From nobody Tue Oct 27 10:04:35 2020 Return-Path: X-Original-To: quic@ietfa.amsl.com Delivered-To: quic@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60A513A11FA for ; Tue, 27 Oct 2020 10:04:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zO9wESc3VHxL for ; Tue, 27 Oct 2020 10:04:32 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00050.outbound.protection.outlook.com [40.107.0.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 618EC3A11FB for ; Tue, 27 Oct 2020 10:04:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=e1s1L8JufSwWfewbuJ8y++WvTnLoUpZssRL0ajXZd4uEmZB9V4bSTzQiMpcZPfZmL2NHo+BmKzSPxWXAh3XVyODktf+sEGo9Q0UTlbjBP5fCs6Egp70ZUZ7xIejzBG/LpO1+5jjaPn1+q6NdbPzGe6i2DWAmhxIz13afucvfKgm1hLdayLgAWu4NS+1Ms0aoo8MneUIVI1ARuf+ha/kKaE8rV/UcvY8ziZ/mVoeFv17Q1vCHk1mjnG9yqjE4jxM93YmkglCTjr4sBhnvktlMKsCSUzf1Ib4tN/VJKneRsonn97S2vxw+t0jzT31jLEf5uRK8N8uClHwd/dFpwn/nQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nEm+hunZozr8+O/ZYvA3XXQFM3DkdmDvoT+fFyWEgaI=; b=bHoecJQPfFmWfpMUn6w2XfrAO11Xg3vPbapqHLagpcfsYxcM3tiEQM7wutYR8OlAOLv54TgXRzOs2IQX133mo4PsVKT1H1Od/n3SBf3Mv8GRuBgqH/ghr3k3SeZ/Koy9HfRxwOTXY5ZORysme7gXkrJQJpZjL62C5Jy0pP2ZlANgzOYZ5wxAgflIryziMdKKEPN1sObLmB/ZVN71V4kqH1ooFC8KpOfVBZ+gd7y2rShvYfdsA5Yf9C6YzBM9OR5jezsv4wR03DlJlLz4eLDNnl6KM1+5FWsUapmzALaSMyasN9O7o1arEsc+U1j4F3lLE3JAgYNkORA7Yl6xIdjTng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nEm+hunZozr8+O/ZYvA3XXQFM3DkdmDvoT+fFyWEgaI=; b=Akc3vY1afAzVvJ5QjSF+bM0mkSfDMX4OCQIuLEg5vmLwRJ8Ydf8xCDHnkSEOESyJr58qWwlxQtYSxhE5FMmx+wZwljSvjZH6E+Wuufeq5IZ61akVFCvDSVgY14Ox4uYXQMLIeVagsnVTMrKJkFLyzRJqzOIlfJez2Wrn4coVTkY= Received: from HE1PR0702MB3772.eurprd07.prod.outlook.com (2603:10a6:7:8e::14) by HE1PR0701MB2266.eurprd07.prod.outlook.com (2603:10a6:3:2c::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.15; Tue, 27 Oct 2020 17:04:28 +0000 Received: from HE1PR0702MB3772.eurprd07.prod.outlook.com ([fe80::cd13:5bbc:84b2:cc8d]) by HE1PR0702MB3772.eurprd07.prod.outlook.com ([fe80::cd13:5bbc:84b2:cc8d%6]) with mapi id 15.20.3499.015; Tue, 27 Oct 2020 17:04:28 +0000 From: Magnus Westerlund To: "ianswett=40google.com@dmarc.ietf.org" , "ximaera@gmail.com" CC: "mt@lowentropy.net" , "quic@ietf.org" Subject: Re: Back to work Thread-Topic: Back to work Thread-Index: AQHWrCtWcKW1sYPxXEaz7HX0GwoCCKmrE90AgABZbwCAAEDQAA== Date: Tue, 27 Oct 2020 17:04:28 +0000 Message-ID: References: <0f150dec-e408-48bf-8e54-05e3e96e7a85@www.fastmail.com> In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Evolution 3.28.5-0ubuntu0.18.04.2 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [158.174.117.100] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4d4daa8f-e807-47ae-de97-08d87a9a5d90 x-ms-traffictypediagnostic: