From bounce-fwtk-users-303@listserv.nai.com Wed Oct 17 16:13 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id QAA09215 Wed, 17 Oct 2001 16:13:24 -0400 (EDT) Message-Id: X-Sender: pdunphy/mailhost.csca.ryerson.ca@Pop3.norton.antivirus X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 17 Oct 2001 16:24:55 -0400 To: "fwtk-users" From: Paul Dunphy Subject: [fwtk-users] Smap Message: peer dropped connection Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1222 Status: RO Hi, I wonder if you might be able to help me: I am running FWTK 2.1 with the Yao smap patches. Several times a day, I get messages like the following in my syslog: smap[4228]: xxx.xxx.xxx.xxx host address lookup failed (where xxx.xxx.xxx.xxx is the IP address of the sender) smap[4228]: connect host=unknown/xxx.xxx.xxx.xxx and, about 20 minutes later: smap[4228]: peer dropped connection: Success ... and no message is received. In all cases, the FWTK box is unable to resolve the IP address of the sender, even though I am 99% certain that our DNS stuff is set up correctly (I can resolve most IP addresses without problems). Could this be a DNS problem at the sender's end? Must smap be able to resolve the sender's IP address before it will accept a message? Any help you can provide would be greatly appreciated... Thanks, Paul --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Systems Administrator/Research Engineer Ryerson University Toronto, Ontario, CANADA E-mail: pdunphy@research.ryerson.ca --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 17 18:17 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id SAA09289 Wed, 17 Oct 2001 18:17:25 -0400 (EDT) X-Complaints-To: abuse@aycuens.com X-Url: http://www.aycuens.com Message-ID: Date: Thu, 18 Oct 2001 00:25:41 +0200 From: "Alvaro Munoz-Aycuens Mtnz." User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5+) Gecko/20011016 X-Accept-Language: en-us MIME-Version: 1.0 To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection Content-Transfer-Encoding: 7bit List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii; format=flowed Content-Length: 1647 Status: RO Is just the smtp client that doesn't issue a QUIT command at the end, example of this broken behaviour is in mozilla mail client. Hope that helps, regards Alvaro Munoz Paul Dunphy wrote: > Hi, > > I wonder if you might be able to help me: I am running FWTK 2.1 with the > Yao smap patches. Several times a day, I get messages like the following > in my syslog: > > smap[4228]: xxx.xxx.xxx.xxx host address lookup failed (where > xxx.xxx.xxx.xxx is the IP address of the sender) > smap[4228]: connect host=unknown/xxx.xxx.xxx.xxx > > and, about 20 minutes later: > > smap[4228]: peer dropped connection: Success > > ... and no message is received. In all cases, the FWTK box is unable to > resolve the IP address of the sender, even though I am 99% certain that > our DNS stuff is set up correctly (I can resolve most IP addresses > without problems). Could this be a DNS problem at the sender's end? Must > smap be able to resolve the sender's IP address before it will accept a > message? > > Any help you can provide would be greatly appreciated... > > Thanks, > Paul > > > --------------------------------------------------------------------- > Paul T. Dunphy, P.Eng. > Systems Administrator/Research Engineer > Ryerson University > Toronto, Ontario, CANADA > E-mail: pdunphy@research.ryerson.ca > > > --- > You are currently subscribed to fwtk-users as: alvarom@altavista.net > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 17 18:33 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id SAA09310 Wed, 17 Oct 2001 18:33:56 -0400 (EDT) Date: Wed, 17 Oct 2001 18:42:20 -0400 (EDT) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2358 Status: RO Paul, smap does not require you to resolve the sender address. Manytimes - remote smtp servers do not resolve. Your DNS is probably fine. This looks like one of two things. 1. the link (probably theirs) is not very dependable - and drops. 2. their server simply does not follow the smtp protocol - and particullary one of the following a. no trailing . on the data part of the message b. the remote server does not fall back to rfc821 smtp protocol. I suspect it is (b) above. Check out the remote server (telnet xxx.xxx.xxx.xxx 25) and see what answers up. Several versions of Microsoft exchange do not fall back to rfc821 standards. Even exchange 5.5 without the appropriate patch levels do not fall back (I have the technet artical somewhere - I can provide it if you need it). There are other systems out there as well that fail the same way. Hope this helps. ted keller On Wed, 17 Oct 2001, Paul Dunphy wrote: > Hi, > > I wonder if you might be able to help me: I am running FWTK 2.1 with the > Yao smap patches. Several times a day, I get messages like the following in > my syslog: > > smap[4228]: xxx.xxx.xxx.xxx host address lookup failed (where > xxx.xxx.xxx.xxx is the IP address of the sender) > smap[4228]: connect host=unknown/xxx.xxx.xxx.xxx > > and, about 20 minutes later: > > smap[4228]: peer dropped connection: Success > > ... and no message is received. In all cases, the FWTK box is unable to > resolve the IP address of the sender, even though I am 99% certain that our > DNS stuff is set up correctly (I can resolve most IP addresses without > problems). Could this be a DNS problem at the sender's end? Must smap be > able to resolve the sender's IP address before it will accept a message? > > Any help you can provide would be greatly appreciated... > > Thanks, > Paul > > > --------------------------------------------------------------------- > Paul T. Dunphy, P.Eng. > Systems Administrator/Research Engineer > Ryerson University > Toronto, Ontario, CANADA > E-mail: pdunphy@research.ryerson.ca > > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 17 19:54 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA09393 Wed, 17 Oct 2001 19:54:36 -0400 (EDT) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 17 Oct 2001 19:51:57 -0400 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Smap Message: peer dropped connection Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/mixed; boundary="=====================_522648334==_" Content-Length: 43652 Status: RO --=====================_522648334==_ Content-Type: text/plain; charset="us-ascii"; format=flowed At 04:24 PM 10/17/01 -0400, Paul Dunphy wrote: >Hi, > >I wonder if you might be able to help me: I am running FWTK 2.1 with the >Yao smap patches. Several times a day, I get messages like the following >in my syslog: > >smap[4228]: xxx.xxx.xxx.xxx host address lookup failed (where >xxx.xxx.xxx.xxx is the IP address of the sender) >smap[4228]: connect host=unknown/xxx.xxx.xxx.xxx > >and, about 20 minutes later: > >smap[4228]: peer dropped connection: Success That's caused by having a long spam-blocking list applied to a host that doesn't have a good reverse lookup, particularly when the attempt to look them up takes a long time. (An immediate negative response isn't a problem - the problem happens when a host takes 60 seconds to time out.) What happens is each "smap: spam ..." line in the netperm-table is passed to hostmatch with the caller's IP address. If the spam block pattern isn't an IP address, hostmatch has to turn the IP address back into a hostname; that has to be done for every spam block entry. It's pretty apparent what can happen - if you have a host that takes 30 seconds to time out on a reverse lookup and you have 30 spam-block hostnames, you're going to take 15 minutes to verify if you're going to let them mail to you. A host that's got this problem will never be able to send you mail unless you remove all the spam block entries in your netperm-table. I fixed this in my version of smap by making a new function called "hostmatch2" that gets passed both the hostname and the host's IP address; it then calls hostmatch with the appropriate arguments to stop the timeouts. My patch (relative to FWTK 2.1) is attached. -Rick --=====================_522648334==_ Content-Type: application/octet-stream; name="smap.patch.gz"; x-mac-type="477A6970"; x-mac-creator="477A6970" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smap.patch.gz" H4sICNISzjsAA3NtYXAucGF0Y2gA5Fttcxs3kv7M/Aocd6ss+YaUKMvJWk5csWUqVlYvXkneJOVz bYEckJxoOMMdzIji/frrpxvAYCgpSV3u27lSETkDNBqN7qdf0Hz+/LmyS70aTns3jVE/6kKNXqjR N0cvvz4aHarRq1d/+2owGKi9Rbk0e9WyqVaLzZ6b8ZNJ1eW0puE08OhgdHT4Qh3s74++et79h+9q lIy+VvztP9Te86+UUs/VcbnaVNl8Uaud6S4We5Hg/9+om6qxNVE/LWZltdR1VhbqekOPljahh9Oy WpWVphFC522eK6ZjVWWsqe5MOuQ38vrKpJmtq2zSMCFdpKqxRunKqHl5Z6qCVppsVL0wqjbV0qrU 1DrL6WlW4KlQybOpKWhaWk6bpSmI5/7Z6fH44nrc36WB07xJacY6qxdCqSzz26we0nbV8z36f7vv 3tumXpTVkTrX1bSx6sehutJFs0x+d98tNVvT22lvutBV72pqT9PPX9R3qv/XD0anhkh3D2y2rm/l fzi6vavja3eGyZ0aDQ8O+KD39kd7dPgHBzj8/a+Vm6zG9yv11/5rYl3++4vbbO9bu7F79WZl7HDx 5sGLGUkQz6E+o+SQTpU+DVgK/xf//ososTI5DVYDZU2RLungVH9d6dXKVP2hDPr/pGxeJtebotb3 R/ylxwL6rAapNkti6ks07r2x0ypbgdmj6PFJVtk6YeIl7TYrdK40q+0zsLw1p8fjJr8aQoNyRrMy q1ZVOa/0UtHHulQ6z8s1SQKfV5Ab7YnA5vr85qNjkSRJm1Z0BmplylWOXala57f0N1HrRTZdgFZT rKrsjgQ2N2nC4q2awgoNkqBW00VVljjPNKuIn7LaDBU9tmZaFqmuNnRq/27oFYsVzC10zYJnEtMy NWpC52WVzZbggj6tSmuzSW4S5p5OLavVkiyWZFKZu8ysaQXsuSXBkqsMbYY+0sJ0xIVVRUmfl1jY qhIDsHgh4ioLowaegBszMVkxh5iyIs2mopnMLnPJgmWKxOY9WJu4TdSi0ZE69GCNVk0rA0WGqtkV 6UwrI1bQvJze0lsIdZ7dmUItsc7Xh4dCqbde0DPWJVo7BcdzjW2AS/q75F0LqabYJiYkmOI3L1+S xEAopeMy01vLisbvMB5TQRMgJypDxtBUfneQQFY/gzxr0kWdYyzbglYrXdUZnQujj2rZkP1jUMQH 7YyZJXtMzSwrMpawIxFLb/lrNWTIiCzkbUHLy5mUcobOFm5wnHxCa227x0N2xDyI4i7o9bwq1yTn hpR7WVZBCXkO8X8DLXJ6QHPp+HLChpmBKllMonWhIqStJp85/fGggTdeGYmlBbsGr4GKMMqwbMWa SecX5dpLOLLfdVnd2lgYxFN4SSdUkaKajLV5VpVL9SwrTJ0+I9gAW1oJ5tBeTovWzIC04EVbMRUQ gnVCNVdNzeIpm5o/kgDIggrSUzpHQIkDDBxsLfbg11ywIGrVrAhwSFjpJmnBBxtfNoUzJKfRHkEJ Dwg0sK+psQ4U1hpGSPPhWBQ8S9iFynVN8O2Oi3cRECor7spbQfln4plEBM9kp1505YqUupUIkJCA poJq4ywTdZdp2P5pUcNr1Eo2LKqz1jQKWOkVhuVD27KiaMRtCv3/CRarVfseDOJdwkiZ5aknsNrg FVG8Ba7KZmrMnualJUXBerZOsyLBHzobZsQdRU2KVQlnabPaOdjljS1FIfh4mfdYi94xOIoCOe0u RbRmAFF3hYWzDPBazLJ5U4npkR1ns8xUtl2rOwCG7/cz2TgDMTPd5Iz+/b3GVnsEEjrfM/V0jwQN gB/UmvC+Lxbo3DcjlXFbpq0mKpupO0KfFCKhzRDYrfWGPRipB6k3OX6h0OUpIJDjHMS9EZLaGFLW WFKnMzqrOlsaEjpr+MSYgr2YAconckwZb4eUHzo6C37QbTjAfJhvV2aK9bENnkqhZDF3FlakrRut y2HEx6fT9/z6B/q70HfmATF3amxFQhIqKRQQCEEv4t1dFlMj+JR5201ii1yUFlC/JHoatCAsaAPx QrjvjIeMVUREmz+jp9EwssJplc/mprY7u6KiWtxNoZduOhw9gWHCs2yzIn8vgphIkEbRTy0GrdXx 1X+enQRk1h6yrQSMAhwsmGhiziwx1vxKnpmonJ0kYONTkd3L/AKhZ56TIyqNfc1scgQBqWg1aeak yPdkJGQvOYJFUWiSb0p+rUXtbZyelYA+2BfjCyCQpoh4ZHLqvFbvw/jskmJPdf729Ax/r44/3uDv +7c3b/n79fjGDb24vPyIR//4dMpDaCp//+fVyS/4O/7544UbOv5wdunUh4AoTdnFssrp6dSsEOSQ VmPT8ObszMh+PE//HF+9611ejH/uvR+/+/SDPEUALtETMHgJGhwSRVvLyzlUmSRMuFRWHbFcsKQZ zlutWmdElIzUUuxOEaxfn2VxcnV5fqS+ZUtnaBrQPiiEtW/cKJbUzeVvjul9rsxKgi8NBC42rK8W 3wiawUe1+eIGQ+Tu43A49J96nw325wMdCrvKFJgphvAlGGnNiEXh2TPaynTaVJJZIMasCKeTbnjO sQZHpwHOlwRi5j4DklxCzusM/o2OTMJHKCRQFQbiQlsJ30SYw0j7kEQE7ScJkz31Ic6+U8w2F4JW 48jgak31OmQVherfXD4cTnCWrTKEMZ8RhmIJSKR9/qVD4t3l+1/6waqE3UmZbiRZCawnrTsSKQuN /hUdEIWw6ZHqy1JzU5jKY0IszmSbU6EgIpiYem3c6n2cMe0rM3nq+XpwpsFhSUjwUIvzjWClBE18 KCxnASCHcap/v9Q/878+PKHxmCXPgDCkm7metuL9SOhOXsyWSyM2aXLL573Ut4aN1wF6kZEXkoWx lI84Wp5coiBs8jheDoOdthHVvo0YtKWL6Tg/eCYbskaWJUF559JJdyXohuJOjI8JeDfYgj9lSgGb Kqvp1FcSKgWnKzQeeF7oMGDPgwvFQkZXVrJOMwgRXCz/dlibGS/JlVWsbLB7BhWSLsNGgK3WcbBH 5ZRpmxfGWc9LZeqmcuvnAlsOU2nngexOG3KzMdaIByflndndJh6mwBEkChifMKInjOf0mcA4UUBj caMMya0HrF1uSWeD3IOdGcCtJDnZoXJkKWSS1JIycnaZrDeJj8ZzpKQ1ebY1icPckUUjKpDgysEM Sl7qOQVeVYYYTT2rOEQIYZkMF+0363gV8ajEyufrLEQdgY5P3wtelkKVNAlxiZZtDL84H4dlIJTo wFz4FAoRB8MRJ67TRcmnrqs5J2UuICTfQBG0ucd5ccQIR5lweCAkaMCqLCRVhw5XtCYFuBRgxgf3 qyUQO746vTn9x6fxkTp1sJ9nt8YLi7gCkQ7fiVf4qUZMlokHxsy+JRuC8NWmbEhxddGX047GkpnJ fFNMS4ppaYFppSk2rtRtRi5e0spbY1YEspUE96/Zz7usfQ3pOGwNid/EkDCzshr2o/1dnRyrvx2M nLJzNmt9/SsqV/WUerm/72pe4vOTYChNQV6hnBfZf/vj6X0OcOFouThBcmrJ2nkuozCqLHlZzL+0 a406a0G+K03wb2rE88h83WnbdsqBOnZEUbbg2hJGeJ4w5IV6p+ECCVOhn2TQ3ijbMYeBTFjxUYJ+ xsFo5KqZrpySMLLLk4XJVwz+m3b4ofqAp84lkrHEdVH6b0HHR8frYnl4XPjGSvlc1CGeLnDwwCQp qEybXIPTYhBO3G3udVQ76zEzXOezZtZQoFfQVxQCieiioeF4UX3pbvFgX31LxkGByBt17eqInP23 I0YPRyCx5coVmZZdZtZigzCYwuR+4uFjEyFufUdBnuaa4GN03G4cNRJi7J+0iFwyrU3QtWzWBgyh HHpL1mLZ6JA42AUHy+tiSwAv99WVzwclstWS7Ze3epO4GlSkagcvR+qTdZrDye9r8bN00mscDbH2 rfs8WOl68SYI5MmlQKqm8KA44seT8p4sL4jJG954OB8mYcCksZvWqjqk/wRVzJmVDTL0omSfaO2X dgOjh6uQR6xqxHetOUuUQefasvdQZiRVDTsg5/6UuA5+c08UdzezWTblUNZ6My2Bqe26B09IvOWa 3IjBhYCbygWvuMwFKi/+kHDZT7KCSxj7uIStgF+GyxFUFoJ0X7w8VNeIoYVRjoteK5TPOKD+9vjq 7OTNUP60rB2qG9iO42rG1yGxEzCcnnuWENZ5vwDPaTRhtjciZH/auigcYceFqz1Ixlg5UnZRNjl8 Djt6GnatvvtOXTesK4k6wbcT4qOpfGwyxqOxeBYsdIrvXJujSDajYMU59kP2VjDvHdvihYtOfhs0 PPjseqCQSElgIlSGI6wISdwTKDHsoMTx5cXF+Pjm9PJCja9v3r47O73+cD6+8En99RGA9LU6OcIe /CREbdGAlzSA4gxytgm8IP53mMTjEdxujSeCpMMJLA//O9iiEE1GRNyZnACpHAWMBwWmReoMWvsR VV9w6HL3orNAlFifHrGyDt6oVNcaf3e2GSbFbOnv+gUgH+Hj8IEsuqtFFZM/JDuEaH9g+y+e2OrB Q4pRIaazuYecPDIZ2UY0eUTjKDr4IzOROzyx8WgUqkex7o38qEhrjx8v9sahX7fM1VZVYUO4Baao Q88QJSHLXB31fR5x8tPN35mC6j1WMW5sIylM/Xs14rjwEtZXXBOg2Cj1hcN+aorNoC+Z8Mfx1fm/ 3o8vflGzXM9D7oH6JyCNk0HEnlLM/R3CciNJpNuMk+m/PTu7/MkvoB7SjoT4luIQQchWgJJ4I65k MMrmBdKwTu3W3wzfnF6zPDnrcdl1fEah/uzOW44iun3cCx8H8EB9pOa0IFebQh2jnEURZjuX8DFc V7QXUwHgfSHbndO8KptVlnYZcQ9R1e4z6sqq/Fih4m3bJdzMhwtVTYGY1/kBFMgdjJt73HhbLv25 2e7CTLslZHvuwqxolhNTDX0t7n6yqX2J1/Prn6q/0D8UdaQmSDNNlU1D9pHg0KM7JlDLls3SLYHo XMh4z5p1S2PaT+tU9ogIl9kesMRP/zxLoYbX8oXSXpcJdx/S5cFfkvwvWcB0tYOEm3sF7C6rlia3 6it3SCo4rfEXD1zZa6+eCBlwXequu1ydSKbI6/vY9HoAjUxCMMsZZtsRQDbaSsTxkzyifmykXKx1 FTkKOra1W57h6qYfts4Pt1XbW4/PQZ5Q7U+PqbbXaK+pWlZ4UrMd7qTp4LKLFZOqpIh0AJl2txG9 UK66robDYQcr+njb9yzIIOOvcyEqna/1xnIW5nQrvt9N/EyXpXN5R3DR9SmQR8kzmdXeZPX4JXPm 6/5d1h++V6O+4oKK7cCWvynrkcYj65baD6lNpYUIq1LJ9dD1wrgeEvPovgH6l3/vcIgjGdRl+Rh3 /t0WZ2HVMrq+78l64RhwE4BxHZ4ofc9Vd6CbDW/kbwwVN+04TuyKZMBnCitJ+L4Ll3gB+fn6jOGf