From eb92fe135ac4b21730f6cda8e324dd350ed39aba Mon Sep 17 00:00:00 2001 From: Thomas Guyot-Sionnest Date: Fri, 28 Feb 2020 17:39:05 -0500 Subject: [PATCH] Update unbound.md * Listen on 127.0.0.1 so that clients cannot bypass pi.hole DNS by querying the resolver directly (Useful if external DNS queries are only allowed from trusted sources on the router) * Use a different port, avahi-daemon may be using 5353 already * Add/document prefer-ip6 param which may be very useful in conjunction with do-ip6 --- docs/guides/unbound.md | 17 +++++++++++------ docs/images/RecursiveResolver.png | Bin 9074 -> 9088 bytes 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/docs/guides/unbound.md b/docs/guides/unbound.md index 6a84aca..911fded 100644 --- a/docs/guides/unbound.md +++ b/docs/guides/unbound.md @@ -68,7 +68,7 @@ sudo mv root.hints /var/lib/unbound/ Highlights: -- Listen only for queries from the local Pi-hole installation (on port 5353) +- Listen only for queries from the local Pi-hole installation (on port 5335) - Listen for both UDP and TCP requests - Verify DNSSEC signatures, discarding BOGUS domains - Apply a few security and privacy tricks @@ -81,7 +81,8 @@ server: # logfile: "/var/log/unbound/unbound.log" verbosity: 0 - port: 5353 + interface: 127.0.0.1 + port: 5335 do-ip4: yes do-udp: yes do-tcp: yes @@ -89,6 +90,10 @@ server: # May be set to yes if you have IPv6 connectivity do-ip6: no + # You want to leave this to no unless you have *native* IPv6. With 6to4 and + # Terredo tunnels your web browser should favor IPv4 for the same reasons + prefer-ip6: no + # Use this only when you downloaded the list of primary root servers! root-hints: "/var/lib/unbound/root.hints" @@ -129,7 +134,7 @@ Start your local recursive server and test that it's operational: ```bash sudo service unbound start -dig pi-hole.net @127.0.0.1 -p 5353 +dig pi-hole.net @127.0.0.1 -p 5335 ``` The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick. @@ -139,8 +144,8 @@ The first query may be quite slow, but subsequent queries, also to other domains You can test DNSSEC validation using ```bash -dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5353 -dig sigok.verteiltesysteme.net @127.0.0.1 -p 5353 +dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335 +dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335 ``` The first command should give a status report of `SERVFAIL` and no IP address. The second should give `NOERROR` plus an IP address. @@ -149,6 +154,6 @@ The first command should give a status report of `SERVFAIL` and no IP address. T Finally, configure Pi-hole to use your recursive DNS server: -![screenshot at 2018-04-18](../images/RecursiveResolver.png) +![Upstream DNS Servers Configuration](../images/RecursiveResolver.png) (don't forget to hit Return or click on `Save`) diff --git a/docs/images/RecursiveResolver.png b/docs/images/RecursiveResolver.png index f2d4d008390d6554abaa09c8a77026d9b25f1462..c2a246f85d3f024d44bc5d2887837047b2cbf14b 100644 GIT binary patch delta 8163 zcmaiZ2{=`4*S~U39aD}m5e}JUCLzN%WS+;PkdTm>%yy29DZ>#(IOZYqJgZEhP^Kc3 zc?g*fGJTt#=Y8Jq`oHh@cb&_*_uBWm_u6Zn^;^Gt-5WO_DVGWof>NrAfPwd!pP$9f zJ{F{wdmG(aKY5(9yqcA2H}c*jLEuYk&2!Mt6SiW{ekB$fxb z5bz+3&dDf72MJxIqo@ZT27h6AnCWeG!8SheHPWKU#N(OZeyg_^wHk%|)GjAq9rGU5F>W&$={Y0rEZ{2ct4 z6VOw+{~{bBpAAo_^c;?!f2iY*Mh_R+yWY0maFmsOqzKM?n_L zZbCwAldrN2AgL4M6N1w8_zelzjafzHQ)z5AxL&b}6hwMu`Qxia@)&fse-YiCTS_wh zdd8D|?sw=-UeT}Fa|uSb3I}OFXE=&`dOVb9AjIVsiC1b5ulMbclU`75jo`bYS9%_( zoo}`Mrf~^mWXR1NbNG6jOn!Aq2AkvkQQwWDqjCZtAWm+<1E`6*=l)XRduh&Crk$Nhv0< z_+u0dD_$36)-PRK{-ce-WrtjPO$sz|L|JJ53+qOP<(#v&oqzpA6fyt&%mzp{O5Y z1mBTD|DD4Aq~ECsN<`w!0>N%EgqIL>@9&I+5l?ksD2e@ud6c`&L>fQ|Vm&0WUJQmh z3k3(cRRFI0sTg|vDy$%1YLaj_x<(it=4GEb;N|M0G@5y(KmD2dlPi?eOLoK_AIhFo