HE1PR0701MB2266: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: MQMzYaagJIJ9wnuR15GlJlU5dmYV4BgfjyzjIMBubcc1M+5VL5oquwSqUCz4twW6zFaG64kPOgODpXhodwTbXORxHjIb4+mwJVAyKnJrQmKlFln10LpBA0AJCwCO61olX0wiD9UWKLOAcH7mgdYpaqN5D+T7U5EDlf6v3gp7ihNVwKH9cEIdOLBJgt7ePR0eDHIZFatd7Abf2VowTVhKkfYEjeo//cIHEwHxfsH/up6b5K0li0D4SZInBXs4roFeZAZhHF0Oy+JVYxx6Qx3GR4qjA4w7ZzZZOi5+69QyqSqo190oBczLkhjVrg189YD+LZJsy6lqdJyq5yR6EV2+OsRm43m+eR51hEilTNnoBfzBlEGA7p/uiOWRXMoE50iX x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0702MB3772.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(346002)(366004)(376002)(136003)(39860400002)(83380400001)(8676002)(6486002)(66446008)(64756008)(66476007)(66616009)(99936003)(66946007)(6512007)(3480700007)(6506007)(66556008)(4001150100001)(71200400001)(76116006)(26005)(110136005)(2906002)(478600001)(7116003)(44832011)(316002)(36756003)(186003)(54906003)(86362001)(5660300002)(2616005)(8936002)(4326008)(99106002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: SvwaW4josEcnXDI68fYxDEpHtbbTXINom6ug99j9QqCOvrQZnYtgBP9uvGwoxKKfIw1tH9QbH/PgtCgwIyHHKvbPtax4/kRMnYwJrp84taHRMxUsQOeM7iHaCRf7Hyzsp7HBH8fZsdBtukxsXKglNsZ/w15nZnYXQnoBIeRvT7g+N74oDCO5DVS4OOFSZ7Q0dgKQBKjkxW/1/lfZXoUciqxRXL1RLhBl0YJXaFwVyCaY7GOD7OcqTbXYy66p4hDIwIZny5a7mqfoFpacHankA4yjQc4bltO2loIK6TsTOfFIbrwnQKsMuBuIg7Zgfie70xE93VolfgQJJql2BM2eo9U0Bjrzf7djx0lQCrFEmcqDVAEYKcUbI1rJjliezeQrl7iT7Suo/RZ9DWYAwISaxCaMBaImV8xFSpgL7Q3CJS1fSh8f46HJ6JVeIUA4x1qiB4QxZoCvQrC/Iqq0ocadbN//UOKuOdFfHEXT2nggdLqG/8u2lUgNuC+p5T9tO6PULKksym85cl7RoTDh6x4BN7mYosuQgHB/MwwftjApeqvMZzVFOaSnCLEyoUlk0HPM+k8Tmef/2YpUUrBUYGhiceoMi2mToaSnrzOn2X3825sQXdSaQvYCULrw/gvm00bBv65XKCMZBmGe7Js0xfj25g== x-ms-exchange-transport-forked: True Content-Type: multipart/signed; micalg="sha-256"; protocol="application/x-pkcs7-signature"; boundary="=-/9+h9rP0f5OSCd/BdDPv" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR0702MB3772.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4d4daa8f-e807-47ae-de97-08d87a9a5d90 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Oct 2020 17:04:28.4353 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: T4HfOd/GNNckYDqrdGmHePJbf52MJDJrzI+jBcRL+PSFv3gpzN8Op6wIGH0Eu2/lYV1uQ+sTRU1Sbb1FKFAfAGRPB1ENV6xeoREckUy4A+I= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2266 Archived-At: X-BeenThere: quic@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Main mailing list of the IETF QUIC working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Oct 2020 17:04:34 -0000 --=-/9+h9rP0f5OSCd/BdDPv Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2020-10-27 at 09:12 -0400, Ian Swett wrote: > Thanks for summarizing this issue. I think the above discussion is about > immediate migration and repeated immediate migrations, but I also wonder = if > we've introduced a single packet amplification attack by requiring > PATH_RESPONSEs be padded on new paths without a requirement on the size o= f > PATH_CHALLENGE(see first item)? >=20 > Validating a new path > If one receives only a PATH_CHALLENGE on a new path, then the server > responds with a full-sized PATH_RESPONSE. This seems safe. If a non-pad= ded > PATH_CHALLENGE is received on a new path, then the peer is supposed to se= nd a > fully padded PATH_RESPONSE on the path, which could be >20x larger. I'm = not > sure if we care about this, but I wanted to point it out.=20 >=20 > Immediately migrating to a new path > I think we should remove the text about allowing kMinimumWindow each > kInitialRtt after migration and change it to the 3x limit. I'm actually > surprised the text about 2*kInitialWindow still exists, since recovery sa= ys > "Until the server has validated the client's address on the path, the amo= unt > of data it can send is limited to three times the amount of data received= , as > specified in Section 8.1 of {{QUIC-TRANSPORT}}.". >=20 > In order to not get deadlocked by the 3x factor, I think we should change= the > newly added MUSTs to only apply to path validation prior to migration, no= t the > peer responding to migration. >=20 > My reasoning is that if a peer migrates prior to validating the path, it = means > it's either unintentional or they have no other choice, so the migrating = peer > has implicitly decided that validating PathMTU is not a prerequisite to > migrating. So some quesitons and ideas as I think it is relevant to resolve this as be= st as possible. So isn't this recreating the issue that if the client initiates a migration= to a new path that is not QUIC compatible, by responding with a minimal size pac= ket and completing the migration and then if the server performs the path verification with 1200 bytes UDP payload it fails. Thus maintaining a broke= n path.=20 So is there need for the non pre-validated path migration case that one nee= d need to do a two step process where one will ACK with minimal packet while initiating path validation. If path validatation fails then maybe one need = to close down the connection as the migration ended up on a path that was unab= le to support QUIC. The question here is how to avoid the DoS attack this may ope= n up if an attack rewrites source address of packets.=20 So Maybe the path validation needs to be a two step process. First a return routability over the new path to verify that it is bi-directional. When tha= t has been verified one does a test with minimal MTU to prove it to be QUIC compatible. This might even be done with application data if there is some = that are available to send.