c3K3OfmyJXP3UMj55WRP7y+uw2tR/lDF7IUSqkahCVfv5N9cAWJGPmdNeiNeGQUyGe2mQtcxifCT gOd7WYHSGbvwnWDfo1Q57L7wOgdyzuJIGyYUW2ykrsvU+jKpz2T6zx0NH3yA7Nb2+dFjm+fETN6y WSBjCmo3MXILlhpUXPteAO1FuEyE9QejaWdTmgLXgVuALE+nlA2HmgenWcF/DOC9iy30bp//HoB7 fNra17YjCbd7vE9hxE/tlJT7fDOAqCO0jLUAHZsnbs/NvV5m6OLjmSek3rgW8pYQLtF6KTGX8jDf rjQvnfVO0JREzySTdDf3NZdKA3pOTcU3a9uumj5wwuvrc1nhepsyX3R6fEeJv/lC/BgqhyHWedIb PybETkU+axXvCSniYA00JQiVGzLyGFya+lF5PubyRLDWCzaUrtGuw8ky22TMWdRR8kACuMGsytwG 6OLOrHJNlGNdsfE9oYujoxslnZJOoO9T0+CO8vjFagndv/1O7TtGSrmDMFmsXqH8x1ck0TUncuMv SbzfiWshLOU4WhvkK7uEC+5yvhRRSGHL8489Imiwj7LKcnkT+Ox2g3HjUVPU4TQZUNEjgPJy6KrE BgCTtdDg/h3p8ck38dHwTXjQ7K27WHd5UIuPYHPX+ZPalrT3u5ZvysFpZ99ut64BdAAH1VFMB0QP 33d8YiSNgHx3BFCzjbvE62LrxeWNlAslmqCzYC/AVXGPZFvW0Hp0bweOczutmskAXrLLcfv8iahC cXMjElo38aG77qO5ENNz7qdkHl1fKlfxKXJ0c+lrnz017xS+4QztTny519nDSnNoGIVykVmj5ehR VoU19rcPJio9h9euhR8VOHHeHLy8Y3cZyUi4FMfZGSztPiEQadB5sCXXEI/4y8cHlQJ/Mu16zP+/ 8AAr7+y6dir/UFanx3lZ3rYtfA+XlKYB12ERjoR77JhEHHUkuFBcocXvzuSbiKcB+5qHS8hzhZqE 67kIkWkAHf/Ex5UcQFdmxv3suWuhcf3IiHzabj8m6KImNzlQRbFV3kt65BGujdZ9u0rb38UtKWw+ z55zR4AEFz7nKVD/LAaQz1bmE72BDWtfJpKu4k70FvdQSo4hAl8vcO1KR68BupzPfL7LfGq8MgiQ lmZn90uc1/TPcccFVOqrS6mHxFkPCivcRi39XFpW5eKtgESMag48GFW8tvjodacv2r0rLEswK6V3 24nkmEi/DU/qRSP905XJ9ca30neXUu0q3mR2A+Q9uZTQCA1s3OUZLdTpbGSEub65urz44ewXdTU+ vjw/H1+8H78XtUJI7OThcljuJpdija+7qR1cgu/6gb40IhuaZRJgyW3idssDBQwZoyYhVU0Wilas 0PiHLZV5lkrPFqtq2kw7G1Duhzzy5M//tMeTPecanFzgtLmxeq7437lrbzlS+6/w+6sSkdro1auv E/WuIg7V1VCNCcRtNIey9DsYmWuqXFIEyejCWgNz5dqpBPOS8EaTtybxm0f5Ge1v8XNc6WyuTofq A+F2oXYW+PP9NFsMCTF2Ixq++RSBV6uE+G2M66KEuLgTPVHL8o6vh8LcLiZjR9x9TzvpVGpdYXK4 zf/HqrzjgNLB0gdaeY+bc9irhx9elHxbx60lpJvyq5iIDOzF2Nozm0mnHmGZ7MclrEgco3UwDHfi TKfHI5Otbu20Klcrw1c+3PktHd2YJISZU3fYPdz/uyKt22PvUxG1BrRdPujCcF0VekXed1XhEitK KzjzFhKcvba3ffTFrmkDg+hmn6I6bogBi9xqUpSuoiUk3FJ9vkF1sNyP2eT20xAOkCcoc27/IXNR la7Dj2Ua66ML/MoKPxKRRFJFzfxMy+00sisZFanroToxk6rBj4LwS7BEfcoroNp4ersg/+LIvk1T Fpyo1MygPYnLMp2wdTw4jzpK/QVd8NRBS2axh5RfC6BpdKje5raEE2S0cbra/niBHskKES38GIki LHYliYKBd5eNycdbqTs3Jl3z8a1x28YTnVRI54iFI9LitYqCeOtLhpbgOHWOtPBsuH0PW0Iu4Y8J STq7RYhzT85N3eS4GniEH+XhBjQSbYg0vVyekElXKfDrV0D34o8rBNdBXEsHP6MjxpU2XkFL2Ju6 vkuJ7gbKJx3+JNmDLrn5mfaThGYrJoA5S1zI4EnZVIiVAVh8x+VqOVJ39eS0ONt4g6dOtVqfrLk9 rtWzx8NbdSTzbyn2G4RDB4I53XTRQhuzcXAOAXRTTg51HG73esLn4f19l0WYQPgdAvdVUm7eZq1E vSaWJmhNdgW4lMJjaXdDOcW1u7nAkWgejg5ix7rtrw4HelW5o+76qkia3eNGb2eBizcxgTZq3UGI 8r3NarOLaBz1VB+pK1PMUc/ccshZ2VjcMPpRpDjfMxH3fc0mwELh4GbNP84ZRlRm2T1sQ9kMV5VT FGWa5UoaiO3G5uWcVElOu+CEf2e0G8VArSQOXpHaexT8sbRmtVDXQ/V+qH7R/9Pel7a1cWXrfpZ/ xUb9JJJQSSAm2xA7TTBOOI3BF3CG4/jhFFIBaoSkqCTbdLf/+13jHmoQQ+x0+tzrTttQtWvPe+01 vksYvqOkRf7j6GYyImdK2K8SboSxUNAZ1uHYeFGMsRvgqMoDy8j3QqlSQYwa8ujTmZNbXxzuvEGf hbAhrZEcQAYDIbKpuj+iG8hLnCkRi7D3sJNwK0l4AGwKaDf0Mjx6ufNkpdMi36l+bLWOk/54rBor bItVjz1Y73HwfZ6fw3lGFum/ZiBSY8B1ZF4DWfsRo7smBlnQv8L/03ja7qf9FDik9j9iYTP5VoBx 9q/7KOKRt6hhF9GUw1KlbezO8d5/73qanD4rz53R0MUAJeyOSqL40DKJcJ1fJE7xRySWqKh6x3N9 zCanZFHzb2j2CNRbGsQnmOdePLkOtE+9fooinK0sDF7ej4GKWDfu5Y2l5adLT5/AeUWUgdUN0jik yM1iEOP7giJP/dp2YAlJvzIacvwJHCmJ8Ng//P70xfbuq8MDqwJDlguDQb1gJo1j7nJFPSsE0fWL BnYWJ/XMSZg1XafJEJ7Uxdu6cnB4+v3uyfHu0Y+wicVpHaW+s0QbxavqBqm8umiSD7XIXHBicF4x mAkDz4fT+mrDgDg0Rb5cmnh9dHiCbj4H3x2+OXhROixc1aXpyCqux3FfXdYvULMyTCgg1ak4WS2j +hcqbvvsxzpUnXqhWshcSD+PD0//trv7ent/78dd20sxnMqtBBSL7k4b2xbZmSfv4qmNLBRGYzYd oWjVJc+Naf9aDqq2+Hp3Z297/8Xhq+298vWuTkdOnb+9/9P2L8f8Oa4ETQJxD/UGqcoSCtfoU884 OoJEBNL3q3WBZW9fcK+nDd+4xVFhHzRyIrBwamgUfy4OLXz0pGId3S/HP1YqbyRyjVeL+Yf1pe+O X8CJOz8H6j3somwsfs5CEKfA8EzqjSUQlpOPorBCRe8q/PweqCP+PMYhS1M//bB3svvD4Zvj3dPv D3/kNmELsJA3tUHuRCP9AAxg6IWOVz9cwkV5OcIIyYvR+2pL1HBdIp7+4T2S3S0H9i+8VsAVnics AMBcmnod/n727ODN/n7j2yr+U92EJ3zXVZKPaMVirIxF+Gg6uqqrO5fgaLzc29+Fd8BI44mt99Eb czoaZ0rB44oLJgzeGfN+1O+hmvIU2aZT5IOyjVAJbOOUruKitzjT+v9cC9j83nAHV3Yfq+dICBhQ tHN+YRa75+NIoiOw9aKv6dsX/cku8FU3df2qYJS4BU9lC57CdHG1E+ROgFPKtMZ7umA4BteH1khW gvZ+3I3i942gczjfD2kyV0nJAHPlupdXMG/SBtyJU5xFYyc0/8Et8+5Ne8G+MvmNxaW6k9mwe4k2 U3gTwU4v6Knut7PZeZT2/xHZ4ZCc1P9HUj/vhZ/R1Ac70dSn1+PzglJ2N5o6HryCEuGOhPd/6Z/D GTRIbsIjSdRDiEn4ZmJfybu/UEBZwekUCrRV8GrivfsLaqzOi0/3+GzijrdHryeR2wkZFX3xPsEa F83kbIDIMbLouD91n5wNYhALgbvJVUqXX7bWnAUAFYzTYD+7fR58Q7SSCErhaxwCqaAL32pj3P3p 2O1Z3F3Am+xN3apmmAeuh88L1gWs0JRgGE7VMaDO0nbEenyYGW6d18fUF8P6Fj3hw7xIusBo2vjj YBnh/gce1BKUyaw7rUxHwEpW/ikTBj9vGX5j6I1ZHH6cbplPIRUKvl1kB7Vnph5+2FgOP6I+VJj0 YGlusawUid+3lJoMcOO8Xe+svCt83Z/7+jqeXKVv15afbhS+XkT/xl5/TleRoleA1MzgPD8zrU7x 24vCt9IGBlqTPmB+I1bGKGnGegmWvAdeU98XVa8Ofs8MbKyffzk92Xu1e/jmpKDkAKQkKH2Hktfp BVLRXIt8Y1YwGuGWIjAoUWP5BWiHOQr8T5N7tIj+gFuyoac8v/4OzhbHH+knt4O9t42izolyHQ8v 7uZT9O8y8P3L7f3j3ZLicNucom4DLuHKbWXp0sYTcMrK6NvKk6GaiKCRP0XlK1wci52i4ul0kvwd Cq5bL/98MS6xtp7fVFriLO7hKas8Q8f10lKevQFLrq+FA9FxyJz6PEvxyO0H4lRwik4Fp6w7KvtA DZo8sbAKlcKStG9+myWzBHbf23dYqlotK4IbRcq4aPCiwriQV6d86p+Z2sdaYSEk+65QWlSI/TNc 18Rfo7Sk9JBLlndQZLVTRLM7BYECA2foM/Q/P/1x9+h47/Dg9NXeweFRwdfopXMdD/JfV1fanaLm pAwuMpXEok2yG5KKtWlNiPoxn+brG7yRaTDAYRVVfJkMRizAvF3ZYLovd3AoXblaK4uwhRHkb51C 2NRurvoDdARDj9HROXv8RvT3X5PRGCUsivqkB6Hk9evk1yF1z2fJ7tYaBZ57ti0QuNquOuIA6ovh YBwD8OtnAQFcQkTCJk7cEGduAIcHfv03YCNqo7y2xzs7x6f9Hm+sv9b/0hDATKhuo6KqKvqKp2lp EXvOo7k3vmJmSvB3s7IWrS4b+hXhF9eX16P1zhMGYMzWI9BMBS2QV/Ug+2aYoDw+XeoP8U3TexNP xvESvst+kkwmw1FY2pTWY7gecmtJJtl3bBjMPuWDlH163h1OB9mHfFNzD/1OVq1z72UVXxVN69rj aH3Fm9ZVmNbHqzqtHkocgXTy1hQR6ODNfqX263LNf4RPhv6TnSN4MvGfvNg72qnUlvxHL/e3v4dn Lf/Zq+2TnR/g4SI+9A5EwPt45YPnlfoG7BVDf600KkvwtwH6MElxEG6LBt/QG/hvaRH+gplBb4rZ dZyC5EXOkYQUoypgh47R5tIv+ilbNZOPQPqnCWMqcgxkHS6+ZNIwTS6KjoOR+TABmhUVFidvkLsX J9+GBhZecvNR2TtAQf30zavt479V6senez+/OT4y/zLw09FPP39vfzpsyPzKd5WToze7FTSqeM/o qq7Ul8OyBMB0+vrw6KSysh6+uaMuK1jZQJHMr4Ir9Xo6PsUjpJcv/J4jU1QIZboRU6ppl8t4ix40 w4tuTIk+zeTeqRhXdJY2VqKnQqJMQLELRapMkUCeyr7rl78rFpVsobyclHt1kX81V0IKK8iIR7mX vmzUCl4Ch6Rf5moNhabw3RyJqVhcyvfZF36McR9mdKaNzIe+olRflGlJ7Yd5FWn4KqsfpT2Xl7WQ GpeIW/gqlLhgRJ/uJFxJY7Y38Jun4DTQLN0KT1ajx8vLeit8sa0d8jmhkuA/eNt/wa2dKTZnm1s6 WawDgGvPvJJICXro4iTEP4u8APv/iD1AA75x5igOQEj06nURGBreEUYcuPhXJculJ9OzZvzxJzQc 8r3MF+GnpbaLpj+mhxkubEtYBR7Ra/QHXQlUtGNCfB1G/jPCrvIfYMufkSzxXn6QHugRAq2bbv/S PH28tLy21FnzYOhBYiOXZjISnqtkKG4nGBGaYKhkKoLdt/bLO2uWWOcBDX03GpHDjNf22SQxTzeW OssgB5XWXKyEqmRrvLs+Kvdpwdfl2qnS8dxFYXWLtmquqmp9eauCXZ9cXm+al+S053DuxxOETOkm QUqA25RZKJwL47n/y97B96e7R0cHh5WK37JX5uDwZP9wZ3u/pNj8VdUdSM9X1rMTfxdtWm7S76FY K9mAJcEBaN+fpRo+hq6mXIA83NrZxuco6YwvGUkEoUIf+k4z7NZAKIlDj55XVadXjQzjJFJFVavH E0Q2G9KjKNzk/1rzNHg1jsBCJxPymW6K2w6Vt8WtLq/Glxf5LhB8lo1zo8B18WqZjriecZ9iGM1s 3C4cKYfqjrxwQQLroejJ2KLA2gngOrxZsPpDnQZ9RFPQVhFuvjK04H2JJjRTskANmi2R14FmxKsy BWhRsWLtp8jY5hWrLVUbiVwBwW3kZuBe2tHw09tUo2Hp++hFaRQletGw1pxSVCcAC81S8cwj/5jM RR/I8wajSA//ZpaJdG7TgaYIgFyhg9ERBoN3qODByBwh+GPKEeK5wvDweDyCuV+h4n7Z635KLEP+ o+8kAcEqffMdAjyJWzRf1/keUVzAmvZIrbvoZkTEjb7NfXbMTsJmnZuRRtWxdGL2Xpu8zgYB32dD G2ng/JmA+MUDdNljFWBkE1CQRgcDG4WWlKKS2wQH8jgGEt8T/AiF3OQ6asKg1xSkBn2RpV6cYQZK lmYZkLHP9AkjyUYcIRz0RnDEKFyN4k0v0W3KOsfbIWP3DnbhUAigONfCyAOIAkfgHHYMVam+qnAc MDkSwWsG6I2I08eg+FQPBkBQjI3DCKVO01sukkHvLFsQnoWatF/T9gmFgCsi70wLhOxPOwZ2Ta3z FaegUGRG9m5kP2RZC9sGQxETiaZ5JBiUeMghx7muSPIRqkM6TY6C2EUD3BTGf5EvLm+gfupc3NUH z66iRQStWkhQujkID7iGcSsIJjv6gLPiEFolWUsyHM0uLmU74I7ZEy9qWoTk49hmkUAEDd3mdRlP Q5CieMLJi9zTKnr+erBN6SzEdi/T1qacETeh26j1X6aauDO0oXGn5ieSO2D3FK0nphGhLnAdXj+4 NLrYfZBEIYxT4+rFY7iymN87fH3eos4o0ts9XYs6yx1V3FUqwAdBJ6/qqgcg6afiSYgdfvIJuKdQ zQS/h7OP5T5JminUpDxeXosedzpWv/6gtlotr6VO0EbR8DrLT6LOmlVMipbjbHb+9rs3L4/3/tss mrV3W+7N9Y0SaKuyUc3IGHV4rFz4SM/px9GYhT2S0SuL71mDUcdfVXXCBS9GU0KmE82HCo7YHHCP lcXL8ZaaMFgl7HyZccDqecwXbYQvX++9oPH/RSx9JWX+hf8evNjd3/4l2n+5vSPfkMcVaRkq6NoT d81z0zFff20W0OXrelyP37/tvItMVdKdVBsNlnhJIkErU0R/D2TReDj4BG/xU4Rdirds+XG/R+vG ZeM20NrTc2AdgZo/M9svT/cOdk+49Nk/ksmorrqnr6UsO2qhcmZ0XveeNcgzzFZJCVeemcspyPD1 lXXdUBga/Uxci+vSWmSOD3f+dnp8crS7/Soyy1IW54LKfwOPZMAV9gOv7+/v/ggTghwVPEkmk00C lRQPXcLLlkY2zVfXVamx4m/lyifbyhlcwnWex3pm9njg3ngbNPkL2b6UdAVr5twzK+t36QlyLslQ +rLe0KHTme08iZ6sbdgz+/vOzxc5NE3RtHh/RBNERpfiAhjXU/xmej2GVuidlUnlD340SIb6rlLh k0GIfFZa1Hc4/6cUNMSKUGmrsugz5MA5F7H4wihTRajpy9U+STA3G15Z3ht6qUeZVhAeVJhFx+3P 7pr1xfh9RIZIUpTxDtBCTulryGBFBVwV8OkWNVMx7F5Ar5tNLkDVffI7MoXN648LtxY9LBJOGtya /wiaLCp5J0LJfZpPKMMytxNKxvWot1puivFMNpswL/QTUQ8mnzTNjnji3NoPwo2DRkf+HEELYFVn Cf/6qaRO3FrZGnGv9kUfVOGPqJvf+IUC4iGPKgER+YrVDnggiYAIxFvVloYuCMn1yAn9+klahhHB Gvfrizgt+hL7079vZ9BjxeuF+arndaQ/vxv+8et70/lJpgg75FbhIVdbU8pPEuR7n5lO/rajX3rJ ++FsMBCPoAJr74LXBocBAX0aO6+bvNnWem3/sP3j7ukxvNp7QdXUkfFrECogxncEvtW8CPUxmX4w MVi9QXuoRTGEMo/GTiQWhrLBO7gkURx9HZORgxCHWI+G8Fg0SqgaD5epV5fgyRI+qkbm8PToxU9H fMlq3frBAvVAN4UMoDcbr2gJ91nx287ctyv+DtQ2n8Nj2TzyEWVFswUabsN8GYaFqoeZ/D5hYY52 ecshrsSTC5JZOY0U+Rq0daZpYezu9shQIRNkS+qYOPfLP51/Wn4zFlZk/R14Vxn1L6vgQPjfRTcg Sk+lgNn+GdYh2i+kUKopHl+jA0N3hOmbJGKcbnGEv7LfMGiA83fA7YxVUES1hXijauw3HzjE9Qp+ qGFCS6qifrLzmqKgsMySDB6vWwnJO6MLom7dLyKvUX9j4TfOemNPsdyiluItkVYV7YdpZDM12Zyy ksbOLvQ8vnOH0GtIz+EyDSqxtpTx9nWsBDsi/006bj1P6RePvJaTpQzhHU5Hl2ndqzF3sP5UnDlQ dGX1+ud1oqLwDTCrdbkUjg/3T7Fv3MfTo903x7vbL14coSRf9scSBronLEmg34Ct/6ffqmU0y3h8 1yW1QvNovDo+sfX4j5MxvurRnEY+pXmAtFEova+tRB110SurU5gyukNaygp1UREi/WClp6kf732/ 88P+iyiIgdLO0n2PrAubi8onbTkyZIGHn/Rb3ZkDHQufJHxMrpJQ7e7ewclRg4v7bJ7JnfNgvlnX LWsdbF03EyimPVkDMW39sadauWWi/iwT80VnpnBLPe5EnaeewotufuqlKptUKVK3YGDLEbvxROyx E+kZ7vONriMLOtuNMaEwXiR+6kvtpVs9IwSY9m5YA+MG0XfPvmqDPJ0ufdVeWU6rYXfUQUF6DS3a EDInjmuf3ZNGo6GsZ3d84xetxtfDJO3HXblJ6H4g5vFS7kYsKnejXyEyc8tltV7CVXJJt2hjy/W2 3j3HOrvnF6d4m4nuijlT9gppKIPqbWlSENDH8i30qV4VJLEqRQZSZ6QGe1/AN93z1nNgr7r4ulN4 j9A+g0ppnymUvANzQ728RWOIWKX7FTXaej4Y6oF8vIF61afuRJbtM2ae2N76ISHLrmJnYLJxUZP7 YNd06wsLhQr6ICb/7+zQTyAhwLJL3hsPKzjIAilVoL2arcGUR7s/VYDPKaOaor4ewTEowzDw/sCq anpkqYGwBRJNfcNgpZg0iuogvT90QUPWp4ObBfpu6X6bwGQ2QZNmr0kdOBh9wOlLx4kkXyQb93ny AdYKUS9oXhS8nZ2v5EtkBAdJ6308mBEujD+bLgtYm0qLyc01W+J7QLDsGY8CvDVR1I/k00LwQnMn 2EKpwYIXmgC2UDsqM/vMng+/l+6Q+GekmTsjHX1cfkSCwd/jnDSDe6qpLFjWEwM1g6RQkF69f7v8 jnaGfJU7SHNB2mllCvxTCIgCv6Ylku1dDGiax3LXk6hgqf1hLvydpQx/x/uUK9/XIiKG3/5TZMAM HaOnZdybLlTBjNxjuRaC5XL6qfxkPitfr4Xy9SqG6aX1KvAJmrdeubnHVctB+sr3dwL2nbt4+Y5/ icUrmJ7PsHj5mb1t8RbmHDY/54B30KxDoVJAXi49NXMWjQB5spH2NhuBdiGAVs4DsYT5BW45gzqE L3f+7CR9trOn83vPpTvafXX44+4Lxv4d9VKO9FGzPqkVAgQtX3WT4zsUO7mijnnaTkU9oNGQQ97V lB6V4RXJZ62KOOvDi6RqXvD6UqwYtxLuMgdVeI+UMMzgTBPMxuKyzHo+4DWGy7MpWtpB08CW4Vej WaoQaQQzTeBF6F5XjHyv/S7Cv7d3CaIgM/p9FvxePi+AwDcMfp/ro+/TngWlF7eXLAi9fHw7FL0p BqGX7+dA0Zf20KHRo0OKw6A3efR5XcE7YNDDiYJLIIM7L9+XoM8XZlYIcee1Azn0eYFasy4igvAV 5A5Afk0quBiZsxght2iGKOmEYTse5oEUdLa5FMpu/y9BnNzZ+gx0yVvrZzma5LgA67x2DyGAivts YylTfvcEJI5cNEvIhQ3tyBML+kQ+fEh+ESEBPanifvlFQkImVRRmFrklYYjCsapoUZIwBHEFcwlD 7CGSj72EIRlZJLubeU5LBPa8MGLuII14q/4ZZBE/pKdgI3sG7+zuC3LQ2TRd+Z3F0Vg1RdfnOr4v yeR1h/R0UoOfpG5eXjqcsPEF4d+hjsE7ABOoYEpAjv4OtzkCbX5AO6+62n9m3UyhSvDp42hl2QsE 7yyvrEed5dUnTnvzyapsiqT/ooRshSs9y630m/uu9JtbVrosTRst9OzLLzRPxmddZ5nf37nMK8tP IkyHbjW/nzw1XPFYLCH7rMNxQRH3VCp2ltfQW3N9o2hfFghlc/Jx2m2K1qm4i1fBeESbQarwti0H m+q+1dydLFYVZu2UKubn7nS84dydtlC+0/5Eq1O43zpAVlZW3X5zUbveJbJ16ybUaNvPOkobwnvv Lbj+FLbgY8+L99Zh5fblQ9KdlrJlVJPdnCUZUaWCsryofkKp378v/zQLVrgrVzailVXPpOoFcxcw OHfYnCRPfu6xcpT4vTfnY6SPTzz6eNfRFe3Re+e/fegelU9vT5T7Wfbmn2O9Cvfm6nq0stYJ9qbC BTxgb2qAz+ccqsYk3XtnPgGyCcQz2Jl3GltuZz4gK3LxxrRBJJl9mcubrJry8uzJ5ra8yXaLl2RP djubdCqYzUbcocg4FkA9RNb4aAhPAu2J8nHdgvE3FPXo85ybP8leKjw1a6vRyvpqhq/14DTKtxd5 YmjB586tih1D0C9ke//oVaRhRKLiyUf5VD45m7yyAwsegIjW272EN/XqknpB0DzTM/mqYf71L+ES 7aOGxiLA+XkMh+hpJ8P+3mGoxSK6n2YxK7ctnUmguRfdiJ/WHKhAjYwZnDxY9cEuvYCN5uZM0/L5 PTM02oyI8vk9MjT6Kue+Nn+XDI1ON+XnZpQK5mdoNHNzM6q9PczQmM8VPSc3oy+gnkioINrniNGb JLWUDRlvw8Rp7zAhCEbMG00pJVXAMKcqyoTNyfIJ5EuKcPgU3fn2v0YJ5lCZZ2b3tlWpkd2DptAA gCJdkrrT+jKX501k6lW0/FcbohugYnax2XjD7C47DG1RBXuv7RJT5K1XivyJClSathynN0OPZ6tP TDRjhfFcnmJdbL4B2FsMMynYVLsMU0iHh/xNuHZXsyoopvDJjFIyZesK40YpHdO0T3ksObmkakMp 2heN9WTDwIjc4Q1syDNNUiyTsYUzoHZk9I1RfawbIHnhEKUGin7BqXpsyuBBMplKblDKeOR9T2tF iwOnrerSpRWojsNtGHMeLPuJZp+yqlzVuIrhhtz0Y7EUkUC/xen/yNtHTTzh3r2Pl1vzbl5u5iv0 UVPnNA0yWsg4djQKtK7iNiYdsePOqlrF8qJ6BY6WRXvxjMnV4Jy9YYi4tn0TgdlWJypyXpUpR5cb KfZgH7ySo2vXnve6T3o5BekFKd9ocbC3qd03aNDiHI3GeeSFm2Yfc87OxjDmqvrZVU2CiErcGh0d Qo6VhvvXmB2PuuP2Ha6glDz47sWmLR4PGDbkYjSdJkMLXVBMhskKR37fQr+FhNq0RsBSXl8nPUxL SOHTfDZhfzcU/0Q+S+EgITzIESUeQu/OqvCJ/ra9j5ujt7PK3Byb93dzLK41cHPM7InCM06Lzi52 yhJGTGSmPoCAvcE5HJ83l7tLSXf3Ph6kgXL2wdxdx+Pr8iOYEGaDl9XWdQSxuJChWyH/jf7UGlO1 /8zc6evAiMrIaAEkMYzTGWbVcY4SwWJRXDE++6OhA6sRO6yoHXFzW105GtLTtH9meQkProH7remd qZcNSShGJn+sqNfHjKAXs36K8BdZRmQyOgNO8YZKxpj7bDJtYfgmJRjDt4PkWj86ODyBNsm7s1eD 5e5p2jVZeYQRhfvCU3LyuV4Ivnf5FTHTrWZu8pKyKdBCr+aSBHEFwGot/QN4TczIuUR+T7hVIr8r lDV33CfgkQ9DYde8WwcTDlZxoqp5k9+XFAYKpaD1J9HqhtPuKyiA9IMhDynWDGPcgaFFmxc/toHt pc7mcsshQ47VwM7VoAepIePUnZGIGIrRb3zGjc/u2fgs1/isvHE4zEDvh9PzenVlZRkjO9Glh8Cw zRHSdUb3jjzKRh+fnw9m6WU9nfZUvHvUknBbDBfz83xhcYxF0eBHDqbz4mZwbw5HWFd/2Ii88Bm/ luhrKKqEG35sZAJvjQTeusgFlLUzeXTwW/ixEXFbQcBBMLXI7tgkvM7bNgghAFEivnKhE3Z7jjmM GgFysdmqgRmc/jpUJ4XsDrfzv768jFnrrinSawgnZXQxhC73aAG00fy85+IhvE2N/SGkBmBVMTR4 HFVfbe/tO5QGiTb/bcupyHgQv7lB2B5HVe5KyTi8gXTM8c1wGn9kyhgMoHgE2ZAOO6HYGejHUEfw W8TeEdVovfHFWuYgPHaoSNJuPKZ7hhzOGEDF9gtD5X+LTO1/al+uN/zTb6b5zKzLY97p/RREw25S X/ytoaExvzWbNuCwzrlsAqqqbU+ShF9rw5r35hqFiS4ODc5k/beGaRqND3JVZpe/FQx7rbNMDm7k FnIN1F7H3Zoz7lLCFtSk548jhIqBYQqgYeyqquBAyKC/aUWWAK4jAYQrT5N1H14x8Qtm6nefQPSk 805gmK1oONEavYPZMrcsQHbfrXJOezzrhp2JzvuTdNr+vSfxz0wWTkZAFFb/kGO4eqdj6C5DPwWl 7f6Cl6bsN6/bwUlQxQHpDTaNQ/RgqwDLmlXaysXDYZXo042os+7gqe0GZWF3D/WI6BuEmFMejw6c Q8gnkjwBf0HZtnHs27+HbfL6/uYefX+T7fu/ieuCvv9EMeYkPS8gqt1MgpJA3h2k8GSblEXspgoS 8YKEfGf4td0Mw7YFXL95s7ML77KsG4jQk3HcA9m6TiHnpaxcMR/ni3j+CxbzwiyuNNeYrzV1qiXT 71kNuR/BhNB97yV+LDWDEWKssfqZPYxT9H1Op6iQQdgIT3j48mxlswjmVgEqd1glzrhyIEeTYyxq Odh+NNXc7qRRLkieA4IYVGQWxf1T9fN7r0UNSE6envKVM+4aTocCE/OBJWbDuSaxKJF5hnrl8pht hWTQAg9YFkkdoCyFo40Nw9WjngxVg5zjGCS8G1EteyoGa5CAqysVxTKeQ9bFQusu4qxAHUSxdNjp IWpnSSvEruN7lFsb1QKYJAPFVxD8TYt06067o6j6IcfC+jZlW5qs3uCiC4W4RcoSYJFINOB5nQyv tG+X8fTjonJHP3DfRBPED5LmLUUlFet1VKXRT606zNpo0LHe/9S6A6PB5Kg7nuIvQOYGPV9Jm0XB fmYymSIVOL1sQ2c3ho0GHcKmHY3ZqZ796RnjktExHKC84mBiFfDFFeurxFJFaJR42XHMSJcFnXST