Server IP : 172.67.171.101 / Your IP : 216.73.216.123
Web Server : Apache
System : Linux server1.morocco-tours.com 3.10.0-1127.19.1.el7.x86_64 #1 SMP Tue Aug 25 17:23:54 UTC 2020 x86_64
User : zagoradraa ( 1005)
PHP Version : 7.4.33
Disable Function : NONE
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /lib/python2.7/site-packages/firewall/core/ |
Upload File : |
| Current File : /lib/python2.7/site-packages/firewall/core/nftables.py |
# -*- coding: utf-8 -*-
#
# Copyright (C) 2018 Red Hat, Inc.
#
# Authors:
# Eric Garver <e@erig.me>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import os.path
import copy
from firewall.core.base import SHORTCUTS, DEFAULT_ZONE_TARGET
from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.functions import splitArgs, check_mac, portStr, \
check_single_address, check_address
from firewall import config
from firewall.errors import FirewallError, UNKNOWN_ERROR, INVALID_RULE, \
INVALID_ICMPTYPE, INVALID_TYPE, INVALID_ENTRY
from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark
TABLE_NAME = "firewalld"
# Map iptables (table, chain) to hooks and priorities.
# These are well defined by NF_IP_PRI_* defines in netfilter.
#
# This is analogous to ipXtables.BUILT_IN_CHAINS, but we omit the chains that
# are only used for direct rules.
#
# Note: All hooks use their standard position + NFT_HOOK_OFFSET. This means
# iptables will have DROP precedence. It also means that even if iptables
# ACCEPTs a packet it may still be dropped later by firewalld's rules.
#
NFT_HOOK_OFFSET = 10
IPTABLES_TO_NFT_HOOK = {
#"security": {
# "INPUT": ("input", 50 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", 50 + NFT_HOOK_OFFSET),
# "FORWARD": ("forward", 50 + NFT_HOOK_OFFSET),
#},
"raw": {
"PREROUTING": ("prerouting", -300 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET),
},
"mangle": {
"PREROUTING": ("prerouting", -150 + NFT_HOOK_OFFSET),
# "POSTROUTING": ("postrouting", -150 + NFT_HOOK_OFFSET),
# "INPUT": ("input", -150 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -150 + NFT_HOOK_OFFSET),
# "FORWARD": ("forward", -150 + NFT_HOOK_OFFSET),
},
"nat": {
"PREROUTING": ("prerouting", -100 + NFT_HOOK_OFFSET),
"POSTROUTING": ("postrouting", 100 + NFT_HOOK_OFFSET),
# "INPUT": ("input", 100 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", -100 + NFT_HOOK_OFFSET),
},
"filter": {
"INPUT": ("input", 0 + NFT_HOOK_OFFSET),
"FORWARD": ("forward", 0 + NFT_HOOK_OFFSET),
# "OUTPUT": ("output", 0 + NFT_HOOK_OFFSET),
},
}
OUR_CHAINS = { # chains created by firewalld
# family: { chains ...}
"inet": {},
"ip": {},
"ip6": {},
}
# Most ICMP types are provided by nft, but for the codes we have to use numeric
# values.
#
ICMP_TYPES_FRAGMENT = {
"ipv4" : {
"communication-prohibited" : ["icmp", "type", "destination-unreachable", "icmp", "code", "13"],
"destination-unreachable" : ["icmp", "type", "destination-unreachable"],
"echo-reply" : ["icmp", "type", "echo-reply"],
"echo-request" : ["icmp", "type", "echo-request"],
"fragmentation-needed" : ["icmp", "type", "destination-unreachable", "icmp", "code", "4"],
"host-precedence-violation" : ["icmp", "type", "destination-unreachable", "icmp", "code", "14"],
"host-prohibited" : ["icmp", "type", "destination-unreachable", "icmp", "code", "10"],
"host-redirect" : ["icmp", "type", "redirect", "icmp", "code", "1"],
"host-unknown" : ["icmp", "type", "destination-unreachable", "icmp", "code", "7"],
"host-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "1"],
"ip-header-bad" : ["icmp", "type", "parameter-problem", "icmp", "code", "1"],
"network-prohibited" : ["icmp", "type", "destination-unreachable", "icmp", "code", "8"],
"network-redirect" : ["icmp", "type", "redirect", "icmp", "code", "0"],
"network-unknown" : ["icmp", "type", "destination-unreachable", "icmp", "code", "6"],
"network-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "0"],
"parameter-problem" : ["icmp", "type", "parameter-problem"],
"port-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "3"],
"precedence-cutoff" : ["icmp", "type", "destination-unreachable", "icmp", "code", "15"],
"protocol-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "2"],
"redirect" : ["icmp", "type", "redirect"],
"required-option-missing" : ["icmp", "type", "parameter-problem", "icmp", "code", "1"],
"router-advertisement" : ["icmp", "type", "router-advertisement"],
"router-solicitation" : ["icmp", "type", "router-solicitation"],
"source-quench" : ["icmp", "type", "source-quench"],
"source-route-failed" : ["icmp", "type", "destination-unreachable", "icmp", "code", "5"],
"time-exceeded" : ["icmp", "type", "time-exceeded"],
"timestamp-reply" : ["icmp", "type", "timestamp-reply"],
"timestamp-request" : ["icmp", "type", "timestamp-request"],
"tos-host-redirect" : ["icmp", "type", "redirect", "icmp", "code", "3"],
"tos-host-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "12"],
"tos-network-redirect" : ["icmp", "type", "redirect", "icmp", "code", "2"],
"tos-network-unreachable" : ["icmp", "type", "destination-unreachable", "icmp", "code", "11"],
"ttl-zero-during-reassembly" : ["icmp", "type", "time-exceeded", "icmp", "code", "1"],
"ttl-zero-during-transit" : ["icmp", "type", "time-exceeded", "icmp", "code", "0"],
},
"ipv6" : {
"address-unreachable" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "3"],
"bad-header" : ["icmpv6", "type", "parameter-problem", "icmpv6", "code", "0"],
"beyond-scope" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "2"],
"communication-prohibited" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "1"],
"destination-unreachable" : ["icmpv6", "type", "destination-unreachable"],
"echo-reply" : ["icmpv6", "type", "echo-reply"],
"echo-request" : ["icmpv6", "type", "echo-request"],
"failed-policy" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "5"],
"neighbour-advertisement" : ["icmpv6", "type", "nd-neighbor-advert"],
"neighbour-solicitation" : ["icmpv6", "type", "nd-neighbor-solicit"],
"no-route" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "0"],
"packet-too-big" : ["icmpv6", "type", "packet-too-big"],
"parameter-problem" : ["icmpv6", "type", "parameter-problem"],
"port-unreachable" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "4"],
"redirect" : ["icmpv6", "type", "nd-redirect"],
"reject-route" : ["icmpv6", "type", "destination-unreachable", "icmpv6", "code", "6"],
