 @@ EndSection Note: if you are running on Solaris 8 or earlier you can easily hit up against the maximum of 6 shm segments per process (for Xsun in this case) from running multiple x11vnc processes. You should modify - /etc/system as mentioned in another [644]FAQ to increase the limit. It - is probably also a good idea to run with the [645]-onetile option in + /etc/system as mentioned in another [650]FAQ to increase the limit. It + is probably also a good idea to run with the [651]-onetile option in this case (to limit each x11vnc to 3 shm segments), or even - [646]-noshm to use no shm segments. + [652]-noshm to use no shm segments. - Q-102: Can x11vnc show only a portion of the display? (E.g. for a + Q-103: Can x11vnc show only a portion of the display? (E.g. for a special purpose application or a very large screen.) - As of Mar/2005 x11vnc has the "[647]-clip WxH+X+Y" option to select a + As of Mar/2005 x11vnc has the "[653]-clip WxH+X+Y" option to select a rectangle of width W, height H and offset (X, Y). Thus the VNC screen will be the clipped sub-region of the display and be only WxH in size. - One user used -clip to split up a large [648]Xinerama screen into two + One user used -clip to split up a large [654]Xinerama screen into two more managable smaller screens. This also works to view a sub-region of a single application window if - the [649]-id or [650]-sid options are used. The offset is measured + the [655]-id or [656]-sid options are used. The offset is measured from the upper left corner of the selected window. - Q-103: Does x11vnc support the XRANDR (X Resize, Rotate and + Q-104: Does x11vnc support the XRANDR (X Resize, Rotate and Reflection) extension? Whenever I rotate or resize the screen x11vnc just seems to crash. As of Dec/2004 x11vnc supports XRANDR. You enable it with the - [651]-xrandr option to make x11vnc monitor XRANDR events and also trap + [657]-xrandr option to make x11vnc monitor XRANDR events and also trap X server errors if the screen change occurred in the middle of an X call like XGetImage. Once it traps the screen change it will create a new framebuffer using the new screen. @@ -7513,9 +7610,9 @@ EndSection then the viewer will automatically resize. Otherwise, the new framebuffer is fit as best as possible into the original viewer size (portions of the screen may be clipped, unused, etc.) For these - viewers you can try the [652]-padgeom option to make the region big + viewers you can try the [658]-padgeom option to make the region big enough to hold all resizes and rotations. We have fixed this problem - for the TightVNC Viewer on Unix: [653]SSVNC + for the TightVNC Viewer on Unix: [659]SSVNC If you specify "-xrandr newfbsize" then vnc viewers that do not support NewFBSize will be disconnected before the resize. If you @@ -7523,21 +7620,21 @@ EndSection terminate. - Q-104: Independent of any XRANDR, can I have x11vnc rotate and/or + Q-105: Independent of any XRANDR, can I have x11vnc rotate and/or reflect the screen that the VNC viewers see? (e.g. for a handheld whose screen is rotated 90 degrees.) - As of Jul/2006 there is the [654]-rotate option allow this. E.g's: + As of Jul/2006 there is the [660]-rotate option allow this. E.g's: "-rotate +90", "-rotate -90", "-rotate x", etc. - Q-105: Why is the view in my VNC viewer completely black? Or why is + Q-106: Why is the view in my VNC viewer completely black? Or why is everything flashing around randomly? See the next FAQ for a possible explanation. - Q-106: I use Linux Virtual Terminals (VT's) to implement 'Fast User + Q-107: I use Linux Virtual Terminals (VT's) to implement 'Fast User Switching' between users' sessions (e.g. Betty is on Ctrl-Alt-F7, Bobby is on Ctrl-Alt-F8, and Sid is on Ctrl-Alt-F1: they use those keystrokes to switch between their sessions.) How come the view in a @@ -7566,7 +7663,7 @@ EndSection "chvt 7" for VT #7. - Q-107: I am using x11vnc where my local machine has "popup/hidden + Q-108: I am using x11vnc where my local machine has "popup/hidden taskbars" and the remote display where x11vnc runs also has "popup/hidden taskbars" and they interfere and fight with each other. What can I do? @@ -7581,7 +7678,7 @@ EndSection click on the task bar panel, and uncheck "enable auto-hide" from the panel properties dialog box. This will make the panel always visible. - Q-108: Help! x11vnc and my KDE screensaver keep switching each other + Q-109: Help! x11vnc and my KDE screensaver keep switching each other on and off every few seconds. This is a new (Jul/2006) problem seen, say, on the version of KDE that @@ -7592,13 +7689,13 @@ EndSection This may be a bug in kdesktop_lock. For now the only workaround is to disable the screensaver. You can try using another one such as - straight xscreensaver (see the instructions [655]here for how to + straight xscreensaver (see the instructions [661]here for how to disable kdesktop_lock.) If you have more info on this or see it outside of KDE please let us know. Update: It appears this is due to kdesktop_lock enabling the screen saver when the Monitor is in DPMS low-power state (e.g. standby, - suspend, or off.) In Nov/2006 the x11vnc [656]-nodpms option was added + suspend, or off.) In Nov/2006 the x11vnc [662]-nodpms option was added as a workaround. Normally it is a good thing that the monitor powers down (since x11vnc can still poll the framebuffer in this state), but if you experience the kdesktop_lock problem you can specify the @@ -7608,22 +7705,22 @@ EndSection disable the screensaver.) Feel free to file a bug against kdesktop_lock with KDE. - Q-109: I am running the beryl 3D window manager (or compiz, MythTv, + Q-110: I am running the beryl 3D window manager (or compiz, MythTv, Google Earth, or some other OpenGL app) and I do not get screen updates in x11vnc. This appears to be because the 3D OpenGL/GLX hardware screen updates do not get reported via the XDAMAGE mechanism. So this is a bug in - [657]beryl/compiz or XDAMAGE/Xorg or the (possibly 3rd party) video + [663]beryl/compiz or XDAMAGE/Xorg or the (possibly 3rd party) video card driver. - As a workaround apply the [658]-noxdamage option. As of Feb/2007 + As a workaround apply the [664]-noxdamage option. As of Feb/2007 x11vnc will try to autodetect the problem and disable XDAMAGE if is appears to be missing a lot of updates. But if you know you are using - beryl you might as well always supply -noxdamage. Thanks to [659]this + beryl you might as well always supply -noxdamage. Thanks to [665]this user who reported the problem and discovered the workaround. - A developer for [660]MiniMyth reports that the 'alphapulse' tag of the + A developer for [666]MiniMyth reports that the 'alphapulse' tag of the theme G.A.N.T. can also cause problems, and should be avoided when using VNC. @@ -7632,7 +7729,7 @@ EndSection responsiveness (especially for typing) and also leads to unnecessary CPU and memory I/O load due to the extra polling. - Q-110: Can I use x11vnc to view my VMWare session remotely? + Q-111: Can I use x11vnc to view my VMWare session remotely? Yes, since VMWare usually runs as an X application you can view it via x11vnc in the normal way. @@ -7643,9 +7740,9 @@ EndSection * Fullscreen mode The way VMWare does Fullscreen mode on Linux is to display the Guest - desktop in a separate Virtual Terminal (e.g. VT 8) (see [661]this FAQ + desktop in a separate Virtual Terminal (e.g. VT 8) (see [667]this FAQ on VT's for background.) Unfortunately, this Fullscreen VT is not an X - server. So x11vnc cannot access it (however, [662]see this discussion + server. So x11vnc cannot access it (however, [668]see this discussion of -rawfb for a possible workaround.) x11vnc works fine with "Normal X application window" and "Quick-Switch mode" because these use X. @@ -7666,13 +7763,13 @@ EndSection improve response. One can also cut the display depth (e.g. to 16bpp) in this 2nd X session to improve video performance. This 2nd X session emulates Fullscreen mode to some degree and can be viewed via x11vnc - as long as the VMWare X session [663]is in the active VT. + as long as the VMWare X session [669]is in the active VT. Also note that with a little bit of playing with "xwininfo -all -children" output one can extract the (non-toplevel) window-id of the of the Guest desktop only when VMWare is running as a normal X application. Then one can export just the guest desktop (i.e. without - the VMWare menu buttons) by use of the [664]-id windowid option. The + the VMWare menu buttons) by use of the [670]-id windowid option. The caveats are the X session VMWare is in must be in the active VT and the window must be fully visible, so this mode is not terribly convenient, but could be useful in some circumstances (e.g. running @@ -7684,14 +7781,14 @@ EndSection [Exporting non-X11 devices via VNC] - Q-111: Can non-X devices (e.g. a raw framebuffer) be viewed (and even + Q-112: Can non-X devices (e.g. a raw framebuffer) be viewed (and even controlled) via VNC with x11vnc? As of Apr/2005 there is support for this. Two options were added: - "[665]-rawfb string" (to indicate the raw frame buffer device, file, - etc. and its parameters) and "[666]-pipeinput command" (to provide an + "[671]-rawfb string" (to indicate the raw frame buffer device, file, + etc. and its parameters) and "[672]-pipeinput command" (to provide an external program that will inject or otherwise process mouse and - keystroke input.) Some useful [667]-pipeinput schemes, VID, CONSOLE, + keystroke input.) Some useful [673]-pipeinput schemes, VID, CONSOLE, and UINPUT, have since been built into x11vnc for convenience. This non-X mode for x11vnc is somewhat experimental because it is so @@ -7731,9 +7828,9 @@ EndSection access method.) Only use file if map isn't working. BTW, "mmap" is an alias for "map" and if you do not supply a type and the file exists, map is assumed (see the -help output and below for some exceptions to - this.) The "snap:" setting applies the [668]-snapfb option with + this.) The "snap:" setting applies the [674]-snapfb option with "file:" type reading (this is useful for exporting webcams or TV tuner - video; see [669]the next FAQ for more info.) + video; see [675]the next FAQ for more info.) Also, if the string is of the form "setup:cmd" then cmd is run and the first line of its output retrieved and used as the rawfb string. This @@ -7778,7 +7875,7 @@ EndSection screen to either shm or a mapped file. The format of these is XWD and so the initial header should be skipped. BTW, since XWD is not strictly RGB the view will only be approximate, but usable. Of course - for the case of Xvfb x11vnc can poll it much better via the [670]X + for the case of Xvfb x11vnc can poll it much better via the [676]X API, but you get the idea. By default in -rawfb mode x11vnc will actually close any X display it @@ -7809,13 +7906,13 @@ minal #2) tty1-tty6), or X graphical display (usually starting at tty7.) In addition to the text console other graphical ones may be viewed and interacted with as well, e.g. DirectFB or SVGAlib apps, VMWare non-X - fullscreen, or [671]Qt-embedded apps (PDAs/Handhelds.) By default the + fullscreen, or [677]Qt-embedded apps (PDAs/Handhelds.) By default the pipeinput mechanisms UINPUT and CONSOLE (keystrokes only) are automatically attempted in this mode under "-rawfb console". The Video4Linux Capture device, /dev/video0, etc is either a Webcam or a TV capture device and needs to have its driver enabled in the - kernel. See [672]this FAQ for details. If specified via "-rawfb Video" + kernel. See [678]this FAQ for details. If specified via "-rawfb Video" then the pipeinput method "VID" is applied (it lets you change video parameters dynamically via keystrokes.) @@ -7823,10 +7920,10 @@ minal #2) also useful in testing. - All of the above [673]-rawfb options are just for viewing the raw + All of the above [679]-rawfb options are just for viewing the raw framebuffer (although some of the aliases do imply keystroke and mouse pipeinput methods.) That may be enough for certain applications of - this feature (e.g. suppose a [674]video camera mapped its framebuffer + this feature (e.g. suppose a [680]video camera mapped its framebuffer into memory and you just wanted to look at it via VNC.) To handle the pointer and keyboard input from the viewer users the "-pipeinput cmd" option was added to indicate a helper program to @@ -7864,7 +7961,7 @@ minal #2) keystrokes into the Linux console (e.g. the virtual consoles: /dev/tty1, /dev/tty2, etc) in x11vnc/misc/vcinject.pl. It is based on the vncterm/LinuxVNC.c program also in the libvncserver CVS. So to - view and interact with VT #2 (assuming it is the [675]active VT) one + view and interact with VT #2 (assuming it is the [681]active VT) one can run something like: x11vnc -rawfb map:/dev/fb0@1024x768x16 -pipeinput './vcinject.pl 2' @@ -7919,7 +8016,7 @@ minal #2) better to use the more accurate and faster LinuxVNC program. The advantage x11vnc -rawfb might have is that it can allow interaction with a non-text application, e.g. one based on SVGAlib or - [676]Qt-embedded Also, for example the [677]VMWare Fullscreen mode is + [682]Qt-embedded Also, for example the [683]VMWare Fullscreen mode is actually viewable under -rawfb and can be interacted with if uinput is enabled. @@ -7936,7 +8033,7 @@ minal #2) program that passes the framebuffer to libvncserver. - Q-112: Can I export the Linux Console (Virtual Terminals) via VNC + Q-113: Can I export the Linux Console (Virtual Terminals) via VNC using x11vnc? Yes, you may need to be root to access the devices that make up the @@ -7981,12 +8078,12 @@ minal #2) startx (or similar, e.g. gdm) in the virtual terminal. A 2nd x11vnc could be used to see if the X server is now working correctly. - Q-113: Can I export via VNC a Webcam or TV tuner framebuffer using + Q-114: Can I export via VNC a Webcam or TV tuner framebuffer using x11vnc? - Yes, this is possible to some degree with the [678]-rawfb option. + Yes, this is possible to some degree with the [684]-rawfb option. There is no X11 involved: snapshots from the video capture device are - used for the screen image data. See the [679]previous FAQ on -rawfb + used for the screen image data. See the [685]previous FAQ on -rawfb for background. For best results, use x11vnc version 0.8.1 or later. Roughly, one would do something like this: @@ -7998,7 +8095,7 @@ minal #2) snapshot to a file that you point -rawfb to; ask me if it is not clear what to do.) - The "snap:" enforces [680]-snapfb mode which appears to be necessary. + The "snap:" enforces [686]-snapfb mode which appears to be necessary. The read pointer for video capture devices cannot be repositioned (which would be needed for scanline polling), but you can read a full frame of data from the device. @@ -8020,7 +8117,7 @@ minal #2) Many video4linux drivers tend to set the framebuffer to be 24bpp (as opposed to 32bpp.) Since this can cause problems with VNC viewers, - etc, the [681]-24to32 option will be automatically imposed when in + etc, the [687]-24to32 option will be automatically imposed when in 24bpp. Note that by its very nature, video capture involves rapid change in @@ -8028,7 +8125,7 @@ minal #2) wavering in brightness is always happening. This can lead to much network bandwidth consumption for the VNC traffic and also local CPU and I/O resource usage. You may want to experiment with "dialing down" - the framerate via the [682]-wait, [683]-slow_fb, or [684]-defer + the framerate via the [688]-wait, [689]-slow_fb, or [690]-defer options. Decreasing the window size and bpp also helps. @@ -8117,16 +8214,16 @@ minal #2) format to HI240, RGB565, RGB24, RGB32, RGB555, and GREY respectively. See -rawfb video for details. - See also the [685]-freqtab option to supply your own xawtv channel to + See also the [691]-freqtab option to supply your own xawtv channel to frequency mappings for your country (only ntsc-cable-us is built into x11vnc.) - Q-114: Can I connect via VNC to a Qt-embedded/Qtopia application + Q-115: Can I connect via VNC to a Qt-embedded/Qtopia application running on my handheld or PC using the Linux console framebuffer (i.e. not X11)? - Yes, the basic method for this is the [686]-rawfb scheme where the + Yes, the basic method for this is the [692]-rawfb scheme where the Linux console framebuffer (usually /dev/fb0) is polled and the uinput driver is used to inject keystrokes and mouse input. Often you will just have to type: @@ -8139,7 +8236,7 @@ minal #2) x11vnc -rawfb /dev/fb0@640x480x16 Also, to force usage of the uinput injection method use "-pipeinput - UINPUT". See the [687]-pipeinput description for tunable parameters, + UINPUT". See the [693]-pipeinput description for tunable parameters, etc. One problem with the x11vnc uinput scheme is that it cannot guess the @@ -8155,7 +8252,7 @@ minal #2) Even with the correct acceleration setting there is still some drift (probably because of the mouse threshold where the acceleration kicks in) and so x11vnc needs to reposition the cursor from 0,0 about 5 - times a second. See the [688]-pipeinput UINPUT option for tuning + times a second. See the [694]-pipeinput UINPUT option for tuning parameters that can be set (there are some experimental thresh=N tuning parameters as well) @@ -8187,10 +8284,10 @@ minal #2) not work. - Q-115: Now that non-X11 devices can be exported via VNC using x11vnc, + Q-116: Now that non-X11 devices can be exported via VNC using x11vnc, can I build it with no dependencies on X11 header files and libraries? - Yes, as of Jul/2006 x11vnc enables building for [689]-rawfb only + Yes, as of Jul/2006 x11vnc enables building for [695]-rawfb only support. Just do something like when building: ./configure --without-x (plus any other flags) make @@ -8201,16 +8298,16 @@ minal #2) know what you did. - Q-116: Does x11vnc support Mac OS X Aqua/Quartz displays natively + Q-117: Does x11vnc support Mac OS X Aqua/Quartz displays natively (i.e. no X11 involved)? Yes, since Nov/2006 in the development tree (x11vnc-0.8.4 tarball) there is support for native Mac OS X Aqua/Quartz displays using the - [690]-rawfb mechanism described above. The mouse and keyboard input is + [696]-rawfb mechanism described above. The mouse and keyboard input is achieved via Mac OS X API's. - So you can use x11vnc as an alternative to [691]OSXvnc (aka Vine - Server), or [692]Apple Remote Desktop (ARD). Perhaps there is some + So you can use x11vnc as an alternative to [697]OSXvnc (aka Vine + Server), or [698]Apple Remote Desktop (ARD). Perhaps there is some x11vnc feature you'd like to use on Mac OS X, etc. For a number of activities (e.g. window drags) it seems to be faster than OSXvnc. @@ -8220,7 +8317,7 @@ minal #2) (XDarwin) running on Mac OS X (people often install this software to display remote X11 apps on their Mac OS X system, or use some old favorites locally such as xterm.) However in this case x11vnc will - only work reasonably in single window [693]-id windowid mode (and the + only work reasonably in single window [699]-id windowid mode (and the window may need to have mouse focus.) If you do not have the DISPLAY env. variable set, x11vnc will assume @@ -8238,9 +8335,9 @@ minal #2) ./configure --without-x make - Win2VNC/x2vnc: One handy use is to use the [694]-nofb mode to + Win2VNC/x2vnc: One handy use is to use the [700]-nofb mode to redirect mouse and keyboard input to a nearby Mac (i.e. one to the - side of your desk) via [695]x2vnc or Win2VNC. See [696]this FAQ for + side of your desk) via [701]x2vnc or Win2VNC. See [702]this FAQ for more info. Options: Here are the Mac OS X specific x11vnc options: @@ -8310,17 +8407,17 @@ rm -f $tmp command for you.) Then once you are connected via VNC, iconify the Terminal windows (you can't delete them since that will kill x11vnc.) - Q-117: Can x11vnc be used as a VNC reflector/repeater to improve + Q-118: Can x11vnc be used as a VNC reflector/repeater to improve performance for the case of a large number of simultaneous VNC viewers (e.g. classroom broadcasting or a large demo)? - Yes, as of Feb/2007 there is the "[697]-reflect host:N" option to + Yes, as of Feb/2007 there is the "[703]-reflect host:N" option to connect to the VNC server "host:N" (either another x11vnc or any other VNC server) and re-export it. VNC viewers then connect to the x11vnc(s) running -reflect. The -reflect option is the same as: "-rawfb vnc:host:N". See the - [698]-rawfb description under "VNC HOST" for more details. + [704]-rawfb description under "VNC HOST" for more details. You can replace "host:N" with "listen" or "listen:port" for reverse connections. @@ -8381,18 +8478,18 @@ rm -f $tmp re-exports via VNC to its clients C.) However, CopyRect and CursorShape encodings are preserved in the reflection and that helps. Dragging windows with the mouse can be a problem (especially if S is - not doing wireframing somehow, consider [699]-nodragging if the + not doing wireframing somehow, consider [705]-nodragging if the problem is severe) For a really fast reflector/repeater it would have to be implemented from scratch with performance in mind. See these other projects: - [700]http://sourceforge.net/projects/vnc-reflector/, - [701]http://www.tightvnc.com/projector/ (closed source?), + [706]http://sourceforge.net/projects/vnc-reflector/, + [707]http://www.tightvnc.com/projector/ (closed source?), Automation via Reverse Connections: Instead of having the R's connect directly to S and then the C's connect directly to the R they should use, some convenience can be achieved by using reverse - connections (the x11vnc "[702]"-connect host1,host2,..." option.) + connections (the x11vnc "[708]"-connect host1,host2,..." option.) Suppose all the clients "C" are started up in Listen mode: client1> vncviewer -listen client2> vncviewer -listen @@ -8419,7 +8516,7 @@ rm -f $tmp us know what you did. A really nice thing would be some sort of auto-discovery of your repeater, etc... - Q-118: Can x11vnc be used during a Linux, Solaris, etc. system + Q-119: Can x11vnc be used during a Linux, Solaris, etc. system Installation so the Installation can be done remotely? This can be done, but it doesn't always work because it depends on how @@ -8451,7 +8548,7 @@ rm -f $tmp If the Solaris install is an older X-based one, there will be a menu for you to get a terminal window. From that window you might be able to retrieve x11vnc.static via wget, scp, or ftp. Remember to do "chmod - 755 ./x11vnc.static" and then find the -auth file as in [703]this FAQ. + 755 ./x11vnc.static" and then find the -auth file as in [709]this FAQ. If it is a Linux install that uses an X server (e.g. SuSE and probably Fedora), then you can often get a shell by pressing Ctrl-Alt-F2 or @@ -8460,8 +8557,8 @@ rm -f $tmp wget http://192.168.0.22/x11vnc.static chmod 755 ./x11vnc.static - Find the name of the auth file as in [704]this FAQ. (maybe run "ps - wwwaux | grep auth".) Then run it like this: + Find the name of the auth file as in [710]this FAQ. (maybe run "ps + wwaux | grep auth".) Then run it like this: ./x11vnc.static -forever -nopw -display :0 -auth /tmp/wherever/the/authfile then press Alt-F7 to go back to the X install. You should now be able @@ -8469,7 +8566,7 @@ rm -f $tmp the display being :1, etc. If there is a firewall blocking incoming connections during the - install, use the [705]"-connect hostname" option option for a reverse + install, use the [711]"-connect hostname" option option for a reverse connection to the hostname running the VNC viewer in listen mode. Debian based installs are either console-text or console-framebuffer @@ -8512,7 +8609,7 @@ rm -f $tmp [Misc: Clipboard, File Transfer/Sharing, Printing, Sound, Beeps, Thanks, etc.] - Q-119: Does the Clipboard/Selection get transferred between the + Q-120: Does the Clipboard/Selection get transferred between the vncviewer and the X display? As of Jan/2004 x11vnc supports the "CutText" part of the RFB (aka VNC) @@ -8531,7 +8628,7 @@ rm -f $tmp as 'for power users' or 'an Easter Egg'. As soon as text is highlighted it is set to the PRIMARY selection and so it is immediately ready for pasting, usually via the Middle Mouse Button or - "Shift+Insert". See [706]this jwz link for more information. + "Shift+Insert". See [712]this jwz link for more information. x11vnc's default behavior is to watch both CLIPBOARD and PRIMARY and whenever one of them changes, it sends the new text to connected @@ -8548,37 +8645,37 @@ rm -f $tmp You may not like these defaults. Here are ways to change the behavior: * If you don't want the Clipboard/Selection exchanged at all use the - [707]-nosel option. + [713]-nosel option. * If you want changes in PRIMARY to be ignored use the - [708]-noprimary option. + [714]-noprimary option. * If you want changes in CLIPBOARD to be ignored use the - [709]-noclipboard option. + [715]-noclipboard option. * If you don't want x11vnc to set PRIMARY to the "CutText" received - from viewers use the [710]-nosetprimary option. + from viewers use the [716]-nosetprimary option. * If you don't want x11vnc to set CLIPBOARD to the "CutText" - received from viewers use the [711]-nosetclipboard option. + received from viewers use the [717]-nosetclipboard option. - You can also fine-tune it a bit with the [712]-seldir dir option and - also [713]-input. + You can also fine-tune it a bit with the [718]-seldir dir option and + also [719]-input. You may need to watch out for desktop utilities such as KDE's "Klipper" that do odd things with the selection, clipboard, and cutbuffers. - Q-120: Can I use x11vnc to record a Shock Wave Flash (or other format) + Q-121: Can I use x11vnc to record a Shock Wave Flash (or other format) video of my desktop, e.g. to record a tutorial or demo? Yes, it is possible with a number of tools that record VNC and transform it to swf format or others. One such popular tool is - [714]pyvnc2swf. There are a number of [715]tutorials (broken link?) on + [720]pyvnc2swf. There are a number of [721]tutorials (broken link?) on how to do this. Another option is to use the vnc2mpg that comes in the LibVNCServer package. An important thing to remember when doing this is that tuning parameters should be applied to x11vnc to speed up its polling for this sort of application, e.g. "-wait 10 -defer 10". - Q-121: Can I transfer files back and forth with x11vnc? + Q-122: Can I transfer files back and forth with x11vnc? As of Oct/2005 and May/2006 x11vnc enables, respectively, the TightVNC and UltraVNC file transfer implementations that were added to @@ -8586,11 +8683,11 @@ rm -f $tmp (and Windows viewers only support filetransfer it appears... but they do work to some degree under Wine on Linux.) - The [716]SSVNC Unix VNC viewer supports UltraVNC file transfer by use + The [722]SSVNC Unix VNC viewer supports UltraVNC file transfer by use of a Java helper program. TightVNC file transfer is off by default, if you want to enable it use - the [717]-tightfilexfer option. + the [723]-tightfilexfer option. UltraVNC file transfer is off by default, to enable it use something like "-rfbversion 3.6 -permitfiletransfer" @@ -8613,7 +8710,7 @@ rm -f $tmp IMPORTANT: please understand if -ultrafilexfer or -tightfilexfer is specified and you run x11vnc as root for, say, inetd or display manager (gdm, kdm, ...) access and you do not have it switch users via - the [718]-users option, then VNC Viewers that connect are able to do + the [724]-users option, then VNC Viewers that connect are able to do filetransfer reads and writes as *root*. The UltraVNC and TightVNC settings can be toggled on and off inside @@ -8626,13 +8723,13 @@ rm -f $tmp control you will probably be foiled by the "-rfbversion 3.6" issue. - Q-122: Which UltraVNC extensions are supported? + Q-123: Which UltraVNC extensions are supported? Some of them are supported. To get UltraVNC Viewers to attempt to use these extensions you will need to supply this option to x11vnc: -rfbversion 3.6 - Or use [719]-ultrafilexfer which is an alias for the above option and + Or use [725]-ultrafilexfer which is an alias for the above option and "-permitfiletransfer". UltraVNC evidently treats any other RFB version number as non-UltraVNC. @@ -8644,31 +8741,31 @@ rm -f $tmp * 1/n Server Scaling * rfbEncodingUltra compression encoding - The [720]SSVNC Unix VNC viewer supports these UltraVNC extensions. + The [726]SSVNC Unix VNC viewer supports these UltraVNC extensions. - To disable SingleWindow and ServerInput use [721]-noultraext (the + To disable SingleWindow and ServerInput use [727]-noultraext (the others are managed by LibVNCServer.) See this option too: - [722]-noserverdpms. + [728]-noserverdpms. - Also, the [723]UltraVNC repeater proxy is supported for use with - reverse connections: "[724]-connect repeater://host:port+ID:NNNN". Use + Also, the [729]UltraVNC repeater proxy is supported for use with + reverse connections: "[730]-connect repeater://host:port+ID:NNNN". Use it for both plaintext and SSL connections. This mode can send any string before switching to the VNC protocol, and so could be used with other proxy/gateway tools. Also, a perl repeater implemention is here: - [725]ultravnc_repeater.pl + [731]ultravnc_repeater.pl - Q-123: Can x11vnc emulate UltraVNC's Single Click helpdesk mode for + Q-124: Can x11vnc emulate UltraVNC's Single Click helpdesk mode for Unix? I.e. something very simple for a naive user to initiate a reverse vnc connection from their Unix desktop to a helpdesk operator's VNC Viewer. - Yes, UltraVNC's [726]Single Click (SC) mode can be emulated fairly + Yes, UltraVNC's [732]Single Click (SC) mode can be emulated