y1d+2N0/RGACYlngDzJJ+C+5+ePvx7snUvTg8PA1Pvo/b/aoCHxKv/949PIX/Hf359cHUhQzpqtO aojr1bcYxBwtkdKG03TLrPkfTbRTP+4efVc5PNj9ufJi97s33wdb+Cc90v2Upidy+V4b4nopajhV 5vyAaZih9ullRNE0jIyjiiwM0PQQ9im1dJdsi7Ox6qUsTCQ2k/Q8c9dSRv7Fnc3LSTE8hHSaMb/7 thVf34xrqR/KnLDaWZBIxB0dZONUmXOmayPChK5IZ+4rfpPu3/I3DZLAXoxQ9Y3J1Wd4W6CLywSx dRRFJIeC8RCxnafK6SxZi2c+jCa9LP6KcoXKQHxRcT/nwE5PQnyXgs9NfTjS09V4iNrA3zocbs5c inKeeMmxFZuU+dKUnCc2aFUoEgfPp24Ite64apDZCsQiLF619qNAmEGIrxRBhjFOCfabEo9gqrJD bIZDbBr11nfn4oSUwROFXCV7OtMoDVSS07kpX1RYojo6fLVpvqGSFGelgbLPXcV9xq0200k/IecU u0J8retw1LapX9piKeeXV+up3jUYijF09lGSU/VbCfgQKy0Kim19tc2fJynt4Zh5jRj1Fp5vL4Ws Tenw2CqHCMw7HYDkzTYJXmxyvpkyArEufDuY1VycplpHHcIx8036ld6tfup4azZlptJHVUZXCv2U eiQG6MA3ASb/4iJBzfxQuZdrBVCuiN0Yab/Ms8Ag4NSQDVc3DweIIl+q3zHisC7rpMeOzUpYWXlA sWjMEdCR8Xs7HpF9gRyiUxyTP2rG0keKYz8ZUOLlKXOPOBWEdOWVViZKXDsIrr/CnihsO8Ad00sQ Hle07x6Zvo+GsBIAeSnRrLnrky8prsSRT/sFjp6JAN8a6tll+/PF1AzNnHQtj0Ka6n+6yewIUtR4 cpE2HqI1aMqUNYMpY782vGOsVd7Lz0CxyptV+83bkZwLXKUWpkRHAAuMN1IITFqF0fm7yH5DOzq4 vXLT3sxM++/Xsz58jkGQxWkm0tqAjVOu0SiZasGzmqu4za7FtkkvMemNFG2Z/2m32/8D/173Ly6n YsrCibdfjHrABfQn3dk10kVEk1NAc4QhJ/SWnuFkBm4lKB2G5CUksSjmdoEU/YRB57j6GMTrrV2M jNnOfVfvQdroh68Z0dpfq1+lv1ar9qN7L5w7I+b4qj82I6RjcgJo5Ei8ScOWWr7rftrwIrL1wTku oC0zlgvTvK2qRRjpqf2CkwlU30UGVedM5qfxaII8AjWbgQcs1r6bIvV7M08jtgdE5zmC0jbhJWZB iyp+Xm37dEWBX6yzSIqgdtfMr/ezW+Z3afwfrrS3VoL1lWIrwULh5uGn5Kuguefy8jwXUrTOz2Ie KLANejwgUC1FM4EfPfcfpGCReMqpVoGJmuxFdsohldfQVP9KqNFLrBWqMpiIlXLwFd+HeL65c7W/ 1hplW7tPHl7OAyy1p4r8Sf9aZRZIv/A8NWrf1NDib2rPa9CHPqZgUPghJEmR/eZ81J1JVL0Sq/qJ HydGzhC2OCoDJBVQmqDrMjr3IHouNn4j1FZcMPQbbF8VQliqBnSaPfcwshiGhCIejqrdsN9gF2o4 XTWNU+N/savivl6j+avZT5hWb2FfPvi0mGENMNtRjJvL+CzM1EzgSI2umX4LcGRMx5KrAxLMS1lz UyY+g8x9pw5zpIr9RXdWRAsi3i5HSkydtkBuv/uIoY50wtbwwEGbTQYx160SllXIBsUCoy3gfc0w 588UFByriqCEdx7rXMSePSzyrNNUfPRbmmVmMcYNV9iqa/T5bY0C8YJDwi/gBtdR42sfhdYvLCQP H3iHqSK6WUcZ5YOmAxFmnGApV7osD6KPd6Rx5UROCtyRzpYQ2gyR5IcCml0hPhHoJE9ARHMdKe69 Lc1v38pjTMYOA/DwYXOkaweVYoUAP6he9+VD+8nd5EQNLWGR786Cov3kGMH14ZOO/Rh1o5MZDHrZ WTeyAMGMyJ8djySlpHyUNhNlwWQcaZgXIhwPSZ+MXs9CRdnt0wv5om/Ye53IOY2uisrTaqZfYXJV bflWE7iXrpoZl9+pWQImx2oz/Rv1G5aen1clJZOVlUZDqypAdBWkVqyF9kMz1Z1vilw9COSk0hBN eiZ4jrQwNI8ExDwhizlpakAqm9yw57fV+5A6+uRwE3PRSxVFmp8ykfr+Jv9/r72/WGgtkvNpZJ6c r1/cSWT5U7gTPEhAn47+7eL5F/d3KJDKcNjzZbK7uUYUyDz7owus34HeAK2VGzaEbpPQFbVPYPTr dX86Fcrnpi2nP+fNSqfY95to+ubuwFOjYGd8SBRizwjAILKj8PdohjFKDBdlPxB+XhF5+PRE+bW3 H1gDQ27x/xhvkSKf2dWNjWhtdd2D1/70KON4ST20oarP4Vb8+mujF02zCU/0ZcFuhRuHcO5wSzn6 fJdNG4wdeRUcaquotnk+YwvzhEL+aTjxsi4T1QaSZLlDRkb3Xtq7EWZlOPEx//Xb/yyvueGk9Rz7 fauuwBb8D/cPlHG4g4IPhh/R24D2lPpMCh81nBQ6EprDvzHv9NsDeKViPoIYujI+YjqWbqClAvo8 +uB09nAYFeFgeauYERR+gx+VbNkSvoPo6u/gOLTxuuT4cpZ0ZgI05dcdNE/ikUXpZXDh2T7iA7/P Pek6tNX1NbNLCgQ2dyJeNN38v1bbv1YpWyrbDNHFZoqhZLd4afMYz6V+HGdURY4XvbRyHqajSX06 tpvNwM8LBQtCL0DkHdPetK69QRO0MtwElkPipI0E5b47fPGLJxZikEf9a9hB+iBTq425Ijnjq7T+ VdrAqYBNr34MBp/9Ovx12u/B4y3phJzMMITQc1CT9/nExZGe4kjGaT3ZHKVR3zV4qxCSmhIunyQO NgIsaPey3p3Mht1LRHlhV7EIxwgbz+41PH+msym/BRfXzWgmGWjSGCPgRr2zm8SSM3S9XF9eiTqP n3oQ75nrMx83FUaPU/ovSZJrfTfYh8hiUMrnvgMS8BphBK+4n1HA9WaV8xAHHkpaJ3EnHxKfH3We FOrLcvTDK0ldO0vVlAt9qa2tdGqqTMIv0a1HdXixhoeL8Rc9Rghss9cfSTockMDrax8/Qn+R4T6H 9RqQmpC461f97mSUjs61GjyZ+IUXMIiucpObRtu8nk2nmnaWJWIJkmUYdews1QLHmFoR0M46LGrg qiZsJHLfLhYbmRuLNoyTXecAbvFckHxfOHun5APwzEC1jukttrVQzRbps1irDGeq1wAOhzzMRkPx JcSs2/Q1rqkzxFSy2mevS9bso5v5qx7u5QkpcXC3UPoVwYqj4FqOvE+hTDeBvSwxcgaknL64rNiG s+3I80L/jCBHYUcefnpUIB/A2QjOBR8J9KRKaSuxMt0WPxvE3avL0SDhnY5Rcf0kfRQIB9fx5Cp9 u4yqqdqvy7WtW9eaDIuZxX7YsCjtONJmzaOHrmCalpnk+AVJ982Cyeujw5PdnZO9g+8O3xy8sLXY XMoW/zNx6cLPEmxfjP5ySNlBussVxNYppD8kH1vaAnCPJx8oq/Wgf8VIFxPEQsGKscIBmRa4Bry1 RJUySM6VWFyPgfuW7A7xML7gti841PkaLsv3uhJ8j46Ig0s5mXkqDZhk2m2323bODjBsnFryiG5C If9rQIn9/MiGZQrO98VfcxgsZ0uHN+iYbIBSUGIFCyksmPF9tBbDmrQNrJIYZSk39DlsoWFvIEMb XQKVJCMu0UHah+idQ/2bsjGEUoXDtHfFl6PCnnIX7Bkpm1L8fDnZOuenFrKNvrRnktVd6SeQD9Jx IYG0ak43TR7F4n2LWciIppzqSqp9Kwo3cihJjgl5GpPbl5Ci6YjMX2SnxR9aTtxS6iHhtrYHBGou VCpvG4uMs4gW3rMwMexsP+xZeF1csbPRx9CWffcjmfEPoyPKV7NZWgzPnPWSzVKluABOztMzal52 +4kXpCDXt3oMYdELcpdFtIpQVUSnvEsackwMl1cQ/GeI37/TgLtQtJLlqrztXk8c5nVnihUQ64UN SlfD6NyWdz3OzO+XUQD87zSi/25twf/Oafk9qoUCj/1iTzwyotgABKSWxCI6P1Jb3h0JdUDHOI+h qTIrYLWt7bAFtn1hxWz/CjTY5GPijE1lf3CiM8EKMr1qOAVW4RQpO+f18TIfi6rAmXOLv/B1pRGH Pfhmx3kdWzBeVZluecwy5aWw89s2O4MRB0M4SYmZ4oPDk/3Dne39092jo4NDp26cq7YdUMoH5Kzz ty/evM8cck6Bc0nJ/s5QzZwdVrztyfmB5C0Ul0n6IrwgEqJ8n4R6NplEA6+dOtk94figGerwby5b JPnqk8TNZZyZnORrLH4wOnpxcLxprfbGeDP+0rfXKlPUQk999tieoL8WVAQ1iDgiJ3b/l72D7zPT nwscuEX6QvaGmENbZDiyLfaG6WbRghSZTF3zEoaQmQLo/fF4NDq/3yTEUyRE2K0UP4a9wwzXHzER 3iyY635KPCNMx9KdZiQwKw9c5uP5k/QdD/w+c9SbJZIpaMpyALR46+xgxfeeIeaOkb7pz8LdCVOs qMIxEIoepdkq44gfsn8ORj9AL+4yMxrzBB3qDmYq/Fkcqj9i67CUGvMPn+0IHbOYt2npC5H2UCXj efvgWzRykig5YDFXFW197jtJlCuYvzm+Pr3qDwanUFXD+SthFaG+JyiZaaxQ5aJSgkHbsdozZdNe JvH7G961IEuHCxPqWh6+MGypxJ9xmvFfrPLZV7pIeozEoGmbL18vcW4pOvSmrNfBgn5yh9D7sfBu cwsQXm/43El4+Rvv+9Go5zgh54GWseM4Xkm9YR5i0XmI94ua2lmytP4v554p2zmkPGeHmAiVt6Js od2sn6mPDNsrIvZn4GCX6SU7JIrHkB8iA4PBNOUEd5mKTondQlGC5egp2KFM4dAfRzA82YczpaBe 4j61ecJTp6K3xKHczdiVfbziB6qgmo0iSAvVbDiHb9N3C8b32i61fyHOlItPvJcxrEDB4ks0mc8e YD7L+9KxU6puAaB/CHpI8aIUcJZl05yfqtM2IHjCTBNhUeoeA7x+l7N3he7xVskY5I2VJERSiS99 DNHXdWB+myUz2lBcL2viyE8CE/eFfntTSbWFUt05qc80tAll+vgKvW8Q4u082ylMihK6wGWtjMSO WhOoESuksztat84vZnu0rjZTGHI8EaA+MWugAg24O+do84WNlN42Op6qIUeYmFhuyUCrkvre0UVb Lpz+UiNouY/hFzaIFij2Xs8UecOjWtaLnAyRloDajwRlPYdJ6Xw2LzVI2qqW5tphg5dyL+atr6bO nGbDFNphs1bXywSEVfZTzxlgS4MKJAqYkwzhvkJoac07zcGKWjqJJ4M+vCTw9GT4vj8ZDRlsHi8m 1JDDuk0vW/1hy34T9+CkTvskQ8fD9AN8jk6oiIQA8vpr2KiiF2+NXEMcPXED1wzIHHDzvO0q1CuU RYHoRvzx3xW41OPBPVX/PDjsveQcE7Cd+s+djBoshKkir2qCkspekKt5+WckFin3VNSkfVlY+5xd McfaLrWgGzKCH3jHzOqvbrWqN3XerNFsga1mDVW6Z4eKHTBUWm9A73jVbFZNMW3DwUL/ZsLBQE4e 89KhSdYFOP2kodAa8cp3BKaG1KiQRBW8TtmOygkvrjZz+AI3gQIqcJKkU2tg873QMXysO50RbsrF SJCsfS4r01DgfVBoR4gsX4IGpg8JhaWhID/RxICM5uqGxhQZbUSz4Ydk0EWdDaeDVxM+XojI17lv JB8gSaDkD4RniM8yY9DE1srPF4DijIapUKFNl7EkMuxC4RssArpZ4PEYxqPZzZXhSsw/UTT7fhKf sUZKuqxeENqG1pA1vHvGZ0JbYt0WKS8lN3CwP3LVeWlhvNFb01Gh34i1QVEsaD14RvpFQpJ50Z/s Ik5rxpZ8mw5aLfulSmgpUORgUMmqGQf9a4JNn7jwCYfUS9jc9tMiimFb+xTY1wIJmDcvB6z/Dt8H 3OCMMkApSeS9RMuRmpIZrZTSYFg3hHLZ1CN7JT4LlUqg7n1T3j4ZP99+lb5bKvWCsM/yonDBGxGc H2DNLPSbIOyX6aWeRAJyohNEm5ZyntM14mxglMx5mXYGejRFHoCX5jgm0mw/ISCnrMnsS3tXFbkq r60+jdbWnniuyn6FK+aE8ml3L2nPhCbOElmr2Mg59evxYqlKg7EK+H4e+Kqq6jzb1bI5ZmxqAYO+ W0czUmFFEuNsshvak+XVqPOks+q5of2xU/OZotqKTL/lM9n5vDNZuOXWl6O1jafBllsi3Ow2XBok KU0QKwR/16PxyYpaDxRsCmxIudQDfFmqBg9edZaX2XZEP2UyE0RyubEjqicahXqRos55hpy8RzHO hcRkYR6bwY2Nn792+lP9KD/uwIKKGiLho1ybpYZYf3IIcYzgwkhCG47sXT8/WcNtNl0odoqtnqIG P7dbu5fXo559Gi0/Xl7W730FI5kSFUTndqznwlNXvvol66zuqU8660AXNjoBXbj7/vVkRIzfmQry zxKZWvqTlIQ4CgUyvZH6Y3ph5LgXZuOMj4ZN3ZJmFQd3Oi1EUbaM2yLT8Yo7PEUGWCUc9z5Expfm rJul8B16ouwdkL/882/04BW+81gvz2WBvyinqQQ2kTnQ+tD+LvRlxYdTUaXUNuwCcktqsYh2ORqA 4JG2LaMcnnt6VHakeXFKPKk8XqEBvCi5uAk7wpoVJ8fMyP0UWHgCJEQOnq3V5TJGOQn5PI4fX5je FEXMQUcCwYUGQHCdDj5UlKSeimow8LDIOPAw7m2xZq/XC0RMHOVoorlg1Hmqiu2QzZLD32xxgivE jF1j1D3iCDLTP4de/nnoYuEt/3g1Wnv8xEv+/WQDCefj9TDLXN7Og5AUBEz5FlXR5zfvaKIRotK8 TT6O4Zd3Fs5Obkr9VIKYYRETijVWwYNtLHZqOOwRoSgGHsjY4JoMl1ADlm3RT+IurrVEgqx6ixkG e1+lLBuZFziIEpywwjl8shGtPe34c/gEmdKnK3eZQwL5VPi5lhmdiaoEveGTwZixSt9ezuD9O/3O Q8ArGxxW643B7r/OWmsnAzKYK3AXyNK50srT9QhBIL0JQZzup8ulE2II+tRHK/WRKDNDw7JFQ1tZ 1sC0svNU1FmMY1lffux19unyGnS2s1zaWSKACe5rH4h7To8dAmSmx50C/6oHjOBptLG8EmbAfFQa aoer53VmDo9KF4SiKVm9qfNzJHPSQiaMbT73GmqP9Jq6U3yc8g0PMVLNkVY/BYyvT6ePkpTy7cXT 5HYqfZ9gRzxfRfSl9ZnyEWDnd+DtNZqo92rXwFUAIQ1dRRVkuvrtt1W9i1XFn6+NzC9juAUlJuo6 SShcoZ3xGijBrrYessKi+sjUv2VEj989u4htXHTYgCD9mEzOEM8bxJfPvKSIpVzS6CGCySKXOZ3E wzS+/Yzfu3HCcC5p/UVyNrsgA0Lr4PBk4YEN3y+XT0G9ZOBxx4/lRTcq+A/PWb9bwRNfQeHLkYJH olPjV8A3U43Qncp5j36kA/Rxdv4W2KF3dE23jG6yj4hc/PE6/pn+SA9Rdmf9yY/IO1xZYFSKOxGd CgE1XF+lREvwasIvLYVBJSKDZWnEWJxS2Az9O0HXJ5bu8DCf9/BIcFXYowYjRNNksRxQd6SOTgmL 2Nj55Q2VrrEmKI1K+x7NzHkvqn6oZkllWa3wGMd6et6DD12NVkDIHlrsJx3bYnJzPzd2/ELuBKyX H+TIMZEAWTirXrDlZUzwj9s9C5LcyZOw+sMItx085A3TH27Zn+GF6AeedlaildWNW9nco124LjEx gSZIpvvAWlaQexUphdIRA+N5C2Pmrl+OeQpu3ek4Muzq44mpexJ2Q750Elrl4BqvnbiKe/J+eoRm kR7B2XTKRfBmoQjezIjgWr2K4E2Pzs/lO6ybE46dGJBLitgkhbyMve/5tRECdxaWMgNaFmBTyiWY 4W1EiM/70+1ZyJbb+yEFb+mIB5GFzyw0221d8V0XppQvVJ1RKD8HkIXIEI/F2SVfQlv2E1FIUWHO ZKpaqDtwdEg7ZkOiHpx+hO0d8xg7YeoCb6O7BaU4du82vTlvttxjj6plZjTD9TULBPQCxk/jVc3J 0fbO306JKsgBLqODXi1Sg4bG3+/OD+kRM4/s1Ag9nox6s66kNCeHxknKhm6XETv0WTSIa8eEKsrg qhPr1vKc4Jy02btd2izkaP8wdnZeMhR/p1CZHBNctEV+HzfcvLVXzYJe3YOHvsOAwwQwt/HZ1lWB O+OiZ2XknnMVb0LzVXtlfR39hbT7Bd6gYfQAOQn5FYWq5YZn7q1wMJTrBg8m34tvRGHwvMQfNSyU 601pF8pOZNNGVfGptL/h4cS0LPc9nH4FDzmj/vd6VN2zJf+3/MGlDgs3EvzhQ2zwEOfe3P9AN7Nn qFV+oB92dJrzDnQzOND5znyxA928y4G+c9X5A+0fF/ZhE8cejJUunvjjvf/eNV9JBJXRDzJ1+dQO NYm35yO5K+XADffvpxzUi9soR1jo7pSjGVIO7/z5aXlQTcFwq+jQLogkB4etw9cWmWJwM0en+DnU HE2OAstKc9S124d7K89iUCvye8b4ObUqJWOlLn6OsZIS5vcM9nNpcUoGyv17+EhlmGgz5eSF1riD dhhfFWTHePeEUBkmFxsJUj/5bWkhGNqFx5g2swO+NZ8Ujn98Z5WVi5CxygfMOAd/LUpaJE0EREHa aZBTLwP0Kdc8OpsyajtDf0JFh3+TvIoEqo4mTzKGkaJB2AbYMCM0aU4uZuh8runsJOkDV4M/ttDj mKCvZhNiOxQ6XuoBsjYJq4ktuDyl2RGHV76K2OhqUd6DxIkqG7NM2WR9BOvzKD4xCxXNNQpg9M75 hVkk1Gh+LIIx1EAEnEUJRV2HB7Nh2r9AYywVZ5d6Ufw1WSuI/nTYmn0AheDC1X2GNxUjyMAkT8ne S96qaAjcG5IX6z4+4/5hz6pnk9FVMqSYVjigtNVEGSX+vH7dAqN6im64p4y88/XXpgRTHV7pgV3I QgfIDSaOAnUXBcuH/JPXJoOonvoTfVs3/aEK3jmNla25LYl+dpoqOPuvkK8lFWmcj01XLRR7O0+Q qCltqc6GBLVVJcbQMYThyDBEvuGnM6NbXKqD/2x1skOwLlUWeNXV/Whzv75POnIHgqWfWkwhXPLT 6WgkLJeA7j9jHRTXJZj74XvukqVkpNzgd1lmThacIzgt/hZ/L98QiHqjcJYkBDg7LPzXYu25/Bum ikdBqQ5GP25nHvGp59bl8xR9HNkn/wPm2xtyakkm85TAEzb2ed/L/ygfvsQQv4hJnbeNqw6HYzJL zFu8xM5uXE7QAKdPTKA+wl98gQRHU0oAOd6kSyzlAKT0nTk8ku89SkRNwk1JlFbmWea4Yd5Kxgom 0659+bagQX5jmwzHfUz0OMo1HxyUbcR2f/WzZFULK7CaPMpXq3XYMHYaAodqJKnLnMdg0ZyDZCxZ STmQghG+MY51IpWhIhDa55x3XdJUy8fX8aQ7S9vAQ82u29N+2oabloGYpKH+1NUdlIrcrA+pYXls H8Av2dy4ko8FDSwxJomLEQTyg3HZRi/6XcmUWyO3DtjJFlyRwdgwoqNN0lAlzJqrVB9O48vt/eNd OiLsoVemkkW6vOjewSM9dF5lWUQXuCb4XBLNDraWR0apC42GnnYsDBdDevrbLJnY/BI7p3sH0cnp dlSfnUq/vuYLLYILrUFCnN9aWQWvfp5TQ2PL495gq+3VKCP1jADmiBiMhhTyJ7tIfS+UjulUCEmU SPZmUCXtdXRqu0EsT6qbKuU96A6GrVii8iURioym1q4JYQN6LMviVkja518Yap3at7kMaQtxpC3l 74zNyf4LfySuyoV8w9nheanY9ZjCIIwZmpGZGoLAu0j8Mw/MH0ENTn1W0AVtOfqiya/ZNzSdDSTT rKTbJe4MS0wpUEoR1hY1VRcBiwZnCEQDly2ZLzl0BpRlc9f3HsYfx4RLIcSVz9qHpMauc0lfYqKI BZXY9yLWuhCOHVgyYnbGs8l4NBGfeaT7GsyJsSRSNao5PClkLnyK4i1kfQoz7I1gp4S8UZ79kTes uluscPpr2B0HFuLuJZAMQpUtiB5CE8vVIy/nuMflhvFPytZaRhYfdM+pdy/2jmBX9y2DarrDqR9A J5ocbHY4FZZJuACGjIIy8BI+QXsP/FTnKHb4qWFTg1MB5ZDkayaMhAqCUWev1dDNFmyNn8MvedU5 1wEKE9gIVi90EqqEPsspJIYaOkpofNzpTItuKewA/HWAZUBoTUrSOrG4DXjb8e9tuiLtr7CnLlAG kaBkrqGH3qHp7EyKdLlCkmJYlHk16hE4ISfnggNWXaxSOmvgTHGXohkN3Qb5khqKrZf1RTEFgluJ iHIcsmMpXtCk7pWrl7pGZxSBP+nztG2vqqxg1L28QsaWKbcMUOUgSgMle8fSoFcMXInAGaNhC0fg JSZLPsIPgxsvc7pcf1o1Lt6r7ZOdH3Yc4xu+1VZ9tpNusq18cd5cQek6rq6UbTaloP6qPzqG1c/t tVizftfZXj+zvaaa5LHLtuGyu08o7yyjewp5tWm8x4glNRkyGtyNt1X4vXK/vOHcFJJNfWvLnzBZ NbteOGfhpNEmp2PGTXCPvKtoMTeB7uKp2MExg589ScHJWTSWgvEgU5en0wPHttCcBMlUsBN9adDu v8jK5vwIv/XpWWVRCBoK2R/dcpB6gRisoCPDEbWuyyySXQmRcpV9n2g+YD+fNd+XXnXdc8THO784 vUimdXwh+HiZPbKdUr5jPNJTmxVd4GWImTNJDGuVAF0kSI4h/24T1/iEEZpElpJmydk5oMtKzrJV aQocdThX8iY7A8NAPtJFYD6ab2Awrefx5KILvzWbVhwkWZXJBr9///bju8jbgwVnUdOD0wlhcAHW 4dGwtPn8DOLQ2HkoPLcHI39UeJxoVLTNCSrlGDNNacV6CVtCktnBpDw7nw1Z9MMrLc24NkSiD7PJ q0lOQ02knl1CWiCehoEWXKJzik73kxAaRtwGfrfm0KlYKnUkXhR2FB1A28KTu3A7E81n/BeKS2CW KKlSDAkjZ2CX4FB7MMyWoYh71yDtwZrFwFUQ/i9cX3SdYdA/XE4JJ7Uk2QdjG4CfuryBEnDzpFkk mpoPRKMANAiXRx7yceRCTBCfBgfkLil6VfvtlBzD8JDXaO7Q54zTD6WIr4BNEvN4lYyndo4miTc0 8YFWFyWC5ZYF6hOMip3/CK9KWk6pqX+dhG4plEmd+GuG9nbZqaCnCA7APfWTBKDp1HWXzrRXAwao tbnU4VBDbKLAeVuID/LH6LxH4dDktqIaUUlRy7XMhn2QwwY3LexuT7Yo9maQgCDEu5dGkk18LibA GuWht9eNnRFTU78Vgo+gtolAYL9RKp8JCIJ2+5Foe7XvRHSpNek3dyusFnkWmR0+DEPR9rLLHu3H M84r0CVLhqbntSsU9AGjkVJR+85x4+xTANxofG93TrlfruP0KkfNPehWRXQSyqb0RM4tWoq6GoPC uiYUd0iCQgZkgqIbHb5EcIFGkz6cEjhKMsxr3gQXI6uPGDFsNRUO2jQtk7Qv2hHquTR1RUxRE94V YlEhnnmoEEqnD8cCCUJAUnb/EHfOQbt0ti3pFi8ptbii3ygileD/MGEvVgKMucbC6+9y9ZpvTbVq Nk11SYP8qYBDXvAs57kOuq0N7PV5QhKLYGpZsemO3bRCjPbTPijtKJfweiruyn+ggy9aiXBvwt05 w3/rewe4s0/fvNo+BpETu3IdX6FEOSWDLBNX+yl79Dlgs1iIi0cOLSwIdhQVYJFEtxG7FMv3b4b9 j/xRL0m7k/4YrxY+ubGHVsWeijmHZHW6ZNETRvMcpc4KrbUiRsHNZujdWdy9sj6P6qBHY8e/bF1L VrVJ3eJZxdQmvch2nimWT2nb1m/aoN/0fD9paQZZxJhwH0bcFlC3HocM8mdqkvydLtSWAdrHjBQO L2tGXEeVcKFSRTqTfVfVtgPn64C7RRUOnh08R9bwl1qEMuev6Y3iP8Rt247ziBecud7MOum4ih28 6YTk2MQqe3wnadVigGTgbjB190uBJ+MahJJHXBpmBznXAOKxSY+UdWQsxwYyP2RRFTg41LlTaUWB gSvyDBVxO0dL+y85vzjviO5kcA7MdFpvqFZP+y/VkGadbTXEQSvOWrvqoO38005gYbuHLw1MPVKv /pQrShPM7IG8PHIKCJfnJ48VVsfOHbnq5nhsrglWe4RmkT5nF1YrCTJxGEba5lLbQC9nZxT8PnVw mzIItM+isEmdBVoUY0JznA8uL0kjZU2Avs+6Dj04xNbT6GmdRX8WCKnF58rt8LKFuCINWD6fTeiy hs0gSi+YtB8F/oXvcfoqVRrFCZQQ7ib1alLAmPgasxhTsl6cdlcrplzXQYRblxKq9IGUkwRlFcHA CooE5CBFCcXpfT/mahwyFfNt10wh4qE4ABB0qZesg13BCIdsKIYjrijgfOleJE4kjd9zHhxCOyUc V9ekl3oaz4Jsl5iQGUl9zATdny+pI5wXnhJd/Lb1QNukR5U3Q0rOgwNSuL0PMR1tohUWaoHUdj4n TF9LV2LaT9tws/AUZHCwJI2XsmaM3wlfc8/fgiRhjl7umCcrnXeRVRfyKl1jsh5hLT4QrPyUlE5c wSRpkTvSNQaILzBVu09kSlF058byWrSx7qI7iTuG++Ltd29eHu/99zvLPX+0P/Umo7Gmg8NnrK3o qFc9qhjsmTpDHkwyfcDPDZAoh0Ln8Qb+6C5gJc+d4DVQ0Y68FxWWeDdhJxpF3kSc0sW6KVp/J4Le t+kcmzaL/RnFSz13rorFeKWWaMeTCxaeh4IEBqv/VU92Qgu4UqBIE1z40P2Rq5Sp85Ov6N99miDK qvXM1No1NCThg44+kNHi9CpmIEFfMmLg11xWWiIfgnnFz+x1C+3SNLc66KFyTpu0zlhTkoBUYi/K MAMKgmSlQf+a1+VdbTinL/4LOiDuUdhCQScW5vEV5S2GDVJTDrYQrwD8UaNNXLBJLhDFvSKe0U3G rTyP9o0+yXfNBAwOGVXsptYSK0FsWhjXSPypU7JWiBp45w7GF51TfezlBM/wcywKrzhQbWV143G0 svbYhc7fiwCI8BxmSc0I0d/BGxSO2QkMkVCQQx9PknFMCqob5qNj0WsVASF6cm3YVCEBsmwvQ8iq eOOFMnl84a0Uq9URmiVBUlD7LhFyBPbGKj2fy1KC5iRb4q4ct0LZCKGbDeSxhpmq8sQvsIsztCyl 9uKbVW/6yOXD9vxBCylmUKGlm5ojkDXWNGXEnXm1ZWksycshLA3pDkfvxURPxBJt9hfk3cdwM9Mg izel7KTbsHRoOVyaPy9Rz7mdsrQ6SWoB50os62zY4t9h0rYcbqCFJSF9MGsFcCY+SIJGzXbvluUP v0JKRimdVXmcQwattOnpFzywWjeK8gvpIddPs/gSK76Q8hrAWMZitZSotaMLa87w5PMM26p07LPd elSDn8srN8zsLeiMow6iPI/lqif91gvTVveGBLuHKC2KLltbLcpnAmFip5f8x8zbb799F+Um2Kow vtRN7fcMk/1Cy0TiYp5GoXJzulV8x2cVGWJFyKgusve/6i4Iq1QUBC1PbcDJMAaj8Zgt0eei57Po