"router-advertisement" : ["icmpv6", "type", "nd-router-advert"],
"router-solicitation" : ["icmpv6", "type", "nd-router-solicit"],
"time-exceeded" : ["icmpv6", "type", "time-exceeded"],
"ttl-zero-during-reassembly" : ["icmpv6", "type", "time-exceeded", "icmpv6", "code", "1"],
"ttl-zero-during-transit" : ["icmpv6", "type", "time-exceeded", "icmpv6", "code", "0"],
"unknown-header-type" : ["icmpv6", "type", "parameter-problem", "icmpv6", "code", "1"],
"unknown-option" : ["icmpv6", "type", "parameter-problem", "icmpv6", "code", "2"],
}
}
class nftables(object):
name = "nftables"
zones_supported = True
def __init__(self, fw):
self._fw = fw
self._command = config.COMMANDS["nft"]
self.fill_exists()
self.available_tables = []
self.rule_to_handle = {}
self.rule_ref_count = {}
self.zone_source_index_cache = {}
def fill_exists(self):
self.command_exists = os.path.exists(self._command)
self.restore_command_exists = False
def _run_replace_zone_source(self, rule_add, rule, zone_source_index_cache):
try:
i = rule.index("%%ZONE_SOURCE%%")
rule.pop(i)
zone = rule.pop(i)
zone_source = (zone, rule[7]) # (zone, address)
except ValueError:
try:
i = rule.index("%%ZONE_INTERFACE%%")
rule.pop(i)
zone_source = None
except ValueError:
return
family = rule[2]
if zone_source and not rule_add:
if family in zone_source_index_cache and \
zone_source in zone_source_index_cache[family]:
zone_source_index_cache[family].remove(zone_source)
elif rule_add:
if family not in zone_source_index_cache:
zone_source_index_cache[family] = []
if zone_source:
# order source based dispatch by zone name
if zone_source not in zone_source_index_cache[family]:
zone_source_index_cache[family].append(zone_source)
zone_source_index_cache[family].sort(key=lambda x: x[0])
index = zone_source_index_cache[family].index(zone_source)
else:
if self._fw._allow_zone_drifting:
index = 0
else:
index = len(zone_source_index_cache[family])
if index == 0:
rule[0] = "insert"
else:
index -= 1 # point to the rule before insertion point
rule[0] = "add"
rule.insert(i, "index")
rule.insert(i+1, "%d" % index)
def __run(self, args):
nft_opts = ["--echo", "--handle"]
_args = args[:]
# If we're deleting a table (i.e. build_flush_rules())
# then check if its exist first to avoid nft throwing an error
if _args[0] == "delete" and _args[1] == "table":
_args_test = _args[:]
_args_test[0] = "list"
(status, output) = runProg(self._command, nft_opts + _args_test)
if status != 0:
return ""
rule_key = None
if _args[0] in ["add", "insert"] and _args[1] == "rule":
rule_add = True
rule_key = _args[2:]
if rule_key[3] == "position":
# strip "position #"
# "insert rule family table chain position <num>"
# ^^ rule_key starts here
try:
int(rule_key[4])
except Exception:
raise FirewallError(INVALID_RULE, "position without a number")
else:
rule_key.pop(3)
rule_key.pop(3)
rule_key = " ".join(rule_key)
elif _args[0] in ["delete"] and _args[1] == "rule":
rule_add = False
rule_key = _args[2:]
rule_key = " ".join(rule_key)
# rule deduplication
if rule_key in self.rule_ref_count:
if rule_add:
self.rule_ref_count[rule_key] += 1
return ""
if not rule_add and self.rule_ref_count[rule_key] > 1:
self.rule_ref_count[rule_key] -= 1
return ""
elif self.rule_ref_count[rule_key] == 1:
self.rule_ref_count[rule_key] -= 1
else:
raise FirewallError(UNKNOWN_ERROR, "rule ref count bug: rule_key '%s', cnt %d"
% (rule_key, self.rule_ref_count[rule_key]))
log.debug2("%s: rule ref cnt %d, %s %s", self.__class__,
self.rule_ref_count[rule_key], self._command, " ".join(_args))
if rule_key:
zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
self._run_replace_zone_source(rule_add, _args, zone_source_index_cache)
if not rule_key or (not rule_add and self.rule_ref_count[rule_key] == 0) \
or ( rule_add and rule_key not in self.rule_ref_count):
# delete using rule handle
if rule_key and not rule_add:
_args = ["delete", "rule"] + _args[2:5] + \
["handle", self.rule_to_handle[rule_key]]
_args_str = " ".join(_args)
log.debug2("%s: %s %s", self.__class__, self._command, _args_str)
(status, output) = runProg(self._command, nft_opts + _args)
if status != 0:
raise ValueError("'%s %s' failed: %s" % (self._command,
_args_str, output))
if rule_key:
self.zone_source_index_cache = zone_source_index_cache
# nft requires deleting rules by handle. So we must cache the rule
# handle when adding/inserting rules.
#
if rule_key:
if rule_add:
str = "# handle "
offset = output.index(str) + len(str)
self.rule_to_handle[rule_key] = output[offset:].strip()
self.rule_ref_count[rule_key] = 1
else:
del self.rule_to_handle[rule_key]
del self.rule_ref_count[rule_key]
return output
def _rule_replace(self, rule, pattern, replacement):
try:
i = rule.index(pattern)
except ValueError:
return False
else:
rule[i:i+1] = replacement
return True
def reverse_rule(self, args):
ret_args = args[:]
ret_args[0] = "delete"
return ret_args
def set_rules(self, rules, log_denied):
# We can't support using "nft -f" because we need to retrieve the
# handles for each rules so we can delete them later on.
# See also: self.restore_command_exists
#
# We can implement this once libnftables in ready.
#
raise FirewallError(UNKNOWN_ERROR, "not implemented")
def set_rule(self, rule, log_denied):
# replace %%REJECT%%
#
# HACK: work around nft bug in which icmpx does not work if the rule
# has qualified the ip family.
icmp_keyword = "icmpx"
if "ipv4" in rule or "ip" in rule or "icmp" in rule:
icmp_keyword = "icmp"
elif "ipv6" in rule or "ip6" in rule or "icmpv6" in rule:
icmp_keyword = "icmpv6"
self._rule_replace(rule, "%%REJECT%%",
["reject", "with", icmp_keyword, "type", "admin-prohibited"])
# replace %%ICMP%%
self._rule_replace(rule, "%%ICMP%%", ["meta", "l4proto", "{icmp, icmpv6}"])
# replace %%LOGTYPE%%
try:
i = rule.index("%%LOGTYPE%%")
except ValueError:
pass
else:
if log_denied == "off":
return ""
if log_denied in ["unicast", "broadcast", "multicast"]:
rule[i:i+1] = ["pkttype", log_denied]
else:
rule.pop(i)
return self.__run(rule)
def get_available_tables(self, table=None):
# Tables always exist in nftables
return [table] if table else IPTABLES_TO_NFT_HOOK.keys()
def build_flush_rules(self):
self.rule_to_handle = {}
self.rule_ref_count = {}
self.zone_source_index_cache = {}
rules = []
for family in OUR_CHAINS.keys():
rules.append(["delete", "table", family, "%s" % TABLE_NAME])
return rules
def build_set_policy_rules(self, policy):