zm1MW`M4lm&lvx=tc~Z2y)DJ&ocoQY`NIpp(ef!a~9Da|8Tlqr;L+Ee!Eb2f0?wg&v z_A9g{)lY+^W^(P8oBQUDET^r^Jm~!H_!B6F*2W6nM)$}raRwUr?q0)u-iJK8}@uc8{S-+-H_K$m~Tdl+M`0YjfG zSrC}rV_i+h?Hkp>51k6a`HNqBInWOJRgc^VsjvVIKXZh$gL`mvOY-~6H8g{RwD;=i zIp)NjnvFA5^Ls(WgZj0Ns?zG*4E3=2^rH8viAv=kweOW1 z1t)X``nQ0~bpZ!l)svDAOuYH|MdAD#-ig1D6*9iOtC@1RMM|iQ?9F1x=|Eq&e)9|O zD!OxH_?jd}tFWD-@1E3qwJg@Y^vir$!*BXajD68}_xL+Z)HPS4$=5vm94~n$=SEo_ zdC-zx2Chf$QMFItE1N5x?@d?P(Nf>I1?XFa<>yp`ty!x5nok&BS`9T6D+n$75lg<8 zJocM;uYCUw5eCO9ZY34Ysj#nGxbvVxFCp=Lfl4xJS%#nM9r`e}As06#*{ri#MJ5O! zttH;@JV=5O-Rm*=ZvVmvDi2~ql17(AQpUiUC6@Qc=nt{t=P*thzfwg1i8l)piz7mS z&G8C0gSPfg7H0vA^MG=P6r-}0?|{qY%x2-Ow;jyP2{m`e*+ZL48ihwmG?7^#P{%*) z;&AKicDRk%B&IMsiW|eq_*&7}d_9pxWd{?vZ1Q}jLEYZ|hWXqv$2Yf(I8C~@v88k6 zs`fP?Q`iqan7QE4=sADCyZFd`B+T@9~%;NRoY3-&aIJ6oloc2>N zJwks?^Oe$SHA|eck*U9xr(0pC!)B8pSDI(weP*{YHU56==5Rpo0i) zqBl=#9~P+&VBqC`Sn)RZ#YlpmuM3aEc-6Cjtkm<{l-7ZQDH7-QwF{o&r)@HLOYTau zQ^FR_W1P{f?u~TQ3_a0OwvE+bdVX)UR0j7$^4HIFWuIQ4EF@O=vvXisLZ-&iVi zCjw$Fz(V*npBiF}`IZZ;Pza1-*{W2kMnFzSg((Jwpq%?gm@z$FxCn(-^v&77Q~I&o zzvcEJvQ7pl0sW7p+2>^gQ)V9Dc@f%Ge93(z1k@pB1z?2R*k$Uib#dh*#jf|xff{b| zf*P&XOI53crbt-IahEojGm|STtL-K)1j*z5e5Zbf9XYQ)qJ;r#(i`^W#joi z=IShFIMCmRf4%qej}bk24O}3}l!H!GBOb;Suw2sHA{81hmY3F-#jxWwQ)o0$l@J&Dj}xk1-fRpaptE}#qRLi?8p@Ngis32_zqfbh%fwj@38lbZT}4H1p* zCr=(}bvc6-iJ0IP`-3A}P-mlJlH}-idccc>t~MbVzvYkO+R0iLMYzL#u=9A$6vH8X z9i;grGO5|(3+@niH!bzu_c^X9-oPH?_&l$oQzIi%>`SdT)0K03jyIU}nBr3iP5YUH zkGuDjgJtWo_4SrVndA&2xiN7PB{N*){+zHyrT&W+yYPVZc2AP-rXsn+<1GRIA)!Fw z8{X=S3{u+`wpu?1ul;P=KQraSwMiDdfm?lyVnmDz%-6%8A9t0sB}vpLQ+ZjLmGYb@ zfNNk&DxJb)YSlYo{B!Fgfnp{zpgXvn3bVx$E+97|@cspN+Bup4Ce3d8Hj7J4mD$hC z5{?!