fairly well on Unix. We use the term "helpdesk" below, but it could be any sort of remote assistance you want to set up, e.g. something for Unix-using friends - or family to use. This includes [727]Mac OS X. + or family to use. This includes [733]Mac OS X. Assume you create a helpdesk directory "hd" on your website: http://www.mysite.com/hd (any website that you can upload files to @@ -8724,7 +8821,7 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc So I guess this is about 3-4 clicks (start a terminal and paste) and pressing "Enter" instead of "single click"... - See [728]this page for some variations on this method, e.g. how to add + See [734]this page for some variations on this method, e.g. how to add a password, SSL Certificates, etc. @@ -8736,11 +8833,11 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc A bit of obscurity security could be put in with a -passwd, -rfbauth options, etc. (note that x11vnc will require a password even for - reverse connections.) More info [729]here. + reverse connections.) More info [735]here. Firewalls: If the helpdesk (you) with the vncviewer is behind a - NAT/Firewall/Router the [730]router will have to be configured to + NAT/Firewall/Router the [736]router will have to be configured to redirect a port (i.e. 5500 or maybe different one if you like) to the vncviewer machine. If the vncviewer machine also has its own host-level firewall, you will have to open up the port there as well. @@ -8750,7 +8847,7 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc configuring a router to do a port redirection (i.e. on your side, the HelpDesk.) To avoid modifying either firewall/router, one would need some public (IP address reachable on the internet) redirection/proxy - service. Perhaps such a thing exists. [731]http://sc.uvnc.com provides + service. Perhaps such a thing exists. [737]http://sc.uvnc.com provides this service for their UltraVNC Single Click users. @@ -8786,7 +8883,7 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc As of Apr/2007 x11vnc supports reverse connections in SSL and so we can do this. On the Helpdesk side (Viewer) you will need STUNNEL or - better use the [732]Enhanced TightVNC Viewer (SSVNC) package we + better use the [738]Enhanced TightVNC Viewer (SSVNC) package we provide that automates all of the SSL for you. To do this create a file named "vncs" in the website "hd" directory @@ -8816,11 +8913,11 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc with the hostnames or IP addresses customized to your case. - The only change from the "vnc" above is the addition of the [733]-ssl + The only change from the "vnc" above is the addition of the [739]-ssl option to x11vnc. This will create a temporary SSL cert: openssl(1) will need to be installed on the user's end. A fixed SSL cert file could be used to avoid this (and provide some authentication; more - info [734]here.) + info [740]here.) The naive user will be doing this: wget -qO - http://www.mysite.com/hd/vncs | sh - @@ -8829,7 +8926,7 @@ chmod 755 ./x11vnc # platform, use $webhost/`uname`/x11vnc But before that, the helpdesk operator needs to have "vncviewer -listen" running as before, however he needs an SSL tunnel at his end. - The easiest way to do this is use [735]Enhanced TightVNC Viewer + The easiest way to do this is use [741]Enhanced TightVNC Viewer (SSVNC). Start it, and select Options -> 'Reverse VNC Connection (-listen)'. Then UN-select 'Verify All Certs' (this can be enabled later if you want; you'll need the x11vnc SSL certificate), and click @@ -8859,7 +8956,7 @@ connect = localhost:5501 answer the prompts with whatever you want; you can take the default for all of them if you like. The openssl(1) package must be installed. - See [736]this link and [737]this one too for more info on SSL certs. + See [742]this link and [743]this one too for more info on SSL certs. This creates $HOME/.vnc/certs/server-self:mystunnel.pem, then you would change the "stunnel.cfg" to look something like: foreground = yes @@ -8880,7 +8977,7 @@ connect = localhost:5501 then all bets are off!. More SSL variations and info about certificates can be found - [738]here. + [744]here. OpenSSL libssl.so.0.9.7 problems: @@ -8890,16 +8987,16 @@ connect = localhost:5501 distros are currently a bit of a mess regarding which version of libssl is installed. - You will find the [739]details here. + You will find the [745]details here. - Q-124: Can I (temporarily) mount my local (viewer-side) Windows/Samba + Q-125: Can I (temporarily) mount my local (viewer-side) Windows/Samba File share on the machine where x11vnc is running? You will have to use an external network redirection for this. Filesystem mounting is not part of the VNC protocol. - We show a simple [740]Samba example here. + We show a simple [746]Samba example here. First you will need a tunnel to redirect the SMB requests from the remote machine to the one you sitting at. We use an ssh tunnel: @@ -8939,17 +9036,17 @@ d,ip=127.0.0.1,port=1139 far-away> smbumount /home/fred/smb-haystack-pub At some point we hope to fold some automation for SMB ssh redir setup - into the [741]Enhanced TightVNC Viewer (SSVNC) package we provide (as + into the [747]Enhanced TightVNC Viewer (SSVNC) package we provide (as of Sep 2006 it is there for testing.) - Q-125: Can I redirect CUPS print jobs from the remote desktop where + Q-126: Can I redirect CUPS print jobs from the remote desktop where x11vnc is running to a printer on my local (viewer-side) machine? You will have to use an external network redirection for this. Printing is not part of the VNC protocol. - We show a simple Unix to Unix [742]CUPS example here. Non-CUPS port + We show a simple Unix to Unix [748]CUPS example here. Non-CUPS port redirections (e.g. LPD) should also be possible, but may be a bit more tricky. If you are viewing on Windows SMB and don't have a local cups server it may be trickier still (see below.) @@ -9031,11 +9128,11 @@ d,ip=127.0.0.1,port=1139 "localhost". At some point we hope to fold some automation for CUPS ssh redir setup - into the [743]Enhanced TightVNC Viewer (SSVNC) package we provide (as + into the [749]Enhanced TightVNC Viewer (SSVNC) package we provide (as of Sep 2006 it is there for testing.) - Q-126: How can I hear the sound (audio) from the remote applications + Q-127: How can I hear the sound (audio) from the remote applications on the desktop I am viewing via x11vnc? You will have to use an external network audio mechanism for this. @@ -9132,11 +9229,11 @@ or: the applications will fail to run because LD_PRELOAD will point to libraries of the wrong wordsize. * At some point we hope to fold some automation for esd or artsd ssh - redir setup into the [744]Enhanced TightVNC Viewer (SSVNC) package + redir setup into the [750]Enhanced TightVNC Viewer (SSVNC) package we provide (as of Sep/2006 it is there for testing.) - Q-127: Why don't I hear the "Beeps" in my X session (e.g. when typing + Q-128: Why don't I hear the "Beeps" in my X session (e.g. when typing tput bel in an xterm)? As of Dec/2003 "Beep" XBell events are tracked by default. The X @@ -9144,31 +9241,65 @@ or: in Solaris, see Xserver(1) for how to turn it on via +kb), and so you won't hear them if the extension is not present. - If you don't want to hear the beeps use the [745]-nobell option. If + If you don't want to hear the beeps use the [751]-nobell option. If you want to hear the audio from the remote applications, consider - trying a [746]redirector such as esd. + trying a [752]redirector such as esd. + + + Q-129: Does x11vnc work with IPv6? + + Currently the only way to do this is via a separate helper program + such as [753]inetd. You configure x11vnc to be run from inetd or + xinetd and instruct it to listen on an IPv6 address. For xinetd the + setting "flags = IPv6" will be needed. For inetd.conf, for example: + 5900 stream tcp6 nowait root /usr/sbin/tcpd /usr/local/bin/x11vnc_wrapper.sh + We also provide a transitional tool in "[754]x11vnc/misc/inet6to4" + that acts as a relay for any IPv4 application to allow connections + over IPv6. For example: + inet6to4 5900 localhost:5900 - Q-128: Does x11vnc work with IPv6? + where x11vnc is listening on IPv4 port 5900. - Currently the only way to do this is via [747]inetd. You configure - x11vnc to be run from inetd or xinetd and instruct it to listen on an - IPv6 address. For xinetd the setting "flags = IPv6" will be needed. + Also note that not all VNC Viewers are IPv6 enabled, so a redirector + may also be needed for them. "inet6to4 -r ..." can do this as well. + + # ./inet6to4 -help + + inet6to4: Act as an ipv6-to-ipv4 relay for tcp applications that + do not support ipv6. + + Usage: inet6to4 + inet6to4 -r + + Examples: inet6to4 5900 localhost:5900 + inet6to4 8080 web1:80 + inet6to4 -r 5900 fe80::217:f2ff:fee6:6f5a%eth0:5900 + + The -r option reverses the direction of translation (e.g. for ipv4 + clients that need to connect to ipv6 servers.) Reversing is the default + if this script is named 'inet4to6' (e.g. by a symlink.) + + Use Ctrl-C to stop this program. + + You can also set env. vars INET6TO4_LOOP=1 or INET6TO4_LOOP=BG + to have an outer loop restarting this program (BG means do that + in the background), and INET6TO4_LOGFILE for a log file. + Also set INET6TO4_VERBOSE to verbosity level and INET6TO4_WAITTIME + and INET6TO4_PIDFILE (see below.) + + The "INET6TO4_LOOP=BG" and "INET6TO4_LOGFILE=..." env. variables make + the tool run reliably as a daemon for very long periods. Read the top + part of the script for more information. - Unfortunately this will be inefficient if multiple VNC Viewers are - connected at the same time (there will be a separate x11vnc for each - connection.) Some sort of ipv4-to-ipv6 redirector tool (perhaps even a - perl script) could be useful to avoid this. - Also note that not all VNC Viewers are [748]IPv6 enabled, so a - redirector could even be needed on the client side. Contributions: - Q-129: Thanks for your program or for your help! Can I make a + Q-130: Thanks for your program or for your help! Can I make a donation? Please do (any amount is appreciated; very few have donated) and thank @@ -9246,78 +9377,78 @@ References 66. http://www.karlrunge.com/x11vnc/faq.html#faq-java-http 67. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect 68. http://www.karlrunge.com/x11vnc/faq.html#faq-reverse-connect-proxy - 69. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb - 70. http://www.karlrunge.com/x11vnc/faq.html#faq-headless - 71. http://www.karlrunge.com/x11vnc/faq.html#faq-solshm - 72. http://www.karlrunge.com/x11vnc/faq.html#faq-less-resource - 73. http://www.karlrunge.com/x11vnc/faq.html#faq-more-resource - 74. http://www.karlrunge.com/x11vnc/faq.html#faq-slow-link - 75. http://www.karlrunge.com/x11vnc/faq.html#faq-xdamage - 76. http://www.karlrunge.com/x11vnc/faq.html#faq-xdamage-opengl - 77. http://www.karlrunge.com/x11vnc/faq.html#faq-pointer-mode - 78. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe - 79. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollcopyrect - 80. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching - 81. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc - 82. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-shape - 83. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha - 84. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha-hacks - 85. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-arrow - 86. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-positions - 87. http://www.karlrunge.com/x11vnc/faq.html#faq-buttonmap-opt - 88. http://www.karlrunge.com/x11vnc/faq.html#faq-altgr - 89. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless - 90. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless-sloppy - 91. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak - 92. http://www.karlrunge.com/x11vnc/faq.html#faq-repeated-keys - 93. http://www.karlrunge.com/x11vnc/faq.html#faq-repeated-keys-still - 94. http://www.karlrunge.com/x11vnc/faq.html#faq-mod-stuck-down - 95. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-opt - 96. http://www.karlrunge.com/x11vnc/faq.html#faq-sun-alt-meta - 97. http://www.karlrunge.com/x11vnc/faq.html#faq-hpux-multi-key - 98. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-button-click - 99. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-capslock - 100. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollbars - 101. http://www.karlrunge.com/x11vnc/faq.html#faq-scaling - 102. http://www.karlrunge.com/x11vnc/faq.html#faq-xinerama - 103. http://www.karlrunge.com/x11vnc/faq.html#faq-multi-screen - 104. http://www.karlrunge.com/x11vnc/faq.html#faq-clip-screen - 105. http://www.karlrunge.com/x11vnc/faq.html#faq-xrandr - 106. http://www.karlrunge.com/x11vnc/faq.html#faq-rotate - 107. http://www.karlrunge.com/x11vnc/faq.html#faq-black-screen - 108. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 109. http://www.karlrunge.com/x11vnc/faq.html#faq-hidden-taskbars - 110. http://www.karlrunge.com/x11vnc/faq.html#faq-kde-screensaver - 111. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl - 112. http://www.karlrunge.com/x11vnc/faq.html#faq-vmware - 113. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb - 114. http://www.karlrunge.com/x11vnc/faq.html#faq-linux-vt - 115. http://www.karlrunge.com/x11vnc/faq.html#faq-video - 116. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded - 117. http://www.karlrunge.com/x11vnc/faq.html#faq-no-x11 - 118. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx - 119. http://www.karlrunge.com/x11vnc/faq.html#faq-reflect - 120. http://www.karlrunge.com/x11vnc/faq.html#faq-os-install - 121. http://www.karlrunge.com/x11vnc/faq.html#faq-clipboard - 122. http://www.karlrunge.com/x11vnc/faq.html#faq-record-swf - 123. http://www.karlrunge.com/x11vnc/faq.html#faq-filexfer - 124. http://www.karlrunge.com/x11vnc/faq.html#faq-ultravnc - 125. http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick - 126. http://www.karlrunge.com/x11vnc/faq.html#faq-smb-shares - 127. http://www.karlrunge.com/x11vnc/faq.html#faq-cups - 128. http://www.karlrunge.com/x11vnc/faq.html#faq-sound - 129. http://www.karlrunge.com/x11vnc/faq.html#faq-beeps - 130. http://www.karlrunge.com/x11vnc/faq.html#faq-ipv6 - 131. http://www.karlrunge.com/x11vnc/faq.html#faq-thanks - 132. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display - 133. http://www.tldp.org/HOWTO/Remote-X-Apps.html - 134. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth - 135. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager - 136. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 137. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users - 138. http://www.karlrunge.com/x11vnc/index.html#firewalls - 139. http://www.karlrunge.com/x11vnc/miscbuild.html - 140. http://www.karlrunge.com/x11vnc/faq.html#infaq_libssl-problems + 69. http://www.karlrunge.com/x11vnc/faq.html#faq-web-login + 70. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 71. http://www.karlrunge.com/x11vnc/faq.html#faq-headless + 72. http://www.karlrunge.com/x11vnc/faq.html#faq-solshm + 73. http://www.karlrunge.com/x11vnc/faq.html#faq-less-resource + 74. http://www.karlrunge.com/x11vnc/faq.html#faq-more-resource + 75. http://www.karlrunge.com/x11vnc/faq.html#faq-slow-link + 76. http://www.karlrunge.com/x11vnc/faq.html#faq-xdamage + 77. http://www.karlrunge.com/x11vnc/faq.html#faq-xdamage-opengl + 78. http://www.karlrunge.com/x11vnc/faq.html#faq-pointer-mode + 79. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe + 80. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollcopyrect + 81. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching + 82. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc + 83. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-shape + 84. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha + 85. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha-hacks + 86. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-arrow + 87. http://www.karlrunge.com/x11vnc/faq.html#faq-cursor-positions + 88. http://www.karlrunge.com/x11vnc/faq.html#faq-buttonmap-opt + 89. http://www.karlrunge.com/x11vnc/faq.html#faq-altgr + 90. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless + 91. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless-sloppy + 92. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak + 93. http://www.karlrunge.com/x11vnc/faq.html#faq-repeated-keys + 94. http://www.karlrunge.com/x11vnc/faq.html#faq-repeated-keys-still + 95. http://www.karlrunge.com/x11vnc/faq.html#faq-mod-stuck-down + 96. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-opt + 97. http://www.karlrunge.com/x11vnc/faq.html#faq-sun-alt-meta + 98. http://www.karlrunge.com/x11vnc/faq.html#faq-hpux-multi-key + 99. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-button-click + 100. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-capslock + 101. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollbars + 102. http://www.karlrunge.com/x11vnc/faq.html#faq-scaling + 103. http://www.karlrunge.com/x11vnc/faq.html#faq-xinerama + 104. http://www.karlrunge.com/x11vnc/faq.html#faq-multi-screen + 105. http://www.karlrunge.com/x11vnc/faq.html#faq-clip-screen + 106. http://www.karlrunge.com/x11vnc/faq.html#faq-xrandr + 107. http://www.karlrunge.com/x11vnc/faq.html#faq-rotate + 108. http://www.karlrunge.com/x11vnc/faq.html#faq-black-screen + 109. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 110. http://www.karlrunge.com/x11vnc/faq.html#faq-hidden-taskbars + 111. http://www.karlrunge.com/x11vnc/faq.html#faq-kde-screensaver + 112. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl + 113. http://www.karlrunge.com/x11vnc/faq.html#faq-vmware + 114. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb + 115. http://www.karlrunge.com/x11vnc/faq.html#faq-linux-vt + 116. http://www.karlrunge.com/x11vnc/faq.html#faq-video + 117. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded + 118. http://www.karlrunge.com/x11vnc/faq.html#faq-no-x11 + 119. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx + 120. http://www.karlrunge.com/x11vnc/faq.html#faq-reflect + 121. http://www.karlrunge.com/x11vnc/faq.html#faq-os-install + 122. http://www.karlrunge.com/x11vnc/faq.html#faq-clipboard + 123. http://www.karlrunge.com/x11vnc/faq.html#faq-record-swf + 124. http://www.karlrunge.com/x11vnc/faq.html#faq-filexfer + 125. http://www.karlrunge.com/x11vnc/faq.html#faq-ultravnc + 126. http://www.karlrunge.com/x11vnc/faq.html#faq-singleclick + 127. http://www.karlrunge.com/x11vnc/faq.html#faq-smb-shares + 128. http://www.karlrunge.com/x11vnc/faq.html#faq-cups + 129. http://www.karlrunge.com/x11vnc/faq.html#faq-sound + 130. http://www.karlrunge.com/x11vnc/faq.html#faq-beeps + 131. http://www.karlrunge.com/x11vnc/faq.html#faq-ipv6 + 132. http://www.karlrunge.com/x11vnc/faq.html#faq-thanks + 133. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display + 134. http://www.tldp.org/HOWTO/Remote-X-Apps.html + 135. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 136. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager + 137. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 138. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users + 139. http://www.karlrunge.com/x11vnc/index.html#firewalls + 140. http://www.karlrunge.com/x11vnc/miscbuild.html 141. http://www.karlrunge.com/x11vnc/index.html#solarisbuilding 142. http://www.karlrunge.com/x11vnc/x11vnc_sunos4.html 143. http://www.karlrunge.com/x11vnc/index.html#building @@ -9495,13 +9626,13 @@ References 315. http://www.karlrunge.com/x11vnc/chainingssh.html#gateway_double_ssh 316. http://www.karlrunge.com/x11vnc/index.html#tunnelling 317. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 318. http://www.stunnel.org/ - 319. http://stunnel.mirt.net/ + 318. http://stunnel.mirt.net/ + 319. http://www.stunnel.org/ 320. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl 321. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel 322. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify 323. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int - 324. http://www.stunnel.org/ + 324. http://stunnel.mirt.net/ 325. http://www.karlrunge.com/x11vnc/ssl.html 326. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer 327. http://www.karlrunge.com/x11vnc/ssvnc.html @@ -9536,7 +9667,7 @@ References 356. http://www.karlrunge.com/x11vnc/ssl.html 357. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel 358. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-stunnel - 359. http://www.stunnel.org/ + 359. http://stunnel.mirt.net/ 360. http://www.karlrunge.com/x11vnc/faq.html#infaq_viewer-side-stunnel 361. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer 362. http://www.karlrunge.com/x11vnc/ssvnc.html @@ -9568,364 +9699,370 @@ References 388. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer 389. http://www.karlrunge.com/x11vnc/ssvnc.html 390. http://www.karlrunge.com/x11vnc/ssl-portal.html - 391. http://www.karlrunge.com/x11vnc/ssl.html - 392. http://www.karlrunge.com/x11vnc/faq.html#infaq_display-manager-continuously - 393. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd - 394. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin - 395. http://www.karlrunge.com/x11vnc/faq.html#infaq_x11vnc_loop - 396. http://club.mandriva.com/xwiki/bin/view/KB/XwinXset - 397. http://www.karlrunge.com/x11vnc/index.html#firewalls - 398. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 391. http://www.karlrunge.com/x11vnc/faq.html#faq-web-login + 392. http://www.karlrunge.com/x11vnc/ssl.html + 393. http://www.karlrunge.com/x11vnc/faq.html#infaq_display-manager-continuously + 394. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd + 395. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + 396. http://www.karlrunge.com/x11vnc/faq.html#infaq_x11vnc_loop + 397. http://club.mandriva.com/xwiki/bin/view/KB/XwinXset + 398. http://www.karlrunge.com/x11vnc/index.html#firewalls 399. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth - 400. http://www.karlrunge.com/x11vnc/faq.html#infaq_dtlogin_solaris - 401. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reopen - 402. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost - 403. http://www.karlrunge.com/x11vnc/index.html#tunnelling - 404. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost - 405. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl - 406. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N - 407. http://www.jirka.org/gdm-documentation/x241.html - 408. http://www.karlrunge.com/x11vnc/x11vnc_loop - 409. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop - 410. http://www.karlrunge.com/x11vnc/faq.html#faq-xterminal-xauth - 411. http://www.karlrunge.com/x11vnc/index.html#firewalls - 412. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-inetd - 413. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-q, - 414. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth - 415. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin - 416. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi - 417. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-mdns - 418. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf - 419. http://www.avahi.org/ - 420. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd - 421. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 422. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 423. http://www.karlrunge.com/x11vnc/faq.html#infaq_stunnel-inetd - 424. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop - 425. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 426. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 427. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 428. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 429. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 430. http://www.karlrunge.com/x11vnc/find_display.html - 431. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 400. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 401. http://www.karlrunge.com/x11vnc/faq.html#infaq_dtlogin_solaris + 402. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reopen + 403. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost + 404. http://www.karlrunge.com/x11vnc/index.html#tunnelling + 405. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost + 406. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 407. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-N + 408. http://www.jirka.org/gdm-documentation/x241.html + 409. http://www.karlrunge.com/x11vnc/x11vnc_loop + 410. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 411. http://www.karlrunge.com/x11vnc/faq.html#faq-xterminal-xauth + 412. http://www.karlrunge.com/x11vnc/index.html#firewalls + 413. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-inetd + 414. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-q, + 415. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-auth + 416. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + 417. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-avahi + 418. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-mdns + 419. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-zeroconf + 420. http://www.avahi.org/ + 421. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd + 422. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 423. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 424. http://www.karlrunge.com/x11vnc/faq.html#infaq_stunnel-inetd + 425. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 426. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 427. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 428. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 429. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 430. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 431. http://www.karlrunge.com/x11vnc/find_display.html 432. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 433. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 434. http://www.karlrunge.com/x11vnc/faq.html#faq-unix-passwords - 435. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 436. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 437. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users - 438. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int - 439. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost - 440. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 441. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users - 442. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb - 443. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 444. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer - 445. http://www.karlrunge.com/x11vnc/ssvnc.html - 446. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 447. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 448. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 449. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create_xsrv - 450. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 451. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 452. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 433. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 434. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 435. http://www.karlrunge.com/x11vnc/faq.html#faq-unix-passwords + 436. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 437. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 438. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users + 439. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-int + 440. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-localhost + 441. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 442. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users + 443. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 444. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 445. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer + 446. http://www.karlrunge.com/x11vnc/ssvnc.html + 447. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 448. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 449. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 450. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create_xsrv + 451. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 452. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc 453. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop - 454. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 455. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpdir - 456. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http - 457. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-java-viewer-proxy - 458. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 459. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remote - 460. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect_or_exit - 461. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vncconnect - 462. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy + 454. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 455. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 456. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-httpdir + 457. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http + 458. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-java-viewer-proxy + 459. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 460. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remote + 461. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect_or_exit + 462. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-vncconnect 463. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy 464. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy - 465. http://www.karlrunge.com/x11vnc/faq.html#infaq_localaccess - 466. http://www.karlrunge.com/x11vnc/faq.html#infaq_localaccess - 467. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 468. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 469. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 470. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 471. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 472. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 473. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms - 474. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 475. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 476. http://www.karlrunge.com/x11vnc/Xdummy - 477. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 478. http://www.karlrunge.com/x11vnc/xdm_one_shot.html - 479. http://www.karlrunge.com/x11vnc/faq.html#infaq_display-manager-continuously + 465. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-proxy + 466. http://www.karlrunge.com/x11vnc/desktop.cgi.pl + 467. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 468. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 469. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-loop + 470. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-portal + 471. http://www.karlrunge.com/x11vnc/faq.html#infaq_localaccess + 472. http://www.karlrunge.com/x11vnc/faq.html#infaq_localaccess + 473. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 474. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 475. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 476. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 477. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 478. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 479. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms 480. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay - 481. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 482. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 483. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 484. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc - 485. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc - 486. http://www.karlrunge.com/x11vnc/shm_clear - 487. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-onetile - 488. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noshm - 489. http://www.karlrunge.com/x11vnc/faq.html#faq-noshm - 490. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nap - 491. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait - 492. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sb + 481. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 482. http://www.karlrunge.com/x11vnc/Xdummy + 483. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 484. http://www.karlrunge.com/x11vnc/xdm_one_shot.html + 485. http://www.karlrunge.com/x11vnc/faq.html#infaq_display-manager-continuously + 486. http://www.karlrunge.com/x11vnc/faq.html#infaq_findcreatedisplay + 487. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 488. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 489. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 490. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-svc + 491. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xdmsvc + 492. http://www.karlrunge.com/x11vnc/shm_clear 493. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-onetile - 494. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fs - 495. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads - 496. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer - 497. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 498. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 499. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc - 500. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid - 501. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 502. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 503. http://www.tightvnc.com/ - 504. http://www.karlrunge.com/x11vnc/ssvnc.html - 505. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 506. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 507. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid - 508. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching - 509. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache - 510. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-speeds - 511. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging - 512. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fs - 513. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait - 514. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer - 515. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-progressive - 516. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 517. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-appshare - 518. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosel - 519. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursor - 520. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorpos - 521. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-readtimeout - 522. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fixscreen - 523. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 524. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xd_area - 525. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xd_mem - 526. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage - 527. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage - 528. http://minimyth.org/ - 529. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl - 530. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 531. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode - 532. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode - 533. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging - 534. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode - 535. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads - 536. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe - 537. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollcopyrect - 538. http://www.karlrunge.com/x11vnc/faq.html#faq-pointer-mode - 539. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 540. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 541. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 542. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 543. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 544. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 545. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe - 546. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wirecopyrect - 547. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe - 548. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fixscreen - 549. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scr_skip - 550. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale - 551. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect - 552. http://www.karlrunge.com/x11vnc/index.html#beta-test - 553. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache - 554. http://www.karlrunge.com/x11vnc/ssvnc.html - 555. http://www.karlrunge.com/x11vnc/ssvnc.html#ycrop - 556. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_no_rootpixmap - 557. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_cr - 558. http://www.virtualgl.org/About/TurboVNC - 559. http://www.virtualgl.org/ - 560. http://sourceforge.net/project/showfiles.php?group_id=117509&package_id=166100 - 561. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait - 562. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer - 563. http://sourceforge.net/project/showfiles.php?group_id=117509&package_id=166100 - 564. http://www.karlrunge.com/x11vnc/ssvnc.html - 565. http://www.karlrunge.com/x11vnc/bins - 566. http://www.karlrunge.com/x11vnc/ssvnc.html - 567. http://www.virtualgl.org/About/Reports - 568. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow - 569. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor - 570. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor - 571. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-overlay - 572. http://www.karlrunge.com/x11vnc/faq.html#infaq_the-overlay-mode - 573. http://www.karlrunge.com/x11vnc/index.html#solaris10-build - 574. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha-hacks - 575. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alphacut - 576. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alphafrac - 577. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alpharemove - 578. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorshape - 579. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noalphablend - 580. http://www.karlrunge.com/x11vnc/ssvnc.html - 581. http://www.tightvnc.com/ - 582. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursor - 583. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursorpos - 584. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorpos - 585. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorshape - 586. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-buttonmap - 587. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_pointer - 588. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-buttonmap - 589. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak - 590. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless - 591. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak - 592. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_keyboard - 593. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak - 594. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb - 595. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sloppy_keys - 596. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak - 597. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak - 598. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 599. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak - 600. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_keyboard - 601. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless - 602. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb - 603. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sloppy_keys - 604. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak - 605. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb - 606. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb - 607. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_keycodes - 608. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 609. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms - 610. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 611. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 612. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms - 613. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-norepeat - 614. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-norepeat - 615. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager - 616. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_mods + 494. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noshm + 495. http://www.karlrunge.com/x11vnc/faq.html#faq-noshm + 496. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nap + 497. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait + 498. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sb + 499. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-onetile + 500. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fs + 501. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads + 502. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer + 503. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 504. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 505. http://www.karlrunge.com/x11vnc/faq.html#faq-turbovnc + 506. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid + 507. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 508. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 509. http://www.tightvnc.com/ + 510. http://www.karlrunge.com/x11vnc/ssvnc.html + 511. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 512. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 513. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-solid + 514. http://www.karlrunge.com/x11vnc/faq.html#faq-client-caching + 515. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache + 516. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-speeds + 517. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging + 518. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fs + 519. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait + 520. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer + 521. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-progressive + 522. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 523. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-appshare + 524. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosel + 525. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursor + 526. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorpos + 527. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-readtimeout + 528. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fixscreen + 529. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 530. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xd_area + 531. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xd_mem + 532. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage + 533. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage + 534. http://minimyth.org/ + 535. http://www.karlrunge.com/x11vnc/faq.html#faq-beryl + 536. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 537. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode + 538. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode + 539. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging + 540. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pointer_mode + 541. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-threads + 542. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe + 543. http://www.karlrunge.com/x11vnc/faq.html#faq-scrollcopyrect + 544. http://www.karlrunge.com/x11vnc/faq.html#faq-pointer-mode + 545. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 546. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 547. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 548. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 549. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 550. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 551. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wireframe + 552. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wirecopyrect + 553. http://www.karlrunge.com/x11vnc/faq.html#faq-wireframe + 554. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-fixscreen + 555. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scr_skip + 556. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale + 557. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scrollcopyrect + 558. http://www.karlrunge.com/x11vnc/index.html#beta-test + 559. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache + 560. http://www.karlrunge.com/x11vnc/ssvnc.html + 561. http://www.karlrunge.com/x11vnc/ssvnc.html#ycrop + 562. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_no_rootpixmap + 563. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ncache_cr + 564. http://www.virtualgl.org/About/TurboVNC + 565. http://www.virtualgl.org/ + 566. http://sourceforge.net/project/showfiles.php?group_id=117509&package_id=166100 + 567. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait + 568. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer + 569. http://sourceforge.net/project/showfiles.php?group_id=117509&package_id=166100 + 570. http://www.karlrunge.com/x11vnc/ssvnc.html + 571. http://www.karlrunge.com/x11vnc/bins + 572. http://www.karlrunge.com/x11vnc/ssvnc.html + 573. http://www.virtualgl.org/About/Reports + 574. http://www.karlrunge.com/x11vnc/index.html#fb_read_slow + 575. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor + 576. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursor + 577. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-overlay + 578. http://www.karlrunge.com/x11vnc/faq.html#infaq_the-overlay-mode + 579. http://www.karlrunge.com/x11vnc/index.html#solaris10-build + 580. http://www.karlrunge.com/x11vnc/faq.html#faq-xfixes-alpha-hacks + 581. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alphacut + 582. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alphafrac + 583. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-alpharemove + 584. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorshape + 585. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noalphablend + 586. http://www.karlrunge.com/x11vnc/ssvnc.html + 587. http://www.tightvnc.com/ + 588. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursor + 589. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-cursorpos + 590. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorpos + 591. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nocursorshape + 592. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-buttonmap + 593. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_pointer + 594. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-buttonmap + 595. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak + 596. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless + 597. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak + 598. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_keyboard + 599. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak + 600. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb + 601. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sloppy_keys + 602. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak + 603. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak + 604. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 605. http://www.karlrunge.com/x11vnc/faq.html#faq-xkbmodtweak + 606. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-debug_keyboard + 607. http://www.karlrunge.com/x11vnc/faq.html#faq-greaterless + 608. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb + 609. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sloppy_keys + 610. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-modtweak + 611. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb + 612. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xkb + 613. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_keycodes + 614. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 615. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms + 616. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap 617. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 618. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-capslock - 619. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_lockkeys - 620. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-capslock - 621. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all - 622. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 618. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-add_keysyms + 619. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-norepeat + 620. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-norepeat + 621. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager + 622. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_mods 623. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 624. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nomodtweak - 625. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 626. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 627. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_lockkeys + 624. http://www.karlrunge.com/x11vnc/faq.html#faq-remap-capslock + 625. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_lockkeys + 626. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-capslock + 627. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all 628. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap - 629. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nomodtweak - 630. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-capslock - 631. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all - 632. http://www.karlrunge.com/x11vnc/faq.html#faq-scaling - 633. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale - 634. http://people.pwf.cam.ac.uk/ssb22/setup/vnc-magnification.html - 635. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport - 636. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-gui - 637. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 638. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale_cursor - 639. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-blackout - 640. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xinerama - 641. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xinerama - 642. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer - 643. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer - 644. http://www.karlrunge.com/x11vnc/faq.html#faq-solshm - 645. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-onetile - 646. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noshm - 647. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clip - 648. http://www.karlrunge.com/x11vnc/faq.html#faq-xinerama - 649. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 650. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 651. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xrandr - 652. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-padgeom - 653. http://www.karlrunge.com/x11vnc/ssvnc.html - 654. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rotate - 655. http://www.jwz.org/xscreensaver/man1.html - 656. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodpms - 657. http://www.beryl-project.org/ - 658. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage - 659. http://www.dslinux.org/blogs/pepsiman/?p=73 - 660. http://minimyth.org/ - 661. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 662. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb - 663. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 664. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 665. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 666. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput - 667. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput - 668. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-snapfb - 669. http://www.karlrunge.com/x11vnc/faq.html#faq-video - 670. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb - 671. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded - 672. http://www.karlrunge.com/x11vnc/faq.html#faq-video - 673. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 674. http://www.karlrunge.com/x11vnc/faq.html#faq-video - 675. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc - 676. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded - 677. http://www.karlrunge.com/x11vnc/faq.html#faq-vmware - 678. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 679. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb - 680. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-snapfb - 681. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-24to32 - 682. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait - 683. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-slow_fb - 684. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer - 685. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-freqtab - 686. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb - 687. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput - 688. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput - 689. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 690. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 691. http://www.testplant.com/products/vine_server/OS_X - 692. http://www.apple.com/remotedesktop/ - 693. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id - 694. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nofb - 695. http://fredrik.hubbe.net/x2vnc.html - 696. http://www.karlrunge.com/x11vnc/faq.html#faq-win2vnc - 697. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect - 698. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb - 699. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging - 700. http://sourceforge.net/projects/vnc-reflector/ - 701. http://www.tightvnc.com/projector/ - 702. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 703. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager - 704. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager - 705. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 706. http://www.jwz.org/doc/x-cut-and-paste.html - 707. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosel - 708. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noprimary - 709. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noclipboard - 710. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosetprimary - 711. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosetclipboard - 712. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-seldir - 713. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-input - 714. http://www.unixuser.org/~euske/vnc2swf/ - 715. http://wolphination.com/linux/2006/06/30/how-to-record-videos-of-your-desktop/ - 716. http://www.karlrunge.com/x11vnc/ssvnc.html - 717. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-tightfilexfer - 718. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users - 719. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ultrafilexfer - 720. http://www.karlrunge.com/x11vnc/ssvnc.html - 721. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noultraext - 722. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noserverdpms - 723. http://www.uvnc.com/addons/repeater.html - 724. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect - 725. http://www.karlrunge.com/x11vnc/ultravnc_repeater.pl - 726. http://www.uvnc.com/addons/singleclick.html - 727. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx - 728. http://www.karlrunge.com/x11vnc/single-click.html - 729. http://www.karlrunge.com/x11vnc/single-click.html - 730. http://www.karlrunge.com/x11vnc/index.html#firewalls - 731. http://sc.uvnc.com/ - 732. http://www.karlrunge.com/x11vnc/ssvnc.html - 733. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 629. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 630. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nomodtweak + 631. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 632. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 633. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-skip_lockkeys + 634. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-remap + 635. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nomodtweak + 636. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-capslock + 637. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clear_all + 638. http://www.karlrunge.com/x11vnc/faq.html#faq-scaling + 639. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale + 640. http://people.pwf.cam.ac.uk/ssb22/setup/vnc-magnification.html + 641. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbport + 642. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-gui + 643. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 644. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-scale_cursor + 645. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-blackout + 646. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xinerama + 647. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xinerama + 648. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer + 649. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xwarppointer + 650. http://www.karlrunge.com/x11vnc/faq.html#faq-solshm + 651. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-onetile + 652. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noshm + 653. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-clip + 654. http://www.karlrunge.com/x11vnc/faq.html#faq-xinerama + 655. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 656. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 657. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-xrandr + 658. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-padgeom + 659. http://www.karlrunge.com/x11vnc/ssvnc.html + 660. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rotate + 661. http://www.jwz.org/xscreensaver/man1.html + 662. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodpms + 663. http://www.beryl-project.org/ + 664. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noxdamage + 665. http://www.dslinux.org/blogs/pepsiman/?p=73 + 666. http://minimyth.org/ + 667. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 668. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb + 669. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 670. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 671. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 672. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput + 673. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput + 674. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-snapfb + 675. http://www.karlrunge.com/x11vnc/faq.html#faq-video + 676. http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb + 677. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded + 678. http://www.karlrunge.com/x11vnc/faq.html#faq-video + 679. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 680. http://www.karlrunge.com/x11vnc/faq.html#faq-video + 681. http://www.karlrunge.com/x11vnc/faq.html#faq-linuxvc + 682. http://www.karlrunge.com/x11vnc/faq.html#faq-qt-embedded + 683. http://www.karlrunge.com/x11vnc/faq.html#faq-vmware + 684. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 685. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb + 686. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-snapfb + 687. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-24to32 + 688. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-wait + 689. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-slow_fb + 690. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-defer + 691. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-freqtab + 692. http://www.karlrunge.com/x11vnc/faq.html#faq-rawfb + 693. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput + 694. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-pipeinput + 695. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 696. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 697. http://www.testplant.com/products/vine_server/OS_X + 698. http://www.apple.com/remotedesktop/ + 699. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-id + 700. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nofb + 701. http://fredrik.hubbe.net/x2vnc.html + 702. http://www.karlrunge.com/x11vnc/faq.html#faq-win2vnc + 703. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-reflect + 704. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rawfb + 705. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nodragging + 706. http://sourceforge.net/projects/vnc-reflector/ + 707. http://www.tightvnc.com/projector/ + 708. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 709. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager + 710. http://www.karlrunge.com/x11vnc/faq.html#faq-display-manager + 711. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 712. http://www.jwz.org/doc/x-cut-and-paste.html + 713. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosel + 714. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noprimary + 715. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noclipboard + 716. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosetprimary + 717. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nosetclipboard + 718. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-seldir + 719. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-input + 720. http://www.unixuser.org/~euske/vnc2swf/ + 721. http://wolphination.com/linux/2006/06/30/how-to-record-videos-of-your-desktop/ + 722. http://www.karlrunge.com/x11vnc/ssvnc.html + 723. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-tightfilexfer + 724. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-users + 725. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ultrafilexfer + 726. http://www.karlrunge.com/x11vnc/ssvnc.html + 727. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noultraext + 728. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-noserverdpms + 729. http://www.uvnc.com/addons/repeater.html + 730. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-connect + 731. http://www.karlrunge.com/x11vnc/ultravnc_repeater.pl + 732. http://www.uvnc.com/addons/singleclick.html + 733. http://www.karlrunge.com/x11vnc/faq.html#faq-macosx 734. http://www.karlrunge.com/x11vnc/single-click.html - 735. http://www.karlrunge.com/x11vnc/ssvnc.html - 736. http://www.karlrunge.com/x11vnc/single-click.html - 737. http://www.karlrunge.com/x11vnc/ssl.html - 738. http://www.karlrunge.com/x11vnc/single-click.html - 739. http://www.karlrunge.com/x11vnc/single-click.html#libssl-problems - 740. http://www.samba.org/ + 735. http://www.karlrunge.com/x11vnc/single-click.html + 736. http://www.karlrunge.com/x11vnc/index.html#firewalls + 737. http://sc.uvnc.com/ + 738. http://www.karlrunge.com/x11vnc/ssvnc.html + 739. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-ssl + 740. http://www.karlrunge.com/x11vnc/single-click.html 741. http://www.karlrunge.com/x11vnc/ssvnc.html - 742. http://www.cups.org/ - 743. http://www.karlrunge.com/x11vnc/ssvnc.html - 744. http://www.karlrunge.com/x11vnc/ssvnc.html - 745. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nobell - 746. http://www.karlrunge.com/x11vnc/faq.html#faq-sound - 747. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd - 748. http://jungla.dit.upm.es/~acosta/paginas/vncIPv6.html + 742. http://www.karlrunge.com/x11vnc/single-click.html + 743. http://www.karlrunge.com/x11vnc/ssl.html + 744. http://www.karlrunge.com/x11vnc/single-click.html + 745. http://www.karlrunge.com/x11vnc/single-click.html#libssl-problems + 746. http://www.samba.org/ + 747. http://www.karlrunge.com/x11vnc/ssvnc.html + 748. http://www.cups.org/ + 749. http://www.karlrunge.com/x11vnc/ssvnc.html + 750. http://www.karlrunge.com/x11vnc/ssvnc.html + 751. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-nobell + 752. http://www.karlrunge.com/x11vnc/faq.html#faq-sound + 753. http://www.karlrunge.com/x11vnc/faq.html#faq-inetd + 754. http://www.karlrunge.com/x11vnc/inet6to4 ======================================================================= http://www.karlrunge.com/x11vnc/chainingssh.html: @@ -11220,11 +11357,21 @@ http://www.karlrunge.com/x11vnc/ssl-portal.html: ([2]ss_vncviewer) can also take advantage of the method described here with its -proxy option. - Simpler Solutions: This apache solution may be too much for you. It is - mainly intended for automatically redirecting to MULTIPLE workstations - inside the firewall. If you only have one inside machine that you want - to access, the method described here is overly complicated. See - [3]below for some simpler (and still non-SSH) encrypted setups. + _________________________________________________________________ + + Simpler Solutions: This apache SSL VNC portal solution may be too much + for you. It is mainly intended for automatically redirecting to + MULTIPLE workstations inside the firewall. If you only have one or two + inside machines that you want to access, the method described here is + overly complicated! See [3]below for some simpler (and still non-SSH) + encrypted setups. + + Also see the recent (Mar/2010) [4]desktop.cgi x11vnc desktop web login + CGI script that achieves much of what the method describes here + (especially if its 'port redirection' feature is enabled.) + _________________________________________________________________ + + There are numerous ways to achieve this with Apache. We present one of the simplest ones here. @@ -11232,7 +11379,7 @@ http://www.karlrunge.com/x11vnc/ssl-portal.html: Important: these sorts of schemes allow incoming connections from anywhere on the Internet to fixed ports on machines inside the firewall. Care must be taken to implement and test thoroughly. If one - is paranoid one can (and should) add [4]extra layers of protection. + is paranoid one can (and should) add [5]extra layers of protection. (e.g. extra passwords, packet filtering, SSL certificate verification, etc). @@ -11259,7 +11406,7 @@ http://www.karlrunge.com/x11vnc/ssl-portal.html: It is the last item that makes it tricky (otherwise the method described on this page will work). If you are interested in such a solution and are willing to run a separate helper program - (connect_switch) [5]look here. Also, see [6]this apache patch. + (connect_switch) [6]look here. Also, see [7]this apache patch. _________________________________________________________________ Example: @@ -11276,7 +11423,7 @@ http://www.karlrunge.com/x11vnc/ssl-portal.html: In this example suppose the gateway machine running apache is named "www.gateway.east" (e.g. it may also provide normal web service). We also choose the Internet-facing port for this VNC service to be port - 563. One could choose any port, including the [7]default HTTP port 80. + 563. One could choose any port, including the [8]default HTTP port 80. Detail: We choose 563 because it is the rarely used SNEWS port that is often allowed by Web proxies for the CONNECT method. The idea is the @@ -11301,8 +11448,8 @@ http://www.karlrunge.com/x11vnc/ssl-portal.html: i.e. we force SSL VNC connections, port 5915, serve the Java VNC viewer applet, and require a VNC password (another option would be - [8]-unixpw). The above command could also be run out of [9]inetd(8). - It can also be used to [10]autodetect the user's display and + [9]-unixpw). The above command could also be run out of [10]inetd(8). + It can also be used to [11]autodetect the user's display and Xauthority data. @@ -11434,7 +11581,7 @@ hostname2 15 This will involve downloading a signed java viewer applet jar file that is able to interact with the internal proxy for the VNC - connection. See [11]this FAQ for more info on how this works. Note: + connection. See [12]this FAQ for more info on how this works. Note: sometimes with the Proxy case if you see 'Bad Gateway' error you will have to wait 10 or so seconds and then hit reload. This seems to be due to having to wait for a Connection Keepalive to terminate... @@ -11506,7 +11653,7 @@ blah,blah... of a outgoing proxy socket connection. Use it only if the Web browser is inside a separate Web proxying environment (i.e. large corporation) - The rewrites with parameter urlPrefix are described under [12]Tricks + The rewrites with parameter urlPrefix are described under [13]Tricks for Better Response. The "trust" ones (also described under Tricks) with trustAllVncCerts tell the Java VNC applet to skip a dialog asking about the VNC Certificate. They are a bit faster and more reliable @@ -11535,7 +11682,7 @@ blah,blah... are not encrypted via SSL, and so in principle could be tampered with by a really bad guy. The subsequent VNC connection, however, is encrypted through a single SSL connection (it makes a CONNECT straight - to x11vnc). [13]See below for how to have these initial downloads + to x11vnc). [14]See below for how to have these initial downloads encrypted as well (if the apache web server has SSL/mod_ssl, i.e. https, enabled and configured). @@ -11544,36 +11691,36 @@ blah,blah... certificate 'always'). This is because an applet it cannot open local files, etc. Sadly, the applet cannot even remember certificates in the same browser session because it is completely reinitialized for each - connection (see [14]below). + connection (see [15]below). _________________________________________________________________ Too Much? If these apache rules are a little too much for you, there is a little - bit [15]simpler scheme where you have to list each of the individual + bit [16]simpler scheme where you have to list each of the individual machines in the httpd.conf and ssl.conf files. It may be a little more typing to maintain, but perhaps being more straight forward (less RewriteRule's) is desirable. _________________________________________________________________ - Problems: + Problems? To see example x11vnc output for a successful https://host:5900/ - connection with the Java Applet see [16]This Page. + connection with the Java Applet see [17]This Page. _________________________________________________________________ Some Ideas for adding extra authentication, etc. for the paranoid: - * VNC passwords: [17]-rfbauth, [18]-passwdfile, or [19]-usepw. Even + * VNC passwords: [18]-rfbauth, [19]-passwdfile, or [20]-usepw. Even adding a simple company-wide VNC password helps block unwanted access. - * Unix passwords: [20]-unixpw - * SSL Client certificates: [21]-sslverify + * Unix passwords: [21]-unixpw + * SSL Client certificates: [22]-sslverify * Apache AuthUserFile directive: .htaccess, etc. * Filter connections based on IP address or hostname. - * Use Port-knocking on your firewall as described in: [22]Enhanced + * Use Port-knocking on your firewall as described in: [23]Enhanced TightVNC Viewer (ssvnc). * Add proxy password authentication (requires Viewer changes?) * Run a separate instance of Apache that provides this VNC service @@ -11588,7 +11735,7 @@ blah,blah... Using non-Java viewers with this scheme: - The [23]ss_vncviewer stunnel wrapper script for VNC viewers has the + The [24]ss_vncviewer stunnel wrapper script for VNC viewers has the -proxy option that can take advantage of this method. ss_vncviewer -proxy www.gateway.east:563 host1:15 @@ -11596,7 +11743,7 @@ blah,blah... separated by a comma. ss_vncviewer -proxy proxy1.foobar.com:8080,www.gateway.east:563 host1:15 - For the [24]Enhanced TightVNC Viewer (ssvnc) GUI (it uses ss_vncviewer + For the [25]Enhanced TightVNC Viewer (ssvnc) GUI (it uses ss_vncviewer on Unix) put 'host1:15' into the 'VNC Server' entry box, and here are possible Proxy/Gateway entries Proxy/Gateway: www.gateway.east:563 @@ -11610,10 +11757,10 @@ blah,blah... To have the Java applet downloaded to the user's Web Browser via an encrypted (and evidently safer) SSL connection the Apache webserver - should be configured for SSL via [25]mod_ssl. + should be configured for SSL via [26]mod_ssl. - It is actually possible to use the x11vnc [26]Key Management utility - "[27]-sslGenCert" to generate your Apache/SSL .crt and .key files. (In + It is actually possible to use the x11vnc [27]Key Management utility + "[28]-sslGenCert" to generate your Apache/SSL .crt and .key files. (In brief, run something like "x11vnc -sslGenCert server self:apache" then copy the resulting self:apache.crt file to conf/ssl.crt/server.crt and extract the private key part from self:apache.pem and paste it into @@ -11621,7 +11768,7 @@ blah,blah... before running x11vnc will bump up the expiration date (3 years in this case). - Or you can use the standard methods described in the [28]Apache + Or you can use the standard methods described in the [29]Apache mod_ssl documentation to create your keys. Then restart Apache, usually something like "apachectl stop" followed by "apachectl startssl" @@ -11738,7 +11885,7 @@ stAllVncCerts=yes [R,NE,L] The "vncs/trust" ones are like the "trust" ones described earlier https://www.gateway.east/vncs/trust/mach2 - and similarly for the httpsPort ones. See [29]Tricks for Better + and similarly for the httpsPort ones. See [30]Tricks for Better Response. In all of the above cases the VNC traffic from Viewer to x11vnc is @@ -11760,7 +11907,7 @@ stAllVncCerts=yes [R,NE,L] The special entries "/vnc443" are only used for the special helper program (connect_switch) for the https port 443 only mode - [30]discussed here. + [31]discussed here. _________________________________________________________________ @@ -11799,16 +11946,16 @@ stAllVncCerts=yes [R,NE,L] -ssl SAVE -http -unixpw -localhost -users unixpw= \ -find - (we have used the alias [31]-find for "-display + (we have used the alias [32]-find for "-display WAIT:cmd=FINDDISPLAY".) This way the user must supply his Unix username and password and then his display and Xauthority data on that machine will be located and returned to x11vnc to allow it to attach. If he doesn't have a display running on that machine or he fails to log in correctly, the connection will be dropped. - The variant "[32]-display WAIT:cmd=FINDCREATEDISPLAY" (aliased by - "[33]-create") will actually create a (virtual or real) X server - session for the user if one doesn't already exist. See [34]here for + The variant "[33]-display WAIT:cmd=FINDCREATEDISPLAY" (aliased by + "[34]-create") will actually create a (virtual or real) X server + session for the user if one doesn't already exist. See [35]here for details. To enable inetd operation for the non-HTTPS Java viewer download (port @@ -11820,8 +11967,8 @@ stAllVncCerts=yes [R,NE,L] -http_ssl -display WAIT:cmd=HTTPONCE where the long inetd.conf line has been split. Note how the - [35]-http_ssl tries to automatically find the .../classes/ssl - subdirectory. This requires the [36]-prog option available in x11vnc + [36]-http_ssl tries to automatically find the .../classes/ssl + subdirectory. This requires the [37]-prog option available in x11vnc 0.8.4 (a shell script wrapper, e.g. /usr/local/bin/x11vnc_http.sh can be used to work around this). @@ -11868,7 +12015,7 @@ stAllVncCerts=yes [R,NE,L] or using the stunnel wrapper script: ss_vncviewer 24.35.46.57:1 - One can acheive similar things with dedicated firewall/routers (e.g. + One can achieve similar things with dedicated firewall/routers (e.g. Linksys) using the device's web or other interface to configure the firewall. @@ -11880,7 +12027,7 @@ stAllVncCerts=yes [R,NE,L] - The redirection could also be done at the application level using a TCP redirect program (e.g. ip_relay or fancier ones). Evidently more careful internal hostname checking, etc., could be performed by the - special purpose application to add security. See [37]connect_switch + special purpose application to add security. See [38]connect_switch which is somewhat related. - One might imagine the ProxyPass could be done for the VNC traffic as @@ -11986,40 +12133,41 @@ References 1. http://www.karlrunge.com/x11vnc/ssvnc.html 2. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer 3. http://www.karlrunge.com/x11vnc/ssl-portal.html#no-apache - 4. http://www.karlrunge.com/x11vnc/ssl-portal.html#precautions - 5. http://www.karlrunge.com/x11vnc/ssl-single-443.html - 6. https://issues.apache.org/bugzilla/show_bug.cgi?id=29744 - 7. http://www.karlrunge.com/x11vnc/ssl-portal.html#port-variations - 8. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 9. http://www.karlrunge.com/x11vnc/ssl-portal.html#inetd - 10. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin - 11. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-java-viewer-proxy - 12. http://www.karlrunge.com/x11vnc/ssl-portal.html#tricks - 13. http://www.karlrunge.com/x11vnc/ssl-portal.html#https-applet - 14. http://www.karlrunge.com/x11vnc/ssl-portal.html#https-applet" - 15. http://www.karlrunge.com/x11vnc/ssl-portal-orig.html - 16. http://www.karlrunge.com/x11vnc/ssl-output.html - 17. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbauth - 18. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile - 19. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-usepw - 20. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw - 21. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify - 22. http://www.karlrunge.com/x11vnc/ssvnc.html - 23. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer - 24. http://www.karlrunge.com/x11vnc/ssvnc.html - 25. http://httpd.apache.org/docs/2.0/mod/mod_ssl.html - 26. http://www.karlrunge.com/x11vnc/ssl.html - 27. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert - 28. http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert - 29. http://www.karlrunge.com/x11vnc/ssl-portal.html#tricks - 30. http://www.karlrunge.com/x11vnc/ssl-single-443.html - 31. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find - 32. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT - 33. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create - 34. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin - 35. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http_ssl - 36. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-prog - 37. http://www.karlrunge.com/x11vnc/ssl-single-443.html + 4. http://www.karlrunge.com/x11vnc/faq.html#faq-web-login + 5. http://www.karlrunge.com/x11vnc/ssl-portal.html#precautions + 6. http://www.karlrunge.com/x11vnc/ssl-single-443.html + 7. https://issues.apache.org/bugzilla/show_bug.cgi?id=29744 + 8. http://www.karlrunge.com/x11vnc/ssl-portal.html#port-variations + 9. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 10. http://www.karlrunge.com/x11vnc/ssl-portal.html#inetd + 11. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + 12. http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-java-viewer-proxy + 13. http://www.karlrunge.com/x11vnc/ssl-portal.html#tricks + 14. http://www.karlrunge.com/x11vnc/ssl-portal.html#https-applet + 15. http://www.karlrunge.com/x11vnc/ssl-portal.html#https-applet" + 16. http://www.karlrunge.com/x11vnc/ssl-portal-orig.html + 17. http://www.karlrunge.com/x11vnc/ssl-output.html + 18. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbauth + 19. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile + 20. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-usepw + 21. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-unixpw + 22. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslverify + 23. http://www.karlrunge.com/x11vnc/ssvnc.html + 24. http://www.karlrunge.com/x11vnc/faq.html#ss_vncviewer + 25. http://www.karlrunge.com/x11vnc/ssvnc.html + 26. http://httpd.apache.org/docs/2.0/mod/mod_ssl.html + 27. http://www.karlrunge.com/x11vnc/ssl.html + 28. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-sslGenCert + 29. http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert + 30. http://www.karlrunge.com/x11vnc/ssl-portal.html#tricks + 31. http://www.karlrunge.com/x11vnc/ssl-single-443.html + 32. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-find + 33. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-display_WAIT + 34. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-create + 35. http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + 36. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-http_ssl + 37. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-prog + 38. http://www.karlrunge.com/x11vnc/ssl-single-443.html ======================================================================= http://www.karlrunge.com/x11vnc/enhanced_tightvnc_viewer.html: @@ -13101,8 +13249,8 @@ Unix VNCviewer (0.5MB) redistribute the above because of cryptographic software they contain or for other reasons. Please check out your situation and information at the following and related sites: - [73]http://www.stunnel.org - [74]http://stunnel.mirt.net + [73]http://stunnel.mirt.net + [74]http://www.stunnel.org [75]http://www.openssl.org [76]http://www.chiark.greenend.org.uk/~sgtatham/putty/ [77]http://www.tightvnc.com @@ -13186,8 +13334,8 @@ References 70. http://sourceforge.net/projects/ssvnc/files/ssvnc/1.0.23/ 71. http://sourceforge.net/projects/ssvnc/files/ssvnc/1.0.24/ 72. http://sourceforge.net/projects/ssvnc/files/ssvnc/1.0.25/ - 73. http://www.stunnel.org/ - 74. http://stunnel.mirt.net/ + 73. http://stunnel.mirt.net/ + 74. http://www.stunnel.org/ 75. http://www.openssl.org/ 76. http://www.chiark.greenend.org.uk/~sgtatham/putty/ 77. http://www.tightvnc.com/ @@ -13206,7 +13354,7 @@ x11vnc: a VNC server for real X displays Here are all of x11vnc command line options: % x11vnc -opts (see below for -help long descriptions) -x11vnc: allow VNC connections to real X11 displays. 0.9.10 lastmod: 2010-02-21 +x11vnc: allow VNC connections to real X11 displays. 0.9.10 lastmod: 2010-03-20 x11vnc options: -display disp -auth file -N @@ -13334,7 +13482,7 @@ libvncserver-tight-extension options: % x11vnc -help -x11vnc: allow VNC connections to real X11 displays. 0.9.10 lastmod: 2010-02-21 +x11vnc: allow VNC connections to real X11 displays. 0.9.10 lastmod: 2010-03-20 (type "x11vnc -opts" to just list the options.) @@ -13795,6 +13943,11 @@ Options: -stunnel the ssl classes subdirectory is sought. -http_ssl As -http, but force lookup for ssl classes subdir. + Note that for HTTPS, single-port Java applet delivery + you can set X11VNC_HTTPS_DOWNLOAD_WAIT_TIME to the + max number of seconds to wait for the applet download + to finish. The default is 15. + -avahi Use the Avahi/mDNS ZeroConf protocol to advertise this VNC server to the local network. (Related terms: Rendezvous, Bonjour). Depending on your setup, you @@ -14232,9 +14385,31 @@ Options: the user is allowed, but the option values associated with it do apply as normal. - There are also some utilities for testing password + There are also some utilities for checking passwords if [list] starts with the "%" character. See the - quick_pw() function in the source for details. + quick_pw() function for more details. Description: + "%-" or "%stdin" means read one line from stdin. + "%env" means it is in $UNIXPW env var. A leading + "%/" or "%." means read the first line from the + filename that follows after the % character. % by + itself means prompt for the username and password. + Otherwise: %user:pass E.g. -unixpw %fred:swordfish + For the other cases user:pass is read from the indicated + source. If the password is correct 'Y user' is printed + and the program exit code is 0. If the password is + incorrect it prints 'N user' and the exit code is 1. + If there is some other error the exit code is 2. + This feature enables x11vnc to be a general unix user + password checking tool; it could be used from scripts + or other programs. These % password checks also apply + to the -unixpw_nis and -unixpw_cmd options. + + For the % password check, if the env. var. UNIXPW_CMD + is set to a command then it is run as the user (assuming + the password is correct.) The output of the command is + not printed, the program or script must manage that by + some other means. The exit code of x11vnc will depend + on the exit code of the command that is run. Use -nounixpw to disable unixpw mode if it was enabled earlier in the cmd line (e.g. -svc mode) @@ -14339,8 +14514,11 @@ Options: supplied unixpw_cmd to do user switching if desired and if it has the permissions to do so. --find Find the user's display using FINDDISPLAY. This is an - alias for "-display WAIT:cmd=FINDDISPLAY". +-find Find the user's display using FINDDISPLAY. This + is an alias for "-display WAIT:cmd=FINDDISPLAY". + + Note: if a -display occurs later on the command line + it will override the -find setting. For this and the next few options see -display WAIT:... below for all of the details. @@ -14378,6 +14556,9 @@ Options: FINDCREATEDISPLAY method. This is an alias for "-display WAIT:cmd=FINDCREATEDISPLAY-Xvfb". + Note: if a -display occurs later on the command line + it will override the -create setting. + SSH NOTE: for both -find and -create you can (should!) add the "-localhost" option to force SSH tunnel access. @@ -14395,6 +14576,10 @@ Options: -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb -unixpw -users unixpw= -ssl SAVE Also "-service". + Note: if a -display, -unixpw, -users, or -ssl occurs + later on the command line it will override the -svc + setting. + -svc_xdummy As -svc except Xdummy instead of Xvfb. -svc_xvnc As -svc except Xvnc instead of Xvfb. -svc_xdummy_xvfb As -svc with Xdummy,Xvfb. @@ -14403,6 +14588,10 @@ Options: Alias for -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb.xdmcp -unixpw -users unixpw= -ssl SAVE Also "-xdm_service". + Note: if a -display, -unixpw, -users, or -ssl occurs + later on the command line it will override the -xdmsvc + setting. + To create a session a user will have to first log in to the -unixpw dialog and then log in again to the XDM/GDM/KDM prompt. Subsequent re-connections will @@ -14753,6 +14942,11 @@ Options: X property, that makes FINDDISPLAY only find sessions with that tag value. + Set FD_XDMCP_IF to the network interface that the + display manager is running on; default is 'localhost' + but you may need to set it to '::1' on some IPv6 only + systems or misconfigured display managers. + If you want the FINDCREATEDISPLAY session to contact an XDMCP login manager (xdm/gdm/kdm) on the same machine, then use "Xvfb.xdmcp" instead of "Xvfb", etc. @@ -15414,7 +15608,7 @@ Options: exits. --stunnel [pem] Use the stunnel(8) (www.stunnel.org) to provide an +-stunnel [pem] Use the stunnel(8) (stunnel.mirt.net) to provide an encrypted SSL tunnel between viewers and x11vnc. This external tunnel method was implemented prior to the @@ -18244,6 +18438,10 @@ n for root window, use +id for children. grab_state get state of pointer and keyboard grab. pointer_pos print XQueryPointer x,y cursor position. + pointer_x print XQueryPointer x cursor position. + pointer_y print XQueryPointer y cursor position. + pointer_same print XQueryPointer ptr on same screen. + pointer_root print XQueryPointer curr ptr rootwin. mouse_x print x11vnc's idea of cursor position. mouse_y print x11vnc's idea of cursor position. noop do nothing. @@ -18542,18 +18740,18 @@ n http_url auth xauth users rootshift clipshift scale_str scaled_x scaled_y scale_numer scale_denom scale_fac_x scale_fac_y scaling_blend scaling_nomult4 scaling_pad - scaling_interpolate inetd privremote unsafe safer - nocmds passwdfile unixpw unixpw_nis unixpw_list ssl - ssl_pem sslverify stunnel stunnel_pem https httpsredir - usepw using_shm logfile o flag rmflag rc norc h help - V version lastmod bg sigpipe threads readrate netrate - netlatency pipeinput clients client_count pid ext_xtest - ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama - ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin - num_buttons button_mask mouse_x mouse_y grab_state - pointer_pos bpp depth indexed_color dpy_x dpy_y wdpy_x - wdpy_y off_x off_y cdpy_x cdpy_y coff_x coff_y rfbauth - passwd viewpasswd + scaling_interpolate inetd privremote unsafe safer nocmds + passwdfile unixpw unixpw_nis unixpw_list ssl ssl_pem + sslverify stunnel stunnel_pem https httpsredir usepw + using_shm logfile o flag rmflag rc norc h help V version + lastmod bg sigpipe threads readrate netrate netlatency + pipeinput clients client_count pid ext_xtest ext_xtrap + ext_xrecord ext_xkb ext_xshm ext_xinerama ext_overlay + ext_xfixes ext_xdamage ext_xrandr rootwin num_buttons + button_mask mouse_x mouse_y grab_state pointer_pos + pointer_x pointer_y pointer_same pointer_root bpp depth + indexed_color dpy_x dpy_y wdpy_x wdpy_y off_x off_y + cdpy_x cdpy_y coff_x coff_y rfbauth passwd viewpasswd -QD variable Just like -query variable, but returns the default value for that parameter (no running x11vnc server diff --git a/x11vnc/cursor.c b/x11vnc/cursor.c index 12700f4..3d613a6 100644 --- a/x11vnc/cursor.c +++ b/x11vnc/cursor.c @@ -908,6 +908,9 @@ static void tree_descend_cursor(int *depth, Window *w, win_str_info_t *winfo) { *(winfo->res_name) = '\0'; *(winfo->res_class) = '\0'; + for (i=0; i < maxtries; i++) { + wins[i] = None; + } /* some times a window can go away before we get to it */ trapped_xerror = 0; diff --git a/x11vnc/help.c b/x11vnc/help.c index 874291c..7a89a32 100644 --- a/x11vnc/help.c +++ b/x11vnc/help.c @@ -518,6 +518,11 @@ void print_help(int mode) { " -stunnel the ssl classes subdirectory is sought.