# Policy is not exposed to the user. It's only to make sure we DROP
# packets while initially starting and for panic mode. As such, using
# hooks with a higher priority than our base chains is sufficient.
#
table_name = TABLE_NAME + "_" + "policy_drop"
rules = []
if policy == "DROP":
rules.append(["add", "table", "inet", table_name])
# To drop everything we need to use the "raw" priority. These occur
# before conntrack, mangle, nat, etc
for hook in ["prerouting", "output"]:
_add_chain = "add chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'" % \
(table_name, "raw", hook, hook, -300 + NFT_HOOK_OFFSET - 1)
rules.append(splitArgs(_add_chain))
elif policy == "ACCEPT":
rules.append(["delete", "table", "inet", table_name])
else:
FirewallError(UNKNOWN_ERROR, "not implemented")
return rules
def supported_icmp_types(self):
# nftables supports any icmp_type via arbitrary type/code matching.
# We just need a translation for it in ICMP_TYPES_FRAGMENT.
supported = set()
for ipv in ICMP_TYPES_FRAGMENT.keys():
supported.update(ICMP_TYPES_FRAGMENT[ipv].keys())
return list(supported)
def build_default_tables(self):
default_tables = []
for family in OUR_CHAINS.keys():
default_tables.append("add table %s %s" % (family, TABLE_NAME))
return map(splitArgs, default_tables)
def build_default_rules(self, log_denied="off"):
default_rules = []
OUR_CHAINS["inet"]["raw"] = set()
for chain in IPTABLES_TO_NFT_HOOK["raw"].keys():
default_rules.append("add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'" %
(TABLE_NAME, chain,
IPTABLES_TO_NFT_HOOK["raw"][chain][0],
IPTABLES_TO_NFT_HOOK["raw"][chain][1]))
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append("add chain inet %s raw_%s_%s" % (TABLE_NAME, chain, dispatch_suffix))
default_rules.append("add rule inet %s raw_%s jump raw_%s_%s" % (TABLE_NAME, chain, chain, dispatch_suffix))
OUR_CHAINS["inet"]["raw"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
OUR_CHAINS["inet"]["mangle"] = set()
for chain in IPTABLES_TO_NFT_HOOK["mangle"].keys():
default_rules.append("add chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'" %
(TABLE_NAME, chain,
IPTABLES_TO_NFT_HOOK["mangle"][chain][0],
IPTABLES_TO_NFT_HOOK["mangle"][chain][1]))
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append("add chain inet %s mangle_%s_%s" % (TABLE_NAME, chain, dispatch_suffix))
default_rules.append("add rule inet %s mangle_%s jump mangle_%s_%s" % (TABLE_NAME, chain, chain, dispatch_suffix))
OUR_CHAINS["inet"]["mangle"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
OUR_CHAINS["ip"]["nat"] = set()
OUR_CHAINS["ip6"]["nat"] = set()
for family in ["ip", "ip6"]:
for chain in IPTABLES_TO_NFT_HOOK["nat"].keys():
default_rules.append("add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'" %
(family, TABLE_NAME, chain,
IPTABLES_TO_NFT_HOOK["nat"][chain][0],
IPTABLES_TO_NFT_HOOK["nat"][chain][1]))
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append("add chain %s %s nat_%s_%s" % (family, TABLE_NAME, chain, dispatch_suffix))
default_rules.append("add rule %s %s nat_%s jump nat_%s_%s" % (family, TABLE_NAME, chain, chain, dispatch_suffix))
OUR_CHAINS[family]["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
OUR_CHAINS["inet"]["filter"] = set()
for chain in IPTABLES_TO_NFT_HOOK["filter"].keys():
default_rules.append("add chain inet %s filter_%s '{ type filter hook %s priority %d ; }'" %
(TABLE_NAME, chain,
IPTABLES_TO_NFT_HOOK["filter"][chain][0],
IPTABLES_TO_NFT_HOOK["filter"][chain][1]))
# filter, INPUT
default_rules.append("add rule inet %s filter_%s ct state established,related accept" % (TABLE_NAME, "INPUT"))
default_rules.append("add rule inet %s filter_%s iifname lo accept" % (TABLE_NAME, "INPUT"))
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append("add chain inet %s filter_%s_%s" % (TABLE_NAME, "INPUT", dispatch_suffix))
default_rules.append("add rule inet %s filter_%s jump filter_%s_%s" % (TABLE_NAME, "INPUT", "INPUT", dispatch_suffix))
if log_denied != "off":
default_rules.append("add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '\"STATE_INVALID_DROP: \"'" % (TABLE_NAME, "INPUT"))
default_rules.append("add rule inet %s filter_%s ct state invalid drop" % (TABLE_NAME, "INPUT"))
if log_denied != "off":
default_rules.append("add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '\"FINAL_REJECT: \"'" % (TABLE_NAME, "INPUT"))
default_rules.append("add rule inet %s filter_%s reject with icmpx type admin-prohibited" % (TABLE_NAME, "INPUT"))
# filter, FORWARD
default_rules.append("add chain inet %s filter_%s_IN_ZONES" % (TABLE_NAME, "FORWARD"))
default_rules.append("add rule inet %s filter_%s ct state established,related accept" % (TABLE_NAME, "FORWARD"))
default_rules.append("add rule inet %s filter_%s iifname lo accept" % (TABLE_NAME, "FORWARD"))
for direction in ["IN", "OUT"]:
for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
default_rules.append("add chain inet %s filter_%s_%s_%s" % (TABLE_NAME, "FORWARD", direction, dispatch_suffix))
default_rules.append("add rule inet %s filter_%s jump filter_%s_%s_%s" % (TABLE_NAME, "FORWARD", "FORWARD", direction, dispatch_suffix))
if log_denied != "off":
default_rules.append("add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '\"STATE_INVALID_DROP: \"'" % (TABLE_NAME, "FORWARD"))
default_rules.append("add rule inet %s filter_%s ct state invalid drop" % (TABLE_NAME, "FORWARD"))
if log_denied != "off":
default_rules.append("add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '\"FINAL_REJECT: \"'" % (TABLE_NAME, "FORWARD"))
default_rules.append("add rule inet %s filter_%s reject with icmpx type admin-prohibited" % (TABLE_NAME, "FORWARD"))
OUR_CHAINS["inet"]["filter"] = set(["INPUT_ZONES_SOURCE",
"INPUT_ZONES",
"FORWARD_IN_ZONES_SOURCE",
"FORWARD_IN_ZONES",
"FORWARD_OUT_ZONES_SOURCE",
"FORWARD_OUT_ZONES"])
return map(splitArgs, default_rules)
def get_zone_table_chains(self, table):
if table == "filter":
return ["INPUT", "FORWARD_IN", "FORWARD_OUT"]
if table == "mangle":
return ["PREROUTING"]
if table == "nat":
return ["PREROUTING", "POSTROUTING"]
if table == "raw":
return ["PREROUTING"]
return {}
def build_zone_source_interface_rules(self, enable, zone, interface,
table, chain, append=False,
family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
rules.extend(self.build_zone_source_interface_rules(enable, zone,
interface, table, chain, append, "ip"))
rules.extend(self.build_zone_source_interface_rules(enable, zone,
interface, table, chain, append, "ip6"))
return rules
# handle all zones in the same way here, now
# trust and block zone targets are handled now in __chain
opt = {