^_kw4w#>uTcgYPl%=`#(cAhQSowPNjlkv)gcgIJc-B;&Z}70jOMj8YG;%O)BP z7jc(g+6Kli&0$dYTb%=6&xtb>bB7cD_NWJaw=w|jk7E3_UdJEChbx-`4qN%{BEH{ z8Sfl)vI3vB(#0lc)TaLCp19mbE3bPn^KNhHMHsN#!vp)VbO8au1_l>|gucPkF$y7% zLO39YPsHHmKO(k9SUQ}X&-(;M{sEIcy$eL9cBkdyHx1i^xLMK5oq5qFwoX^v%@Dz|Cg1VIWhhcs1L5OcZ|pp6u4(0z>6FMgbC9>yKV#zw63zu7yg%X&#rC zeOi1{y`#OZZ&S9Jv<_bHIn#;oYnNU&nJ^99`F(k_>jG5>@UCf~xse}euEO(dZd5JS z%snNd{*s({Y~ycZSq@$ekIH6`^IW!2Zr_DJPpfxneRlUhRl=Qxu`$dDE)_F1{tT8K zQe7b@9m&l*I+i-@RV@rQR&Qt?YzwN?ipTZU`BPD#)s2%IQj?v!Qg7p+hc$4Nys&KH zB8eLdD!N5Q%dUDmMj$)z?kE{0sJMJ-toiA4>V~i1^*=cDNK0RTUbSl4DWlgH>`N56 zQySXjm+Q)KbAMgfFlH*YjB&hnSNH0$J}b~~JYc6iBc;PSiOF7ctJJ%*1}^pR$JWDB zq~oo|N0}OgpOCOlPERuqMrECh5_@YlF(1hrnCm`UvsFx^k7!6#$twX4<}sHdf@A% z;}xa2$riEu_Jx#<_Gn{91xqBO$LJc0-}Va+TBq%Kt6ES1IneQ$ErKK?Y8G6fRkTg+ z`E3^CIq3>G8a%bFQnUnPeyvq9kNx_^e4rj#w_HYptyg2qej{Vjukdo{+7za?wEM!q ztEc3BfxhMr$0dM=mVw!PvRKMH7RiN5<7RSUFS3a_fnsCgpN7EF4iE?o2QYF>sz-cq z6@BRxj#89O!M`FcUR?-V$Q@w9{N{wT$O)l@*7AcHdqETdg!sY_@z=W_Az<*@+#SF1 z4?+B!Nt{YzcE#h6Y!_e=fmeutkqfZxLk3lZe6jY4+$6Z|Ej`;&$gKtVADsvgnlvT% zFP)Q1Nax?h9xH!tga5WBQQ(ymghQMfcCu0ozWjF}P22Jfc>x4Qe$*ciC`}Ib|hKxQQd4XH#be~4Q62gJ_+=9D((V@1AFMWrMf1j3m?PbiW2PtQ& zN@szTM3c8Io4PWxb8bk6-^+N~W->3>8{&laDJfHe@*u43Q%H}DKuLGi{$-UxI1z$vA1 zQje6Jnp1c0Ww(nPad!GPUYjHd-ayZX;j6!k<%Qt@*?6uvSE-ZD0gkCXo@T{S+u^Ux zU8_NJM9T$0^5XvqaHe2iUnD)6hT_snXO968soe1}rYwGzeS@Mbm68bKA@IKDYOI8L z)cR9Lk3xy*Dl$#a>TwFqGCvc~sNd+qFx=D!wd%vCXZLPhaW>Kh5(o?5-Hb1LGbC8_ zs8=#E28DdQmX%EZ8dhRDY}g5J;Vt*Ea;K~DD0U_)L_3|i35PCAqRf++f80l_Q1emw{Wy`n>?VJE#LI>Y?J;Wv7QxNmM10yw_uFHLD4PNh#2_KCQpQ_R zi)%N|h+vh{m@9s`M7uScN-_f#02Cqxe{2%td^q!MUqd&{ZN{(EMIaLQUAkFHf%9+k z#(c>3EDjxXH14$P!t(v(um0;s1S?M+)plX009QkmoZil3lbG)-3Od(4M%_=Ll}As; zXAgvb>dC!Kw3OOULfH}kW$ocMg0k^+;Q3z$?}iv_>j_WYnb!gV@PC2XaC7*-NEZx% zt}Myk(L-}*)FljV2IS1)*^yhGNDzX60awu+ak5UKC6QC2H5K8RNH^#w?Tp4Ms73V| zl{ePi^h;MghLCEco!-e&eIX!NJr>86%gXh+Y^i7eqq7wWS$9kCy|Do^qKzJ32s{7( z%xmyaduhBJ)dMy!wJxRj?v*b2JUGAd&0sw#*9E^^qDDRWf^E?Z2~)bBjE&$#EtnY} zj#_4F50*FL8bT_F7Ndr8E0*Z?5S^)oSoq5Z$^Vl1z#3%r|CRY5)Trs!3b(((=-iE| z56M$5Gfgm@Ee%lqW*_B{jbzNamat7L8lD?