\n" "-http_ssl As -http, but force lookup for ssl classes subdir.\n" "\n" +" Note that for HTTPS, single-port Java applet delivery\n" +" you can set X11VNC_HTTPS_DOWNLOAD_WAIT_TIME to the\n" +" max number of seconds to wait for the applet download\n" +" to finish. The default is 15.\n" +"\n" "-avahi Use the Avahi/mDNS ZeroConf protocol to advertise\n" " this VNC server to the local network. (Related terms:\n" " Rendezvous, Bonjour). Depending on your setup, you\n" @@ -965,9 +970,31 @@ void print_help(int mode) { " the user is allowed, but the option values associated\n" " with it do apply as normal.\n" "\n" -" There are also some utilities for testing password\n" +" There are also some utilities for checking passwords\n" " if [list] starts with the \"%%\" character. See the\n" -" quick_pw() function in the source for details.\n" +" quick_pw() function for more details. Description:\n" +" \"%%-\" or \"%%stdin\" means read one line from stdin.\n" +" \"%%env\" means it is in $UNIXPW env var. A leading\n" +" \"%%/\" or \"%%.\" means read the first line from the\n" +" filename that follows after the %% character. %% by\n" +" itself means prompt for the username and password.\n" +" Otherwise: %%user:pass E.g. -unixpw %%fred:swordfish\n" +" For the other cases user:pass is read from the indicated\n" +" source. If the password is correct 'Y user' is printed\n" +" and the program exit code is 0. If the password is\n" +" incorrect it prints 'N user' and the exit code is 1.\n" +" If there is some other error the exit code is 2.\n" +" This feature enables x11vnc to be a general unix user\n" +" password checking tool; it could be used from scripts\n" +" or other programs. These %% password checks also apply\n" +" to the -unixpw_nis and -unixpw_cmd options.\n" +"\n" +" For the %% password check, if the env. var. UNIXPW_CMD\n" +" is set to a command then it is run as the user (assuming\n" +" the password is correct.) The output of the command is\n" +" not printed, the program or script must manage that by\n" +" some other means. The exit code of x11vnc will depend\n" +" on the exit code of the command that is run.\n" "\n" " Use -nounixpw to disable unixpw mode if it was enabled\n" " earlier in the cmd line (e.g. -svc mode)\n" @@ -1072,8 +1099,11 @@ void print_help(int mode) { " supplied unixpw_cmd to do user switching if desired\n" " and if it has the permissions to do so.\n" "\n" -"-find Find the user's display using FINDDISPLAY. This is an\n" -" alias for \"-display WAIT:cmd=FINDDISPLAY\".\n" +"-find Find the user's display using FINDDISPLAY. This\n" +" is an alias for \"-display WAIT:cmd=FINDDISPLAY\".\n" +"\n" +" Note: if a -display occurs later on the command line\n" +" it will override the -find setting.\n" "\n" " For this and the next few options see -display WAIT:...\n" " below for all of the details.\n" @@ -1111,6 +1141,9 @@ void print_help(int mode) { " FINDCREATEDISPLAY method. This is an alias for\n" " \"-display WAIT:cmd=FINDCREATEDISPLAY-Xvfb\".\n" "\n" +" Note: if a -display occurs later on the command line\n" +" it will override the -create setting.\n" +"\n" " SSH NOTE: for both -find and -create you can (should!)\n" " add the \"-localhost\" option to force SSH tunnel access.\n" "\n" @@ -1128,6 +1161,10 @@ void print_help(int mode) { " -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb -unixpw -users\n" " unixpw= -ssl SAVE Also \"-service\".\n" "\n" +" Note: if a -display, -unixpw, -users, or -ssl occurs\n" +" later on the command line it will override the -svc\n" +" setting.\n" +"\n" "-svc_xdummy As -svc except Xdummy instead of Xvfb.\n" "-svc_xvnc As -svc except Xvnc instead of Xvfb.\n" "-svc_xdummy_xvfb As -svc with Xdummy,Xvfb.\n" @@ -1136,6 +1173,10 @@ void print_help(int mode) { " Alias for -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb.xdmcp\n" " -unixpw -users unixpw= -ssl SAVE Also \"-xdm_service\".\n" "\n" +" Note: if a -display, -unixpw, -users, or -ssl occurs\n" +" later on the command line it will override the -xdmsvc\n" +" setting.\n" +"\n" " To create a session a user will have to first log in\n" " to the -unixpw dialog and then log in again to the\n" " XDM/GDM/KDM prompt. Subsequent re-connections will\n" @@ -1485,6 +1526,11 @@ void print_help(int mode) { " X property, that makes FINDDISPLAY only find sessions\n" " with that tag value.\n" "\n" +" Set FD_XDMCP_IF to the network interface that the\n" +" display manager is running on; default is 'localhost'\n" +" but you may need to set it to '::1' on some IPv6 only\n" +" systems or misconfigured display managers.\n" +"\n" " If you want the FINDCREATEDISPLAY session to contact an\n" " XDMCP login manager (xdm/gdm/kdm) on the same machine,\n" " then use \"Xvfb.xdmcp\" instead of \"Xvfb\", etc.\n" @@ -2147,7 +2193,7 @@ void print_help(int mode) { " exits.\n" "\n" "\n" -"-stunnel [pem] Use the stunnel(8) (www.stunnel.org) to provide an\n" +"-stunnel [pem] Use the stunnel(8) (stunnel.mirt.net) to provide an\n" " encrypted SSL tunnel between viewers and x11vnc.\n" "\n" " This external tunnel method was implemented prior to the\n" @@ -4980,6 +5026,10 @@ void print_help(int mode) { " for root window, use +id for children.\n" " grab_state get state of pointer and keyboard grab.\n" " pointer_pos print XQueryPointer x,y cursor position.\n" +" pointer_x print XQueryPointer x cursor position.\n" +" pointer_y print XQueryPointer y cursor position.\n" +" pointer_same print XQueryPointer ptr on same screen.\n" +" pointer_root print XQueryPointer curr ptr rootwin.\n" " mouse_x print x11vnc's idea of cursor position.\n" " mouse_y print x11vnc's idea of cursor position.\n" " noop do nothing.\n" @@ -5278,18 +5328,18 @@ void print_help(int mode) { " http_url auth xauth users rootshift clipshift scale_str\n" " scaled_x scaled_y scale_numer scale_denom scale_fac_x\n" " scale_fac_y scaling_blend scaling_nomult4 scaling_pad\n" -" scaling_interpolate inetd privremote unsafe safer\n" -" nocmds passwdfile unixpw unixpw_nis unixpw_list ssl\n" -" ssl_pem sslverify stunnel stunnel_pem https httpsredir\n" -" usepw using_shm logfile o flag rmflag rc norc h help\n" -" V version lastmod bg sigpipe threads readrate netrate\n" -" netlatency pipeinput clients client_count pid ext_xtest\n" -" ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama\n" -" ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin\n" -" num_buttons button_mask mouse_x mouse_y grab_state\n" -" pointer_pos bpp depth indexed_color dpy_x dpy_y wdpy_x\n" -" wdpy_y off_x off_y cdpy_x cdpy_y coff_x coff_y rfbauth\n" -" passwd viewpasswd\n" +" scaling_interpolate inetd privremote unsafe safer nocmds\n" +" passwdfile unixpw unixpw_nis unixpw_list ssl ssl_pem\n" +" sslverify stunnel stunnel_pem https httpsredir usepw\n" +" using_shm logfile o flag rmflag rc norc h help V version\n" +" lastmod bg sigpipe threads readrate netrate netlatency\n" +" pipeinput clients client_count pid ext_xtest ext_xtrap\n" +" ext_xrecord ext_xkb ext_xshm ext_xinerama ext_overlay\n" +" ext_xfixes ext_xdamage ext_xrandr rootwin num_buttons\n" +" button_mask mouse_x mouse_y grab_state pointer_pos\n" +" pointer_x pointer_y pointer_same pointer_root bpp depth\n" +" indexed_color dpy_x dpy_y wdpy_x wdpy_y off_x off_y\n" +" cdpy_x cdpy_y coff_x coff_y rfbauth passwd viewpasswd\n" "\n" "-QD variable Just like -query variable, but returns the default\n" " value for that parameter (no running x11vnc server\n" diff --git a/x11vnc/keyboard.c b/x11vnc/keyboard.c index cdf85e9..edce680 100644 --- a/x11vnc/keyboard.c +++ b/x11vnc/keyboard.c @@ -1114,7 +1114,8 @@ void switch_to_xkb_if_better(void) { n = k; XFree_wr(keymap); - if (missing_noxkb == 0 && syms_gt_4 >= 8) { + if (missing_noxkb == 0 && syms_per_keycode > 4 && syms_gt_4 >= 0) { + /* we used to have syms_gt_4 >= 8, now always on. */ if (! raw_fb_str) { rfbLog("\n"); rfbLog("XKEYBOARD: number of keysyms per keycode %d is greater\n", syms_per_keycode); @@ -1123,6 +1124,7 @@ void switch_to_xkb_if_better(void) { rfbLog(" If this makes the key mapping worse you can\n"); rfbLog(" disable it with the \"-noxkb\" option.\n"); rfbLog(" Also, remember \"-remap DEAD\" for accenting characters.\n"); + rfbLog("\n"); } use_xkb_modtweak = 1; @@ -1135,6 +1137,7 @@ void switch_to_xkb_if_better(void) { rfbLog(" Not automatically switching to -xkb mode.\n"); rfbLog(" If some keys still cannot be typed, try using -xkb.\n"); rfbLog(" Also, remember \"-remap DEAD\" for accenting characters.\n"); + rfbLog("\n"); } return; } @@ -1217,6 +1220,7 @@ void switch_to_xkb_if_better(void) { rfbLog(" Also, remember \"-remap DEAD\" for accenting" " characters.\n"); } + rfbLog("\n"); } /* sets up all the keymapping info via Xkb API */ diff --git a/x11vnc/misc/Makefile.am b/x11vnc/misc/Makefile.am index f814315..98a7511 100644 --- a/x11vnc/misc/Makefile.am +++ b/x11vnc/misc/Makefile.am @@ -1,3 +1,3 @@ SUBDIRS = turbovnc DIST_SUBDIRS = turbovnc -EXTRA_DIST=README blockdpy.c dtVncPopup rx11vnc rx11vnc.pl shm_clear ranfb.pl slide.pl vcinject.pl x11vnc_loop Xdummy ultravnc_repeater.pl connect_switch +EXTRA_DIST=README blockdpy.c dtVncPopup rx11vnc rx11vnc.pl shm_clear ranfb.pl slide.pl vcinject.pl x11vnc_loop Xdummy ultravnc_repeater.pl connect_switch panner.pl desktop.cgi inet6to4 diff --git a/x11vnc/misc/README b/x11vnc/misc/README index abb60f6..f38616e 100644 --- a/x11vnc/misc/README +++ b/x11vnc/misc/README @@ -33,3 +33,14 @@ Misc. scripts: use Xsetup mechanism. Xdummy An LD_PRELOAD kludge to run the Xorg "dummy" device driver like Xvfb. + + ultravnc_repeater.pl: Unix script to act as UltraVNC repeater proxy. + + connect_switch: Share HTTPS, VNC, SSH, etc. through a single port (e.g. 443) + + panner.pl Allows a small rectangle to pan around a desktop more or less. + + desktop.cgi CGI script for creating multi-user virtual desktops on a + server. Also can do port-redirection to internal machines. + + inet6to4 ipv6 to ipv4 relay (i.e. until libvncserver supports ipv6) diff --git a/x11vnc/misc/connect_switch b/x11vnc/misc/connect_switch index ad6d138..212157f 100755 --- a/x11vnc/misc/connect_switch +++ b/x11vnc/misc/connect_switch @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# Copyright (c) 2006-2009 by Karl J. Runge +# Copyright (c) 2006-2010 by Karl J. Runge # # connect_switch is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -35,10 +35,14 @@ # because the CONNECT request appears to be forwarded encrypted to # the remote host and so the SSL dies immediately. # +# It can also be used to redirect ANY protocol, e.g. SSH, not just VNC. +# See CONNECT_SWITCH_APPLY_VNC_OFFSET=0 to disable VNC 5900 shift. +# # Note: There is no need to use this script for a non-ssl apache webserver # port because mod_proxy works fine for doing the switching all inside # apache (see ProxyRequests and AllowCONNECT parameters). # +# # Apache configuration: # # The mod_ssl configuration is often in a file named ssl.conf. In the @@ -68,6 +72,126 @@ # It is probably a good idea to set $listen_host below to the known # IP address you want the service to listen on (to avoid localhost where # apache is listening). +# + +#################################################################### +# NOTE: For more info on configuration settings, read below for +# all of the CONNECT_SWITCH_* env. var. parameters. +#################################################################### + + +#################################################################### +# Allow env vars to also be specified on cmdline: +# +foreach my $arg (@ARGV) { + if ($arg =~ /^(CONNECT_SWITCH.*?)=(.*)$/) { + $ENV{$1} = $2; + } +} + +# Set up logging: +# +if (exists $ENV{CONNECT_SWITCH_LOGFILE}) { + close STDOUT; + if (!open(STDOUT, ">>$ENV{CONNECT_SWITCH_LOGFILE}")) { + die "connect_switch: $ENV{CONNECT_SWITCH_LOGFILE} $!\n"; + } + close STDERR; + open(STDERR, ">&STDOUT"); +} +select(STDERR); $| = 1; +select(STDOUT); $| = 1; + +# interrupt handler: +# +my $looppid = ''; +my $pidfile = ''; +my $listen_sock = ''; # declared here for get_out() +# +sub get_out { + print STDERR "$_[0]:\t$$ looppid=$looppid\n"; + close $listen_sock if $listen_sock; + if ($looppid) { + kill 'TERM', $looppid; + fsleep(0.2); + } + unlink $pidfile if $pidfile; + exit 0; +} +$SIG{INT} = \&get_out; +$SIG{TERM} = \&get_out; + +# pidfile: +# +sub open_pidfile { + if (exists $ENV{CONNECT_SWITCH_PIDFILE}) { + my $pf = $ENV{CONNECT_SWITCH_PIDFILE}; + if (open(PID, ">$pf")) { + print PID "$$\n"; + close PID; + $pidfile = $pf; + } else { + print STDERR "could not open pidfile: $pf - $! - continuing...\n"; + } + delete $ENV{CONNECT_SWITCH_PIDFILE}; + } +} + +#################################################################### +# Set CONNECT_SWITCH_LOOP=1 to have this script create an outer loop +# restarting itself if it ever exits. Set CONNECT_SWITCH_LOOP=BG to +# do this in the background as a daemon. + +if (exists $ENV{CONNECT_SWITCH_LOOP}) { + my $csl = $ENV{CONNECT_SWITCH_LOOP}; + if ($csl ne 'BG' && $csl ne '1') { + die "connect_switch: invalid CONNECT_SWITCH_LOOP.\n"; + } + if ($csl eq 'BG') { + # go into bg as "daemon": + setpgrp(0, 0); + my $pid = fork(); + if (! defined $pid) { + die "connect_switch: $!\n"; + } elsif ($pid) { + wait; + exit 0; + } + if (fork) { + exit 0; + } + setpgrp(0, 0); + close STDIN; + if (! $ENV{CONNECT_SWITCH_LOGFILE}) { + close STDOUT; + close STDERR; + } + } + delete $ENV{CONNECT_SWITCH_LOOP}; + + if (exists $ENV{CONNECT_SWITCH_PIDFILE}) { + open_pidfile(); + } + + print STDERR "connect_switch: starting service at ", scalar(localtime), " master-pid=$$\n"; + while (1) { + $looppid = fork; + if (! defined $looppid) { + sleep 10; + } elsif ($looppid) { + wait; + } else { + exec $0; + exit 1; + } + print STDERR "connect_switch: re-starting service at ", scalar(localtime), " master-pid=$$\n"; + sleep 1; + } + exit 0; +} +if (exists $ENV{CONNECT_SWITCH_PIDFILE}) { + open_pidfile(); +} ############################################################################ @@ -83,15 +207,29 @@ # CONNECT_SWITCH_VERBOSE # CONNECT_SWITCH_APPLY_VNC_OFFSET # CONNECT_SWITCH_VNC_OFFSET +# CONNECT_SWITCH_LISTEN_IPV6 +# CONNECT_SWITCH_BUFSIZE +# CONNECT_SWITCH_LOGFILE +# CONNECT_SWITCH_PIDFILE +# +# You can also set these on the cmdline: +# connect_switch CONNECT_SWITCH_LISTEN=X CONNECT_SWITCH_ALLOW_FILE=Y ... +# +# By default we will use hostname and assume it resolves: +# my $hostname = `hostname`; chomp $hostname; my $listen_host = $hostname; my $listen_port = 443; +# Let user override listening situation, e.g. multihomed: +# if (exists $ENV{CONNECT_SWITCH_LISTEN}) { + # # E.g. CONNECT_SWITCH_LISTEN=192.168.0.32:443 + # ($listen_host, $listen_port) = split(/:/, $ENV{CONNECT_SWITCH_LISTEN}); } @@ -99,10 +237,21 @@ my $httpd_host = 'localhost'; my $httpd_port = 443; if (exists $ENV{CONNECT_SWITCH_HTTPD}) { + # # E.g. CONNECT_SWITCH_HTTPD=127.0.0.1:443 + # ($httpd_host, $httpd_port) = split(/:/, $ENV{CONNECT_SWITCH_HTTPD}); } +my $bufsize = 8192; +if (exists $ENV{CONNECT_SWITCH_BUFSIZE}) { + # + # E.g. CONNECT_SWITCH_BUFSIZE=32768 + # + $bufsize = $ENV{CONNECT_SWITCH_BUFSIZE}; +} + + ############################################################################ # You can/should override the host/port settings here: # @@ -113,6 +262,9 @@ if (exists $ENV{CONNECT_SWITCH_HTTPD}) { # You must set the allowed host:port CONNECT redirection list. # Only these host:port pairs will be redirected to. +# Port ranges are allowed too: host:5900-5930. +# If there is one entry named ALL all connections are allow. +# You must supply something, default is deny. # my @allowed = qw( machine1:5915 @@ -141,6 +293,8 @@ if (exists $ENV{CONNECT_SWITCH_ALLOWED}) { # fredsbox 15 # rupert 1 +# For examply, mine is: +# my $allow_file = '/dist/apache/2.0/conf/vnc.hosts'; $allow_file = ''; @@ -158,25 +312,34 @@ my $apply_vnc_offset = 1; my $vnc_offset = 5900; if (exists $ENV{CONNECT_SWITCH_APPLY_VNC_OFFSET}) { + # # E.g. CONNECT_SWITCH_APPLY_VNC_OFFSET=0 + # $apply_vnc_offset = $ENV{CONNECT_SWITCH_APPLY_VNC_OFFSET}; } if (exists $ENV{CONNECT_SWITCH_VNC_OFFSET}) { + # # E.g. CONNECT_SWITCH_VNC_OFFSET=6000 + # $vnc_offset = $ENV{CONNECT_SWITCH_VNC_OFFSET}; } -# Set to 1 for more debugging output: +# Set to 1 or higher for more info output: # my $verbose = 0; if (exists $ENV{CONNECT_SWITCH_VERBOSE}) { + # # E.g. CONNECT_SWITCH_VERBOSE=1 + # $verbose = $ENV{CONNECT_SWITCH_VERBOSE}; } -############################################################################ + + +#=========================================================================== # No need for any changes below here. +#=========================================================================== use IO::Socket::INET; use strict; @@ -186,12 +349,29 @@ my $killpid = 1; setpgrp(0, 0); -my $listen_sock = IO::Socket::INET->new( - Listen => 10, - LocalAddr => $listen_host, - LocalPort => $listen_port, - Proto => "tcp" -); +if (exists $ENV{CONNECT_SWITCH_LISTEN_IPV6}) { + # note we leave out LocalAddr. + my $cmd = ' + use IO::Socket::INET6; + $listen_sock = IO::Socket::INET6->new( + Listen => 10, + LocalPort => $listen_port, + ReuseAddr => 1, + Domain => AF_INET6, + Proto => "tcp" + ); + '; + eval $cmd; + die "$@\n" if $@; +} else { + $listen_sock = IO::Socket::INET->new( + Listen => 10, + LocalAddr => $listen_host, + LocalPort => $listen_port, + ReuseAddr => 1, + Proto => "tcp" + ); +} if (! $listen_sock) { die "connect_switch: $!\n"; @@ -210,7 +390,7 @@ while (1) { fsleep(0.5); next; } - print STDERR "conn: $conn -- ", $client->peerhost(), "\n" if $verbose; + print STDERR "conn: $conn -- ", $client->peerhost(), " at ", scalar(localtime), "\n" if $verbose; my $pid = fork(); if (! defined $pid) { @@ -237,6 +417,10 @@ sub handle_conn { my @allow = @allowed; + # read allow file. Note we read it for every connection + # to allow the admin to modify it w/o restarting us. + # better way would be to read in parent and check mtime. + # if ($allow_file && -f $allow_file) { if (open(ALLOW, "<$allow_file")) { while () { @@ -259,6 +443,8 @@ sub handle_conn { } } + # Read the first 7 bytes of connection, see if it is 'CONNECT' + # my $str = ''; my $N = 0; my $isconn = 1; @@ -267,7 +453,7 @@ sub handle_conn { sysread($client, $b, 1); $str .= $b; $N++; - print STDERR "read: '$str'\n" if $verbose; + print STDERR "read: '$str'\n" if $verbose > 1; my $cstr = substr('CONNECT', 0, $i+1); if ($str ne $cstr) { $isconn = 0; @@ -276,28 +462,60 @@ sub handle_conn { } my $sock = ''; + if ($isconn) { + # it is CONNECT, read rest of HTTP header: + # while ($str !~ /\r\n\r\n/) { my $b; sysread($client, $b, 1); $str .= $b; } - print STDERR "read: $str\n" if $verbose; + print STDERR "read: $str\n" if $verbose > 1; + # get http version and host:port + # my $ok = 0; my $hostport = ''; my $http_vers = '1.0'; if ($str =~ /^CONNECT\s+(\S+)\s+HTTP\/(\S+)/) { $hostport = $1; $http_vers = $2; - foreach my $hp (@allow) { - if ($hp eq $hostport) { - $ok = 1; - last; + + my ($h, $p) = split(/:/, $hostport); + if ($p =~ /^\d+$/) { + # check allowed host list: + foreach my $hp (@allow) { + if ($hp eq 'ALL') { + $ok = 1; + } + if ($hp eq $hostport) { + $ok = 1; + } + if ($hp =~ /^(.*):(\d+)-(\d+)$/) { + my $ahost = $1; + my $pmin = $2; + my $pmax = $3; + if ($h eq $ahost) { + if ($p >= $pmin && $p <= $pmax) { + $ok = 1; + } + } + } + last if $ok; } } } + + my $msg_1 = "HTTP/$http_vers 200 Connection Established\r\n" + . "Proxy-agent: connect_switch v0.2\r\n\r\n"; + my $msg_2 = "HTTP/$http_vers 502 Bad Gateway\r\n" + . "Connection: close\r\n\r\n"; + if (! $ok) { + # disallowed. drop with message. + # + syswrite($client, $msg_2, length($msg_2)); close $client; exit 0; } @@ -312,18 +530,20 @@ sub handle_conn { Proto => "tcp" ); my $msg; + + # send the connect proxy reply: + # if ($sock) { - $msg = "HTTP/$http_vers 200 Connection Established\r\n" - . "Proxy-agent: connect_switch v0.2\r\n\r\n"; + $msg = $msg_1; } else { - $msg = "HTTP/$http_vers 502 Bad Gateway\r\n" - . "Connection: close\r\n\r\n"; + $msg = $msg_2; } syswrite($client, $msg, length($msg)); $str = ''; } else { - print STDERR "connecting to: $httpd_host:$httpd_port\n" - if $verbose; + # otherwise, redirect to apache for normal https: + # + print STDERR "connecting to: $httpd_host:$httpd_port\n" if $verbose; $sock = IO::Socket::INET->new( PeerAddr => $httpd_host, PeerPort => $httpd_port, @@ -336,6 +556,8 @@ sub handle_conn { die "connect_switch: $!\n"; } + # get ready for xfer phase: + # $current_fh1 = $client; $current_fh2 = $sock; @@ -349,6 +571,8 @@ sub handle_conn { kill 'TERM', $child; } } else { + # write those first bytes if not CONNECT: + # if ($str ne '' && $N > 0) { syswrite($sock, $str, $N); } @@ -358,9 +582,9 @@ sub handle_conn { kill 'TERM', $parent; } } - if ($verbose) { + if ($verbose > 1) { my $dt = time() - $start; - print STDERR "dt\[$$]: $dt\n"; + print STDERR "duration\[$$]: $dt seconds. ", scalar(localtime), "\n"; } exit 0; } @@ -380,7 +604,7 @@ sub xfer { while (! $nf) { $nf = select($ROUT=$RIN, undef, undef, undef); } - my $len = sysread($in, $buf, 8192); + my $len = sysread($in, $buf, $bufsize); if (! defined($len)) { next if $! =~ /^Interrupted/; print STDERR "connect_switch\[$lab/$conn/$$]: $!\n"; @@ -392,7 +616,7 @@ sub xfer { } if (0) { - # verbose debugging of data: + # very verbose debugging of data: syswrite(STDERR , "\n$lab: ", 6); syswrite(STDERR , $buf, $len); } diff --git a/x11vnc/misc/desktop.cgi b/x11vnc/misc/desktop.cgi new file mode 100755 index 0000000..c2f9cc9 --- /dev/null +++ b/x11vnc/misc/desktop.cgi @@ -0,0 +1,1134 @@ +#!/usr/bin/perl +# +# desktop.cgi +# +# An example cgi script to provide multi-user web access to x11vnc +# desktops. This script should/must be served by an HTTPS webserver, +# otherwise the unix and vnc passwords are sent over the network +# unencrypted (see below to disable) +# +# Note that the x11vnc -create virtual desktop service used below requires +# that you install the 'Xvfb' program. +# +# You should put this script in, say, a cgi-bin directory. +# +# You will *also* need to copy the x11vnc classes/ssl/UltraViewerSSL.jar +# file to the document root: /UltraViewerSSL.jar (or change the html +# at bottom.) +# +# Each x11vnc server created for a login will listen on its own port (see +# below for port selection schemes.) Your firewall must let in these ports. +# It is difficult and not as reliable to do all of this through a single port; +# however, see the fixed port scheme find_free_port = 'fixed:5900' below. +# +# Note there are two SSL certificates involved that the user may be +# asked to inspect: apache's SSL cert and x11vnc's SSL cert. This may +# confuse the user. +# +# This script provides one example on how to provide the service. You can +# customize to meet your needs, e.g. switch to php, newer modules, +# different authentication, SQL database, etc. If you plan to use it +# in production, please examine all security aspects of it carefully; +# read the comments in the script for more info. +# +# More information and background: +# +# http://www.karlrunge.com/x11vnc/faq.html#faq-xvfb +# http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tunnel-viewers +# http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-java-viewer-proxy +# http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-portal +# http://www.karlrunge.com/x11vnc/faq.html#faq-unix-passwords +# http://www.karlrunge.com/x11vnc/faq.html#faq-userlogin + + +#------------------------------------------------------------------------- +# Copyright (c) 2010 by Karl J. Runge +# +# desktop.cgi is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or (at +# your option) any later version. +# +# desktop.cgi is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with desktop.cgi; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA +# or see . +#------------------------------------------------------------------------- + +use strict; +use IO::Socket::INET; + + +# TCP Ports: +# +# Set find_free_port to 1 (or the other modes described below) to +# autoselect a free port to use. The default is to use a fixed port +# based on the userid. +# +my $find_free_port = 0; +# +# Or specify a port range: +# +#$find_free_port = '7000-8000'; +# +# Or indicate to use a kludge to try to do everything through a SINGLE +# port. To try to avoid contention on the port, simultaneous instances +# of this script attempt to 'take turns' using it. +# +#$find_free_port = 'fixed:5900'; + + +# Port redirection mode: +# +# This is to allow port redirection mode: username@host:port If username +# is valid, there will be a port redirection to internal machine +# host:port. Presumably there is already an SSL enabled and password +# protected VNC server running there. We don't start that server. +# See the next setting for an allowed hosts file. The default for port +# redirection is off. +# +my $enable_port_redirection = 0; + +# A file with allowed port redirections. The empty string '' (the +# default) means all host:port redirections would be allowed. +# +# Format of the file: A list of 'user@host:port' or 'host:port' +# entries, one per line. Port ranges, e.g. host:n-m are also accepted. +# +# Leading and trailing whitespace is trimmed off each line. Blank lines +# and comment lines starting with '#' are skipped. A line consisting of +# 'ALL' matches everything. If no match can be found or the file cannot +# be opened the connection is dropped. +# +my $port_redirection_allowed_hosts = ''; + + +# Set to 0 to have the java applet html set the parameter +# trustUrlVncCert=no, i.e. the applet will not automatically accept an +# SSL cert already accepted by an HTTPS URL. See print_applet_html() +# below for more info. +# +my $trustUrlVncCert = 1; + + +# Comment this out if you don't want PATH modified: +# +$ENV{PATH} = "/usr/bin:bin:$ENV{PATH}"; + + +# For the next two settings, note that most users will be confused that +# geometry and session are ignored when they are returning to their +# existing desktop session (x11vnc FINDDISPLAY action.) + +# Used below if user did not specify preferred geometry and color depth: +# +my $default_geometry = '1024x768x24'; + + +# Set this to the list of x11vnc -create sessions types to show a session +# dropdown for the user to select from. +# +my $session_types = ''; +# +# example: +#$session_types = 'gnome kde xfce lxde wmaker enlightenment mwm twm failsafe'; + + +# Set this to 1 to enable user setting a unique tag for each one +# of his desktops and so can have multiple ones simultaneously and +# select which one he wants. For now we just hack this onto geometry +# 1024x768x24:my_2nd_desktop but ultimately there should be a form entry +# for it. Search for enable_unique_tags for more info: +# +my $enable_unique_tags = 0; +my $unique_tag = ''; + +# You can set some extra x11vnc cmdline options here: +# +my $x11vnc_extra_opts = ''; + + +# Path to x11vnc program: +# +my $x11vnc = '/usr/bin/x11vnc'; + +if (`uname -n` =~ /haystack/) { + # for my testing: + if (-f "/home/runge/dtcgi.test") { + eval `cat /home/runge/dtcgi.test`; + } +} + + +# http header: +# +print STDOUT "Content-Type: text/html\r\n\r\n"; + + +# Require HTTPS so that unix and vnc passwords are not sent in clear text +# (perhaps it is too late...) Disable HTTPS at your own risk. +# +if ($ENV{HTTPS} !~ /^on$/i) { + bye("HTTPS must be used (to encrypt passwords)"); +} + + +# Read request: +# +my $request; +if ($ENV{'REQUEST_METHOD'} eq "POST") { + read(STDIN, $request, $ENV{'CONTENT_LENGTH'}); +} elsif ($ENV{'REQUEST_METHOD'} eq "GET" ) { + $request = $ENV{'QUERY_STRING'}; +} else { + $request = $ARGV[0]; +} + +my %request = url_decode(split(/[&=]/, $request)); + + +# Experiment for FD_TAG x11vnc feature for multiple desktops: +# +# we hide it in geometry:tag for now: +# +if ($enable_unique_tags && $request{geometry} =~ /^(.*):(\w+)$/) { + $request{geometry} = $1; + $unique_tag = $2; +} + +# Check/set geometry and session: +# +if (!exists $request{geometry} || $request{geometry} !~ /^[x\d]+$/) { + # default geometry and depth: + $request{geometry} = $default_geometry; +} +if (!exists $request{session} || $request{session} =~ /^\s*$/) { + $request{session} = ''; +} + + +# String for the login form: +# +my $login_str = <<"END"; +x11vnc web access +

x11vnc web access

+
+ + + + + + + +

Login

Username: + +
Password: + +
Geometry: + +
+ +
+
+END + + +# Set up user selected desktop session list, if enabled: +# +my %sessions; + +if ($session_types ne '') { + my $str = "Session:\n\n"; + + # This forces $request{session} to be a valid one: + # + if (! exists $sessions{$request{session}}) { + $request{session} = 'none'; + } + + # Insert into login_str: + # + my $r = $request{session}; + $str =~ s/option value=\Q$r\E/option selected value=$r/; + $login_str =~ s//$str/; +} + + +# If no username or password, show login form: +# +if (!$request{username} && !$request{password}) { + bye($login_str); +} elsif (!$request{username}) { + bye("No Username.