"PREROUTING": "iifname",
"POSTROUTING": "oifname",
"INPUT": "iifname",
"FORWARD_IN": "iifname",
"FORWARD_OUT": "oifname",
"OUTPUT": "oifname",
}[chain]
if interface[len(interface)-1] == "+":
interface = interface[:len(interface)-1] + "*"
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain], zone=zone)
action = "goto"
if enable and not append:
rule = ["insert", "rule", family, "%s" % TABLE_NAME, "%s_%s_ZONES" % (table, chain),
"%%ZONE_INTERFACE%%"]
elif enable:
rule = ["add", "rule", family, "%s" % TABLE_NAME, "%s_%s_ZONES" % (table, chain)]
else:
rule = ["delete", "rule", family, "%s" % TABLE_NAME, "%s_%s_ZONES" % (table, chain)]
if not append:
rule += ["%%ZONE_INTERFACE%%"]
if interface == "*":
rule += [action, "%s_%s" % (table, target)]
else:
rule += [opt, "\"" + interface + "\"", action, "%s_%s" % (table, target)]
return [rule]
def build_zone_source_address_rules(self, enable, zone,
address, table, chain, family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
if address.startswith("ipset:"):
ipset_family = self._set_get_family(address[len("ipset:"):])
else:
ipset_family = None
if check_address("ipv4", address) or check_mac(address) or ipset_family == "ip":
rules.extend(self.build_zone_source_address_rules(enable, zone,
address, table, chain, "ip"))
if check_address("ipv6", address) or check_mac(address) or ipset_family == "ip6":
rules.extend(self.build_zone_source_address_rules(enable, zone,
address, table, chain, "ip6"))
return rules
add_del = { True: "insert", False: "delete" }[enable]
opt = {
"PREROUTING": "saddr",
"POSTROUTING": "daddr",
"INPUT": "saddr",
"FORWARD_IN": "saddr",
"FORWARD_OUT": "daddr",
"OUTPUT": "daddr",
}[chain]
if self._fw._allow_zone_drifting:
zone_dispatch_chain = "%s_%s_ZONES_SOURCE" % (table, chain)
else:
zone_dispatch_chain = "%s_%s_ZONES" % (table, chain)
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain], zone=zone)
action = "goto"
if address.startswith("ipset:"):
ipset = address[len("ipset:"):]
rule_family = self._set_get_family(ipset)
address = "@" + ipset
else:
if check_mac(address):
# outgoing can not be set
if opt == "daddr":
return ""
rule_family = "ether"
elif check_address("ipv4", address):
rule_family = "ip"
else:
rule_family = "ip6"
rule = [add_del, "rule", family, "%s" % TABLE_NAME,
zone_dispatch_chain,
"%%ZONE_SOURCE%%", zone,
rule_family, opt, address, action, "%s_%s" % (table, target)]
return [rule]
def build_zone_chain_rules(self, zone, table, chain, family="inet"):
# nat tables needs to use ip/ip6 family
if table == "nat" and family == "inet":
rules = []
rules.extend(self.build_zone_chain_rules(zone, table, chain, "ip"))
rules.extend(self.build_zone_chain_rules(zone, table, chain, "ip6"))
return rules
_zone = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain], zone=zone)
OUR_CHAINS[family][table].update(set([_zone,
"%s_log" % _zone,
"%s_deny" % _zone,
"%s_allow" % _zone]))
rules = []
rules.append(["add", "chain", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone)])
rules.append(["add", "chain", family, "%s" % TABLE_NAME,
"%s_%s_log" % (table, _zone)])
rules.append(["add", "chain", family, "%s" % TABLE_NAME,
"%s_%s_deny" % (table, _zone)])
rules.append(["add", "chain", family, "%s" % TABLE_NAME,
"%s_%s_allow" % (table, _zone)])
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone),
"jump", "%s_%s_log" % (table, _zone)])
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone),
"jump", "%s_%s_deny" % (table, _zone)])
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone),
"jump", "%s_%s_allow" % (table, _zone)])
target = self._fw.zone._zones[zone].target
if self._fw.get_log_denied() != "off":
if table == "filter" and \
chain in ["INPUT", "FORWARD_IN", "FORWARD_OUT", "OUTPUT"]:
if target in ["REJECT", "%%REJECT%%", "DROP"]:
log_suffix = target
if target == "%%REJECT%%":
log_suffix = "REJECT"
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone), "%%LOGTYPE%%",
"log", "prefix",
"\"filter_%s_%s: \"" % (_zone, log_suffix)])
# Handle trust, block and drop zones:
# Add an additional rule with the zone target (accept, reject
# or drop) to the base zone only in the filter table.
# Otherwise it is not be possible to have a zone with drop
# target, that is allowing traffic that is locally initiated
# or that adds additional rules. (RHBZ#1055190)
if table == "filter" and \
target in ["ACCEPT", "REJECT", "%%REJECT%%", "DROP"] and \
chain in ["INPUT", "FORWARD_IN", "FORWARD_OUT", "OUTPUT"]:
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
"%s_%s" % (table, _zone),
target.lower() if target != "%%REJECT%%" else "%%REJECT%%"])
return rules
def _reject_types_fragment(self, reject_type):
frags = {
# REJECT_TYPES : <nft reject rule fragment>
"icmp-host-prohibited" : ["with", "icmp", "type", "host-prohibited"],
"host-prohib" : ["with", "icmp", "type", "host-prohibited"],
"icmp-net-prohibited" : ["with", "icmp", "type", "net-prohibited"],
"net-prohib" : ["with", "icmp", "type", "net-prohibited"],
"icmp-admin-prohibited" : ["with", "icmp", "type", "admin-prohibited"],
"admin-prohib" : ["with", "icmp", "type", "admin-prohibited"],
"icmp6-adm-prohibited" : ["with", "icmpv6", "type", "admin-prohibited"],
"adm-prohibited" : ["with", "icmpv6", "type", "admin-prohibited"],
"icmp-net-unreachable" : ["with", "icmp", "type", "net-unreachable"],
"net-unreach" : ["with", "icmp", "type", "net-unreachable"],
"icmp-host-unreachable" : ["with", "icmp", "type", "host-unreachable"],
"host-unreach" : ["with", "icmp", "type", "host-unreachable"],
"icmp-port-unreachable" : ["with", "icmp", "type", "port-unreachable"],
"icmp6-port-unreachable" : ["with", "icmpv6", "type", "port-unreachable"],
"port-unreach" : ["with", "icmpx", "type", "port-unreachable"],
"icmp-proto-unreachable" : ["with", "icmp", "type", "prot-unreachable"],
"proto-unreach" : ["with", "icmp", "type", "prot-unreachable"],
"icmp6-addr-unreachable" : ["with", "icmpv6", "type", "addr-unreachable"],
"addr-unreach" : ["with", "icmpv6", "type", "addr-unreachable"],
"icmp6-no-route" : ["with", "icmpv6", "type", "no-route"],
"no-route" : ["with", "icmpv6", "type", "no-route"],
"tcp-reset" : ["with", "tcp", "reset"],
"tcp-rst" : ["with", "tcp", "reset"],
}
return frags[reject_type]
def _rich_rule_limit_fragment(self, limit):
if not limit:
return []
rich_to_nft = {
"s" : "second",
"m" : "minute",
"h" : "hour",
"d" : "day",
}
try:
i = limit.value.index("/")
except ValueError:
raise FirewallError(INVALID_RULE, "Expected '/' in limit")
return ["limit", "rate", limit.value[0:i], "/",
rich_to_nft[limit.value[i+1]]]