smh64RZV3hL5qi+0imCSY5f6gd/Cf3iPkSQENwHpPzHIim1KLExCyeGIDAIgtgjCdJBFgoKcG04O FxZAVRDs/kCsC1tc4Cbw0gCRRsubaK5GdBcsvxZU6GyynmNDWKWKjqJPwoPtykaoH0d1PlSLdXry OBur2IHQjqnKIV58oSZqLXC7w/X3BxCuMXslzjzqZ+QLWZYBZbfUvARSDQiSl/E4tSYKSXtDHlsX N0Yx2lFVI/W8Otk2b49nw8Njkk4l+0H7ov3OMyRAn4fVTbqoqWZfGeymWcaIGrDYxmyIobtYX7Is MqvPs96XZS2UYNfXo40NB17reFWuA1lFqYfeJSTn2xTnAqIh1Fcc9c+R+0MvaZ+GtpgI4AfMcbZa 0CmlLag1pZsSBtOlb/ESg5my0eaYIBmf4cUprENYcyjkWrGQbsPar8MaSWTItK89Xgem/eljy7Tf a8xN1KZa1ww8VnhUK958EB1iDbE9rmiMqhEBGFKGYHYD9vTf8B2/fGbr9HTowkpi9l7Ru+wtHaoq jOmJU83Xy5YDORpuZAHmdu/g5Gj+Ct1zfUxdRqCVa/6pTDIkMq7pUlowAR01NCKjzy9y03GIt691 4W6Hpd94uuHh5uaqWUybTejDRydb0n7gVN3QVczuMu1fW5YVmYGAJhhYcSRkaGvvtUbnLasvHCdd ogcpwZMBpViuktnHLJpfJNXwGQp7iGs5xWXVBMQfRpMrs9VqcGF7GYb8Ki3vguxVt25STLhYmhvY E8Gz5Voxd2iqO/Hs4hK93IGUkwM4MG+7rMB+xaP6VnnkPuOgG7QlN0zADHsHqJPVX+g1rv32wWOM xzf1GkLJ2A4tR3l9eS1aWV/zgGLmLSj5b/X/0WqVrG1g8juRewEvX1GVqq8RX8sxhhWQB8T7hLiD mNwlMIW3s+W53SLvFHXyM2yb++yaRW0OnSptDglKak03FgrtmDb8YJ+cEMjFRVS1pD9VvYLYwhBg N9WkNOj5RWDYZ8lg9MHVXqXc2ZqxyfpIV81b6BQnR8F7nvkHUklTBZGRbR0PPsQ3qasv+Ygp2jdN 0qfrkswrBC4ap9rXSOUMNthQIvN4eCVWDXaxRlu15UlsL85N5jQJm+B2NzH78XViOyBtSg2U0YD4 NGhAd8D/loPq5B6KmxneCCvL5oyIrWRnwMqrN0GemjOWy5zjruw4+0xaeUWtLOYcr916I3Db+UAc Ztawbk2KkgjO48FUYqONAjIycFhar8iYYhmYQ3mKLpbHyyvR41ULyO6EjBnOfR3PIF10GnVLjzct SIqn7Fowgij0SP11DBrx4bcAx5Zi2M6V1zMYhHnO3WNzL6I2ucKL5wMPzcl73jCF+cRtCdHdchtj D7whtGtTX2yibd3248DITazIwE9y5/dD1H5Z8/UjZ7wew4nEZqhD54PWc2KhWLbGSuzzqTW+c15r LYBlB1rpEuFxUEp2dku+Ihej9/20f8bOCQRhbK6ShMU/9ThSRxOm72M61qaWMnOAo2YsJOhDZMac nNjxXLs/7x2fFArUpkpd4XAMBfzWn1RTApI1TwJWvUX2Be3Ax1qp/b9lMqVkd4a7y34IK4b5SHjT G85ow5fteida2ejYyzYvSYem1Cl51sSes0zMtmoNaybPRfW6S01szfdX4gvtQNkZKNq6LKNfp3XG oGDn0AXO2T/HMzLiIpkQO+GlQHfLNWHbquk+qZE/gHgwc019ylBK/oq9ZJBMuS0KIx+6mQMi0mdW H8MvnSUVLhe5MuTUNFwUnz9hKdqd6Z6bpv73BRZqIm2pGzV0TDC3eVIpQJFqP7vhSsipkCYP1QjW H9Oc4e/ih4ngNaJHtvUJoI2zT0+SIaZswopYYPYoMa0yuRykBU6hMq9cjfW7kgrwChE/S2mYY66u 1Cy99FCCKHE8/a0/A2m06q+iHYFnHOHjPR7/c9BQbnN3yP6KHIT6wT+W7mBo05+f5gaxIMJbx+SO AkTV225iz8cdD3XIB14oEHJdvkWL010QTZRcF80vQOC9bcyEHp4FhH4rKGxdtnNixZ4jPE4Bnksf wGV3RdYn3vg67nGGwY+IOUGJcUUhieYXMc0pzgR/Twxz0tuiQELJJzeieR86bqfiPPr6ZH77TJdT yWVUjM5hiVs9VjjB1Gb8PNeYP/2Fwh8I39HFqJOeT32iXS4PvnLMBZDDLeClG2x6EMoJ4hgaNesk XAFduUo1MoCiZNn1SxA9dAtZRS33hgwZKGilDY45q3cbXAlRcQmWC4J86I7FJc24Zd/pIi7kPdeA 91xfV97zkbFRWvYULpQRDFlsooFamk85K2vEv9C9mnqY4WwzQUit4veVPBlggYK2hGQ9K2FHPsT9 qf5fUIaJCdnoPAEmZG1NmZDPOloyfGSHUg6AGcJfzpmj8klaMJpfMygyZ/pYFCvAFUoHQMnUXl48 ye7UqW+++pmhRmM2ZFikXpxco28+7MBZqmyE4+rQs35qA0QuE6XhaXzDx5HPhrUU9AfWwyxRvz12 7DvRk/vTweEP2wffM+uBBJkOLWPtxJxTw5pUYjJtc70TcQUH5kOiLZAvjDkDSMHRKthUhQdqYy16 /GQ5I8zBhXI1mPUuLKsyTS5HMEHti9F7OPrTfgvjes4pBnZ0MUoxlohoK4OTVo5f7+7sbe+/OHy1 vXfAj4cIWnr8y/GPUD1swmQyFA10H958rNPCBc8n3guLWBqUgH0/Pptc1XXziSUgRp9ySm93ZDMe KfRHnybxGnjiTcOwP/j3X5PRGIdGkjI9CIdMphnbCIjshKVRnzjzw8TKo/x7PB17Sva/fxyLXLGx vgpH+slaRq548HzDhwg59h499s9u4HgiQFUynFozKOWRV2dKAwxut3+pn/6F0+Oan37YO9n94fDN 8e7p94c/2pAAAZqlNYPfpDCtSoVxC7zHE/tcXxjxC/hCiy07Lex7fhN0PvcmsCO7a1PEAhFgh6Bz pI22q4vGurQYDoOOc05N5ON4uVxeCk8DLVUnVYlwVbQXapfrEIgJFIeUH2dd5PUYeRoE6aqGvajS RU42lzGX5pqqHgpNauP9GOHLeUwvZc4KRcH656VJiFv4ByN7bz8/hdTryUr0pONsHFy8e5nG78eh OxrLGAgRSi44IoqQnUeEl0mjLFzBYw4yAM/lQQzZAAYsnQtV4I6iTxn0SkU2lEXw92jiKZjqE9Wp flPz7FRY7u1HONWiNX2ujjvBC1H64wt8jjHdxoUo4azEDNbOh5Aar/0V9a8LBTMBZbkGqtAa7CgI gJPRwI7InB2U5fR8ea5hHu4g1BpVw4+qhFrDCuBMQamqKmZXTP48Asp4feb3C4Uon4/1blQ2QjM4 yoV4DkC3Wjw8NJrgj4s8LW72cKpgL/KeIWpEc1X96q+bb98tVAsmLN+7jEPrfeqjr8Oh8qXyZCNa eby6FnpmFh+DIARdhAi05tg8ZAURQHRmBLNdyE3on/TgU3W/ICBlW29LJTcXqr04aOhOJ9HpM4bk /kPRNt+02+3nEXnkC2jNN89rqRch9ZlPbpPcUFvPzIo7xRoLRihVDDpESo5ROtUczuN4MvXDtu5z 4hfpyBsKfdSJwAYZZwTtYGh9ovu4BpOCa4fAan1BmhA+InNT/ymJR1Mvd8VP8DEt/Ol0iBbhbSg2 oewfBEIKELqwI4hnQdgIjYIv9E/YOeIWsjPZNL+L6H12wtY0n4e2FV34T0AkfrJi5f8wFAS/pDTX YnkCzky0eShv8hEv9JJvOZ6TKerj1Y1otfPE+brfoZ0CSfUOTdNpeiQwFOYMVurpxlJneWn5qYV2 ctojQdQ7R42myKgpIja8T4Bwp/3r/iCmMEPE+jFmLwwMojqAS0tHwI/FU0kRjNbtm2Ta9nDsFtte u0aPKCoRk0TPgkAkkgHSMrl9BrmhXPMEjUjfe6ovRK1C4sRmA3JgY1xDQsJs4Yfiz8ZSbRGo7Uxt AYy/ZeoOorFB7tfoZMmYtiSwj2aTrojeitZCyUMdyCNbEQSoidX0HvIiao3ZPKJYCVCzdhtHCjNY ZTdCCtkk6BF0BRcmOyYVpIcjiWoyrqi2WMOYtR56jKckdpBOgkDJSFnNZgW/lHmrffORK0ggIADU FloRMDsoL5PXLFpreIg9WnSaiarNh8ngHlfVCCh6N0Zt8ofEEAQr6vG8Foy0QOYgKANnll8TKhrX tKSLgyGo72AuplJYLNNVJHs4abvmo+maxIwRyq7PfrLkocr1KOplMrxp2bne4tr6U+svSIAuCCo6 7PFNUmNsiZEHlcV6VJiWLmwIxCtxvaHPsWpvy+3RMbpiDc+L3YNf0HaEc/hhMkJ9TssH0nLwqbh0 hYhrxQhFAdBNlba/BQuaC+1zZ4Aeh8yjXEirpvA8HtITlsW+0+5dCQB9QrQ7B6ovtaMaKzVfm9e7 R69OcaJciTzeTsXB0heAA8krGw9RNDs5IKD5oD5AvSZngx00mm4KsAGeMDQJKYTbjWxscmnFPUvW 1/HYi8mketwfqFEhFOtt+KUNmzRtv+9/RNjRRluJXvDN7scY42w3Tdw+a3fbPfPsuenBD2ftOFfF I4X1E4Ue3pF2HHWGHj4bxN0rjO1o0P7DAoo0zVeqLbClu7AvygLgyrFHlkN3KIZYQt5yCS3etNEy ttktNkhhUzCbAi9mJQAo21xxlfa3KhX9+e+0bd3vV66drcojhztoa6Xtare9qfefabeAR94yfUKI gH9bLd7YdvebOo3tbd85I6GTUZ+BDOUU2O2MY0fDZt98C3WCyAI7pu/CVqTxrQEct6stM8BzZrv4 9u/N5jsZx9vBO93quffQB32Hw+7rvq/Yje9/JMN0YgD59CEzO3Wz42+FIsRJN40FZ8MRrjOKydhk hje1kp69Cc8UvATpaGrqr7ZfH5uj7/Yjc3j03XFkkmm33bAblyEFg7qBWNBKCnG80G2pNJG7u4PW P3U9ZikWydJrhFb56D1koE8emPcYO3cAF6eltNT0SyBRWx4d9qkKFWhRqm1Eu75o+I1Y7HY2sFSw K6hyW7z0So3pZwsGj5huFaxv73XBC6Kv8oY/X4zHPtpmHg/+wtJcua7cTDkiSHvzLiOrGCM3ilwp Ztl/Ufa9vX+8w0jdlYsHa1wLjl9oUnWVGcbf4ns0knzcqCn1ipDhiAHC8OG/ruPJFXFFrTFthLeb wtS8k6+Ylm+yjpsc/rBjg6FeLH4Uo54z3Ss0ZrnuluXo2m3DzoE6Wk+QtJ9gZD4PT0HluUm/Ckk4 6MPIF9eDA62SYLR8t8mc3oyTkqlEdhLru9+suNPmz4ugX3mxe145ccpl8FEC4GdkrpHN2+ae8uUK zNvY8qX1STKIb9L2KO1PZunofIpX4GZn5XF7Gf63wfPgIVbWRaRE2GTXi6i2WWs47mRxHBBNOZBI cofJlBIT1JtNTQz5yQPStwVtdHLFpzX+pKy+czujPhGQbr2lJee9N09ZDVj5+t6qB6NvnBxZqfj3 xyX0Ag4wNnx2g3POffOAUy8t0qXfB04X5ScQyu8PvoSzBdkRkOZtwc+qEOMiXLaeX9KEn7IPjb2b 6QVcbxcg4jzXMGqhjxZB0i/0LFtIKhNt3xm6xtWBnEZ2kr+WkpHx6gmQKDNdRw9G96u2k58N+613 yikC25tP6gMewO9Ioeow5CwtQYYKC6QMjy5DlgueXsBm8NJdBW+qP7fg+m39FJOBedO4UqKUcE1H xt/CZemiwnbd1/Z9gLuNwhiWSSyE97MwTxYwZ+hFRKFeKDqrkgAB1mSkeka0P0qRbSBuQXovQYDL zf1KMPdLi+p7vLbS0X7ANYzZ6zZhpmyiWpsYaH25qFhQKDOJQee1y1rf7WnK8tMpDefn83PMZcBe dbwj4CP7hpxFEa+Y0QLllKGBCkgUo/x5PSUEUzYSximVaJGSiNnGR3lNj/UvxebyeWU4TsSmUDGK sk3pPVghE+ZSsWAFGgYptQse7k8/HO7vkuH3kUUo9SLsDcv/4TcyAYcH+78Q4pWN/abPBOqzrrov B5WvwbMtg3oE9qIqmAFVJhE7rvmRXM4mUT1XfX2V67sqrR6or3rkY9nO1URlFE1BKiauxQ9OUAVN LKZ3dH5BB+GFd/M0YFyPa/z/HZWSGAxQcTsNMlO5jFW3K5q8rBPZxE9heiarRSEJ5T9APSVzQSP5 z1NOFRFVvYcsUbXSoKFJEI/26ZR89LmeaTy4gr13AWdjIGcQ87PfYBXAJsCF/oeT37vQNIExI308 EANCR/Bqx/6x1MCUZi5tc7P0BxE47vA7Sw8KqFF4mp1U/1ANsa3hz3cOM2rif97lIGVPkTe8+x8l OT1Oslyy2wfvfeuSHKfiFcVf5ZyXXLopdMSnqFE4n5jlgp24pHZGmsYj3L8Uk11nOXuUPGCFwANV oj2BGUlNLZPWqUa+oLqr3MH5jzCIMX36/xaxP8Qi5ib7y/IvjoLpiXowAaMdzlnz/uwU7N/GS/hz dHcymKeEXi7UgALeQvgoPp/gSxF6n5K+cjCgeqlLNAnmGLudAhYwE0PK5zgexF1KISHZGjFHrGZi dATQEttN9mbG9vX4qoutUJWR72nLR4M2uFC6CVF0zcaIQwucciNmivSSQLcZ6NtbGgPeA2cad+Mk N8oMSFi0MDmSIZCY+/Y7Y3Mxylq4XJRVrkeyH3AXWkTo6E6gLwLvecVlQLhk9tUV6uFdEW5245Q8 vehUO+fbRlQc0/NIsjaoLzHznKOhBfnypygtvYFuE1Pj6biav0K4ohwfJ439fzHV0nl/Rv4oSq9S JwmK6KxmMzCRoXR0sXeHBEwhXVM/uT8B4Q/oPozuftSelMY6A/Qk1ObhomXym1N4Jsz/RTxN4JhX C3MI3naR5NsNmmWp8GEN3/eOsmuZv6AyvfwcMzPnzpMokNdHhye7Oyd7B98dvjl48cj5zHmKrxab xagPLGO3lBZYCqhPqoolfj5LXcQl342SfxyZYHsfiswu2bRsdZiAit8w0GNAbO3d5tLOMjG94Vsl IGPtMsZ/GKMpkXd1w6anisXRDo7jZGRx7Vfai1tcD+HZoDceR9fSYJFo4L34HgYZS9hwp73aMilI ZamlD4jFplQC5JkpJdw8pYwZw3hQ55mIeJycQPqR+qTwuy37O5XBX5W4COFQqmKUqvgp3JFdOEWA ocozm8MxT2zcgle5E47gmLrJkBx8VWzTXtVjz068GDGpzVuCkDfeQS/IeOftOpeIedVekWlUZprF 1nwx2donrX2D/8XQIFj9Fnpxo8MS37ucXpC2hOS8k71gPyKozZX2Mt105+ftLdwQMLwbuB7MGcIb wUew9pH9oud5klo+hHmPoUPaVULrb0rfws0bgIBCCousABeOe0Lo8W1/lhYRdoNAgoeojYFNgog9 Y9iWCF8lHKENgaNrD6dCiB7GSA6njHMBNIEvYcKPDOKeY44FxTOF5ZSns5Ugf2Cu+2kL2MfBQAvJ vY884sXIxATEwYm5KKPu9BJO8cVl29byEzd9jUnPSYWH2QcGNN3JRyDtQDK6CeFrUsog5jgGI1KK cQ2JUCfUKMc3WrOuSqkDw/I7psvqvpCTajqNLZzqG8RrZIU19YIPvtGDr+TMtqe3ls3Y5NcJFwZU qahfkjAi+2m5oig43XqMjXcJuWMaZOEOWh+OLFdJmaKpeblZxNF+aTG8WPLJduEXX5z0lPRyDiP/ GTlG+A80n7WKbpqvMZasbXhxWI6VAEikWlE+7YUpRSW9JVCXCXQPPW0IPv2cryaXjtSrsT/lmhyS NN3IBLaAvuYBOZFWQxgDxYvhvCbJFPmQFieuY2cxVZ+gHglt9WIRVO0J+oawBkUwZsajlHAruLUl vRDcvInTFT5cWlS4Mu2ojD4SvK5NzARFLDv/voQYMN+KARgdFOQ7jyFdHCPpR+8RyZqOtAafClb2 v/5l5JdF+qWf9voX/SmUaHjvNv2CS5rXe2yzxUrveVFURol50mnxNTub3x+okR1NntnofGe9MR6D q7uPqmp4J8M7jnO+YhWI/eqTefR/AT0kxCTSsAEA --=====================_522648334==_ Content-Type: text/plain; charset="us-ascii" Content-description: footer --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --=====================_522648334==_-- From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 10:06 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA10864 Thu, 18 Oct 2001 10:06:08 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] ICQ With FWTK Date: Thu, 18 Oct 2001 07:12:52 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 468 Status: RO > How is this done? > What is Configuration to allow ICQ? > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > clients to the firewall. > Disadvantage: file transfers don't work - udprelay only works for ICQ > chat. > > Thank You For any help you may provide. > Jonathan Fritsch > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 10:33 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA10933 Thu, 18 Oct 2001 10:33:02 -0400 (EDT) From: ark@eltex.ru Message-Id: Subject: [fwtk-users] Re: ICQ With FWTK To: "fwtk-users" Date: Thu, 18 Oct 2001 18:34:56 +0400 (MSD) Reply-To: "fwtk-users" In-Reply-To: from "Fritsch Jonathan D CONT PSNS" at Oct 18, 2001 07:12:52 AM X-Mailer: ELM [version 2.5 PL3] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by AMaViS perl-10 List-Unsubscribe: Content-Type: text/plain; charset=us-ascii Content-Length: 930 Status: RO nuqneH, Moving to icq2000 and dropping the old udp protocol completely may be a better option. YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > How is this done? > > What is Configuration to allow ICQ? > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > clients to the firewall. > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > chat. > > > > Thank You For any help you may provide. > > Jonathan Fritsch -- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 10:42 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA10954 Thu, 18 Oct 2001 10:42:21 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Cc: "'fwtk-users'" Subject: [fwtk-users] Re: ICQ With FWTK Date: Thu, 18 Oct 2001 07:49:08 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1289 Status: RO And in lame name terms that means what? -----Original Message----- From: ark@eltex.ru [mailto:ark@eltex.ru] Sent: Thursday, October 18, 2001 7:35 AM To: fwtk-users Subject: [fwtk-users] Re: ICQ With FWTK nuqneH, Moving to icq2000 and dropping the old udp protocol completely may be a better option. YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > How is this done? > > What is Configuration to allow ICQ? > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > clients to the firewall. > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > chat. > > > > Thank You For any help you may provide. > > Jonathan Fritsch -- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! --- You are currently subscribed to fwtk-users as: fritschj@PSNS.navy.mil To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 10:46 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA10981 Thu, 18 Oct 2001 10:46:29 -0400 (EDT) From: ark@eltex.ru Date: Thu, 18 Oct 2001 18:47:57 +0400 Message-Id: In-Reply-To: from "Fritsch Jonathan D CONT PSNS " Organization: "Klingon Imperial Intelligence Service" Subject: [fwtk-users] Re: ICQ With FWTK To: "fwtk-users" Cc: fwtk-users@listserv.nai.com X-Virus-Scanned: by AMaViS perl-10 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text Content-Length: 1745 Status: RO -----BEGIN PGP SIGNED MESSAGE----- That means icq2000b and later does support CONNECT-style proxy, so you can pass it through firewall using your favorite one (plug-gw in ssl mode, squid-gw or ssl-gw) Fritsch Jonathan D CONT PSNS said : > And in lame name terms that means what? > > -----Original Message----- > From: ark@eltex.ru [mailto:ark@eltex.ru] > Sent: Thursday, October 18, 2001 7:35 AM > To: fwtk-users > Subject: [fwtk-users] Re: ICQ With FWTK > > > nuqneH, > > Moving to icq2000 and dropping the old udp protocol completely may be a > better > option. > > YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > > > How is this done? > > > What is Configuration to allow ICQ? > > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > > clients to the firewall. > > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > > chat. > > > > > > Thank You For any help you may provide. > > > Jonathan Fritsch _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBO87rmaH/mIJW9LeBAQHblwP9Fj/X+NDPuPX6c1T4JWptu6MkixLoXbrI 231AJ8trT5FXXNIQ2MtxbkDwH/JuNqH9OxFnK6Y8IdDF48xHnBlVzk7LWm9cpJdG Ml3ir7I2Y2ZFFunTJpPvxPZsGldQnNVtFQen+/IZyElk7bK2x0R5SQsD6CAg8068 gl96POlQUEM= =D9gP -----END PGP SIGNATURE----- --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 11:27 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA11097 Thu, 18 Oct 2001 11:27:50 -0400 (EDT) Message-ID: From: "Don" To: "fwtk-users" Cc: Subject: [fwtk-users] Re: ICQ With FWTK Date: Thu, 18 Oct 2001 11:36:14 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2289 Status: RO Does this mean that we have to configure ICQ client to use HTTPS proxy? ----- Original Message ----- From: To: "fwtk-users" Cc: Sent: Thursday, October 18, 2001 10:47 AM Subject: [fwtk-users] Re: ICQ With FWTK > -----BEGIN PGP SIGNED MESSAGE----- > > That means icq2000b and later does support CONNECT-style proxy, so you > can pass it through firewall using your favorite one (plug-gw in ssl mode, > squid-gw or ssl-gw) > > Fritsch Jonathan D CONT PSNS said : > > > And in lame name terms that means what? > > > > -----Original Message----- > > From: ark@eltex.ru [mailto:ark@eltex.ru] > > Sent: Thursday, October 18, 2001 7:35 AM > > To: fwtk-users > > Subject: [fwtk-users] Re: ICQ With FWTK > > > > > > nuqneH, > > > > Moving to icq2000 and dropping the old udp protocol completely may be a > > better > > option. > > > > YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > > > > > How is this done? > > > > What is Configuration to allow ICQ? > > > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > > > clients to the firewall. > > > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > > > chat. > > > > > > > > Thank You For any help you may provide. > > > > Jonathan Fritsch > > > _ _ _ _ _ _ _ > {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ > (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| > [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! > > -----BEGIN PGP SIGNATURE----- > Version: PGP 6.5.1i > > iQCVAwUBO87rmaH/mIJW9LeBAQHblwP9Fj/X+NDPuPX6c1T4JWptu6MkixLoXbrI > 231AJ8trT5FXXNIQ2MtxbkDwH/JuNqH9OxFnK6Y8IdDF48xHnBlVzk7LWm9cpJdG > Ml3ir7I2Y2ZFFunTJpPvxPZsGldQnNVtFQen+/IZyElk7bK2x0R5SQsD6CAg8068 > gl96POlQUEM= > =D9gP > -----END PGP SIGNATURE----- > > --- > You are currently subscribed to fwtk-users as: don@lclcan.