$login_str"); +} elsif (!$request{password}) { + bye("No Password.

$login_str"); +} + + +# Some shorthand names: +# +my $username = $request{username}; +my $password = $request{password}; +my $geometry = $request{geometry}; +my $session = $request{session}; + + +# If port redirection is enabled, split username@host:port +# +my $redirect_host = ''; +my $current_fh1 = ''; +my $current_fh2 = ''; + +if ($enable_port_redirection) { + ($username, $redirect_host) = split(/@/, $username, 2); + if ($redirect_host ne '') { + # will exit if the redirection is not allowed: + check_redirect_host(); + } +} + + +# Require username to be alphanumeric + '-' + '_': +# (one may want to add '.' as well) +# +if ($username !~ /^\w[-\w]*$/) { + bye("Invalid Username.

$login_str"); +} + + +# Get the userid number, we may use it as his VNC display port; this +# also checks if the username exists: +# +my $uid = `/usr/bin/id -u '$username'`; +chomp $uid; +if ($? != 0 || $uid !~ /^\d+$/) { + bye("Invalid Username.

$login_str"); +} + + +# Use x11vnc trick to check if the unix password is valid: +# +if (!open(X11VNC, "| $x11vnc -unixpw \%stdin > /dev/null")) { + bye("Internal Error #1"); +} +print X11VNC "$username:$password\n"; + +if (!close X11VNC) { + # x11vnc returns non-zero for invalid username+password: + bye("Invalid Password.

$login_str"); +} + + +# Initialize random number generator for use below: +# +initialize_random(); + + +# Set vnc port: +# +my $vnc_port = 0; +my $fixed_port = 0; + +if (! $find_free_port) { + # Fixed port based on userid (we assume it is free): + # + $vnc_port = 7000 + $uid; + +} elsif ($find_free_port =~ /^fixed:(\d+)$/) { + # + # Enable the -loopbg method that tries to share a single port: + # + $vnc_port = $1; + $fixed_port = 1; +} else { + # Autoselect a port, either default range (7000-8000) or a user + # supplied range. (note that $find_free_port will now contain + # a socket listening on the found port so that it is held.) + # + $vnc_port = auto_select_port(); +} + +# Check for crazy port value: +# +if ($vnc_port > 64000 || $vnc_port < 1) { + bye("Internal Error #2 $vnc_port"); +} + + +# If port redirection is enabled and the user selected it via +# username@host:port, we do that right now and then exit. +# +if ($enable_port_redirection && $redirect_host ne '') { + port_redir(); + exit 0; +} + + +# Make a random, onetime vnc password: +# +my $pass = ''; +my $chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; +my @abc = split(//, $chars); + +for (my $i = 0; $i < 8; $i++) { + $pass .= $abc[ rand(scalar(@abc)) ]; +} + +# Use x11vnc trick to switch to user and store vnc pass in the passwdfile. +# Result is $pass is placed in user's $HOME/x11vnc.pw +# +# (This is actually difficult to do without untrusted local users being +# able to see the pass as well, see copy_password_to_user() for details +# on how we try to avoid this.) +# +copy_password_to_user($pass); + + +# Make a tmp file for x11vnc launcher script: +# +my $tmpfile = `/bin/mktemp /tmp/desktop.cgi.XXXXXX`; +chomp $tmpfile; + +# Check if the tmpfile is valid: +# +if (! -e $tmpfile || ! -o $tmpfile || -l $tmpfile) { + unlink $tmpfile; + bye("Internal Error #3"); +} +if (!chmod 0644, $tmpfile) { + unlink $tmpfile; + bye("Internal Error #4"); +} +if (!open(TMP, ">$tmpfile")) { + unlink $tmpfile; + bye("Internal Error #5"); +} + + +# The x11vnc command. You adjust it to suit your needs. +# +# some ideas: -env FD_PROG=/usr/bin/gnome-session +# -env FD_SESS=kde +# -env FD_TAG=my_2nd_desktop +# -ultrafilexfer +# +# Note that -timeout will cause it to exit if client does not connect +# and -sslonly disables VeNCrypt SSL connections. + +# Some settings: +# +my $timeout = 75; +my $extra = ''; +if ($fixed_port) { + # settings for fixed port case: + $timeout = 45; + $extra .= " -loopbg100,1"; +} +if ($session_types ne '') { + # settings for session selection case: + if (exists $sessions{$session}) { + $extra .= " -env FD_SESS='$session'"; + } +} +if ($enable_unique_tags && $unique_tag ne '' && $unique_tag =~ /^\w+$/) { + $extra .= " -env FD_TAG='$unique_tag'"; +} + +# This md5sum check of the vnc passwd is for extra safety (see +# copy_password_to_user for details.) +# +my $md5sum = ''; +system("type md5sum > /dev/null"); +if ($? == 0) { + my $md5 = `/bin/mktemp /tmp/desktop.cgi.XXXXXX`; + chomp $md5; + # compute md5sum of password: + if (-o $md5 && open(MD5, "| md5sum > $md5")) { + print MD5 "$pass\n"; + close MD5; + if (open(MD5, "<$md5")) { + # read it: + my $line = ; + close MD5; + my ($s, $t) = split(' ', $line); + if (length($s) >= 32 && $s =~ /^\w+$/) { + # shell code for user to check he has correct passwd: + $md5sum = "if md5sum \$HOME/x11vnc.pw | grep '$s' > /dev/null; then true; else exit 1; fi"; + } + } + } + unlink $md5; +} + +# write x11vnc command to the tmp file: +# +print TMP <<"END"; +#!/bin/sh +export PATH=/usr/bin:/bin:\$PATH +$md5sum +$x11vnc -sigpipe ignore:HUP -nopw -rfbport $vnc_port \\ + -passwdfile \$HOME/x11vnc.pw -oa \$HOME/x11vnc.log \\ + -create -ssl SAVE -sslonly -env FD_GEOM=$geometry \\ + -timeout $timeout $extra $x11vnc_extra_opts \\ + >/dev/null 2>/dev/null /dev/null")) { + unlink $tmpfile; + unlink $rmlock if $rmlock; + bye("Internal Error #6"); +} + +select(X11VNC); $| = 1; select(STDOUT); + +# Close any port we held. There is still a gap of time between now +# and when when x11vnc in $tmpfile reopens the port after the password +# authentication. So another instance of this script could accidentally +# think it is free... +# +sleep 1; +close $find_free_port if $find_free_port; + +print X11VNC "$username:$password\n"; +close X11VNC; # note we ignore return value. +unlink $tmpfile; + +if ($rmlock) { + # let our x11vnc proceed a bit before removing lock. + sleep 2; + unlink $rmlock; +} + +# Return html for the java applet to connect to x11vnc. +# +print_applet_html(); + +exit 0; + +################################################################# +# Subroutines: + +# print the message to client and exit with success. +# +sub bye { + my $msg = shift; + print STDOUT "$msg\n"; + exit 0; +} + +# decode %xx to character: +# +sub url_decode { + foreach (@_) { + tr/+/ /; + s/%(..)/pack("c",hex($1))/ge; + } + @_; +} + +# seed random +# +sub initialize_random { + my $rbytes = ''; + if (open(RAN, " $pmax) { + ($pmin, $pmax) = ($pmax, $pmin); + } + } elsif ($find_free_port > 1024) { + # user supplied a starting port: + $pmin = $find_free_port; + $pmax = $pmin + 1000; + } + + # Try to add a bit of randomness to the starting port so + # simultaneous instances of this script won't be fooled by the gap + # of time before x11vnc reopens the port (see near the bottom.) + # + my $dp = int(rand(1.0) * 0.25 * ($pmax - $pmin)); + if ($pmin + $dp < $pmax - 20) { + $pmin = $pmin + $dp; + } + + my $port = 0; + + # Now try to find a free one: + # + for (my $p = $pmin; $p <= $pmax; $p++) { + my $sock = IO::Socket::INET->new( + Listen => 1, + LocalPort => $p, + ReuseAddr => 1, + Proto => "tcp" + ); + if ($sock) { + # we will keep this open until we call x11vnc: + $find_free_port = $sock; + $port = $p; + last; + } + } + return $port; +} + +# Since apache typically runs as user 'apache', 'nobody', etc, and not +# as root it is tricky for us to copy the pass string to a file owned by +# the user without some other untrusted local user being able to learn +# the password (e.g. via reading a file or watching ps.) Note that with +# the x11vnc -unixpw trick we unfortunately can't use a pipe because +# the user command is run in its own tty. +# +# The best way would be a sudo action or a special setuid program for +# copying. So consider using that and thereby simplify this function. +# +# Short of a special program doing this, we use a fifo so ONLY ONE +# process can read the password. If the untrusted local user reads it, +# then the logging-in user's x11vnc won't get it. The login and x11vnc +# will fail, but the untrusted user won't gain access to the logging-in +# user's desktop. +# +# So here we start long, tedious work carefully managing the fifo. +# +sub copy_password_to_user { + + my $pass = shift; + + my $use_fifo = ''; + + # Find a command to make a fifo: + # + system("type mkfifo > /dev/null"); + if ($? == 0) { + $use_fifo = 'mkfifo %s'; + } else { + system("type mknod > /dev/null"); + if ($? == 0) { + $use_fifo = 'mknod %s p'; + } + } + + # Create the filename for our fifo: + # + my $fifo = `/bin/mktemp /tmp/desktop.cgi.XXXXXX`; + chomp $fifo; + + if (! -e $fifo || ! -o $fifo || -l $fifo) { + unlink $fifo; + bye("Internal Error #7"); + } + + # Make the fifo: + # + if ($use_fifo) { + $use_fifo = sprintf($use_fifo, $fifo); + + # there is a small race here: + system("umask 077; rm -f $fifo; $use_fifo; chmod 600 $fifo"); + + if (!chmod 0600, $fifo) { + # we chmod once more.. + unlink $fifo; + bye("Internal Error #8"); + } + + if (! -o $fifo || ! -p $fifo || -l $fifo) { + # but we get out if not owned by us anymore: + unlink $fifo; + bye("Internal Error #9"); + } + } + + # Build cmd for user to read our fifo: + # + my $upw = '$HOME/x11vnc.pw'; + $ENV{UNIXPW_CMD} = "touch $upw; chmod 600 $upw; cat $fifo > $upw"; + + # Start it: + # + if (!open(X11VNC, "| $x11vnc -unixpw \%stdin > /dev/null")) { + unlink $fifo; + bye("Internal Error #10"); + } + select(X11VNC); $| = 1; select(STDOUT); + + if (! $use_fifo) { + # regular file, we need to write it now. + if (!open(FIFO, ">$fifo")) { + close X11VNC; + unlink $fifo; + bye("Internal Error #11"); + } + print FIFO "$pass\n"; + close FIFO; + } + + # open fifo up for reading. + # (this means the bad guy can read it too.) + # + if (!chmod 0644, $fifo) { + unlink $fifo; + bye("Internal Error #12"); + } + + # send the user's passwd now: + # + print X11VNC "$username:$password\n"; + + if ($use_fifo) { + # wait a bit for the cat $fifo to start, reader will block. + sleep 1; + if (!open(FIFO, ">$fifo")) { + close X11VNC; + unlink $fifo; + bye("Internal Error #13"); + } + # here it goes: + print FIFO "$pass\n"; + close FIFO; + } + close X11VNC; # note we ignore return value. + fsleep(0.5); + #print STDERR `ls -l $fifo ~$username/x11vnc.pw`; + unlink $fifo; + + # Done! +} + +# For fixed, single port mode. Try to open and lock the port before +# proceeding. +# +sub lock_fixed_port { + my ($t_max, $t_age) = @_; + + # lock file name: + # + my $lock = '/tmp/desktop.cgi.lock'; + my $remove = ''; + + my $t = 0; + my $sock = ''; + + while ($t < $t_max) { + if (-e $lock) { + # clean out stale locks if possible: + if (! -l $lock) { + unlink $lock; + } else { + my ($pid, $time) = split(/:/, readlink($lock)); + if (! -d "/proc/$pid") { + unlink $lock; + } + if (time() > $time + $t_age) { + unlink $lock; + } + } + } + + my $reason = ''; + + if (-l $lock) { + # someone has locked it. + $reason = 'locked'; + } else { + # unlocked, try to listen on port: + $sock = IO::Socket::INET->new( + Listen => 1, + LocalPort => $vnc_port, + ReuseAddr => 1, + Proto => "tcp" + ); + if ($sock) { + # we got it, now try to lock: + my $str = "$$:" . time(); + if (symlink($str, $lock)) { + $remove = $lock; + $find_free_port = $sock; + last; + } + # wow, we didn't lock it... + $reason = "symlink failed: $!"; + close $sock; + } else { + $reason = "listen failed: $!"; + } + } + # sleep a bit and then try again: + # + print STDERR "$$ failed to get fixed port $vnc_port for $username at $t ($reason)\n"; + $sock = ''; + $t += 5; + sleep 5; + } + if (! $sock) { + bye("Failed to lock fixed TCP port. Try again a bit later.

$login_str"); + } + print STDERR "$$ got fixed port $vnc_port for $username at $t\n"; + + # Return the file to remove, if any: + # + return $remove; +} + + +# Return html for the java applet to connect to x11vnc. +# +# N.B. Please examine the applet params, e.g. trustUrlVncCert=yes to +# see if you agree with them. See x11vnc classes/ssl/README for all +# parameters. +# +# Note how we do not take extreme care to authenticate the server to +# the client applet (but note that trustUrlVncCert=yes is better than +# trustAllVncCerts=yes) One can tighten all of this up at the expense +# of extra certificate dialogs (assuming the user bothers to check...) +# +# This assumes /UltraViewerSSL.jar is at document root; you need to put +# it there. +# +sub print_applet_html { + my ($W, $H, $D) = split(/x/, $geometry); + $W = 640; # make it smaller since we 'Open New Window' below anyway. + $H = 480; + my $tUVC = ($trustUrlVncCert ? 'yes' : 'no'); + my $str = <<"END"; + + +x11vnc desktop ($uid/$vnc_port) + + + + + + + + + + + + +
+Login page
+x11vnc website + +END + + if ($enable_port_redirection && $redirect_host ne '') { + $str =~ s/name=PASSWORD value=.*>/name=NOT_USED value=yes>/; + #$str =~ s//\n/; + } + + print $str; +} + +########################################################################## +# The following subroutines are for port redirection only, which is +# disabled by default ($enable_port_redirection == 0) +# +sub port_redir { + # To aid in avoiding zombies: + # + setpgrp(0, 0); + + # For the fixed port scheme we try to cooperate via lock file: + # + my $rmlock = ''; + # + if ($fixed_port) { + # try to grab the fixed port for the next 90 secs removing + # stale locks older than 60 secs: + # + $rmlock = lock_fixed_port(90, 60); + + } elsif ($find_free_port eq '0') { + $find_free_port = IO::Socket::INET->new( + Listen => 1, + LocalPort => $vnc_port, + ReuseAddr => 1, + Proto => "tcp" + ); + } + # In all cases, at this point $find_free_port is the listening + # socket. + + # fork a helper process to do the port redir: + # + # Actually we need to spawn 4(!) of them in case the proxy check + # /check.https.proxy.connection (it is by default) and the other + # test connections. Spawn one for each expected connection, for + # whatever applet parameter usage mode you set up. + # + for (my $n = 1; $n <= 4; $n++) { + my $pid = fork(); + if (! defined $pid) { + bye("Internal Error #14"); + } elsif ($pid) { + wait; + } else { + if (fork) { + exit 0; + } + setpgrp(0, 0); + handle_conn(); + exit 0; + } + } + + # We now close the listening socket: + # + close $find_free_port; + + if ($rmlock) { + # let our process proceed a bit before removing lock. + sleep 1; + unlink $rmlock; + } + + # Now send html to the browser so it can connect: + # + print_applet_html(); + + exit 0; +} + +# This checks the validity of a username@host:port for the port +# redirection mode. Finishes and exits if it is invalid. +# +sub check_redirect_host { + # First check that the host:port string is valid: + # + if ($redirect_host !~ /^\w[-\w\.]*:\d+$/) { + bye("Invalid Redirect Host:Port.

$login_str"); + } + # Second, check if the allowed host file permits it: + # + if ($port_redirection_allowed_hosts ne '') { + if (! open(ALLOWED, "<$port_redirection_allowed_hosts")) { + bye("Internal Error #15"); + } + my $ok = 0; + while (my $line = ) { + chomp $line; + # skip blank lines and '#' comments: + next if $line =~ /^\s*$/; + next if $line =~ /^\s*#/; + + # trim spaces from ends: + $line =~ s/^\s*//; + $line =~ s/\s*$//; + + # collect host:ports in case port range given: + my @items; + if ($line =~ /^(.*):(\d+)-(\d+)$/) { + # port range: + my $host = $1; + my $pmin = $2; + my $pmax = $3; + for (my $p = $pmin; $p <= $pmax; $p++) { + push @items, "$host:$p"; + } + } else { + push @items, $line; + } + + # now check each item for a match: + foreach my $item (@items) { + if ($item eq 'ALL') { + $ok = 1; + last; + } elsif ($item =~ /@/) { + if ("$username\@$redirect_host" eq $item) { + $ok = 1; + last; + } + } elsif ($redirect_host eq $item) { + $ok = 1; + last; + } + } + # got a match: + last if $ok; + } + close ALLOWED; + + if (! $ok) { + bye("Disallowed Redirect Host:Port.