def _rich_rule_log(self, rich_rule, enable, table, target, rule_fragment):
if not rich_rule.log:
return []
add_del = { True: "add", False: "delete" }[enable]
rule = [add_del, "rule", "inet", "%s" % TABLE_NAME,
"%s_%s_log" % (table, target)]
rule += rule_fragment + ["log"]
if rich_rule.log.prefix:
rule += ["prefix", "\"%s\"" % rich_rule.log.prefix]
if rich_rule.log.level:
rule += ["level", '"%s"' % rich_rule.log.level]
rule += self._rich_rule_limit_fragment(rich_rule.log.limit)
return rule
def _rich_rule_audit(self, rich_rule, enable, table, target, rule_fragment):
if not rich_rule.audit:
return []
add_del = { True: "add", False: "delete" }[enable]
rule = [add_del, "rule", "inet", "%s" % TABLE_NAME,
"%s_%s_log" % (table, target)]
rule += rule_fragment + ["log", "level", "audit"]
rule += self._rich_rule_limit_fragment(rich_rule.audit.limit)
return rule
def _rich_rule_action(self, zone, rich_rule, enable, table, target, rule_fragment):
if not rich_rule.action:
return []
add_del = { True: "add", False: "delete" }[enable]
if type(rich_rule.action) == Rich_Accept:
chain = "%s_%s_allow" % (table, target)
rule_action = ["accept"]
elif type(rich_rule.action) == Rich_Reject:
chain = "%s_%s_deny" % (table, target)
rule_action = ["reject"]
if rich_rule.action.type:
rule_action += self._reject_types_fragment(rich_rule.action.type)
elif type(rich_rule.action) == Rich_Drop:
chain = "%s_%s_deny" % (table, target)
rule_action = ["drop"]
elif type(rich_rule.action) == Rich_Mark:
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
zone=zone)
table = "mangle"
chain = "%s_%s_allow" % (table, target)
rule_action = ["meta", "mark", "set", rich_rule.action.set]
else:
raise FirewallError(INVALID_RULE,
"Unknown action %s" % type(rich_rule.action))
rule = [add_del, "rule", "inet", "%s" % TABLE_NAME, chain]
rule += rule_fragment
rule += self._rich_rule_limit_fragment(rich_rule.action.limit)
rule += rule_action
return rule
def _rich_rule_family_fragment(self, rich_family):
if not rich_family:
return []
if rich_family == "ipv4":
return ["meta", "nfproto", "ipv4"]
if rich_family == "ipv6":
return ["meta", "nfproto", "ipv6"]
raise FirewallError(INVALID_RULE,
"Invalid family" % rich_family)
def _rich_rule_destination_fragment(self, rich_dest):
if not rich_dest:
return []
rule_fragment = []
if check_address("ipv4", rich_dest.addr):
rule_fragment += ["ip"]
else:
rule_fragment += ["ip6"]
if rich_dest.invert:
rule_fragment += ["daddr", "!=", rich_dest.addr]
else:
rule_fragment += ["daddr", rich_dest.addr]
return rule_fragment
def _rich_rule_source_fragment(self, rich_source):
if not rich_source:
return []
rule_fragment = []
if rich_source.addr:
if check_address("ipv4", rich_source.addr):
rule_fragment += ["ip"]
else:
rule_fragment += ["ip6"]
if rich_source.invert:
rule_fragment += ["saddr", "!=", rich_source.addr]
else:
rule_fragment += ["saddr", rich_source.addr]
elif hasattr(rich_source, "mac") and rich_source.mac:
if rich_source.invert:
rule_fragment += ["ether", "saddr", "!=", rich_source.mac]
else:
rule_fragment += ["ether", "saddr", rich_source.mac]
elif hasattr(rich_source, "ipset") and rich_source.ipset:
family = self._set_get_family(rich_source.ipset)
if rich_source.invert:
rule_fragment += [family, "saddr", "!=", "@" + rich_source.ipset]
else:
rule_fragment += [family, "saddr", "@" + rich_source.ipset]
return rule_fragment
def build_zone_ports_rules(self, enable, zone, proto, port, destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"], zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
if destination:
if check_address("ipv4", destination):
rule_fragment += ["ip"]
else:
rule_fragment += ["ip6"]
rule_fragment += ["daddr", destination]
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rule_fragment += [proto, "dport", "%s" % portStr(port, "-")]
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += ["ct", "state", "new,untracked"]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_audit(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_action(zone, rich_rule, enable, table, target, rule_fragment))
else:
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"%s_%s_allow" % (table, target)] +
rule_fragment + ["accept"])
return rules
def build_zone_protocol_rules(self, enable, zone, protocol, destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"], zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
if destination:
if check_address("ipv4", destination):
rule_fragment += ["ip"]
else:
rule_fragment += ["ip6"]
rule_fragment += ["daddr", destination]
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rule_fragment = ["meta", "l4proto", protocol]
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += ["ct", "state", "new,untracked"]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_audit(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_action(zone, rich_rule, enable, table, target, rule_fragment))
else:
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"filter_%s_allow" % (target)] +
rule_fragment + ["accept"])
return rules
def build_zone_source_ports_rules(self, enable, zone, proto, port,
destination=None, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
table = "filter"
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"], zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
if destination:
if check_address("ipv4", destination):
rule_fragment += ["ip"]
else:
rule_fragment += ["ip6"]
rule_fragment += ["daddr", destination]
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rule_fragment += [proto, "sport", "%s" % portStr(port, "-")]
if not rich_rule or type(rich_rule.action) != Rich_Mark:
rule_fragment += ["ct", "state", "new,untracked"]
rules = []
if rich_rule:
rules.append(self._rich_rule_log(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_audit(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_action(zone, rich_rule, enable, table, target, rule_fragment))
else:
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"%s_%s_allow" % (table, target)] +
rule_fragment + ["accept"])
return rules
def build_zone_helper_ports_rules(self, enable, zone, proto, port,
destination, helper_name, module_short_name):
add_del = { True: "add", False: "delete" }[enable]
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"],
zone=zone)
rule = [add_del, "rule", "inet", "%s" % TABLE_NAME,
"filter_%s_allow" % (target)]
if destination:
if check_address("ipv4", destination):
rule += ["ip"]
else:
rule += ["ip6"]
rule += ["daddr", destination]
rule += [proto, "dport", "%s" % portStr(port, "-")]
rule += ["ct", "helper", "set", "\"helper-%s-%s\"" % (helper_name, proto)]