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 11:34 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA11111 Thu, 18 Oct 2001 11:34:33 -0400 (EDT) From: ark@eltex.ru Message-Id: Subject: [fwtk-users] Re: ICQ With FWTK To: "fwtk-users" Date: Thu, 18 Oct 2001 19:36:37 +0400 (MSD) Reply-To: "fwtk-users" In-Reply-To: from "Don" at Oct 18, 2001 11:36:14 AM X-Mailer: ELM [version 2.5 PL3] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by AMaViS perl-10 List-Unsubscribe: Content-Type: text/plain; charset=us-ascii Content-Length: 1880 Status: RO nuqneH, Yes. That provides you a nice side effect: you get rid of banners authomagically - icq2000 tries to obtain banners by applying GET method to HTTPS proxy (which is not expected to handle it ;) YOU (Don) WROTE: > > Does this mean that we have to configure ICQ client to use HTTPS proxy? > > > That means icq2000b and later does support CONNECT-style proxy, so you > > can pass it through firewall using your favorite one (plug-gw in ssl mode, > > squid-gw or ssl-gw) > > > > Fritsch Jonathan D CONT PSNS said : > > > > > And in lame name terms that means what? > > > > > > -----Original Message----- > > > From: ark@eltex.ru [mailto:ark@eltex.ru] > > > Sent: Thursday, October 18, 2001 7:35 AM > > > To: fwtk-users > > > Subject: [fwtk-users] Re: ICQ With FWTK > > > > > > > > > nuqneH, > > > > > > Moving to icq2000 and dropping the old udp protocol completely may be a > > > better > > > option. > > > > > > YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > > > > > > > How is this done? > > > > > What is Configuration to allow ICQ? > > > > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > > > > clients to the firewall. > > > > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > > > > chat. > > > > > > > > > > Thank You For any help you may provide. > > > > > Jonathan Fritsch -- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 12:31 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA11216 Thu, 18 Oct 2001 12:31:25 -0400 (EDT) Message-ID: From: "Don" To: "fwtk-users" Subject: [fwtk-users] Re: ICQ With FWTK Date: Thu, 18 Oct 2001 12:40:17 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2468 Status: RO And my understanding is (please correct me if I am wrong), if I have not purchased and installed a certificate, I cannot use SSL and therefore, cannot use ICQ through FWTK 2.1? ----- Original Message ----- From: To: "fwtk-users" Sent: Thursday, October 18, 2001 11:36 AM Subject: [fwtk-users] Re: ICQ With FWTK > nuqneH, > > Yes. That provides you a nice side effect: you get rid of banners > authomagically - icq2000 tries to obtain banners by applying GET method to > HTTPS proxy (which is not expected to handle it ;) > > YOU (Don) WROTE: > > > > Does this mean that we have to configure ICQ client to use HTTPS proxy? > > > > > That means icq2000b and later does support CONNECT-style proxy, so you > > > can pass it through firewall using your favorite one (plug-gw in ssl mode, > > > squid-gw or ssl-gw) > > > > > > Fritsch Jonathan D CONT PSNS said : > > > > > > > And in lame name terms that means what? > > > > > > > > -----Original Message----- > > > > From: ark@eltex.ru [mailto:ark@eltex.ru] > > > > Sent: Thursday, October 18, 2001 7:35 AM > > > > To: fwtk-users > > > > Subject: [fwtk-users] Re: ICQ With FWTK > > > > > > > > > > > > nuqneH, > > > > > > > > Moving to icq2000 and dropping the old udp protocol completely may be a > > > > better > > > > option. > > > > > > > > YOU (Fritsch Jonathan D CONT PSNS) WROTE: > > > > > > > > > > > How is this done? > > > > > > What is Configuration to allow ICQ? > > > > > > Use udprelay on port 4000. Relay to icq.mirabilis.com then point your > > > > > > clients to the firewall. > > > > > > Disadvantage: file transfers don't work - udprelay only works for ICQ > > > > > > chat. > > > > > > > > > > > > Thank You For any help you may provide. > > > > > > Jonathan Fritsch > > -- > _ _ _ _ _ _ _ > {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ > (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| > [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! > > --- > You are currently subscribed to fwtk-users as: don@lclcan.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 12:40 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA11241 Thu, 18 Oct 2001 12:40:42 -0400 (EDT) X-Authentication-Warning: tyger.hq.internetmedia.ru: antuan owned process doing -bs Date: Thu, 18 Oct 2001 20:46:31 +0400 (MSD) From: Antuan Avdioukhine X-X-Sender: To: "fwtk-users" cc: Don Subject: [fwtk-users] Re: ICQ With FWTK In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 688 Status: RO On Thu, 18 Oct 2001, Don wrote: > And my understanding is (please correct me if I am wrong), if I have > not purchased and installed a certificate, I cannot use SSL and > therefore, cannot use ICQ through FWTK 2.1? You are wrong. SSL and SSL proxy are different things. ICQ2000b+ uses "CONNECT-style" proxy, ssl-gw _is_ such one. "CONNECT-style" proxy just receives "CONNECT .." string then acts like plug-gw. -- Antuan Avdioukhine (DEKA-RIPN) InternetMedia Holding Ltd. St.Petersburg, Russia. +7 (812) 320 8585 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 12:54 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA11274 Thu, 18 Oct 2001 12:54:41 -0400 (EDT) Message-ID: From: "Don" To: "fwtk-users" References: <20011018204352.F25145-100000@tyger.hq.internetmedia.ru> Subject: [fwtk-users] Re: ICQ With FWTK Date: Thu, 18 Oct 2001 13:03:20 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1636 Status: RO > On Thu, 18 Oct 2001, Don wrote: > > > And my understanding is (please correct me if I am wrong), if I have > > not purchased and installed a certificate, I cannot use SSL and > > therefore, cannot use ICQ through FWTK 2.1? > You are wrong. SSL and SSL proxy are different things. ICQ2000b+ uses > "CONNECT-style" proxy, ssl-gw _is_ such one. "CONNECT-style" proxy just > receives "CONNECT .." string then acts like plug-gw. Thanks for your reply. I would like to know if I have everything set properly. Using RedHat Linux 6.2 1) In /usr/local/etc/netperm-table file, I have the following: # outbound ssl netacl-ssl: permit-hosts * -exec /usr/local/etc/ssl-gw # secure http ssl-gw: denial-msg /usr/local/etc/http-deny.html ssl-gw: timeout 36000 ssl-gw: permit-hosts 205.205.137.* ssl-gw: deny-hosts * 2) In /etc/inetd.conf, I have the following: ssl stream tcp nowait root /usr/local/etc/netacl ssl 3) in /etc/services, I have the following: ssl 444/tcp 4) How do I configure my ICQ 2000b to use the proxy? In my connection settings, a) I have checked "Using Firewall" b) I have checked "Connect using proxy" c) I have entered my proxy Host name d) I have enters Port: 444 (is thsi correct)? e) I have checked HTTPS f) I enter my Username/Password (any real user will do I assume?) Unfortunately, ICQ is still unable ro register so there must be a miscong. somewhere --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 18 13:09 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id NAA11304 Thu, 18 Oct 2001 13:09:07 -0400 (EDT) X-Authentication-Warning: tyger.hq.internetmedia.ru: antuan owned process doing -bs Date: Thu, 18 Oct 2001 21:16:44 +0400 (MSD) From: Antuan Avdioukhine X-X-Sender: To: "fwtk-users" cc: Don Subject: [fwtk-users] Re: ICQ With FWTK In-Reply-To: <054e01c157f6$c9ff2f00$c889cdcd@lclcan.com> Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1572 Status: RO On Thu, 18 Oct 2001, Don wrote: > Thanks for your reply. I would like to know if I have everything set > properly. Using RedHat Linux 6.2 > > 1) In /usr/local/etc/netperm-table file, I have the following: > > # outbound ssl > netacl-ssl: permit-hosts * -exec /usr/local/etc/ssl-gw hmm... > > # secure http > ssl-gw: denial-msg /usr/local/etc/http-deny.html > ssl-gw: timeout 36000 > ssl-gw: permit-hosts 205.205.137.* > ssl-gw: deny-hosts * looks good > 2) In /etc/inetd.conf, I have the following: > > ssl stream tcp nowait root /usr/local/etc/netacl ssl maybe use ssl stream tcp nowait root /usr/local/etc/ssl-gw ssl-gw ? > 3) in /etc/services, I have the following: > > ssl 444/tcp ok > 4) How do I configure my ICQ 2000b to use the proxy? In my connection > settings, > a) I have checked "Using Firewall" > b) I have checked "Connect using proxy" > c) I have entered my proxy Host name > d) I have enters Port: 444 (is thsi correct)? > e) I have checked HTTPS > f) I enter my Username/Password (any real user will do I assume?) nope. ssl-gw does not support Proxy-authenticate method. use blank fields > Unfortunately, ICQ is still unable ro register so there must be a > miscong. somewhere -- Antuan Avdioukhine (DEKA-RIPN) InternetMedia Holding Ltd. St.Petersburg, Russia. +7 (812) 320 8585 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 02:32 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id CAA12347 Fri, 19 Oct 2001 02:32:07 -0400 (EDT) Message-ID: From: "MARCON Michel, CETU/SG/Informatique" To: "fwtk-users" Subject: [fwtk-users] http-gw thru a squid proxy ?? Date: Fri, 19 Oct 2001 08:39:43 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 498 Status: RO Hello. I want to use http-gw but to redirect its requests to a squid proxy. I fumbled everywhere, but haven't found any command line option to dothat. client-Iexplore-->http-gw-->SuidProxy-->Internet Any Hint ?? TYA -------------------------- Michel Marcon SysAdmin Unix & Windows NT Ministere Equipement, CETU Tel (33) 04 7214-3408 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 02:48 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id CAA12352 Fri, 19 Oct 2001 02:48:39 -0400 (EDT) Subject: [fwtk-users] Re: http-gw thru a squid proxy ?? To: "fwtk-users" X-Mailer: Lotus Notes Release 5.0.8 June 18, 2001 Message-ID: From: juergen.streck@pruftechnik.com Date: Fri, 19 Oct 2001 08:56:42 +0200 MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id CAA12352 Content-Type: text/plain; charset=iso-8859-1 Content-Length: 379 Status: RO Hi, perhaps you should look at the following link: http://www.squid-cache.org/Doc/FAQ/FAQ-4.html#ss4.16 Regards, Juergen Juergen Streck PRUEFTECHNIK AG Oskar-Messter-Straße 19-21 85737 Ismaning www.pruftechnik.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 04:03 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id EAA12455 Fri, 19 Oct 2001 04:03:04 -0400 (EDT) Message-ID: From: "MARCON Michel, CETU/SG/Informatique" To: "fwtk-users" Subject: [fwtk-users] Re: http-gw thru a squid proxy ?? Date: Fri, 19 Oct 2001 10:10:56 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id EAA12455 Content-Type: text/plain; charset="iso-8859-1" Content-Length: 992 Status: RO Hello. Fine answer, but.... > -----Message d'origine----- > De : juergen.streck@pruftechnik.com > [mailto:juergen.streck@pruftechnik.com] > Envoyé : vendredi 19 octobre 2001 08:57 > > perhaps you should look at the following link: > http://www.squid-cache.org/Doc/FAQ/FAQ-4.html#ss4.16 In this exemple http-gw is the front-end and squid passes it requests to it. What I want to is the reverse. And I cannot make any change on the Squid wich is out of reach (I'm not the sysadmin of it). Thanks for the tip, however. > > Regards, Juergen > > Juergen Streck > PRUEFTECHNIK AG > Oskar-Messter-Straße 19-21 > 85737 Ismaning > www.pruftechnik.com > > > > --- > You are currently subscribed to fwtk-users as: > Michel.Marcon@equipement.gouv.fr > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 06:07 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA12634 Fri, 19 Oct 2001 06:07:36 -0400 (EDT) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Fri, 19 Oct 2001 06:07:48 -0400 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: http-gw thru a squid proxy ?? In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 992 Status: RO At 10:10 AM 10/19/01 +0200, MARCON Michel, CETU/SG/Informatique wrote: >In this exemple http-gw is the front-end and squid passes it requests to it. >What I want to is the reverse. And I cannot make any change on the Squid >wich is out of reach (I'm not the sysadmin of it). I don't think there's anything you can do to make this work. It's exactly the same situation as installing the firewall toolkit and http-gw to protect a network; when you do that, you must tell the users to configure their web browsers to use the firewall as their proxy. When you do that, the browser sends the full URL to the firewall, including the hostname. In your case, you've got to reconfigure the squid system to use the proxy as well. A transparent http proxy (like those in commercial firewalls) wouldn't have this problem. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 08:52 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id IAA13125 Fri, 19 Oct 2001 08:52:58 -0400 (EDT) Mime-Version: 1.0 X-Sender: johnk@mail.gw.tislabs.com (Unverified) Message-Id: Date: Fri, 19 Oct 2001 08:59:49 -0400 To: "fwtk-users" From: John Kelley Subject: [fwtk-users] The fwtk-users lists is back up. List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii" Content-Length: 735 Status: RO After too long an absence, the fwtk-users list is back up and running. We had a catastrophic hardware failure that took us down, and we were heading toward deploying new hardware with new software, so we wanted to just bring that up instead of a rebuild of the old system. Since this is new software, we ask that if any problems or issues arise, please send an email to Support.Listserv@nai.com. All your typical "majordomo" list management commands should still work. -John Kelley -- John C. Kelley Development Engineer NAILabs at Network Associates, Inc. Glenwood, MD --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 11:16 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA13516 Fri, 19 Oct 2001 11:16:35 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] RAS Date: Fri, 19 Oct 2001 08:24:10 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 273 Status: RO Has anyone setup and NT RAS Server and been able to get a dialup device to connect to the internet? - Jonathan --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 12:07 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA13623 Fri, 19 Oct 2001 12:07:48 -0400 (EDT) Subject: [fwtk-users] RE: RAS Date: Sat, 20 Oct 2001 00:19:07 +0800 MIME-Version: 1.0 Message-ID: X-MimeOLE: Produced By Microsoft Exchange V6.0.4417.0 content-class: urn:content-classes:message Thread-Topic: [fwtk-users] RAS Thread-Index: AcFYsyGcjB+0+WC6RXCVIE2fKmG4WwABpvMQ From: "Jason M. Smith" To: "fwtk-users" List-Unsubscribe: Reply-To: "fwtk-users" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id MAA13623 Content-Type: text/plain; charset="iso-8859-1" Content-Length: 651 Status: RO yeah i can do that with NT4 and 2000 server -----Original Message----- From: Fritsch Jonathan D CONT PSNS [mailto:fritschj@PSNS.navy.mil] Sent: Friday, 19 October 2001 11:24 PM To: fwtk-users Subject: [fwtk-users] RAS Has anyone setup and NT RAS Server and been able to get a dialup device to connect to the internet? - Jonathan --- You are currently subscribed to fwtk-users as: jason.smith@clsglobal.com.au To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Oct 19 12:32 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA13651 Fri, 19 Oct 2001 12:32:34 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Cc: "'fwtk-users'" Subject: [fwtk-users] RE: RAS Date: Fri, 19 Oct 2001 09:39:14 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1390 Status: RO I've currenly have a NT 4.0 server setup with RAS and DHCP. I can dial in, get connected that talk to the entire network. I can even telnet to the firewall. But what I can't do it get to the internet via my laptop that is dialed into my RAS NT 4.0 server. What I think is happening, is that my request to getting though the firewall, BUT the firewall does not know how to return the request. WHY? - Jonathan -----Original Message----- From: Jason M. Smith [mailto:jason.smith@clsglobal.com.au] Sent: Friday, October 19, 2001 9:19 AM To: fwtk-users Subject: [fwtk-users] RE: RAS yeah i can do that with NT4 and 2000 server -----Original Message----- From: Fritsch Jonathan D CONT PSNS [mailto:fritschj@PSNS.navy.mil] Sent: Friday, 19 October 2001 11:24 PM To: fwtk-users Subject: [fwtk-users] RAS Has anyone setup and NT RAS Server and been able to get a dialup device to connect to the internet? - Jonathan --- You are currently subscribed to fwtk-users as: jason.smith@clsglobal.com.au To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fritschj@PSNS.navy.mil To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Oct 22 02:43 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id CAA18474 Mon, 22 Oct 2001 02:43:32 -0400 (EDT) Sender: gerd4000 Message-ID: Date: Mon, 22 Oct 2001 08:51:26 +0200 From: Gerd Schering Organization: TUB X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.19-4.4mdk i686) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users" Subject: [fwtk-users] Re: http-gw thru a squid proxy ?? Content-Transfer-Encoding: 7bit List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 1062 Status: RO Have a look at squid-gw. I think you'll find in the patches section of fwtk.org under -> Other addons -> Proxies for NNTP, POP3, Squid, and other services such as traceroute (em-gw) Gerd "MARCON Michel, CETU/SG/Informatique" wrote: > > Hello. > > I want to use http-gw but to redirect its requests to a squid proxy. I > fumbled everywhere, but haven't found any command line option to dothat. > > client-Iexplore-->http-gw-->SuidProxy-->Internet > > Any Hint ?? > > TYA > > -------------------------- > Michel Marcon > SysAdmin Unix & Windows NT > Ministere Equipement, CETU > Tel (33) 04 7214-3408 > > --- > You are currently subscribed to fwtk-users as: Schering@zrz.TU-Berlin.DE > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com -- ------------------------------------------------------ -- Gerd Schering ------------------------------------------------------ --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Oct 22 08:59 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id IAA19425 Mon, 22 Oct 2001 08:59:09 -0400 (EDT) Message-Id: X-Sender: pdunphy/mailhost.csca.ryerson.ca@Pop3.norton.antivirus X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Mon, 22 Oct 2001 09:11:10 -0400 To: "fwtk-users" From: Paul Dunphy Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2474 Status: RO Thanks for all your help, folks. The problem appears to have been what Rick Murphy suggested; if I shorten the list of blocked spam domains, everything seems to work fine. I'll try applying the patch as soon as I get time. Cheers... Paul At 07:51 PM 10/17/2001 -0400, you wrote: >At 04:24 PM 10/17/01 -0400, Paul Dunphy wrote: >>Hi, >> >>I wonder if you might be able to help me: I am running FWTK 2.1 with the >>Yao smap patches. Several times a day, I get messages like the following >>in my syslog: >> >>smap[4228]: xxx.xxx.xxx.xxx host address lookup failed (where >>xxx.xxx.xxx.xxx is the IP address of the sender) >>smap[4228]: connect host=unknown/xxx.xxx.xxx.xxx >> >>and, about 20 minutes later: >> >>smap[4228]: peer dropped connection: Success > >That's caused by having a long spam-blocking list applied to a host that >doesn't have a good reverse lookup, particularly when the attempt to look >them up takes a long time. (An immediate negative response isn't a problem >- the problem happens when a host takes 60 seconds to time out.) > >What happens is each "smap: spam ..." line in the netperm-table is passed >to hostmatch with the caller's IP address. If the spam block pattern isn't >an IP address, hostmatch has to turn the IP address back into a hostname; >that has to be done for every spam block entry. It's pretty apparent what >can happen - if you have a host that takes 30 seconds to time out on a >reverse lookup and you have 30 spam-block hostnames, you're going to take >15 minutes to verify if you're going to let them mail to you. > >A host that's got this problem will never be able to send you mail unless >you remove all the spam block entries in your netperm-table. > >I fixed this in my version of smap by making a new function called >"hostmatch2" that gets passed both the hostname and the host's IP address; >it then calls hostmatch with the appropriate arguments to stop the timeouts. > >My patch (relative to FWTK 2.1) is attached. > -Rick --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Systems Administrator/Research Engineer Centre for the Study of Commercial Activity Ryerson University Toronto, Ontario, CANADA Phone: (416) 979-5000 ext. 7537 Fax: (416) 979-5378 E-mail: pdunphy@csca.ryerson.ca --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Oct 22 21:30 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id VAA20883 Mon, 22 Oct 2001 21:30:29 -0400 (EDT) Message-Id: X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: "fwtk-users" Subject: [fwtk-users] Re: http-gw thru a squid proxy ?? In-reply-to: Your message of "Fri, 19 Oct 2001 10:10:56 +0200." Mime-Version: 1.0 Date: Tue, 23 Oct 2001 11:38:23 +1000 From: Ian Mortimer List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=iso-8859-1 Content-Length: 918 Status: RO > In this exemple http-gw is the front-end and squid passes it requests to it. > What I want to is the reverse. And I cannot make any change on the Squid > wich is out of reach (I'm not the sysadmin of it). This works here (but will depend on how your squid proxy is configured): http-gw: default-http http-proxy.our.net http-gw: default-gopher gopher-proxy.our.net http-gw: ftp-proxy ftp-proxy.our.net -- Ian ian@physics.uq.edu.au Ian Mortimer Tel: +61 7 3365 3436 Department of Physics Fax: +61 7 3365 1242 University of Queensland -- Ian ian@physics.uq.edu.au Ian Mortimer Tel: +61 7 3365 3436 Department of Physics Fax: +61 7 3365 1242 University of Queensland --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 23 07:42 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id HAA21956 Tue, 23 Oct 2001 07:42:46 -0400 (EDT) From: "elvis" To: "fwtk-users" Subject: [fwtk-users] x-gw problem Date: Tue, 23 Oct 2001 13:51:49 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 In-Reply-To: Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 406 Status: RO Hi, I installed FWTK 2.1 few months ago. Installation was fine except x-gw. x-gw didn't compiled because there was not header file "Intrinsic.h". Can anyone help me, where to find this and others files for x-gw on SUSE Linux 6.4. Thanks Elvis --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 23 22:14 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id WAA23320 Tue, 23 Oct 2001 22:14:55 -0400 (EDT) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 23 Oct 2001 22:13:38 -0400 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: x-gw problem In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 628 Status: RO At 01:51 PM 10/23/01 +0200, elvis wrote: >Hi, > >I installed FWTK 2.1 few months ago. Installation was fine except x-gw. >x-gw didn't compiled because there was not header file "Intrinsic.h". >Can anyone help me, where to find this and others files for x-gw on SUSE >Linux 6.4. You need the X Window System development libraries and headers. I don't know what package SuSE uses for X development, but the package names are usually easy to figure out. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 23 22:19 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id WAA23327 Tue, 23 Oct 2001 22:19:03 -0400 (EDT) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 23 Oct 2001 22:25:46 -0400 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2237 Status: RO At 09:11 AM 10/22/01 -0400, Paul Dunphy wrote: >Thanks for all your help, folks. The problem appears to have been what >Rick Murphy suggested; if I shorten the list of blocked spam domains, >everything seems to work fine. I'll try applying the patch as soon as I >get time. Just FYI, there are several things that I've added to smap since Joe Yao's patch. First, "verify-reverse". Any "from" address that has a domain that matches one of these entries must be sent from a host with a reverse DNS matching that entry. For example, I have: smap: verify-reverse msn.com yahoo.com hotmail.com aol.com lycos.com That means that anyone trying to send with "mail from: " must be sent from a host that's in the hotmail.com domain. This is a real spamkiller - 75% of the junk mail I get forges hotmail or yahoo. Second, block-list. These entries are used to configure DNS blocking lists. An example: smap: block-list "MAPS RBL" block .blackholes.mail-abuse.org "%s/%s was found in the MAPS RBL (see http://mail-abuse.org/rbl)" (all on one line, of course). This defines a block list called "MAPS RBL", which blocks mail from any host on the RBL. The ".blackholes.mail-abuse.org" suffix is added to the host address and looked up in the DNS blocking list. The "block" argument can also be "mark" - in this case, the mail isn't rejected, it's marked with an "X-RBL-Warning:" header line that you can test using procmail. The lookup can match a particular return value - for example, the OsiruSoft blocking list (relays.osirusoft.com) returns 127.0.0.2 for an open relay; you block that by adding the match address after the relay list name: smap: block-list "ORL" block .relays.osirusoft.com:127.0.0.2 "%s/%s was found in the Osirusoft relays list (see http://relays.osirusoft.com/)" Finally, there's a "whitelist" entry - any host that matches these is ignored when checking for spam blocks, reverse checks, etc. This allows you to permit mail from an important correspondent that happens to be on one of your blocking lists. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 07:58 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id HAA24129 Wed, 24 Oct 2001 07:58:13 -0400 (EDT) From: "Operador Certisign" To: "fwtk-users" Subject: [fwtk-users] Stop Relay Date: Wed, 24 Oct 2001 10:04:03 -0300 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 322 Status: RO Hi folks, I want to use smap on my mail server and I would like to know the best way to stop relay on smap. Thanks, Leonardo Guimaraes System Administrator. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 13:42 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id NAA24851 Wed, 24 Oct 2001 13:42:20 -0400 (EDT) From: "Todd Williams" To: "fwtk-users" Cc: "'fwtk-users'" Subject: [fwtk-users] Re: Smap Message: peer dropped connection Date: Wed, 24 Oct 2001 13:48:36 -0400 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 Importance: Normal In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2716 Status: RO Hi Rick, Are your smap patches readily available for download by any chance? The reverse lookup especially sounds like a great idea. Thanks, Todd -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Tuesday, October 23, 2001 10:26 PM To: fwtk-users Subject: [fwtk-users] Re: Smap Message: peer dropped connection At 09:11 AM 10/22/01 -0400, Paul Dunphy wrote: >Thanks for all your help, folks. The problem appears to have been what >Rick Murphy suggested; if I shorten the list of blocked spam domains, >everything seems to work fine. I'll try applying the patch as soon as I >get time. Just FYI, there are several things that I've added to smap since Joe Yao's patch. First, "verify-reverse". Any "from" address that has a domain that matches one of these entries must be sent from a host with a reverse DNS matching that entry. For example, I have: smap: verify-reverse msn.com yahoo.com hotmail.com aol.com lycos.com That means that anyone trying to send with "mail from: " must be sent from a host that's in the hotmail.com domain. This is a real spamkiller - 75% of the junk mail I get forges hotmail or yahoo. Second, block-list. These entries are used to configure DNS blocking lists. An example: smap: block-list "MAPS RBL" block .blackholes.mail-abuse.org "%s/%s was found in the MAPS RBL (see http://mail-abuse.org/rbl)" (all on one line, of course). This defines a block list called "MAPS RBL", which blocks mail from any host on the RBL. The ".blackholes.mail-abuse.org" suffix is added to the host address and looked up in the DNS blocking list. The "block" argument can also be "mark" - in this case, the mail isn't rejected, it's marked with an "X-RBL-Warning:" header line that you can test using procmail. The lookup can match a particular return value - for example, the OsiruSoft blocking list (relays.osirusoft.com) returns 127.0.0.2 for an open relay; you block that by adding the match address after the relay list name: smap: block-list "ORL" block .relays.osirusoft.com:127.0.0.2 "%s/%s was found in the Osirusoft relays list (see http://relays.osirusoft.com/)" Finally, there's a "whitelist" entry - any host that matches these is ignored when checking for spam blocks, reverse checks, etc. This allows you to permit mail from an important correspondent that happens to be on one of your blocking lists. -Rick --- You are currently subscribed to fwtk-users as: twilliams@tfcci.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 14:05 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA24860 Wed, 24 Oct 2001 14:05:35 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] Segments Date: Wed, 24 Oct 2001 11:12:39 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 235 Status: RO How do you configure FWTK when you have more than one segment? - Jonathan --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 14:38 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA24899 Wed, 24 Oct 2001 14:38:09 -0400 (EDT) From: "Ken Long" Organization: Lectrosonics, Inc. To: "fwtk-users" Date: Wed, 24 Oct 2001 12:46:07 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: [fwtk-users] Re: Segments Message-ID: Priority: normal In-reply-to: X-mailer: Pegasus Mail for Win32 (v3.12c) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=US-ASCII Content-Length: 1377 Status: RO Hi, This answer has two parts. You must make entries in your netperm-table to allow for your multiple subnets. For instance, here's a single permit- hosts line from mine: netacl-http: permit-hosts 172.16.1.* 172.16.2.* 172.16.3.* 172.16.4.* 172.16.5.* 172.16.6.* -exec /usr/local/etc/http-gw Additionally, you must set up routing from your fwtk box to all of your subnets. This is how I have mine: /sbin/route add -net 172.16.1.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.3.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.4.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.5.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.6.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 These static route commands were entered into one of my startup scripts so they are set at each bootup. I use a separate router as the central hub of all my internal subnets. That router has the fwtk box ip as it's default route so that packets can find their way back out to the Internet. Regards, Ken Long On 24 Oct 2001, at 11:12, Fritsch Jonathan D CONT PSNS wrote: > How do you configure FWTK when you have more than one segment? --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 15:11 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id PAA25031 Wed, 24 Oct 2001 15:11:47 -0400 (EDT) Date: Wed, 24 Oct 2001 14:56:01 -0400 From: Joseph S D Yao To: "fwtk-users" Cc: Operador Certisign Subject: [fwtk-users] Re: Stop Relay Message-ID: Mail-Followup-To: fwtk-users , Operador Certisign Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 1203 Status: RO On Wed, Oct 24, 2001 at 10:04:03AM -0300, Operador Certisign wrote: > Hi folks, > > I want to use smap on my mail server and I would like to know the best way > to stop > relay on smap. > > Thanks, > > Leonardo Guimaraes > System Administrator. 'smap' is not intended for use on your mail server. It is intended for use on a firewall bastion host, to filter mail and pass it through to your name server. See "Building Internet Firewalls" by Zwicky, Cooper, and Chapman if you're not already familiar with the concepts. There are several patches for 'smap' on www.fwtk.org that allow you to stop relaying, including a collection of patches that I put together, commented, and debugged to some degree . -- Joe Yao jsdy@center.osis.gov - Joseph S. D. Yao OSIS Center Systems Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of OSIS Center policies. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 15:54 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id PAA25093 Wed, 24 Oct 2001 15:54:10 -0400 (EDT) Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Cc: fwtk-users Subject: [fwtk-users] Re: Segments Date: Wed, 24 Oct 2001 13:00:15 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1791 Status: RO Okay, so your eth1 is your internet or external network then, and gw being your machine name? -----Original Message----- From: Ken Long [mailto:ken@lectrosonics.com] Sent: Wednesday, October 24, 2001 11:46 AM To: fwtk-users Subject: [fwtk-users] Re: Segments Hi, This answer has two parts. You must make entries in your netperm-table to allow for your multiple subnets. For instance, here's a single permit- hosts line from mine: netacl-http: permit-hosts 172.16.1.* 172.16.2.* 172.16.3.* 172.16.4.* 172.16.5.* 172.16.6.* -exec /usr/local/etc/http-gw Additionally, you must set up routing from your fwtk box to all of your subnets. This is how I have mine: /sbin/route add -net 172.16.1.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.3.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.4.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.5.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 /sbin/route add -net 172.16.6.0 gw 172.16.2.1 netmask 255.255.255.0 eth1 These static route commands were entered into one of my startup scripts so they are set at each bootup. I use a separate router as the central hub of all my internal subnets. That router has the fwtk box ip as it's default route so that packets can find their way back out to the Internet. Regards, Ken Long On 24 Oct 2001, at 11:12, Fritsch Jonathan D CONT PSNS wrote: > How do you configure FWTK when you have more than one segment? --- You are currently subscribed to fwtk-users as: fritschj@PSNS.navy.mil To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 18:05 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id SAA25254 Wed, 24 Oct 2001 18:05:54 -0400 (EDT) From: "Ken Long" Organization: Lectrosonics, Inc. To: "fwtk-users" Date: Wed, 24 Oct 2001 16:13:37 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: [fwtk-users] Re: Segments Message-ID: Priority: normal In-reply-to: X-mailer: Pegasus Mail for Win32 (v3.12c) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=US-ASCII Content-Length: 612 Status: RO Not exactly, gw is a commandline parameter for route and eth1 is my inside network card. My fwtk box has two nics, one for the inside company network and one for the outside internet. My answer and examples are for one outside subnet and multiple inside subnets. Hope this helps. Ken On 24 Oct 2001, at 13:00, Fritsch Jonathan D CONT PSNS wrote: > Okay, so your eth1 is your internet or external network then, and gw being > your machine name? --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 24 22:11 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id WAA25618 Wed, 24 Oct 2001 22:11:19 -0400 (EDT) Date: Wed, 24 Oct 2001 22:19:47 -0400 (EDT) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2723 Status: RO Hmm, This is a really neat idea. Would like a copy of the verify-reverse patches. Seems again that we should look at integrating the three versions of smap together. Would like to come up with the "next" version somehow. tek On Tue, 23 Oct 2001, Rick Murphy wrote: > At 09:11 AM 10/22/01 -0400, Paul Dunphy wrote: > >Thanks for all your help, folks. The problem appears to have been what > >Rick Murphy suggested; if I shorten the list of blocked spam domains, > >everything seems to work fine. I'll try applying the patch as soon as I > >get time. > > Just FYI, there are several things that I've added to smap since Joe Yao's > patch. > > First, "verify-reverse". Any "from" address that has a domain that matches > one of these entries must be sent from a host with a reverse DNS matching > that entry. > For example, I have: > smap: verify-reverse msn.com yahoo.com hotmail.com aol.com lycos.com > That means that anyone trying to send with "mail from: " > must be sent from a host that's in the hotmail.com domain. This is a real > spamkiller - 75% of the junk mail I get forges hotmail or yahoo. > > Second, block-list. These entries are used to configure DNS blocking lists. > An example: > smap: block-list "MAPS RBL" block .blackholes.mail-abuse.org "%s/%s was found > in the MAPS RBL (see http://mail-abuse.org/rbl)" > (all on one line, of course). This defines a block list called "MAPS RBL", > which blocks mail from any host on the RBL. The > ".blackholes.mail-abuse.org" suffix is added to the host address and looked > up in the DNS blocking list. > The "block" argument can also be "mark" - in this case, the mail isn't > rejected, it's marked with an "X-RBL-Warning:" header line that you can > test using procmail. > > The lookup can match a particular return value - for example, the OsiruSoft > blocking list (relays.osirusoft.com) returns 127.0.0.2 for an open relay; > you block that by adding the match address after the relay list name: > smap: block-list "ORL" block .relays.osirusoft.com:127.0.0.2 "%s/%s was found > in the Osirusoft relays list (see http://relays.osirusoft.com/)" > > Finally, there's a "whitelist" entry - any host that matches these is > ignored when checking for spam blocks, reverse checks, etc. This allows you > to permit mail from an important correspondent that happens to be on one of > your blocking lists. > -Rick > > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 25 06:17 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA26230 Thu, 25 Oct 2001 06:17:05 -0400 (EDT) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Thu, 25 Oct 2001 06:24:53 -0400 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 696 Status: RO At 10:19 PM 10/24/01 -0400, Ted Keller wrote: >Hmm, This is a really neat idea. Would like a copy of the verify-reverse >patches. > >Seems again that we should look at integrating the three versions of smap >together. Would like to come up with the "next" version somehow. > >tek I posted the patch in an earlier message and can resend it if you're interested. I tried merging the various smap versions together but it's a lot of work and I don't have a lot of time right now. You're welcome to give it a shot. :-) -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Oct 25 08:35 EDT 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id IAA26338 Thu, 25 Oct 2001 08:35:04 -0400 (EDT) Date: Thu, 25 Oct 2001 08:42:37 -0400 (EDT) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1178 Status: RO Rick, I would appreciate a resend. Would like to integrate it into my version - maybe I'll even get around to integrating your RBL support as well. I think with that, I could offer a fairly complete integrated version of all the major varients. ted keller On Thu, 25 Oct 2001, Rick Murphy wrote: > At 10:19 PM 10/24/01 -0400, Ted Keller wrote: > >Hmm, This is a really neat idea. Would like a copy of the verify-reverse > >patches. > > > >Seems again that we should look at integrating the three versions of smap > >together. Would like to come up with the "next" version somehow. > > > >tek > > I posted the patch in an earlier message and can resend it if you're > interested. > I tried merging the various smap versions together but it's a lot of work > and I don't have a lot of time right now. You're welcome to give it a shot. :-) > -Rick > > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 30 09:03 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id JAA09563 Tue, 30 Oct 2001 09:03:29 -0500 (EST) Message-ID: From: "MARCON Michel, CETU/SG/Informatique" To: "fwtk-users" Subject: [fwtk-users] Usage of authsrv Date: Tue, 30 Oct 2001 15:11:19 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 494 Status: RO Hello. The man page of authsrv specifies that you can permit/deny certains operations at certains tile of the day . But the man page specifies that this permit rule is only used by the server if the proxy uses the -extn attribute ? What is this anyway. I want to permit/deny ftp-gw on the office hours only (don't want to use). TYA --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 30 14:29 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA10649 Tue, 30 Oct 2001 14:29:52 -0500 (EST) From: "Todd Williams" To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection Date: Tue, 30 Oct 2001 14:37:02 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2522 Status: RO Hi, I've been play testing (on a non-production box attached to the internet - scary, eh?) some of the code in the patch provided by RMurphy and the original JSDY patches, and came up with a couple of questions: 1. Is it the normal response of the verify-reverse and associated routines to just drop a DNS-spoofed connection without any error (return) codes displayed to the spoofer? It seems to me this would make the spoofer's mail queue continue to attempt connections for days until the message drops dead, rather than error out due to a 550 return code immediately, and never return? Perhaps there's something more to this than I'm seeing. 