=20 But, I think that one needs to work through the criterias for when the QUIC connection is shut down under the conditions that the path available is not supporting 1200 bytes. Also do we end up in a situation where the client ne= eds to do the second step itself towards the server to verify the path so that = it can determine if it needs to try another path if this one doesn't work?=20 Cheers Magnus --=-/9+h9rP0f5OSCd/BdDPv Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEtww ggYHMIID76ADAgECAhALRm3NcHtuMGWutmt5cXntMA0GCSqGSIb3DQEBCwUAMEcxCzAJBgNVBAYT AlNFMREwDwYDVQQKDAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBD QSB2MzAeFw0xNzEyMTUwNzIyMjNaFw0yMDEyMTUwNzIyMjJaMHAxETAPBgNVBAoMCEVyaWNzc29u MRowGAYDVQQDDBFNYWdudXMgV2VzdGVybHVuZDEtMCsGCSqGSIb3DQEJARYebWFnbnVzLndlc3Rl cmx1bmRAZXJpY3Nzb24uY29tMRAwDgYDVQQFEwdlcmFtc3dkMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAsKlHZvB3TsmLEDtPSiFFKAh73S2wApt+laqg5eXTqonqnzT9ykEGL2dx9mBT +2WZiIKxo4w2sisVl3EEYTqXTkctpur7cN29gLC8F3tJHGI2sUVpO9AwpVrN+UuHEVetHt7hdxW9 uYd0LJJ8TP6/wGkIfAFaZxlZUn79O2eHElfih1iVIiTZXLcEe1rBJtzhUNRHWgOm2vQlDJ4sCpig GFq5w+XSRviEQMkQZRvw1CQmb35QS/C/T36ogzIRHDuAdkoSaiUOY/S2dLp4HkwvOOg+tADpaHkr bdmdnjKGrYSnJigmxw14pJugxL/Vb2EeVcgpAfVVst7Lm4POPRI8+wIDAQABo4IBxDCCAcAwSAYD VR0fBEEwPzA9oDugOYY3aHR0cDovL2NybC50cnVzdC50ZWxpYS5jb20vZXJpY3Nzb25ubGluZGl2 aWR1YWxjYXYzLmNybDCBggYIKwYBBQUHAQEEdjB0MCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcDIu dHJ1c3QudGVsaWEuY29tMEgGCCsGAQUFBzAChjxodHRwOi8vY2EudHJ1c3QudGVsaWFzb25lcmEu Y29tL2VyaWNzc29ubmxpbmRpdmlkdWFsY2F2My5jZXIwKQYDVR0RBCIwIIEebWFnbnVzLndlc3Rl cmx1bmRAZXJpY3Nzb24uY29tMFUGA1UdIAROMEwwSgYMKwYBBAGCDwIDAQESMDowOAYIKwYBBQUH AgEWLGh0dHBzOi8vcmVwb3NpdG9yeS50cnVzdC50ZWxpYXNvbmVyYS5jb20vQ1BTMB0GA1UdJQQW MBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4EFgQU5ivuhpU51W4UhBDBWwf8XsU837YwHwYD VR0jBBgwFoAUHHsZnpecdqwgPdjc45Fq49stplMwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEB CwUAA4ICAQBn0FKukg00UN/c/ESpxSIaYTrsd8liHHMu5rLpOBNOacpGNBMGNgUDDt4QihhoQR3c vhYXCrAM59NTvw0HNlgqHZoEeVY7YnJJYnJXDCLUfkK5Dn28E3QrzykkF6giUOXDyF9mhWYbSAkJ yx0Yj0Xc8en3wYNyoFYEqjlKtZrdV0pcgFzEeXVLS8DWrzSy7+KfUtDOEiM6H3zO3nsq++KBmsOi SKkWn4oYERZg5KElEAHis9av+3KIaEPnOAt8QRWRpFfGZ4d89F16qFvElup5n7l864FqxnC2friD o4hLQY6ENaOaYIihXhbl2UYxAGDk89aJm/S5pYyq7wzm+KK3IcUl60rmc8SJlt6QXKw0wXEOE1Mu bauYKMsad2s8jD+rEkXp+agTRl+sezWaRxHBpxuUKDd6MhwDig3SZi1qP7D/Ds4V+JLIjjUJc25l 9tvMGC9+lqI0P+vMI3Zyrou0NNfb55uLQaq18O+7BZ8Kv7jvFdxYyUgbxQ0SPEiyhylcLHAmJeLC QaiZHmCREBkCLKSf0O4lE2TrVzdOD38wjzuQ27U3UddVCD9EQ3tF7o6EVhpxJJUlB6xe/2UWwy4Z la71dKLUhakdVrN5abzxqFWvzOAT9nBa2HzYVBtpbcu6KGh72YJ+M79fa9iIkcQCgUnw3gIAeWd/ /n4YbY2QhDCCBgcwggPvoAMCAQICEAtGbc1we24wZa62a3lxee0wDQYJKoZIhvcNAQELBQAwRzEL MAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJbmRp dmlkdWFsIENBIHYzMB4XDTE3MTIxNTA3MjIyM1oXDTIwMTIxNTA3MjIyMlowcDERMA8GA1UECgwI RXJpY3Nzb24xGjAYBgNVBAMMEU1hZ251cyBXZXN0ZXJsdW5kMS0wKwYJKoZIhvcNAQkBFh5tYWdu dXMud2VzdGVybHVuZEBlcmljc3Nvbi5jb20xEDAOBgNVBAUTB2VyYW1zd2QwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCwqUdm8HdOyYsQO09KIUUoCHvdLbACm36VqqDl5dOqieqfNP3K QQYvZ3H2YFP7ZZmIgrGjjDayKxWXcQRhOpdORy2m6vtw3b2AsLwXe0kcYjaxRWk70DClWs35S4cR V60e3uF3Fb25h3QsknxM/r/AaQh8AVpnGVlSfv07Z4cSV+KHWJUiJNlctwR7WsEm3OFQ1EdaA6ba 9CUMniwKmKAYWrnD5dJG+IRAyRBlG/DUJCZvflBL8L9PfqiDMhEcO4B2ShJqJQ5j9LZ0ungeTC84 6D60AOloeStt2Z2eMoathKcmKCbHDXikm6DEv9VvYR5VyCkB9VWy3subg849Ejz7AgMBAAGjggHE MIIBwDBIBgNVHR8EQTA/MD2gO6A5hjdodHRwOi8vY3JsLnRydXN0LnRlbGlhLmNvbS9lcmljc3Nv bm5saW5kaXZpZHVhbGNhdjMuY3JsMIGCBggrBgEFBQcBAQR2MHQwKAYIKwYBBQUHMAGGHGh0dHA6 Ly9vY3NwMi50cnVzdC50ZWxpYS5jb20wSAYIKwYBBQUHMAKGPGh0dHA6Ly9jYS50cnVzdC50ZWxp YXNvbmVyYS5jb20vZXJpY3Nzb25ubGluZGl2aWR1YWxjYXYzLmNlcjApBgNVHREEIjAggR5tYWdu dXMud2VzdGVybHVuZEBlcmljc3Nvbi5jb20wVQYDVR0gBE4wTDBKBgwrBgEEAYIPAgMBARIwOjA4 BggrBgEFBQcCARYsaHR0cHM6Ly9yZXBvc2l0b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS9DUFMw HQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMB0GA1UdDgQWBBTmK+6GlTnVbhSEEMFbB/xe xTzftjAfBgNVHSMEGDAWgBQcexmel5x2rCA92NzjkWrj2y2mUzAOBgNVHQ8BAf8EBAMCBaAwDQYJ KoZIhvcNAQELBQADggIBAGfQUq6SDTRQ39z8RKnFIhphOux3yWIccy7msuk4E05pykY0EwY2BQMO 3hCKGGhBHdy+FhcKsAzn01O/DQc2WCodmgR5VjtickliclcMItR+QrkOfbwTdCvPKSQXqCJQ5cPI X2aFZhtICQnLHRiPRdzx6ffBg3KgVgSqOUq1mt1XSlyAXMR5dUtLwNavNLLv4p9S0M4SIzoffM7e eyr74oGaw6JIqRafihgRFmDkoSUQAeKz1q/7cohoQ+c4C3xBFZGkV8Znh3z0XXqoW8SW6nmfuXzr gWrGcLZ+uIOjiEtBjoQ1o5pgiKFeFuXZRjEAYOTz1omb9LmljKrvDOb4orchxSXrSuZzxImW3pBc rDTBcQ4TUy5tq5goyxp3azyMP6sSRen5qBNGX6x7NZpHEcGnG5QoN3oyHAOKDdJmLWo/sP8OzhX4 ksiONQlzbmX228wYL36WojQ/68wjdnKui7Q019vnm4tBqrXw77sFnwq/uO8V3FjJSBvFDRI8SLKH KVwscCYl4sJBqJkeYJEQGQIspJ/Q7iUTZOtXN04PfzCPO5DbtTdR11UIP0RDe0XujoRWGnEklSUH rF7/ZRbDLhmVrvV0otSFqR1Ws3lpvPGoVa/M4BP2cFrYfNhUG2lty7ooaHvZgn4zv19r2IiRxAKB SfDeAgB5Z3/+fhhtjZCEMIIGwjCCBKqgAwIBAgIQU7h+g+GcmSiTsJtJHOy46zANBgkqhkiG9w0B AQsFADA3MRQwEgYDVQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBD QSB2MTAeFw0xNTEwMjcxMjE2NDZaFw0yNTEwMjcxMjE2NDZaMEcxCzAJBgNVBAYTAlNFMREwDwYD VQQKDAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MzCCAiIw DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOzy3wAAuFDyp7vYVLfGk/fjwao71MNGNLSzzl5D tjQtMtl2ZLPZyX6ViqzTN9JOb7uZ6KxuGSpReQvt8XOh7iIhkKH9W5hRpbjTsJmUMJd6zifhOpNK 6iSU3q44+FjsQL1lVtcguUuFG6aZN0N3GFVbgt6jRrASF8t/3wy9bHPAIfMyPybpg6Y2PH5/1Nwk TepoDSmK69LGV+lV2IK6U9OWayZXZFIFIDCoGyFlhFxAEgN+qZ2+Rqg/0TM0oCHvKO2ELSGmAdnJ kwizR42ji/Y9SYTSuG75mzSe6OfCGWM8Db/xvy/20aLEPXNu1PvOgzY63WZ6cmkWnjMlVJ90pWC2 