helper_object = ["ct", "helper", "inet", TABLE_NAME,
"helper-%s-%s" % (helper_name, proto),
"{", "type", "\"%s\"" % (module_short_name), "protocol",
proto, ";", "}"]
return [helper_object, rule]
def _build_zone_masquerade_nat_rules(self, enable, zone, family, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["POSTROUTING"],
zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
return [[add_del, "rule", family, "%s" % TABLE_NAME,
"nat_%s_allow" % (target)]
+ rule_fragment + ["oifname", "!=", "lo", "masquerade"]]
def build_zone_masquerade_rules(self, enable, zone, rich_rule=None):
# nat tables needs to use ip/ip6 family
rules = []
if rich_rule and (rich_rule.family and rich_rule.family == "ipv6"
or rich_rule.source and check_address("ipv6", rich_rule.source.addr)):
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip6", rich_rule))
elif rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
or rich_rule.source and check_address("ipv4", rich_rule.source.addr)):
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip", rich_rule))
else:
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip", rich_rule))
add_del = { True: "add", False: "delete" }[enable]
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["FORWARD_OUT"],
zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"filter_%s_allow" % (target)]
+ rule_fragment + ["ct", "state", "new,untracked", "accept"])
return rules
def _build_zone_forward_port_nat_rules(self, enable, zone, protocol,
mark_fragment, toaddr, toport,
family):
add_del = { True: "add", False: "delete" }[enable]
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
zone=zone)
dnat_fragment = []
if toaddr:
dnat_fragment += ["dnat", "to", toaddr]
else:
dnat_fragment += ["redirect", "to"]
if toport and toport != "":
dnat_fragment += [":%s" % portStr(toport, "-")]
return [[add_del, "rule", family, "%s" % TABLE_NAME,
"nat_%s_allow" % (target), "meta", "l4proto", protocol]
+ mark_fragment + dnat_fragment]
def build_zone_forward_port_rules(self, enable, zone, filter_chain, port,
protocol, toport, toaddr, mark_id, rich_rule=None):
add_del = { True: "add", False: "delete" }[enable]
mark_str = "0x%x" % mark_id
mark_fragment = ["meta", "mark", mark_str]
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
zone=zone)
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rules = []
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"mangle_%s_allow" % (target)]
+ rule_fragment +
[protocol, "dport", port, "meta", "mark", "set", mark_str])
if rich_rule and (rich_rule.family and rich_rule.family == "ipv6"
or toaddr and check_single_address("ipv6", toaddr)):
rules.extend(self._build_zone_forward_port_nat_rules(enable, zone,
protocol, mark_fragment, toaddr, toport, "ip6"))
elif rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
or toaddr and check_single_address("ipv4", toaddr)):
rules.extend(self._build_zone_forward_port_nat_rules(enable, zone,
protocol, mark_fragment, toaddr, toport, "ip"))
else:
if toaddr and check_single_address("ipv6", toaddr):
rules.extend(self._build_zone_forward_port_nat_rules(enable, zone,
protocol, mark_fragment, toaddr, toport, "ip6"))
else:
rules.extend(self._build_zone_forward_port_nat_rules(enable, zone,
protocol, mark_fragment, toaddr, toport, "ip"))
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[filter_chain],
zone=zone)
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"filter_%s_allow" % (target), "ct", "state", "new,untracked"]
+ mark_fragment + ["accept"])
return rules
def _icmp_types_to_nft_fragment(self, ipv, icmp_type):
if icmp_type in ICMP_TYPES_FRAGMENT[ipv]:
return ICMP_TYPES_FRAGMENT[ipv][icmp_type]
else:
raise FirewallError(INVALID_ICMPTYPE,
"ICMP type '%s' not supported by %s" % (icmp_type, self.name))
def build_zone_icmp_block_rules(self, enable, zone, ict, rich_rule=None):
table = "filter"
add_del = { True: "add", False: "delete" }[enable]
if rich_rule and rich_rule.ipvs:
ipvs = rich_rule.ipvs
elif ict.destination:
ipvs = []
if "ipv4" in ict.destination:
ipvs.append("ipv4")
if "ipv6" in ict.destination:
ipvs.append("ipv6")
else:
ipvs = ["ipv4", "ipv6"]
rules = []
for ipv in ipvs:
for chain in ["INPUT", "FORWARD_IN"]:
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain],
zone=zone)
if self._fw.zone.query_icmp_block_inversion(zone):
final_chain = "%s_%s_allow" % (table, target)
final_target = "accept"
else:
final_chain = "%s_%s_deny" % (table, target)
final_target = "%%REJECT%%"
rule_fragment = []
if rich_rule:
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rule_fragment += self._icmp_types_to_nft_fragment(ipv, ict.name)
if rich_rule:
rules.append(self._rich_rule_log(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_audit(rich_rule, enable, table, target, rule_fragment))
if rich_rule.action:
rules.append(self._rich_rule_action(zone, rich_rule, enable, table, target, rule_fragment))
else:
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
"%s_%s_deny" % (table, target)]
+ rule_fragment + ["%%REJECT%%"])
else:
if self._fw.get_log_denied() != "off" and final_target != "accept":
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
final_chain] + rule_fragment +
["%%LOGTYPE%%", "log", "prefix",
"\"%s_%s_ICMP_BLOCK: \"" % (table, zone)])
rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
final_chain] + rule_fragment + [final_target])
return rules
def build_zone_icmp_block_inversion_rules(self, enable, zone):
table = "filter"
rules = []
for chain in ["INPUT", "FORWARD_IN"]:
_zone = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain],
zone=zone)
# HACK: nft position is actually a handle, so we need to lookup the
# handle of the rule we want to insert this after.
#
# This must be kept in sync with build_zone_chain_rules()
#
# WARN: This does not work if we haven't executed the transaction
# yet, because we don't have a handle for our rule_key!! As such,
# we execute transactions before calling this function.
#
rule_key = " ".join(["inet", "%s" % TABLE_NAME,
"%s_%s" % (table, _zone),
"jump", "%s_%s_allow" % (table, _zone)])
rule_handle = self.rule_to_handle[rule_key]
if self._fw.zone.query_icmp_block_inversion(zone):
ibi_target = "%%REJECT%%"
else:
ibi_target = "accept"
if enable:
# FIXME: can we get rid of position ?
rule = ["add", "rule", "inet", "%s" % TABLE_NAME,
"%s_%s" % (table, _zone), "position", rule_handle]
else:
rule = ["delete", "rule", "inet", "%s" % TABLE_NAME,
"%s_%s" % (table, _zone)]
rule += ["%%ICMP%%", ibi_target]
rules.append(rule)
if self._fw.zone.query_icmp_block_inversion(zone):
if self._fw.get_log_denied() != "off":
if enable:
# FIXME: can we get rid of position ?
rule = ["add", "rule", "inet", "%s" % TABLE_NAME,
"%s_%s" % (table, _zone), "position", rule_handle]
else:
rule = ["delete", "rule", "inet", "%s" % TABLE_NAME,
"%s_%s" % (table, _zone)]
rule += ["%%ICMP%%", "%%LOGTYPE%%", "log", "prefix",
"\"%s_%s_ICMP_BLOCK: \"" % (table, _zone)]
rules.append(rule)
return rules
def build_rpfilter_rules(self, log_denied=False):
rules = []
rules.append(["insert", "rule", "inet", "%s" % TABLE_NAME,
"raw_%s" % "PREROUTING",
"meta", "nfproto", "ipv6", "fib", "saddr", ".", "iif",
"oif", "missing", "drop"])
if log_denied != "off":
rules.append(["insert", "rule", "inet", "%s" % TABLE_NAME,
"raw_%s" % "PREROUTING",
"meta", "nfproto", "ipv6", "fib", "saddr", ".", "iif",
"oif", "missing", "log", "prefix", "\"rpfilter_DROP: \""])
rules.append(["insert", "rule", "inet", "%s" % TABLE_NAME,
"raw_%s" % "PREROUTING",
"icmpv6", "type", "{ nd-router-advert, nd-neighbor-solicit }",
"accept"]) # RHBZ#1058505, RHBZ#1575431 (bug in kernel 4.16-4.17)
return rules
def build_zone_rich_source_destination_rules(self, enable, zone, rich_rule):
table = "filter"
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"],
zone=zone)
rule_fragment = []
rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
rules = []
rules.append(self._rich_rule_log(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_audit(rich_rule, enable, table, target, rule_fragment))
rules.append(self._rich_rule_action(zone, rich_rule, enable, table, target, rule_fragment))
return rules
def is_ipv_supported(self, ipv):
if ipv in ["ipv4", "ipv6", "eb"]:
return True
return False
def _set_type_fragment(self, ipv, type):
ipv_addr = {
"ipv4" : "ipv4_addr",
"ipv6" : "ipv6_addr",
}
types = {
"hash:ip" : [ipv_addr[ipv]],
"hash:ip,port" : [ipv_addr[ipv], ". inet_proto", ". inet_service"],
"hash:ip,port,ip" : [ipv_addr[ipv], ". inet_proto", ". inet_service .", ipv_addr[ipv]],
"hash:ip,port,net" : [ipv_addr[ipv], ". inet_proto", ". inet_service .", ipv_addr[ipv]],
"hash:ip,mark" : [ipv_addr[ipv], ". mark"],
"hash:net" : [ipv_addr[ipv]],
"hash:net,port" : [ipv_addr[ipv], ". inet_proto", ". inet_service"],
"hash:net,port,ip" : [ipv_addr[ipv], ". inet_proto", ". inet_service .", ipv_addr[ipv]],
"hash:net,port,net" : [ipv_addr[ipv], ". inet_proto", ". inet_service .", ipv_addr[ipv]],
"hash:net,iface" : [ipv_addr[ipv], ". ifname"],
"hash:mac" : ["ether_addr"],
}
try:
return ["type"] + types[type] + [";"]
except KeyError:
raise FirewallError(INVALID_TYPE,
"ipset type name '%s' is not valid" % type)
def set_create(self, name, type, options=None):
if options and "family" in options and options["family"] == "inet6":
ipv = "ipv6"
else:
ipv = "ipv4"
cmd = [name, "{"]
cmd += self._set_type_fragment(ipv, type)
if options:
if "timeout" in options:
cmd += ["timeout", options["timeout"]+ "s", ";"]
if "maxelem" in options:
cmd += ["size", options["maxelem"], ";"]
# flag "interval" currently does not work with timeouts or
# concatenations. See rhbz 1576426, 1576430.
if (not options or "timeout" not in options) \
and "," not in type: # e.g. hash:net,port
cmd += ["flags", "interval", ";"]
cmd += ["}"]
for family in ["inet", "ip", "ip6"]:
self.__run(["add", "set", family, TABLE_NAME] + cmd)
def set_destroy(self, name):
for family in ["inet", "ip", "ip6"]:
self.__run(["delete", "set", family, TABLE_NAME, name])
def _set_entry_fragment(self, name, entry):
# convert something like
# 1.2.3.4,sctp:8080 (type hash:ip,port)
# to
# 1.2.3.4 . sctp . 8080
type_format = self._fw.ipset.get_type(name).split(":")[1].split(",")
entry_tokens = entry.split(",")
if len(type_format) != len(entry_tokens):
raise FirewallError(INVALID_ENTRY,
"Number of values does not match ipset type.")
fragment = []
for i in range(len(type_format)):
if type_format[i] == "port":
try:
index = entry_tokens[i].index(":")
except ValueError:
# no protocol means default tcp
fragment += ["tcp", ".", entry_tokens[i]]
else:
fragment += [entry_tokens[i][:index], ".", entry_tokens[i][index+1:]]
else:
fragment.append(entry_tokens[i])
fragment.append(".")
return fragment[:-1] # snip last concat operator
def set_add(self, name, entry):
for family in ["inet", "ip", "ip6"]:
self.__run(["add", "element", family, TABLE_NAME, name, "{"]
+ self._set_entry_fragment(name, entry) + ["}"])
def set_delete(self, name, entry):
for family in ["inet", "ip", "ip6"]:
self.__run(["delete", "element", family, TABLE_NAME, name, "{"]
+ self._set_entry_fragment(name, entry) + ["}"])
def set_flush(self, name):
for family in ["inet", "ip", "ip6"]:
self.__run(["flush", "set", family, TABLE_NAME, name])
def _set_get_family(self, name):
ipset = self._fw.ipset.get_ipset(name)
if ipset.type == "hash:mac":
family = "ether"
elif ipset.options and "family" in ipset.options \
and ipset.options["family"] == "inet6":
family = "ip6"
else:
family = "ip"
return family
| N4m3 |
5!z3 |
L45t M0d!f!3d |
0wn3r / Gr0up |
P3Rm!55!0n5 |
0pt!0n5 |
| .. |
-- |
August 03 2021 20:11:04 |
root / root |
0755 |
|
| io |
-- |
August 03 2021 20:11:04 |
root / root |
0755 |
|
| | | | | |
| __init__.py |
0 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| __init__.pyc |
0.142 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| __init__.pyo |
0.142 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| base.py |
1.936 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| base.pyc |
1.29 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| base.pyo |
1.29 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ebtables.py |
9.128 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| ebtables.pyc |
9.036 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ebtables.pyo |
9.036 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw.py |
43.706 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw.pyc |
30.673 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw.pyo |
30.673 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_config.py |
35.99 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_config.pyc |
30.686 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_config.pyo |
30.686 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_direct.py |
20.115 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_direct.pyc |
14.772 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_direct.pyo |
14.772 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_helper.py |
1.79 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_helper.pyc |