$login_str"); + } + } +} + +# Much of this code is borrowed from 'connect_switch': +# +sub handle_conn { + close STDIN; + close STDOUT; + close STDERR; + + $SIG{ALRM} = sub {close $find_free_port; exit 0}; + + # We only wait 30 secs for the redir case, esp. since + # we need to spawn so many helpers... + # + alarm(30); + + my ($client, $ip) = $find_free_port->accept(); + + alarm(0); + + close $find_free_port; + + if (!$client) { + exit 1; + } + + my ($host, $port) = split(/:/, $redirect_host); + + my $sock = IO::Socket::INET->new( + PeerAddr => $host, + PeerPort => $port, + Proto => "tcp" + ); + + if (! $sock) { + close $client; + exit 1; + } + + $current_fh1 = $client; + $current_fh2 = $sock; + + $SIG{TERM} = sub {close $current_fh1; close $current_fh2; exit 0}; + + my $killpid = 1; + + my $parent = $$; + if (my $child = fork()) { + xfer($sock, $client, 'S->C'); + if ($killpid) { + fsleep(0.5); + kill 'TERM', $child; + } + } else { + xfer($client, $sock, 'C->S'); + if ($killpid) { + fsleep(0.75); + kill 'TERM', $parent; + } + } + exit 0; +} + +# This does socket data transfer in one direction. +# +sub xfer { + my($in, $out, $lab) = @_; + my ($RIN, $WIN, $EIN, $ROUT); + $RIN = $WIN = $EIN = ""; + $ROUT = ""; + vec($RIN, fileno($in), 1) = 1; + vec($WIN, fileno($in), 1) = 1; + $EIN = $RIN | $WIN; + my $buf; + + while (1) { + my $nf = 0; + while (! $nf) { + $nf = select($ROUT=$RIN, undef, undef, undef); + } + my $len = sysread($in, $buf, 8192); + if (! defined($len)) { + next if $! =~ /^Interrupted/; + last; + } elsif ($len == 0) { + last; + } + + my $offset = 0; + my $quit = 0; + while ($len) { + my $written = syswrite($out, $buf, $len, $offset); + if (! defined $written) { + $quit = 1; + last; + } + $len -= $written; + $offset += $written; + } + last if $quit; + } + close($in); + close($out); +} + +# Sleep a small amount of time (float) +# +sub fsleep { + my ($time) = @_; + select(undef, undef, undef, $time) if $time; +} diff --git a/x11vnc/misc/inet6to4 b/x11vnc/misc/inet6to4 new file mode 100755 index 0000000..b5c2fd1 --- /dev/null +++ b/x11vnc/misc/inet6to4 @@ -0,0 +1,400 @@ +#!/usr/bin/perl +# +# inet6to4: Act as an ipv6-to-ipv4 relay for tcp applications that +# do not support ipv6. +# +# Usage: inet6to4 +# inet6to4 -r +# +# Examples: inet6to4 5900 localhost:5900 +# inet6to4 8080 web1:80 +# inet6to4 -r 5900 fe80::217:f2ff:fee6:6f5a%eth0:5900 +# +# The -r option reverses the direction of translation (e.g. for ipv4 +# clients that need to connect to ipv6 servers.) Reversing is the default +# if this script is named 'inet4to6' (e.g. by a symlink.) +# +# Use Ctrl-C to stop this program. +# +# You can also set env. vars INET6TO4_LOOP=1 or INET6TO4_LOOP=BG +# to have an outer loop restarting this program (BG means do that +# in the background), and INET6TO4_LOGFILE for a log file. +# Also set INET6TO4_VERBOSE to verbosity level and INET6TO4_WAITTIME +# and INET6TO4_PIDFILE (see below.) +# + +#------------------------------------------------------------------------- +# Copyright (c) 2010 by Karl J. Runge +# +# inet6to4 is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or (at +# your option) any later version. +# +# inet6to4 is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with inet6to4; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA +# or see . +#------------------------------------------------------------------------- + +# Set up logging: +# +if (exists $ENV{INET6TO4_LOGFILE}) { + close STDOUT; + if (!open(STDOUT, ">>$ENV{INET6TO4_LOGFILE}")) { + die "inet6to4: $ENV{INET6TO4_LOGFILE} $!\n"; + } + close STDERR; + open(STDERR, ">&STDOUT"); +} +select(STDERR); $| = 1; +select(STDOUT); $| = 1; + +# interrupt handler: +# +my $looppid = ''; +my $pidfile = ''; +my $listen_sock = ''; # declared here for get_out() +# +sub get_out { + print STDERR "$_[0]:\t$$ looppid=$looppid\n"; + close $listen_sock if $listen_sock; + if ($looppid) { + kill 'TERM', $looppid; + fsleep(0.2); + } + unlink $pidfile if $pidfile; + exit 0; +} +$SIG{INT} = \&get_out; +$SIG{TERM} = \&get_out; + +# pidfile: +# +sub open_pidfile { + if (exists $ENV{INET6TO4_PIDFILE}) { + my $pf = $ENV{INET6TO4_PIDFILE}; + if (open(PID, ">$pf")) { + print PID "$$\n"; + close PID; + $pidfile = $pf; + } else { + print STDERR "could not open pidfile: $pf - $! - continuing...\n"; + } + delete $ENV{INET6TO4_PIDFILE}; + } +} + +#################################################################### +# Set INET6TO4_LOOP=1 to have this script create an outer loop +# restarting itself if it ever exits. Set INET6TO4_LOOP=BG to +# do this in the background as a daemon. + +if (exists $ENV{INET6TO4_LOOP}) { + my $csl = $ENV{INET6TO4_LOOP}; + if ($csl ne 'BG' && $csl ne '1') { + die "inet6to4: invalid INET6TO4_LOOP.\n"; + } + if ($csl eq 'BG') { + # go into bg as "daemon": + setpgrp(0, 0); + my $pid = fork(); + if (! defined $pid) { + die "inet6to4: $!\n"; + } elsif ($pid) { + wait; + exit 0; + } + if (fork) { + exit 0; + } + setpgrp(0, 0); + close STDIN; + if (! $ENV{INET6TO4_LOGFILE}) { + close STDOUT; + close STDERR; + } + } + delete $ENV{INET6TO4_LOOP}; + + if (exists $ENV{INET6TO4_PIDFILE}) { + open_pidfile(); + } + + print STDERR "inet6to4: starting service at ", scalar(localtime), " master-pid=$$\n"; + while (1) { + $looppid = fork; + if (! defined $looppid) { + sleep 10; + } elsif ($looppid) { + wait; + } else { + exec $0, @ARGV; + exit 1; + } + print STDERR "inet6to4: re-starting service at ", scalar(localtime), " master-pid=$$\n"; + sleep 1; + } + exit 0; +} +if (exists $ENV{INET6TO4_PIDFILE}) { + open_pidfile(); +} + +use IO::Socket::INET6; +use strict; +use warnings; + +# some settings: +# +my $verbose = 1; # set to 0 for no messages, 2 for more. +my $killpid = 1; # does kill(2) at end of connection. +my $waittime = 0.25; # time to wait between connections. +my $reverse = 0; # -r switch (or file named inet4to6) + +if (exists $ENV{INET6TO4_VERBOSE}) { + $verbose = $ENV{INET6TO4_VERBOSE}; +} +if (exists $ENV{INET6TO4_WAITTIME}) { + $waittime = $ENV{INET6TO4_WAITTIME}; +} + +# process command line args: + +if (! @ARGV || $ARGV[0] =~ '^-+h') { # -help + open(ME, "<$0"); + while () { + last unless /^#/; + next if /usr.bin.perl/; + $_ =~ s/# ?//; + print; + } + exit; +} + +if ($ARGV[0] eq '-r') { # -r + shift; + $reverse = 1; +} elsif ($0 =~ /inet4to6$/) { + $reverse = 1; +} + +my $listen_port = shift; # ipv6-listen-port +my $connect_to = shift; # ipv4-host:port + +die "no listen port or connect-to-host:port\n" if ! $listen_port || ! $connect_to; + +# connect to host: +# +my $host = ''; +my $port = ''; +if ($connect_to =~ /^(.*):(\d+)$/) { + $host = $1; + $port = $2; +} +die "invalid connect-to-host:port\n" if ! $host || ! $port; + +setpgrp(0, 0); + +# create listening socket: +# +if (!$reverse) { + $listen_sock = IO::Socket::INET6->new( + Listen => 10, + LocalPort => $listen_port, + Domain => AF_INET6, + ReuseAddr => 1, + Proto => "tcp" + ); +} else { + $listen_sock = IO::Socket::INET->new( + Listen => 10, + LocalPort => $listen_port, + ReuseAddr => 1, + Proto => "tcp" + ); +} +if (! $listen_sock) { + die "inet6to4: $!\n"; +} + +# for use by the xfer helper processes' interrupt handlers: +# +my $current_fh1 = ''; +my $current_fh2 = ''; + +# connection counter: +# +my $conn = 0; + +# loop forever waiting for connections: +# +while (1) { + $conn++; + print STDERR "listening for connection: $conn\n" if $verbose; + my ($client, $ip) = $listen_sock->accept(); + + if ($client && !$reverse && $port == $listen_port) { + # This happens on Darwin 'tcp46' + if ($client->peerhost() =~ /^::ffff:/) { + print STDERR "closing client we think is actually us: ", + $client->peerhost(), "\n"; + close $client; + $client = undef; + } + } + if (! $client) { + # to throttle runaways + fsleep(2 * $waittime); + next; + } + print STDERR "conn: $conn -- ", $client->peerhost(), " at ", scalar(localtime), "\n" if $verbose; + + # spawn helper: + # + my $pid = fork(); + if (! defined $pid) { + die "inet6to4: $!\n"; + } elsif ($pid) { + wait; + # to throttle runaways + fsleep($waittime); + next; + } else { + # this is to avoid zombies: + close $listen_sock; + if (fork) { + exit 0; + } + setpgrp(0, 0); + handle_conn($client); + } +} + +exit 0; + +sub handle_conn { + my $client = shift; + + my $start = time(); + + print STDERR "connecting to: $host:$port\n" if $verbose; + + my $sock = ''; + if (!$reverse) { + $sock = IO::Socket::INET->new( + PeerAddr => $host, + PeerPort => $port, + Proto => "tcp" + ); + } else { + $sock = IO::Socket::INET6->new( + PeerAddr => $host, + PeerPort => $port, + Domain => AF_INET6, + Proto => "tcp" + ); + } + + if (! $sock) { + close $client; + die "inet6to4: $!\n"; + } + + $current_fh1 = $client; + $current_fh2 = $sock; + + # interrupt handler: + # + $SIG{TERM} = sub {print STDERR "got sigterm\[$$]\n" if $verbose; close $current_fh1; close $current_fh2; exit 0}; + + # spawn another helper and transfer the data: + # + my $parent = $$; + if (my $child = fork()) { + xfer($sock, $client, 'S->C'); + if ($killpid) { + fsleep(0.5); + kill 'TERM', $child; + } + } else { + xfer($client, $sock, 'C->S'); + if ($killpid) { + fsleep(0.75); + kill 'TERM', $parent; + } + } + + # done. + # + if ($verbose > 1) { + my $dt = time() - $start; + print STDERR "dt\[$$]: $dt\n"; + } + exit 0; +} + +# transfers data in one direction: +# +sub xfer { + my($in, $out, $lab) = @_; + my ($RIN, $WIN, $EIN, $ROUT); + $RIN = $WIN = $EIN = ""; + $ROUT = ""; + vec($RIN, fileno($in), 1) = 1; + vec($WIN, fileno($in), 1) = 1; + $EIN = $RIN | $WIN; + my $buf; + + while (1) { + my $nf = 0; + while (! $nf) { + $nf = select($ROUT=$RIN, undef, undef, undef); + } + my $len = sysread($in, $buf, 8192); + if (! defined($len)) { + next if $! =~ /^Interrupted/; + print STDERR "inet6to4\[$lab/$conn/$$]: $!\n"; + last; + } elsif ($len == 0) { + print STDERR "inet6to4\[$lab/$conn/$$]: " + . "Input is EOF.\n"; + last; + } + + if ($verbose > 4) { + # verbose debugging of data: + syswrite(STDERR , "\n$lab: ", 6); + syswrite(STDERR , $buf, $len); + } + + my $offset = 0; + my $quit = 0; + while ($len) { + my $written = syswrite($out, $buf, $len, $offset); + if (! defined $written) { + print STDERR "inet6to4\[$lab/$conn/$$]: " + . "Output is EOF. $!\n"; + $quit = 1; + last; + } + $len -= $written; + $offset += $written; + } + last if $quit; + } + close($in); + close($out); +} + +# sleep a fraction of a second: +# +sub fsleep { + my ($time) = @_; + select(undef, undef, undef, $time) if $time; +} diff --git a/x11vnc/misc/panner.pl b/x11vnc/misc/panner.pl new file mode 100755 index 0000000..344beee --- /dev/null +++ b/x11vnc/misc/panner.pl @@ -0,0 +1,117 @@ +#!/usr/bin/perl +# +# panner.pl: start up x11vnc in '-clip' mode viewing a small (WxH) +# rectangular region of the screen. Allow the viewer user +# to 'pan' around the display region by moving the mouse. +# +# Remote interaction with applications, e.g. clicking a +# button though the VNC viewer, will be very difficult. +# This may be useful in a 'demo' mode where the user sitting +# at the physical display is the only one moving the mouse. +# Depending on your usage the following x11vnc options may +# be useful: -nonap +# +# Usage: panner.pl WxH (e.g. -display ...) +# or panner.pl WxH:0.05 (e.g. 0.05 is polling time in secs.) + +use strict; + +my $WxH = shift; +my $poll_time; + +# split off poll time: +# +($WxH, $poll_time) = split(/:/, $WxH); +my ($W, $H) = split(/x/, $WxH); + +$poll_time = 0.1 unless $poll_time ne ''; + +# set to x11vnc command (e.g. full PATH) +# +my $x11vnc = "x11vnc"; + +# check if display was given: +# +my $query_args = ""; +for (my $i=0; $i < @ARGV; $i++) { + if ($ARGV[$i] eq '-display') { + $query_args = "-display $ARGV[$i+1]"; + } +} + +# find the size of display and the current mouse position: +my %v; +vset("DIRECT:wdpy_x,wdpy_y,pointer_x,pointer_y,pointer_same"); + +# set a -clip argument based on the above: +# +my $clip = ''; +clip_set(); +$clip = "${W}x${H}+0+0" unless $v{pointer_same}; + +# launch x11vnc with -clip in the background: +# +my $cmd = "$x11vnc -clip $clip -bg " . join(" ", @ARGV); +print STDERR "running: $cmd\n"; +system $cmd; + +# user can hit Ctrl-C or kill this script to quit (and stop x11vnc) +# +sub quit { + system("$x11vnc $query_args -R stop"); + exit 0; +} + +$SIG{INT} = \&quit; +$SIG{TERM} = \&quit; + +# loop forever waiting for mouse position to change, then shift -clip: +# +my $clip_old = $clip; +while (1) { + fsleep($poll_time); + vset("pointer_x,pointer_y,pointer_same"); + next unless $v{pointer_same}; + clip_set(); + if ($clip ne $clip_old) { + system("$x11vnc $query_args -R clip:$clip"); + $clip_old = $clip + } +} + +exit 0; + +# short sleep: +# +sub fsleep { + my ($time) = @_; + select(undef, undef, undef, $time) if $time; +} + +# set the -clip string, making sure view doesn't go off edges of display: +# +sub clip_set { + my $x = int($v{pointer_x} - $W/2); + my $y = int($v{pointer_y} - $H/2); + $x = 0 if $x < 0; + $y = 0 if $y < 0; + $x = $v{wdpy_x} - $W if $x + $W > $v{wdpy_x}; + $y = $v{wdpy_y} - $H if $y + $H > $v{wdpy_y}; + $clip = "${W}x${H}+$x+$y"; +} + +# query x11vnc for values, put results in the %v hash: +# +sub vset { + my $str = shift; + my $out = `$x11vnc $query_args -Q $str 2>/dev/null`; + chomp $out; + foreach my $pair (split(/,/, $out)) { + $pair =~ s/^a..=//; + my ($k, $v) = split(/:/, $pair, 2); + if ($k ne '' && $v ne '') { + print STDERR "k=$k v=$v\n" if $ENV{DEBUG}; + $v{$k} = $v; + } + } +} diff --git a/x11vnc/misc/ultravnc_repeater.pl b/x11vnc/misc/ultravnc_repeater.pl index 40af575..a305ebe 100755 --- a/x11vnc/misc/ultravnc_repeater.pl +++ b/x11vnc/misc/ultravnc_repeater.pl @@ -1,6 +1,6 @@ #!/usr/bin/env perl # -# Copyright (c) 2009 by Karl J. Runge +# Copyright (c) 2009-2010 by Karl J. Runge # # ultravnc_repeater.pl is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -41,17 +41,137 @@ usage: ultravnc_repeater.pl [-r] [client_port [server_port]] Use -r to refuse new server/client connections with an existing server/client ID. The default is to close the previous one. +To write to a log file set the env. var ULTRAVNC_REPEATER_LOGFILE. + +To run in a loop restarting the server if it exits set the env. var. +ULTRAVNC_REPEATER_LOOP=1 or ULTRAVNC_REPEATER_LOOP=BG, the latter +forks into the background. Set ULTRAVNC_REPEATER_PIDFILE to a file +to store the master pid in. + + Examples: + ultravnc_repeater.pl ultravnc_repeater.pl -r ultravnc_repeater.pl 5901 ultravnc_repeater.pl 5901 5501 + env ULTRAVNC_REPEATER_LOOP=BG ULTRAVNC_REPEATER_LOGFILE=/tmp/u.log ultravnc_repeater.pl ... + '; -use warnings; use strict; +# Set up logging: +# +if (exists $ENV{ULTRAVNC_REPEATER_LOGFILE}) { + close STDOUT; + if (!open(STDOUT, ">>$ENV{ULTRAVNC_REPEATER_LOGFILE}")) { + die "ultravnc_repeater.pl: $ENV{ULTRAVNC_REPEATER_LOGFILE} $!\n"; + } + close STDERR; + open(STDERR, ">&STDOUT"); +} +select(STDERR); $| = 1; +select(STDOUT); $| = 1; + +# interrupt handler: +# +my $looppid = ''; +my $pidfile = ''; +# +sub get_out { + print STDERR "$_[0]:\t$$ looppid=$looppid\n"; + if ($looppid) { + kill 'TERM', $looppid; + fsleep(0.2); + } + unlink $pidfile if $pidfile; + cleanup(); + exit 0; +} + +# These are overridden in actual server thread: +# +$SIG{INT} = \&get_out; +$SIG{TERM} = \&get_out; + +# pidfile: +# +sub open_pidfile { + if (exists $ENV{ULTRAVNC_REPEATER_PIDFILE}) { + my $pf = $ENV{ULTRAVNC_REPEATER_PIDFILE}; + if (open(PID, ">$pf")) { + print PID "$$\n"; + close PID; + $pidfile = $pf; + } else { + print STDERR "could not open pidfile: $pf - $! - continuing...\n"; + } + delete $ENV{ULTRAVNC_REPEATER_PIDFILE}; + } +} + +#################################################################### +# Set ULTRAVNC_REPEATER_LOOP=1 to have this script create an outer loop +# restarting itself if it ever exits. Set ULTRAVNC_REPEATER_LOOP=BG to +# do this in the background as a daemon. + +if (exists $ENV{ULTRAVNC_REPEATER_LOOP}) { + my $csl = $ENV{ULTRAVNC_REPEATER_LOOP}; + if ($csl ne 'BG' && $csl ne '1') { + die "ultravnc_repeater.pl: invalid ULTRAVNC_REPEATER_LOOP.\n"; + } + if ($csl eq 'BG') { + # go into bg as "daemon": + setpgrp(0, 0); + my $pid = fork(); + if (! defined $pid) { + die "ultravnc_repeater.pl: $!\n"; + } elsif ($pid) { + wait; + exit 0; + } + if (fork) { + exit 0; + } + setpgrp(0, 0); + close STDIN; + if (! $ENV{ULTRAVNC_REPEATER_LOGFILE}) { + close STDOUT; + close STDERR; + } + } + delete $ENV{ULTRAVNC_REPEATER_LOOP}; + + if (exists $ENV{ULTRAVNC_REPEATER_PIDFILE}) { + open_pidfile(); + } + + print STDERR "ultravnc_repeater.pl: starting service at ", scalar(localtime), " master-pid=$$\n"; + while (1) { + $looppid = fork; + if (! defined $looppid) { + sleep 10; + } elsif ($looppid) { + wait; + } else { + exec $0, @ARGV; + exit 1; + } + print STDERR "ultravnc_repeater.pl: re-starting service at ", scalar(localtime), " master-pid=$$\n"; + sleep 1; + } + exit 0; +} +if (exists $ENV{ULTRAVNC_REPEATER_PIDFILE}) { + open_pidfile(); +} + +# End of background/daemon stuff. +#################################################################### + +use warnings; use IO::Socket::INET; use IO::Select; @@ -85,6 +205,7 @@ my ($RIN, $WIN, $EIN, $ROUT); my $client_listen = IO::Socket::INET->new( Listen => 10, LocalPort => $client_port, + ReuseAddr => 1, Proto => "tcp" ); if (! $client_listen) { @@ -95,6 +216,7 @@ if (! $client_listen) { my $server_listen = IO::Socket::INET->new( Listen => 10, LocalPort => $server_port, + ReuseAddr => 1, Proto => "tcp" ); if (! $server_listen) { @@ -103,7 +225,7 @@ if (! $server_listen) { } my $select = new IO::Select(); -if (! select) { +if (! $select) { cleanup(); die "$prog: select $!\n"; } @@ -120,9 +242,6 @@ my $CURR = ''; print "watching for connections on ports $server_port/server and $client_port/client\n"; -select(STDERR); $| = 1; -select(STDOUT); $| = 1; - my $alarm_sock = ''; my $got_alarm = 0; sub alarm_handler { diff --git a/x11vnc/remote.c b/x11vnc/remote.c index 5985464..953f963 100644 --- a/x11vnc/remote.c +++ b/x11vnc/remote.c @@ -1191,7 +1191,23 @@ char *process_remote_cmd(char *cmd, int stringonly) { goto qry; } p += strlen("clip:"); - if (clip_str) free(clip_str); + if (clip_str) { + int w, h, x, y; + free(clip_str); + /* try to handle easy case where WxH is unchanged: */ + if (parse_geom(p, &w, &h, &x, &y, wdpy_x, wdpy_y)) { + if (cdpy_x == w && cdpy_y == h) { + if (x >= 0 && y >= 0) { + if (x + w <= wdpy_x && y + h <= wdpy_y) { + coff_x = x; + coff_y = y; + clip_str = strdup(p); + goto done; + } + } + } + } + } clip_str = strdup(p); /* OK, this requires a new fb... */ @@ -5925,15 +5941,25 @@ char *process_remote_cmd(char *cmd, int stringonly) { } goto qry; } - - if (!strcmp(p, "pointer_pos")) { + if (!strcmp(p, "pointer_pos") || !strcmp(p, "pointer_x") || !strcmp(p, "pointer_y") || !strcmp(p, "pointer_same") || !strcmp(p, "pointer_root")) { int px = -1, py = -1; int wx, wy; unsigned int m; Window r, c; + Bool same_screen = True; - snprintf(buf, bufn, "aro=%s:%d,%d", p, px, py); + if (!strcmp(p, "pointer_pos")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d,%d", p, px, py); + } else if (!strcmp(p, "pointer_x")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, px); + } else if (!strcmp(p, "pointer_y")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, py); + } else if (!strcmp(p, "pointer_same")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, same_screen); + } else if (!strcmp(p, "pointer_root")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:0x%x", p, (unsigned int) rootwin); + } if (!dpy) { goto qry; } @@ -5941,12 +5967,22 @@ char *process_remote_cmd(char *cmd, int stringonly) { goto qry; #else X_LOCK; - XQueryPointer_wr(dpy, rootwin, &r, &c, &px, &py, &wx, &wy, &m); + same_screen = XQueryPointer_wr(dpy, rootwin, &r, &c, &px, &py, &wx, &wy, &m); X_UNLOCK; #endif - snprintf(buf, bufn, "aro=%s:%d,%d", p, px, py); - rfbLog("remote_cmd: pointer_pos: %s\n", buf); + if (!strcmp(p, "pointer_pos")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d,%d", p, px, py); + } else if (!strcmp(p, "pointer_x")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, px); + } else if (!strcmp(p, "pointer_y")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, py); + } else if (!strcmp(p, "pointer_same")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:%d", p, same_screen); + } else if (!strcmp(p, "pointer_root")) { /* skip-cmd-list */ + snprintf(buf, bufn, "aro=%s:0x%x", p, (unsigned int) r); + } + rfbLog("remote_cmd: %s: %s\n", p, buf); goto qry; } if (!strcmp(p, "bpp")) { diff --git a/x11vnc/sslhelper.c b/x11vnc/sslhelper.c index 3d19834..ab2a43f 100644 --- a/x11vnc/sslhelper.c +++ b/x11vnc/sslhelper.c @@ -3460,6 +3460,7 @@ void accept_openssl(int mode, int presock) { char reply[] = "HTTP/1.0 200 OK\r\n" "Content-Type: octet-stream\r\n" "Connection: Keep-Alive\r\n" + "VNC-Server: x11vnc\r\n" "Pragma: no-cache\r\n\r\n"; /* * special case proxy coming thru https @@ -3503,6 +3504,7 @@ void accept_openssl(int mode, int presock) { char reply[] = "HTTP/1.0 200 OK\r\n" "Connection: close\r\n" "Content-Type: octet-stream\r\n" + "VNC-Server: x11vnc\r\n" "Pragma: no-cache\r\n\r\n"; rfbLog("Handling Check HTTPS request via https GET. [%d]\n", getpid()); @@ -3782,14 +3784,14 @@ void accept_openssl(int mode, int presock) { q = strstr(rcookie, "VENCRYPT="); if (q && sscanf(q, "VENCRYPT=%d,", &vencrypt_sel) == 1) { if (vencrypt_sel != 0) { - rfbLog("SSL: VENCRYPT mode=%d accepted.