&^#CeN7q2K=UPToeecns#3`wsA;vvRrY_Tc|@kf%#>xx1)l7ildjJ{!b<&#>_z4Wl$jo>JJR* z$IKGE{w1JAa+_>`_=K_$odtHa>hsIgeihi5d6Gf}lxsMk6ArHsOC6#N(cYT0TWhFL zqQ8S#_(q7i7*LU;f1RyRYGp_yHq_4bkPSh!ujSV*E$xaQNK@LuqE2Y3$P#~dGyumh zKF78sn)-ASdopX%gMA!P&as2@EXc=?9j^Ec*f6ZaE`FJ(cI1f?O8Z9frIVRCS=vtf zN!E=p91h~%#&NTq-_QCvEGlgjsmGn&r**eE;L4F94??j$kXo7Na?o)JYVvfb!M$m& zIEW?DOAC`jQdXznFL`e0a@W2wr=k8bZ;@Mz+V(-fSS-ivKy9lgs!8A9*iVpU1(4QM zJ&Z?YAVa3p*~s}e#COdPWw`kAP8F4vDV+niZt*R-A2=PIJ1MOY_cMM`K|$ z2(=D>ctVr510XTW2(OBN5aTe)we;NI(@!1%Ad6QYoj#Nv6?6iqbYK><swV%h&;0>q=Si{q)?MRJsP~5v(bO)>j?pwavfL zX)4ZPR{+gjB=x-%JUC@JrF#~5r4nI1{(D4MC=i&<<>xACw`lGvU+}_`bQ|A`^?bXa zq;3ENarh&MD{i{23$Akoq3Wha>cuQ|Ifn9KFG%Jl`B{yb}!++Um zZYBulvQ&AIoGO~K1XzJuL+*8`)O0^uTI8qNxNX%2J)_AwQ{e>RRK_!a`=D4}WSXs# zybhfwEM~~J0vL=5q!@D|Vl$nCMIlAe)<9jFtzE)~j%R929&=#XS1i6#g~E8XtkJ`l2DVLsh#Om! zNQrxdN)0oYZ1PyQN%p6%NUinU$M!@o-aa+O)PJ`0Dwirv<<<31Rk;=3ttG$F59YhM zB`-orxq`6|)r{>6eHbqbYS2B7+#}9wb|qWJrLi zJdrIAHlIqT7~W2lYqvGc0>ES$yFPnW$Y#3|Gi1BpaMVF@u3Co8n3Fjctu%a)%xng2 z3ZJn}94yqBW<|k!L+#)Y!&|5v;Sc8sm>Lau^0>twH(>r6wei#;P|o+v$wG!m^gSml zzH<;{G+j8pMh?Y>FbIkZ7RJIr{l5cbM)Z#Uu^8483eHL3Ad6pUJgr-npKQVlq`BSr zU@_A4N4Og8^n#X?a;C@pz93YkBv;xqAz-4il|4jP>huQgS>h-*w&5sh>x?KIQP7WucMB^M@6fTx)(ugj6aJLgk1L-q} z^?X-`#8mPd#Jw0Jf0X>yRV`^kO)wM@oBFdSah11HBeS+fUt{9y{oIYEK25E~uM4gG zri4O4hW$un8k})q7O51)LxO;oG6dAdn;I|8)=Gj$rR;xAvKb_UrrnJfQz@=V9Lc={ z&5@prA3+_0DXN(R=B?JE!&2)-xw4lWWqg7@bo=PwCd?PB65;D3&+GlrNalUTq}jxC zDMXNKz2m>{<3!aTx(m~Ig0v)qW4ulHa@6rM^wg{2z1fnC(V8QPr`{t4hvagb@Lebs zGRYM&ZT!x|Rhsj6P%s=S)a6anG1)cG-2$b+tDc(osL$@P0YKnrbT#!%eXC~}20E8J zId_AO-Tv(q?&J{eMDXWKu4&g!TTlQIcpExb$5LFmBL3%K{V_&(4z)~Qf0wvm^U{b6 m$DNYmS{qHELz#f!4UuVs_>1z{AUOi)PgO}vu~_~N=6?XBL`66N delta 8164 zcmZ{J2|QG7`+sF7I}?KzGIrUMB_s~Y$gU8Dh!};(k|l9+sE3fTWFKVTm+aXhitNTR zwvnP=UmrypZmVV|A9cxUD-|C2$a@PAQGYuHW+`xj$Ulgb# zAV_sXL@Id#y^V{Cq&3>Wnm$vMISGOOmWy)RSlf=+GTvLPZrFkk9W28B63ITy#{C-oSR4P<&t=JzuG(j}` zs2=;KlJ?