haqDm3Yf8TRdjUvAl7Pz1bTuexwShzIGakL7MkCYrEqHMRaojI/VStloQgW76E76zQ2byw5QxrhO UbisBSKRzlTlOZQgYFFAbG6ViF8DOpJh/ygtQwuTLUM5r15G7eynQV1AMTNCWcX+HUvgArUw6RfW 9L58uA68GjktFTV8s9RlDsUqsNcLqeXaV28S2WMday0YGaq/bloS8AD7KuumUKH+Ri9IGO9mJvP0 5tvDHjKpLvv80c3WLJnJU/aznYHYEt2+jjKHOTqdGTxL/zMdpRSQFSuu+KM8NoYrkU1VJqKga+QL sgqKghMp99gu1P1e6KsqseWHdXORrMbjqkBXAgMBAAGjggG4MIIBtDCBigYIKwYBBQUHAQEEfjB8 MC0GCCsGAQUFBzABhiFodHRwOi8vb2NzcC50cnVzdC50ZWxpYXNvbmVyYS5jb20wSwYIKwYBBQUH MAKGP2h0dHA6Ly9yZXBvc2l0b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYXJv b3RjYXYxLmNlcjASBgNVHRMBAf8ECDAGAQH/AgEAMFUGA1UdIAROMEwwSgYMKwYBBAGCDwIDAQEC MDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vcmVwb3NpdG9yeS50cnVzdC50ZWxpYXNvbmVyYS5jb20v Q1BTMEsGA1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmwtMy50cnVzdC50ZWxpYXNvbmVyYS5jb20v dGVsaWFzb25lcmFyb290Y2F2MS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA4G A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUHHsZnpecdqwgPdjc45Fq49stplMwHwYDVR0jBBgwFoAU 8I9ZOACz9Y+algzV6/p7qhfoExIwDQYJKoZIhvcNAQELBQADggIBAFBYa/HVjDu0LqtXQ8iMp8PL Fpqchf41ksQY6R1AsoZbaBUu0NQlAQ9GzlC1pmI5s0cJnuaZI0xV6TiWS3/R2p9UgW61XD9CTIUb AL31mY3BdJf3P46gzKgQEca/DlFjq9GVmuPS4q90BLNgvgoxoHubc3C6s0OaY1sbnay5EhnvrAE4 Q511FlxmJPLnRmQGpieeXa3cPegFfY1kJDKyyFRypF1RuRLXcdMIgKEy5NX1bS3M9dQ4mgmUmVT2 d33UiKSEYQ6s/B+LFaaz4LywXSv2o3W4kbHoQs86IWst821ww0wxsCpEfClIvF7fBw2QkbG/1Pwu zAuLVStEhDzkAqOrMGctKyNEaBsyAn7Eq2eCa8QDXnkmagp9QPsNFs/oqnXj9j1cVtH9a4OPzhtg 0pd7gd0NzU/5QxibXqbYvouQgihGXHQDmaL4ruN7C4arMUqRo82YnREsKL7h3j/jtmzcMLc9Q07F 04QQd/iSR1Y5pIi6PdNBiE2/4uyAXS6KOIGZrPbNQUNrZtwiQpqQNl8AUzgegfPwrYFlFocpaF3d 1m5r+2VKKqiRQVfYPGYeZnWfkcz06JoAhc/9mjbHXSP9hvWYzeLRuoZqHGUdjOX9DIQb926OneV7 C5WMIjSY8ORkamG/HKqngmjypL3gSc6oG/E6B+1i6Ds5j0Qpj5aQMYICzTCCAskCAQEwWzBHMQsw CQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIEluZGl2 aWR1YWwgQ0EgdjMCEAtGbc1we24wZa62a3lxee0wDQYJYIZIAWUDBAIBBQCgggFDMBgGCSqGSIb3 DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIwMTAyNzE3MDQyNlowLwYJKoZIhvcN AQkEMSIEIKLZRgL1aocv4mHXhZhmmnvp6QrlN+2dO6EMG1UHJDPsMGoGCSsGAQQBgjcQBDFdMFsw RzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJ bmRpdmlkdWFsIENBIHYzAhALRm3NcHtuMGWutmt5cXntMGwGCyqGSIb3DQEJEAILMV2gWzBHMQsw CQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIEluZGl2 aWR1YWwgQ0EgdjMCEAtGbc1we24wZa62a3lxee0wDQYJKoZIhvcNAQEBBQAEggEAmClKIe5warjD Hj+bLlxAPBepTe6cI5go8Cvmss6NHcl6kkDa2serdgKpTVQOYix0Ak8k6Itwz5o3VWezIVB8GJf1 oSB0bDbRgKyYdVTadympOOii8cabVYOFBpUquSniur/CpXg/0DWpvJePWxokaiTsIK1ZgVX7LtCg G/uFR87aINQlLukpVKrC+tzXO2LsyCOGSyuYiZVP7CG9YQsZ/7gEm8wb5pet2Wpu6aUMaBa6ymmR FzoZDQ6r7kx3ktETC2jpuLz2Dc7UeIxNDqTYXQxhH6ISh142LX43nSgYW4vrTPsTbPuvkjnzgB29 am7WXV1bqGKI9MMUrmyERF7fnAAAAAAAAA== --=-/9+h9rP0f5OSCd/BdDPv--