\n", vencrypt_sel); + rfbLog("SSL: VENCRYPT mode=%d accepted. helper[%d]\n", vencrypt_sel, pid); goto accept_client; } } q = strstr(rcookie, "ANONTLS="); if (q && sscanf(q, "ANONTLS=%d,", &anontls_sel) == 1) { if (anontls_sel != 0) { - rfbLog("SSL: ANONTLS mode=%d accepted.\n", anontls_sel); + rfbLog("SSL: ANONTLS mode=%d accepted. helper[%d]\n", anontls_sel, pid); goto accept_client; } } @@ -3803,6 +3805,12 @@ void accept_openssl(int mode, int presock) { if (strstr(rcookie, uniq) == rcookie) { int i; + double https_download_wait_time = 15.0; + + if (getenv("X11VNC_HTTPS_DOWNLOAD_WAIT_TIME")) { + https_download_wait_time = atof(getenv("X11VNC_HTTPS_DOWNLOAD_WAIT_TIME")); + } + rfbLog("SSL: BUT WAIT! HTTPS for helper process[%d] succeeded. Good.\n", pid); if (mode != OPENSSL_HTTPS) { last_https = dnow(); @@ -3814,6 +3822,7 @@ void accept_openssl(int mode, int presock) { } if (rcookie && strstr(rcookie, "VncViewer.class")) { rfbLog("\n"); + rfbLog("helper[%d]:\n", pid); rfbLog("***********************************************************\n"); rfbLog("SSL: WARNING CLIENT ASKED FOR NONEXISTENT 'VncViewer.class'\n"); rfbLog("SSL: USER NEEDS TO **RESTART** HIS WEB BROWSER.\n"); @@ -3841,31 +3850,34 @@ void accept_openssl(int mode, int presock) { } screen->port = useport; if (origport != useport) { - rfbLog("SSL: -httpsredir guess port: %d\n", screen->port); + rfbLog("SSL: -httpsredir guess port: %d helper[%d]\n", screen->port, pid); } start = dnow(); - while (dnow() < start + 10.0) { + while (dnow() < start + https_download_wait_time) { if (screen->httpSock >= 0) saw_httpsock = 1; rfbPE(10000); usleep(10000); if (screen->httpSock >= 0) saw_httpsock = 1; waitpid(pid, &status, WNOHANG); if (kill(pid, 0) != 0) { - rfbPE(10000); - rfbPE(10000); + rfbLog("SSL: helper[%d] pid finished\n", pid); break; } - if (saw_httpsock && screen->httpSock < 0) { + if (0 && saw_httpsock && screen->httpSock < 0) { + /* this check can kill the helper too soon. */ rfbLog("SSL: httpSock for helper[%d] went away\n", pid); - rfbPE(10000); - rfbPE(10000); break; } } - screen->port = origport; rfbLog("SSL: guessing child helper[%d] https finished. dt=%.6f\n", pid, dnow() - start); + + rfbPE(10000); + rfbPE(10000); + rfbPE(10000); + + screen->port = origport; ssl_helper_pid(0, -2); if (mode == OPENSSL_INETD) { clean_up_exit(1); @@ -3888,31 +3900,34 @@ void accept_openssl(int mode, int presock) { } } } - rfbLog("SSL: screen->port %d\n", screen->port); + rfbLog("SSL: screen->port %d for helper[%d]\n", screen->port, pid); /* kludge for https fetch via inetd */ start = dnow(); - while (dnow() < start + 10.0) { + while (dnow() < start + https_download_wait_time) { if (screen->httpSock >= 0) saw_httpsock = 1; rfbPE(10000); usleep(10000); if (screen->httpSock >= 0) saw_httpsock = 1; waitpid(pid, &status, WNOHANG); if (kill(pid, 0) != 0) { - rfbPE(10000); - rfbPE(10000); + rfbLog("SSL: helper[%d] pid finished\n", pid); break; } - if (saw_httpsock && screen->httpSock < 0) { + if (0 && saw_httpsock && screen->httpSock < 0) { + /* this check can kill the helper too soon. */ rfbLog("SSL: httpSock for helper[%d] went away\n", pid); - rfbPE(10000); - rfbPE(10000); break; } } rfbLog("SSL: OPENSSL_INETD guessing " "child helper[%d] https finished. dt=%.6f\n", pid, dnow() - start); + + rfbPE(10000); + rfbPE(10000); + rfbPE(10000); + ssl_helper_pid(0, -2); clean_up_exit(1); } diff --git a/x11vnc/ssltools.h b/x11vnc/ssltools.h index a08ebb8..534dbdd 100644 --- a/x11vnc/ssltools.h +++ b/x11vnc/ssltools.h @@ -1603,7 +1603,7 @@ char create_display[] = " fi\n" " if [ -f \"$home/.dmrc\" ]; then\n" " if [ \"X$have_startkde\" != \"X\" ]; then\n" -" if egrep -i 'Session=(default|kde)' \"$home/.dmrc\" > /dev/null; then\n" +" if egrep -i 'Session=kde' \"$home/.dmrc\" > /dev/null; then\n" " echo \"$have_startkde\"\n" " return\n" " fi\n" @@ -1632,6 +1632,18 @@ char create_display[] = " fi\n" " \n" " done\n" +" if egrep -i 'Session=default' \"$home/.dmrc\" > /dev/null; then\n" +" if [ \"X$have_gnome_session\" != \"X\" ]; then\n" +" echo \"$have_gnome_session\"\n" +" return\n" +" elif [ \"X$have_startkde\" != \"X\" ]; then\n" +" echo \"$have_startkde\"\n" +" return\n" +" elif [ \"X$have_startxfce\" != \"X\" ]; then\n" +" echo \"$have_startxfce\"\n" +" return\n" +" fi\n" +" fi\n" " fi\n" " if [ -f \"$home/.xsession\" ]; then\n" " echo \"$home/.xsession\"\n" @@ -1851,19 +1863,30 @@ char create_display[] = "\n" " if [ \"X$use_xdmcp_query\" = \"X1\" ]; then\n" " # we cannot use -nolisten tcp\n" -" echo \"$* -once -query localhost $FD_OPTS\" 1>&2\n" +" if [ \"X$FD_XDMCP_IF\" != \"X\" ]; then\n" +" lhost=$FD_XDMCP_IF\n" +" elif [ \"X$have_netstat\" = \"X\" ]; then\n" +" lhost=localhost\n" +" elif $have_netstat -an | grep -w 177 | grep -w udp > /dev/null; then\n" +" lhost=localhost\n" +" elif $have_netstat -an | grep -w 177 | grep -w udp6 > /dev/null; then\n" +" lhost=::1\n" +" else\n" +" lhost=localhost\n" +" fi\n" +" echo \"$* -once -query $lhost $FD_OPTS\" 1>&2\n" " if [ \"X$have_root\" != \"X\" ]; then\n" " if [ -r $authfile ]; then\n" -" $have_nohup $* -once -query localhost -auth $authfile $FD_OPTS 1>&2 &\n" +" $have_nohup $* -once -query $lhost -auth $authfile $FD_OPTS 1>&2 &\n" " else\n" " # why did we have this?\n" -" $have_nohup $* -once -query localhost $FD_OPTS 1>&2 &\n" +" $have_nohup $* -once -query $lhost $FD_OPTS 1>&2 &\n" " fi\n" " else\n" " if [ \"X$ns\" = \"X0\" ]; then\n" -" $have_nohup sh -c \"$* -once -query localhost -auth $authfile $FD_OPTS\" 1>&2 &\n" +" $have_nohup sh -c \"$* -once -query $lhost -auth $authfile $FD_OPTS\" 1>&2 &\n" " else\n" -" $have_nohup sh -c \"(sleep $ns; $* -once -query localhost -auth $authfile $FD_OPTS)\" 1>&2 &\n" +" $have_nohup sh -c \"(sleep $ns; $* -once -query $lhost -auth $authfile $FD_OPTS)\" 1>&2 &\n" " #result=1\n" " fi\n" " fi\n" diff --git a/x11vnc/user.c b/x11vnc/user.c index 12783f0..be2370e 100644 --- a/x11vnc/user.c +++ b/x11vnc/user.c @@ -1956,7 +1956,7 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t char st[] = ""; char fdgeom[128], fdsess[128], fdopts[128], fdextra[256], fdprog[128]; char fdxsrv[128], fdxdum[128], fdcups[128], fdesd[128]; - char fdnas[128], fdsmb[128], fdtag[128]; + char fdnas[128], fdsmb[128], fdtag[128], fdxdmcpif[128]; char cdout[128]; if (opts) { @@ -1980,6 +1980,7 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t fdnas[0] = '\0'; fdsmb[0] = '\0'; fdtag[0] = '\0'; + fdxdmcpif[0] = '\0'; cdout[0] = '\0'; if (unixpw && keep_unixpw_opts && keep_unixpw_opts[0] != '\0') { @@ -2122,6 +2123,9 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t if (fdtag[0] == '\0' && getenv("FD_TAG")) { snprintf(fdtag, 120, "%s", getenv("FD_TAG")); } + if (fdxdmcpif[0] == '\0' && getenv("FD_XDMCP_IF")) { + snprintf(fdxdmcpif, 120, "%s", getenv("FD_XDMCP_IF")); + } if (fdxdum[0] == '\0' && getenv("FD_XDUMMY_RUN_AS_ROOT")) { snprintf(fdxdum, 120, "%s", getenv("FD_XDUMMY_RUN_AS_ROOT")); } @@ -2139,6 +2143,7 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t if (strchr(fdnas, '\'')) fdnas[0] = '\0'; if (strchr(fdsmb, '\'')) fdsmb[0] = '\0'; if (strchr(fdtag, '\'')) fdtag[0] = '\0'; + if (strchr(fdxdmcpif, '\'')) fdxdmcpif[0] = '\0'; if (strchr(fdxdum, '\'')) fdxdum[0] = '\0'; if (strchr(fdsess, '\'')) fdsess[0] = '\0'; if (strchr(cdout, '\'')) cdout[0] = '\0'; @@ -2153,6 +2158,7 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t set_env("FD_NAS", fdnas); set_env("FD_SMB", fdsmb); set_env("FD_TAG", fdtag); + set_env("FD_XDMCP_IF", fdxdmcpif); set_env("FD_XDUMMY_RUN_AS_ROOT", fdxdum); set_env("FD_SESS", fdsess); @@ -2176,6 +2182,7 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t + strlen("FD_NAS='' ") + strlen("FD_SMB='' ") + strlen("FD_TAG='' ") + + strlen("FD_XDMCP_IF='' ") + strlen("FD_XDUMMY_RUN_AS_ROOT='' ") + strlen("FD_SESS='' /bin/sh ") + strlen(uu) + 1 @@ -2189,16 +2196,17 @@ static char *build_create_cmd(char *cmd, int *saw_xdmcp, char *usslpeer, char *t + strlen(fdnas) + 1 + strlen(fdsmb) + 1 + strlen(fdtag) + 1 + + strlen(fdxdmcpif) + 1 + strlen(fdxdum) + 1 + strlen(fdsess) + 1 + strlen(cdout) + 1 + strlen(opts) + 1); sprintf(create_cmd, "env USER='%s' FD_GEOM='%s' FD_SESS='%s' " "FD_OPTS='%s' FD_EXTRA='%s' FD_PROG='%s' FD_XSRV='%s' FD_CUPS='%s' " - "FD_ESD='%s' FD_NAS='%s' FD_SMB='%s' FD_TAG='%s' " + "FD_ESD='%s' FD_NAS='%s' FD_SMB='%s' FD_TAG='%s' FD_XDMCP_IF='%s' " "FD_XDUMMY_RUN_AS_ROOT='%s' %s /bin/sh %s %s", uu, fdgeom, fdsess, fdopts, fdextra, fdprog, fdxsrv, - fdcups, fdesd, fdnas, fdsmb, fdtag, fdxdum, cdout, tmp, opts); + fdcups, fdesd, fdnas, fdsmb, fdtag, fdxdmcpif, fdxdum, cdout, tmp, opts); } else { create_cmd = (char *) malloc(strlen(tmp) + strlen("/bin/sh ") + 1 + strlen(opts) + 1); diff --git a/x11vnc/x11vnc.1 b/x11vnc/x11vnc.1 index 4d193c3..41e41ad 100644 --- a/x11vnc/x11vnc.1 +++ b/x11vnc/x11vnc.1 @@ -1,8 +1,8 @@ .\" This file was automatically generated from x11vnc -help output. -.TH X11VNC "1" "February 2010" "x11vnc " "User Commands" +.TH X11VNC "1" "March 2010" "x11vnc " "User Commands" .SH NAME x11vnc - allow VNC connections to real X11 displays - version: 0.9.10, lastmod: 2010-02-21 + version: 0.9.10, lastmod: 2010-03-20 .SH SYNOPSIS .B x11vnc [OPTION]... @@ -558,6 +558,11 @@ to the program location and in standard locations \fB-http_ssl\fR .IP As \fB-http,\fR but force lookup for ssl classes subdir. +.IP +Note that for HTTPS, single-port Java applet delivery +you can set X11VNC_HTTPS_DOWNLOAD_WAIT_TIME to the +max number of seconds to wait for the applet download +to finish. The default is 15. .PP \fB-avahi\fR .IP @@ -1061,9 +1066,31 @@ Use "deny" to explicitly deny some users if you use the user is allowed, but the option values associated with it do apply as normal. .IP -There are also some utilities for testing password +There are also some utilities for checking passwords if [list] starts with the "%" character. See the -quick_pw() function in the source for details. +quick_pw() function for more details. Description: +"%-" or "%stdin" means read one line from stdin. +"%env" means it is in $UNIXPW env var. A leading +"%/" or "%." means read the first line from the +filename that follows after the % character. % by +itself means prompt for the username and password. +Otherwise: %user:pass E.g. \fB-unixpw\fR %fred:swordfish +For the other cases user:pass is read from the indicated +source. If the password is correct 'Y user' is printed +and the program exit code is 0. If the password is +incorrect it prints 'N user' and the exit code is 1. +If there is some other error the exit code is 2. +This feature enables x11vnc to be a general unix user +password checking tool; it could be used from scripts +or other programs. These % password checks also apply +to the \fB-unixpw_nis\fR and \fB-unixpw_cmd\fR options. +.IP +For the % password check, if the env. var. UNIXPW_CMD +is set to a command then it is run as the user (assuming +the password is correct.) The output of the command is +not printed, the program or script must manage that by +some other means. The exit code of x11vnc will depend +on the exit code of the command that is run. .IP Use \fB-nounixpw\fR to disable unixpw mode if it was enabled earlier in the cmd line (e.g. \fB-svc\fR mode) @@ -1184,8 +1211,11 @@ and if it has the permissions to do so. .PP \fB-find\fR .IP -Find the user's display using FINDDISPLAY. This is an -alias for "\fB-display\fR \fIWAIT:cmd=FINDDISPLAY\fR". +Find the user's display using FINDDISPLAY. This +is an alias for "\fB-display\fR \fIWAIT:cmd=FINDDISPLAY\fR". +.IP +Note: if a \fB-display\fR occurs later on the command line +it will override the \fB-find\fR setting. .IP For this and the next few options see \fB-display\fR WAIT:... below for all of the details. @@ -1232,6 +1262,9 @@ if that doesn't succeed create an X session via the FINDCREATEDISPLAY method. This is an alias for "\fB-display\fR \fIWAIT:cmd=FINDCREATEDISPLAY-Xvfb\fR". .IP +Note: if a \fB-display\fR occurs later on the command line +it will override the \fB-create\fR setting. +.IP SSH NOTE: for both \fB-find\fR and \fB-create\fR you can (should!) add the "\fB-localhost\fR" option to force SSH tunnel access. .PP @@ -1263,6 +1296,10 @@ Example: \fB-svc\fR ... \fB-create_xsrv\fR Xdummy,X Terminal services mode based on SSL access. Alias for \fB-display\fR WAIT:cmd=FINDCREATEDISPLAY-Xvfb \fB-unixpw\fR \fB-users\fR unixpw= \fB-ssl\fR SAVE Also "\fB-service\fR". +.IP +Note: if a \fB-display,\fR \fB-unixpw,\fR \fB-users,\fR or \fB-ssl\fR occurs +later on the command line it will override the \fB-svc\fR +setting. .PP \fB-svc_xdummy\fR .IP @@ -1282,6 +1319,10 @@ Display manager Terminal services mode based on SSL. Alias for \fB-display\fR WAIT:cmd=FINDCREATEDISPLAY-Xvfb.xdmcp \fB-unixpw\fR \fB-users\fR unixpw= \fB-ssl\fR SAVE Also "\fB-xdm_service\fR". .IP +Note: if a \fB-display,\fR \fB-unixpw,\fR \fB-users,\fR or \fB-ssl\fR occurs +later on the command line it will override the \fB-xdmsvc\fR +setting. +.IP To create a session a user will have to first log in to the \fB-unixpw\fR dialog and then log in again to the XDM/GDM/KDM prompt. Subsequent re-connections will @@ -1654,6 +1695,11 @@ to be a unique name for the session, it is set as an X property, that makes FINDDISPLAY only find sessions with that tag value. .IP +Set FD_XDMCP_IF to the network interface that the +display manager is running on; default is 'localhost' +but you may need to set it to '::1' on some IPv6 only +systems or misconfigured display managers. +.IP If you want the FINDCREATEDISPLAY session to contact an XDMCP login manager (xdm/gdm/kdm) on the same machine, then use "Xvfb.xdmcp" instead of "Xvfb", etc. @@ -2370,7 +2416,7 @@ exits. .IP Use the .IR stunnel (8) -(www.stunnel.org) to provide an +(stunnel.mirt.net) to provide an encrypted SSL tunnel between viewers and x11vnc. .IP This external tunnel method was implemented prior to the @@ -5838,6 +5884,14 @@ grab_state get state of pointer and keyboard grab. .IP pointer_pos print XQueryPointer x,y cursor position. .IP +pointer_x print XQueryPointer x cursor position. +.IP +pointer_y print XQueryPointer y cursor position. +.IP +pointer_same print XQueryPointer ptr on same screen. +.IP +pointer_root print XQueryPointer curr ptr rootwin. +.IP mouse_x print x11vnc's idea of cursor position. .IP mouse_y print x11vnc's idea of cursor position. @@ -6234,18 +6288,18 @@ loop loopbg desktopname guess_desktop guess_dbus http_url auth xauth users rootshift clipshift scale_str scaled_x scaled_y scale_numer scale_denom scale_fac_x scale_fac_y scaling_blend scaling_nomult4 scaling_pad -scaling_interpolate inetd privremote unsafe safer -nocmds passwdfile unixpw unixpw_nis unixpw_list ssl -ssl_pem sslverify stunnel stunnel_pem https httpsredir -usepw using_shm logfile o flag rmflag rc norc h help -V version lastmod bg sigpipe threads readrate netrate -netlatency pipeinput clients client_count pid ext_xtest -ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama -ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin -num_buttons button_mask mouse_x mouse_y grab_state -pointer_pos bpp depth indexed_color dpy_x dpy_y wdpy_x -wdpy_y off_x off_y cdpy_x cdpy_y coff_x coff_y rfbauth -passwd viewpasswd +scaling_interpolate inetd privremote unsafe safer nocmds +passwdfile unixpw unixpw_nis unixpw_list ssl ssl_pem +sslverify stunnel stunnel_pem https httpsredir usepw +using_shm logfile o flag rmflag rc norc h help V version +lastmod bg sigpipe threads readrate netrate netlatency +pipeinput clients client_count pid ext_xtest ext_xtrap +ext_xrecord ext_xkb ext_xshm ext_xinerama ext_overlay +ext_xfixes ext_xdamage ext_xrandr rootwin num_buttons +button_mask mouse_x mouse_y grab_state pointer_pos +pointer_x pointer_y pointer_same pointer_root bpp depth +indexed_color dpy_x dpy_y wdpy_x wdpy_y off_x off_y +cdpy_x cdpy_y coff_x coff_y rfbauth passwd viewpasswd .PP \fB-QD\fR \fIvariable\fR .IP diff --git a/x11vnc/x11vnc.c b/x11vnc/x11vnc.c index d3a4b7c..d659651 100644 --- a/x11vnc/x11vnc.c +++ b/x11vnc/x11vnc.c @@ -1321,10 +1321,10 @@ static void quick_pw(char *str) { if (db) fprintf(stderr, "quick_pw: %s\n", str); if (! str || str[0] == '\0') { - exit(1); + exit(2); } if (str[0] != '%') { - exit(1); + exit(2); } /* * "%-" or "%stdin" means read one line from stdin. @@ -1339,19 +1339,19 @@ static void quick_pw(char *str) { */ if (!strcmp(str, "%-") || !strcmp(str, "%stdin")) { if(fgets(tmp, 1024, stdin) == NULL) { - exit(1); + exit(2); } q = strdup(tmp); } else if (!strcmp(str, "%env")) { if (getenv("UNIXPW") == NULL) { - exit(1); + exit(2); } q = strdup(getenv("UNIXPW")); } else if (!strcmp(str, "%%") || !strcmp(str, "%")) { char *t, inp[1024]; fprintf(stdout, "username: "); if(fgets(tmp, 128, stdin) == NULL) { - exit(1); + exit(2); } strcpy(inp, tmp); t = strchr(inp, '\n'); @@ -1367,7 +1367,7 @@ static void quick_pw(char *str) { if(fgets(tmp, 128, stdin) == NULL) { fprintf(stdout, "\n"); system("stty echo"); - exit(1); + exit(2); } system("stty echo"); fprintf(stdout, "\n"); @@ -1376,10 +1376,10 @@ static void quick_pw(char *str) { } else if (str[1] == '/' || str[1] == '.') { FILE *in = fopen(str+1, "r"); if (in == NULL) { - exit(1); + exit(2); } if(fgets(tmp, 1024, in) == NULL) { - exit(1); + exit(2); } q = strdup(tmp); } else { @@ -1392,7 +1392,7 @@ static void quick_pw(char *str) { } if ((q = strchr(p, ':')) == NULL) { - exit(1); + exit(2); } *q = '\0'; if (db) fprintf(stderr, "'%s' '%s'\n", p, q+1); @@ -1413,7 +1413,8 @@ static void quick_pw(char *str) { exit(1); } } else { - if (su_verify(p, q+1, NULL, NULL, NULL, 1)) { + char *ucmd = getenv("UNIXPW_CMD"); + if (su_verify(p, q+1, ucmd, NULL, NULL, 1)) { fprintf(stdout, "Y %s\n", p); exit(0); } else { @@ -1422,7 +1423,7 @@ static void quick_pw(char *str) { } } /* NOTREACHED */ - exit(1); + exit(2); } static void print_settings(int try_http, int bg, char *gui_str) { @@ -2629,7 +2630,7 @@ int main(int argc, char* argv[]) { if (s[0] == '%') { unixpw_list = NULL; quick_pw(s); - exit(1); + exit(2); } } if (strstr(arg, "_unsafe")) { diff --git a/x11vnc/x11vnc_defs.c b/x11vnc/x11vnc_defs.c index 42211e2..740b4a3 100644 --- a/x11vnc/x11vnc_defs.c +++ b/x11vnc/x11vnc_defs.c @@ -47,7 +47,7 @@ int xtrap_base_event_type = 0; int xdamage_base_event_type = 0; /* date +'lastmod: %Y-%m-%d' */ -char lastmod[] = "0.9.10 lastmod: 2010-02-21"; +char lastmod[] = "0.9.10 lastmod: 2010-03-20"; /* X display info */