+^<8V-@XA(;7cnJU@PIh*!*{NLx0vYJCS6wm~^C!hm-MSf&#l4u@XGQ2>)d;#WeBy4Zi;V$N$xuGgm(ii* ztRZJO>U6{B2TLKO#@Eu6#1x8-?*dovwA-1TF_{x|DDq@;#&vy_yphZmNVNYBQLSA8 zXS4?|=(zZ|-A!eRgHoEfD-L?x3ugQ^eM+CySR9r<96EWdN$(gOU(%pOPEA(zu7PPxNRGU#fqvz16UzxL=9{Lh37}!W@%mIMcMAnBDi@4mmg5C)$uC zP~M9`vO)w9ZRWGA@-BFZXmG}CtY_|)m|agV@eh_R@Abz(94dZ_#TxwS&RsrXnVTox zk&B5p?Wx`L_0!UPELE5BJO#nj-#4~{a=?q_VJ0F~k{$I#$WGSmTolI@^m`lae;Ddm zLk~vXNluy6k2j^{aD5-$O!F={&Ycb?l(0i8b0S8%kuMVq-XTX!W*45^sZMEB4^F?6 z+?Bd)%1607=`Str29}l*j<=6JFDomomweYcZ9cir8I-C?3@UQMtLV+$)sXEBx%7kZ zX+&scRC#?!c647X|K}uU=M!u+&9y?+>KhD3UKVlQGz!5i{dzY>7ZyNI&q};Q=Ocpr zeaX$tAsFz+m35u}W&NW4VXyl_=xDB<-j`l2(N41$?{>uexj~>(DwE1>BU+x0_&oGmBaVb>l%e!65Knwk&)G;UW zI5At3-n=$~LsjbSckkk*+SBzAn4HR(xl(ooP>&hax@*#rq_jFirScso1p^SjFRmj2 z{G}vCsZLwB_K#PyL-jP!D=lY2nEgq7F(;3zP5*~Zr7I$0E%KV>suNxrl`Lmb=zVC- z-VVRaLCuSrp;x7S8>KHq{jx0PJE_*Hh6}w3y*y`E{-s*o4s+F!_8J}4VFR062cTvh>w|btwNEz!e}`n-5t;`lkKw53%I}HU@Ez*>dvZwuAwW@ z`9X7dE_x3hq;lEA{G#O&A(t&cZqBp10kxuiBa~JRh{Pn^TdL%w-M+a3-UGSgm{GUpMR?f{o;!aYvP%V|bi6QUUg^qvDf*~kWHtpw z=dD zIw-Uv1Yx6R?7Pg@UzpO9=S)1B^i96YLi+AQI2D9)>{4u2Q0nSLk*Ac4m2CLyg8eO! z)w$i)Q0gb^-_}<&$S*aoPZT{QLC{LP0YzzKmW4aD@B=~EY1NvKe z!K|U?48RA$xh%@5y(m@HpAsz~W&5KlK^iMp?Da(Nr$tGj#%$wxTz%{T!t<7_8|&m| zyN;Ue^VdjjiLQ7U+P4|DQf}3$)?~HR@Lopo^@D@wG6cxi*B9@5A))IqahnqI^-}H< zm;3dJ67%LBnHlIEI{v!&7=s%g{7Y?^fpFLS@b#dOd$jTm2gabwV6wo0U&_jP?7A5P z{qzUq`H;xyA(tTA`^s%zSh&N^K+*J`J@YDKy?*V+&hZOHhXLz`Z`Len7(ccRH@R4~ znWXNo!Ilpb~Sl3_1; zfA$HKsaTsG0AgqBalV_x0p68dS?1>DiK@?H2NcoiCCz&w{O*~9i635^??fC<`|$oD znhxJ@JS<8CQC5%yc?lqStDxJ3;&a1?@lCgy!D3U3?