2. In my testing with the spam code, I've noticed something odd once the "spam" has been rejected and dumped into a secure file. I realize what causes it - the file is no longer where smap expects it to be. Are we missing a close statement somewhere? Is this normal behavior, and if so, could it present any problems? SMAP - 451 System problem /var/log/messages - fwtksyserr: cannot fprintf: Bad file descriptor 3. Also in testing the spam code, after smap rejects a message with a 554 Unacceptable address/domain and moves it into a secure file, upon issuing the "QUIT" command to smap, I received an error message: SMAP - 451 System problem /var/log/messages - fwtksyserr: cannot fprintf: Interrupted system call Everything else seems to be working okay. Thanks for your help in advance. Todd Williams -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Thursday, October 25, 2001 6:25 AM To: fwtk-users Subject: [fwtk-users] Re: Smap Message: peer dropped connection At 10:19 PM 10/24/01 -0400, Ted Keller wrote: >Hmm, This is a really neat idea. Would like a copy of the verify-reverse >patches. > >Seems again that we should look at integrating the three versions of smap >together. Would like to come up with the "next" version somehow. > >tek I posted the patch in an earlier message and can resend it if you're interested. I tried merging the various smap versions together but it's a lot of work and I don't have a lot of time right now. You're welcome to give it a shot. :-) -Rick --- You are currently subscribed to fwtk-users as: twilliams@tfcci.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 30 16:30 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id QAA11022 Tue, 30 Oct 2001 16:30:19 -0500 (EST) From: "Alexandre Ghisoli" To: "fwtk-users" Subject: [fwtk-users] x-gw seg fault !! Date: Tue, 30 Oct 2001 19:38:07 +0100 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 1 (Highest) X-MSMail-Priority: High X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: High List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 538 Status: RO Hi there, I've problems with x-gw. It's seg. fault !! After some gdb and mailarchives/doc red, it seems that it is in sws.c the problem, when freesws is called. But when I destroy the memory management, main() crashes also :-( Could you help me ? It's a urgent problem to solve. Best regards. --Alexandre Config : Slackware 8 gcc (tryed on different version - 2.96 - 3) --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Oct 30 17:28 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id RAA11127 Tue, 30 Oct 2001 17:28:40 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 30 Oct 2001 17:24:19 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2691 Status: RO At 02:37 PM 10/30/01 -0500, Todd Williams wrote: >Hi, > >I've been play testing (on a non-production box attached to the internet - >scary, eh?) some of the code in the patch provided by RMurphy and the >original JSDY patches, and came up with a couple of questions: > >1. Is it the normal response of the verify-reverse and associated routines >to just drop a DNS-spoofed connection without any error (return) codes >displayed to the spoofer? It seems to me this would make the spoofer's mail >queue continue to attempt connections for days until the message drops dead, >rather than error out due to a 550 return code immediately, and never >return? Perhaps there's something more to this than I'm seeing. Here's what I see: Escape character is '^]'. 220 fw.itm-inst.com ESMTP/smap Ready; NO UCE Tue, 30 Oct 01 17:03:03 -0500 helo there 250 (there) pleased to meet you. mail from: 250 ... Sender Ok rcpt to: 550 From address blocked - attempted spoof detected quit 221 Closing connection Connection closed by foreign host. So, it's not immediately disconnecting. >2. In my testing with the spam code, I've noticed something odd once the >"spam" has been rejected and dumped into a secure file. I realize what >causes it - the file is no longer where smap expects it to be. Are we >missing a close statement somewhere? Is this normal behavior, and if so, >could it present any problems? > SMAP - 451 System problem > /var/log/messages - fwtksyserr: cannot fprintf: Bad file > descriptor I don't use the "max-email" feature, so there's likely some problem there. Try editing line 1790 to read: rejecting = 1; } else <-- edit here /* ** Read the body, copy from stdin to vout, ** return 0 for good, otherwise various error ** values. */ >3. Also in testing the spam code, after smap rejects a message with a 554 >Unacceptable address/domain and moves it into a secure file, upon issuing >the "QUIT" command to smap, I received an error message: > SMAP - 451 System problem > /var/log/messages - fwtksyserr: cannot fprintf: > Interrupted system call This is probably the same problem as above. I'll have a look at what's going on. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 31 04:39 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id EAA12325 Wed, 31 Oct 2001 04:39:52 -0500 (EST) Subject: [fwtk-users] Re: x-gw seg fault !! From: Tony Gale To: "fwtk-users" In-Reply-To: Content-Transfer-Encoding: 7bit X-Mailer: Evolution/0.16 (Preview Release) Date: 31 Oct 2001 09:47:43 +0000 Message-Id: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain Content-Length: 923 Status: RO Have you applied the jumbo patch from www.fwtk.org? It contains a memory usage bugfix for x-gw (and a security fix). -tony On Tue, 2001-10-30 at 18:38, Alexandre Ghisoli wrote: > Hi there, > > I've problems with x-gw. > It's seg. fault !! > > After some gdb and mailarchives/doc red, it seems that it is in sws.c the > problem, when freesws is called. > But when I destroy the memory management, main() crashes also :-( > > Could you help me ? > It's a urgent problem to solve. > > Best regards. > > --Alexandre > > Config : > Slackware 8 > gcc (tryed on different version - 2.96 - 3) > > > > --- > You are currently subscribed to fwtk-users as: gale@syntax.dera.gov.uk > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 31 10:36 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA12817 Wed, 31 Oct 2001 10:36:23 -0500 (EST) From: "Todd Williams" To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection Date: Wed, 31 Oct 2001 10:42:52 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4320 Status: RO Hey folks, Good news. The "else" statement was an easy fix for the bad file descriptor problem. It would appear that the max-email and max-dirent (along with the associated "secure" file handling stuff) seems to alter the behavior of smap significantly as far as the verify-reverse, and possibly other parts of the code go. This example is with the max-email and max-dirent entries configured in netperm-table: (The names and numbers have been changed to protect the innocent.) $ telnet thistestdomain.com 25 Trying thistestdomain.com... Connected to thistestdomain.com. Escape character is '^]'. 220 thistestdomain.com ESMTP/smap Ready; NO UCE Tue, 30 Oct 01 20:21:53 -0500 helo there 250 (there) pleased to meet you. mail from: 250 ... Sender Ok rcpt to: 250 recipient Ok DATA 354 Enter mail, end with "." on a line by itself Testing 123 554 Unacceptable address/domain: [yahoo.com]/ Connection closed by foreign host. When I disable the max-email and max-dirent entries in netperm-table, and perform the same test, I see what you saw: 550 From address blocked - attempted spoof detected It does look like there might be problem(s) with the max-email/max-dirent code and how it interacts with the rest of the code and patches. Thanks for all your help with this, Todd Williams -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Tuesday, October 30, 2001 5:24 PM To: fwtk-users Subject: [fwtk-users] Re: Smap Message: peer dropped connection At 02:37 PM 10/30/01 -0500, Todd Williams wrote: >Hi, > >I've been play testing (on a non-production box attached to the internet - >scary, eh?) some of the code in the patch provided by RMurphy and the >original JSDY patches, and came up with a couple of questions: > >1. Is it the normal response of the verify-reverse and associated routines >to just drop a DNS-spoofed connection without any error (return) codes >displayed to the spoofer? It seems to me this would make the spoofer's mail >queue continue to attempt connections for days until the message drops dead, >rather than error out due to a 550 return code immediately, and never >return? Perhaps there's something more to this than I'm seeing. Here's what I see: Escape character is '^]'. 220 fw.itm-inst.com ESMTP/smap Ready; NO UCE Tue, 30 Oct 01 17:03:03 -0500 helo there 250 (there) pleased to meet you. mail from: 250 ... Sender Ok rcpt to: 550 From address blocked - attempted spoof detected quit 221 Closing connection Connection closed by foreign host. So, it's not immediately disconnecting. >2. In my testing with the spam code, I've noticed something odd once the >"spam" has been rejected and dumped into a secure file. I realize what >causes it - the file is no longer where smap expects it to be. Are we >missing a close statement somewhere? Is this normal behavior, and if so, >could it present any problems? > SMAP - 451 System problem > /var/log/messages - fwtksyserr: cannot fprintf: Bad file > descriptor I don't use the "max-email" feature, so there's likely some problem there. Try editing line 1790 to read: rejecting = 1; } else <-- edit here /* ** Read the body, copy from stdin to vout, ** return 0 for good, otherwise various error ** values. */ >3. Also in testing the spam code, after smap rejects a message with a 554 >Unacceptable address/domain and moves it into a secure file, upon issuing >the "QUIT" command to smap, I received an error message: > SMAP - 451 System problem > /var/log/messages - fwtksyserr: cannot fprintf: > Interrupted system call This is probably the same problem as above. I'll have a look at what's going on. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 31 13:58 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id NAA13354 Wed, 31 Oct 2001 13:58:22 -0500 (EST) Subject: [fwtk-users] Re: x-gw seg fault !! From: Tony Gale To: "fwtk-users" In-Reply-To: Content-Transfer-Encoding: 7bit X-Mailer: Evolution/0.16 (Preview Release) Date: 31 Oct 2001 16:07:36 +0000 Message-Id: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain Content-Length: 1067 Status: RO But... the fact that it is calling freesws at all indicates a problem, as that is an error condition in the parsing of the command line arguments that have been passwd to x-gw. So, how have you configured x-gw exactly, and what do you do to trigger this error? -tony On Tue, 2001-10-30 at 18:38, Alexandre Ghisoli wrote: > Hi there, > > I've problems with x-gw. > It's seg. fault !! > > After some gdb and mailarchives/doc red, it seems that it is in sws.c the > problem, when freesws is called. > But when I destroy the memory management, main() crashes also :-( > > Could you help me ? > It's a urgent problem to solve. > > Best regards. > > --Alexandre > > Config : > Slackware 8 > gcc (tryed on different version - 2.96 - 3) > > > > --- > You are currently subscribed to fwtk-users as: gale@syntax.dera.gov.uk > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Oct 31 14:00 EST 2001 Received: from 161.69.213.6 (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA13358 Wed, 31 Oct 2001 14:00:57 -0500 (EST) Date: Wed, 31 Oct 2001 13:17:57 -0500 From: Joseph S D Yao To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection Message-ID: Mail-Followup-To: fwtk-users Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from rmurphy@itm-inst.com on Tue, Oct 30, 2001 at 05:24:19PM -0500 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 1006 Status: RO Caveat: I have not looked at your specific code yet [with Rick's changes]. I did notice that in some cases the original 'smap' sent an inappropriate error code - sometimes while the sender was still sending! The latter behaviour is guaranteed to make the remote machine try again. I changed at least the maxbytes code to read the WHOLE message [and not save it] before sending an appropriate error code [something like, "E-go 'way, ya bother me"]. There may be similar problems elsewhere in the code. While I tried to review it all for security problems, I did not have enough time to test all code paths. -- Joe Yao jsdy@center.osis.gov - Joseph S. D. Yao OSIS Center Systems Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of OSIS Center policies. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com