@`gk9SuX8W`}KQ-ZM|_X>Lb+ zjEL=anVry0YF`tJ{JNf(tgxDM;SbRO*d&Qz8d6gMhm?X_o^qFKb}B7o+~4C(C~j`p zQcB-;efT~?O6GvlSXT7Op1#i@9k`rlBjYG23ATTu}{}4$rSF^Lv;}u0q*7R-E!u>B;NcZ~5u|uyPa$*4&Gk zDp~yj9xet2O(nP*CkWJK-aq`h&^zEic#E3~B1pM?fHq9N+UWJp_NvAE6Ot|-*X$#_ zo)2>}l~TDfl_UWd(YW6rC$Q_y8Qc0f z2eZSh?rPlCAh|R?B|*P6e7gM~#gi|AqZX8o%H8K!ybn1|9fHP+Btl z0~IPLDp60nM*n|fNRuX3U>Y&Iwf#;ZCeH)`bB?z@L%(}bQcc9wy{C@0x#hNPj*;)+ zdd1`Fwb)@9Q?Fp6k)2)xit2OT8|_LDUOM0R(>>6^hwwx(MQ!OmbC+eWb%nX|h(JM* zl9`ueRD+@ta!eV3X3sbNsP$S85{kc45n?c6DyEcEDUp|nu?N-%ci}608?=!b3FhDB z7Yh|dlyYL|^UTm5;p2CN(t^*O#cAn1b&XI~QOaE@V=N@c$h=p@+ps!ge3kD;0Q08Q z#0q9Is#Ct~B5o(CHm@?MG`OTlSO;Wne%14Dj&TnuLn^HNg!?~JoaE}WME8|f7Ash-D%m*NDE1aZ0ai-kq$ru(Adut9UX z)j=b#iIedSNs4t>hX@lkdVVR`m9io`G=j6h%<69W)%~r#p!yTu-*T07bA45m3Peoyv40dG-QrZ%8; zDAKqZtZ`|irf`eXA&Xd5z;cIh(4$L`jp%N88tjpI;m*S)Z>|rCm&SQn2tXXKgz;Y6X zQ;d2zOgvM=pFqu>B#=e0wHZSK29fz6F9qQ|x~dA&3^+JEu0;}j%8YnGR$7Eq+}l9V zST_mj;hutWWh^Ko$2s}vNC|Y6$B1V4K+ovlOK3stPR0pu{ho1iV2!=MO`fzKi;C9Y zjgEb>f5-oyfK2V5or3pevvj#069{n^vPaV_QNZTgBVhc2)`dIm&rmKEW?8)fAXNN=Z3Aso@LB@Ux@{O^c`&0st5{R) zvptJ)A#o9ZIy;`E{*&y=eCKK_LDuTe$|`fA;uv__1f>_b@fx}$W2T(_>{nx2Kp>6$ z@|iPZ;}=Erfvo-Sv?{lHFpR((5h~mk6^Zoh*XC|=GFk-_45^w{W>#yw{$UOOB^)^M zas_fyz5D$%KlyFmwDSSW$~zZ z`#*}oqxXK5qo_PQl*v$yfIZJaP1|gK5Dy&iQr7zphd1D_W<$5zIdrkxBDlRE1oA1+ zIA6x;3tUUah{)AB|1yv_eJU!ajW`y`i+#!Vi7vm*wj^+M`d66~FJmUT?BJ25SkSgn zVHrQQe5Hg2EwHDI1^cZn_P)~Tc9{aE%y2Txe)H;YpRrInzxPK0*MZX$@lup6NcKM9 zcW(%;SlLsI`65!=gS^1f=WO2F5O#8|jPV88Ns@Kp4GZC-GrQtgjZ&io0ke`+xUMK} z3qYuuh~3cM%Ku2*O=QP(CgOA3J91M&@59J!WrX~4Z*z{|T-l$fX&_4x2Irb9i#Y+1 zX?fzx=S9-pS6AnYpcI~)>FQyWJx8>>*~N-daX(x6wiPbJ^ruPp=-@Qdg`L?vyMq&T z1wARg03ym*HNkNOeR}U%`x|&mO$44}>tX=k-_XlcuuH3!kjBd;DDYpMFH!T zA5`_Toe8?PdZ$WkqWT71ernV`H<8x9NgH2D6h}mRm(84i*Djn9(Twc67MVkQ@zOrq($hK-}!!PWXsn&bOrmV8kZy@jK)G z0psgz)nmeH0wU3pBNq)&*2;lTS@W_qu5}ri(JY7jKHc5tRH#^hTQbO-lf+vM^ilFXdfdh32=z9+ z52s*HUTX|ytb z5lg)_uvf|11odDVL?;hv*QV(FQN&S3OJJ_-DB1`HZW3hcGWb3kf;wPgeN>-A`+kKM zIVQnP5Qocu7Nevh1Vpr%VpC!-iKo{+apAqV#nFe*WlZodbcm~eQn74>g|ALrg*`7$ z=^{uEYxTSp?hR0LKNI4EvsUgY7iA-03T{0^xs4q907;?v_45*H9G_W|8=Gp;&|ak{ ziJ<~@@K81aJ36KI}yS|9Z?B0LHt-&)tmDe@nB-oZ%J%5Rx}6XmiYl9lQl3_ zNe0jfOgH%mUPG6T-kF+aQ8QP>=wd5i7UX`DhilnM3o-kbp!`1s66yUo$1juvK5!iI zum3{Z-|D|fSUC+@b4ARcs0{K@x}V>;bgj3L?lJ%ta6mot@{+o=KZXz%&UI<@y08~%){!vbYfF}d}a>3^Uey}$pekFn@DTYf6=gszfwDX z&9Va2N2l{suZ%b>SE-*AWjgQAQ41_!>L>6`7#I1B(0OtQPMVy<(}Ss~`xeHDB7q!l zHi3~$Gb4PGdgS6fG03{I)QlFeXG31|{7Ic9p{rT5dn#3is!+|3JqTwRb9V?|@PqF%w!ASbAd zwNcpo=)lKY`eukXxh4I~vYByBPDXXRp7DfDHlb-t75f<;9vVd&12ltiZp|7q-2YAy zz(FdeNVz{)@uRO|+9BSsC=&OMWPCC@Pa{8%yo3j6*YdT}w_>D|G?qHtK00u`UYM&A zj&CNVm7kq2C19Z|7f4IWz|48md0ZmvkW{B+cpT)_ufQ25tClh-L|&mkA1#FBA@}$w)fTXeTwnG!}tV0Rb2uuXY<@%T@8> zZqX5g?2B6~YYz8|bUP9%inOtVT&?1W4I&GNCADC2Wt16j61@iGG%A@Hf&*KoHdCln zn#%CL^-`2S*$8(k7^&7A6xz+>P+p3H5LRNjtosq7`^Eu$>n&gU%QO@B+kdpKZ z(I^_;!Qsr!M=8WAv*`4+__=oZ;m_>}X~Q!2!7K}A-`mtGV3s0y8blf+cnpMYR~*{ZeiY9BIt9mA z>`mY4&;%96ZBOT^3W2|_;R zOc75>!ef1Wc?7DOniE2yW$yhaNB8{k*dp=py?R9im_5(WWFmxgsJH=5@jq>MU${pt zK%S>xKDq(i5tjdE--Pz5zEBNsgF#}QQBRD1wAoc)eOfL%-puyei*WL^uK&5J?p)~q z9|SxR!K7cceLBeV-Xz?h(&R&;wrtxFz~jtH+kG@%2ZCUiZHcL{C3HG2SM0-HXIPiF zyXCHWvKFeOu*gKC7x$=XxJpeE&2a|-Z`0mBEJj(MmS6t)VLPpAg7V_oXp)%!>}xf9 zrCedh(`{87A5YaS>lG3!forxZP3>m}Py6=``~=zZMQOZYVI$p(&xK4XLnCb~PKwm!wjPh|jR z)u{j1q)i<2+_&WMYQu2C7PBjy*0cNY@#z( zzdmpHiJUveZPCC*Yg}$4qj+gebVZVu;98Xt&Mcz4qM?$6`2I{A?O8X@y5{4_5) z6kmk5J#dW_5rjllu{#ROEYwV#f$u}^R&-Suf{{N9?U}&gg*Z2%nkp_oWHN@?>LC82 z!vvY<^iN=l^bkQF1?PS^7?&#>k*Xe>8A+EQ$9A@Nq=%=_Ukk#(H0{>AOLp-#+=%o8 z9q$aNwM^H3i^%__=1Y)-pdw>7%*!2Pt>OSk&(bTE+za*pf$2o?O_0_++$>2eN}!r ztIK<<)UGfksT>CNk7J7V?#0ow72#UQ`Bd_MB7F5$_i~1Ob!jpRoJ#i%#_OC1l9{tU zm6SX>1KsLF7w+8?jVXBhH*ZQ80nrQPF|()~5|QA6{;;K(5jyecc}h_&YVe#Wt*JX- zJhoNLUl-f|P@FbmffVY43lP~gk~@c|288CzjD3rL`nu{N7fS?AeQWoD(#^e1u(v$K z#jXz*iJ3}0k%Q%=d2!r0+4dh-ki0&IT_z`T)VeP#>YrJz7y%PChE*hQUc6kEq58{{SA%~p zEN7T|>tj6{$X;ozl1JIM1SC;tKHS!4#;rqznjB!QY^eQOA8uy6+n*8yD;)-8b*K_$k-Z1~5K(>{#*qN#knS*sq_Y RP8=iuG_L8W6{_5W{vW5on4|yz