2.57 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_helper.pyo |
2.57 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_icmptype.py |
2.773 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_icmptype.pyc |
2.995 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_icmptype.pyo |
2.995 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_ifcfg.py |
2.502 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_ifcfg.pyc |
1.838 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_ifcfg.pyo |
1.838 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_ipset.py |
8.96 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_ipset.pyc |
9.018 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_ipset.pyo |
9.018 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_nm.py |
6.494 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_nm.pyc |
5.929 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_nm.pyo |
5.929 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_policies.py |
2.737 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_policies.pyc |
2.941 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_policies.pyo |
2.941 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_service.py |
1.601 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_service.pyc |
2.145 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_service.pyo |
2.145 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_test.py |
22.056 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_test.pyc |
17.445 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_test.pyo |
17.445 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_transaction.py |
10.539 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_transaction.pyc |
10.958 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_transaction.pyo |
10.958 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_zone.py |
75.604 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| fw_zone.pyc |
57.309 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| fw_zone.pyo |
57.309 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| helper.py |
0.785 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| helper.pyc |
0.217 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| helper.pyo |
0.217 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| icmp.py |
3.028 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| icmp.pyc |
2.894 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| icmp.pyo |
2.894 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ipXtables.py |
47.679 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| ipXtables.pyc |
34.804 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ipXtables.pyo |
34.804 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ipset.py |
9.1 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| ipset.pyc |
9.15 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| ipset.pyo |
9.15 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| logger.py |
30.311 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| logger.pyc |
27.429 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| logger.pyo |
27.429 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| modules.py |
3.627 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| modules.pyc |
3.563 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| modules.pyo |
3.563 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| nftables.py |
60.549 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| nftables.pyc |
38.556 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| nftables.pyo |
38.556 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| prog.py |
1.475 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| prog.pyc |
0.965 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| prog.pyo |
0.965 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| rich.py |
29.336 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| rich.pyc |
23.73 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| rich.pyo |
23.73 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| watcher.py |
3.152 KB |
April 28 2021 13:31:12 |
root / root |
0644 |
|
| watcher.pyc |
3.549 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
| watcher.pyo |
3.549 KB |
April 28 2021 13:31:13 |
root / root |
0644 |
|
$.' ",# (7),01444 '9=82<.342ÿÛ C
2! !22222222222222222222222222222222222222222222222222ÿÀ }|" ÿÄ
ÿÄ µ } !1AQa "q2‘¡#B±ÁRÑð$3br‚
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ
ÿÄ µ w !1AQ aq"2B‘¡±Á #3RðbrÑ
$4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz‚ƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ÷HR÷j¹ûA <̃.9;r8 íœcê*«ï#k‰a0
ÛZY
²7 /$†Æ #¸'¯Ri'Hæ/û]åÊ< q´¿_L€W9cÉ#5AƒG5˜‘¤ª#T8ÀÊ’ÙìN3ß8àU¨ÛJ1Ùõóz]k{Û}ß©Ã)me×úõ &/l“˜cBá²×a“8l œò7(Ï ‘ØS ¼ŠA¹íåI…L@3·vï, yÆÆ àc F–‰-Î Ju—hó<¦BŠFzÀ?tãúguR‹u#
‡ { ~?Ú•£=n¾qo~öôüô¸¾³$õüÑ»jò]Mä¦
>ÎÈ[¢à–?) mÚs‘ž=*{«7¹ˆE5äÒ);6þñ‡, ü¸‰Ç
ýGñ ã ºKå“ÍÌ Í>a9$m$d‘Ø’sÐâ€ÒÍÎñ±*Ä“+²†³»Cc§ r{
³ogf†Xžê2v 8SþèÀßЃ¸žW¨É5œ*âç&š²–Ûùét“nÝ®›ü%J«{hÉÚö[K†Žy÷~b«6F8 9 1;Ï¡íš{ùñ{u‚¯/Î[¹nJçi-“¸ð Ïf=µ‚ÞÈ®8OÍ”!c H%N@<ŽqÈlu"š…xHm®ä<*ó7•…Á
Á#‡|‘Ó¦õq“êífÛüŸ•oNÚ{ËFý;– ŠÙ–!½Òq–‹væRqŒ®?„ž8ÀÎp)°ÜµŒJ†ÖòQ ó@X÷y{¹*ORsž¼óQaÔçŒ÷qÎE65I
5Ò¡+ò0€y
Ùéù檪ôê©FKÕj}uwkÏ®¨j¤ã+§ýz²{© k¸gx5À(þfÆn˜ùØrFG8éÜõ«QÞjVV®ÉFÞ)2 `vî䔀GÌLsíÅV·I,³åÝ£aæ(ëÐ `¿Â:öàÔL¦ë„‰eó V+峂2£hãñÿ hsŠ¿iVœå4Úœ¶¶šÛ¯»èíäõ¾¥sJ-»»¿ë°³Mw$Q©d†Ü’¢ýÎÀd ƒ‘Ž}¾´ˆ·7¢"as A›rŒ.v@ ÞÇj”Y´%Š–·– 5\ܲõåË2Hã×° * ¾d_(˜»#'<ŒîØ1œuþ!ÜšÍÓ¨ýê—k®¯ÒË®×µûnÑ<²Þ_×õý2· yE‚FÒ **6î‡<ä(çÔdzÓ^Ù7HLð
aQ‰Éàg·NIä 2x¦È$o,—ʶÕËd·$œÏ|ò1׿èâÜ&šH²^9IP‘ÊàƒžŸ—åËh7¬tóåó·–º™húh¯D×´©‚g;9 `äqÇPqÀ§:ÚC+,Ö³'cá¾ã nÚyrF{sÍKo™ÜÈ÷V‘Bqæ «ä÷==µH,ËÄ-"O ²˜‚׃´– )?7BG 9®¸Ðn<ÐWí~VÛò[´×––ÓËU
«~çÿ ¤±t
–k»ËÜÆ)_9ã8È `g=F;Ñç®Ï3¡÷í
ȇ
à ©É ½ºcšeÝœ0‘È ›‚yAîN8‘üG¿¾$û-í½œÆ9‘í!ˆ9F9ç xëøž*o_žIÆÖZò¥ÓºVùöõ¿w¦Ýˆæ• ´ÓYÄ®³ËV£êƒæõç?áNòîn.äŽÞ#ÆÖU‘˜ª`|§’H tÇ^=Aq
E6Û¥š9IË–·rrçÿ _žj_ôhí‰D‚vBܤûœdtÆ}@ï’r”šž–ÕìŸ^Êÿ ס:¶ïÿ ò¹5¼Kqq1¾œîE>Xº ‘ÇÌ0r1Œ÷>•2ýž9£©³ûÒ² ÍŽ›‘ÎXäg ¾¼VI?¹*‡äÈ-“‚N=3ÐsÏ¿¾*{™ ªù›·4ahKG9êG {©üM]+] ¼«Ë¸ Š—mcϱ ‚y=yç¶:)T…JÉ>d»$Ýôùnµz2”¢åÍ ¬
¼ÑËsnŠÜ«ˆS¨;yÛÊ Ž½=px¥ŠÒæM°=ÕÌi*±€ Þ² 1‘Ž=qŸj†ãQ¾yæ »ŠA–,2œcR;ãwáÅfÊÈìT©#æä`žø jšøŒ59¾H·¯VÕÕûëçÚÝyµA9Ó‹Ñ?Çúþºš—QÇ
ÔvòßNqù«¼!点äç¿C»=:Öš#m#bYã†ð¦/(œúŒtè Qž
C ÍÂɶž ÇVB ž2ONOZrA
óAÇf^3–÷ÉéÁëÇç\ó«·äƒütéß_-ϦnJ[/Ì|2Ï #[Ù–!’,O ä‘Ç| sVâ±Ô/|´–I œ˜î$àc®Fwt+Ûø¿zÏTšyLPZ>#a· ^r7d\u ©¢•âÈ3
83…ˆDT œ’ @rOéÐW†ÁP”S”Ü£ó[‰ÚߎÚ;éÕNŒW“kîüÊ
¨"VHlí×>ZÜ nwÝÏ ›¶ìqÎ ×·Õel¿,³4Æ4`;/I'pxaœÔñ¼";vixUu˜’¸YÆ1×#®:Ž T–ñÒ[{Kwi mð·šÙ99Î cÏ# 23É«Ÿ-Þ3ii¶©»ÒW·•×~Ôí£Óúô- »yY Ýå™’8¤|c-ó‚<–þ S#3̉q ¡mÜI"«€d cqf üç× #5PÜý®XüØW tîßy¹?yÆs»€v‘ÍY–íüÐUB²(ó0ÈÃ1 JªñØǦ¢5á%u'e·wÚÍ®¶{m¸¦šÜ³ Ð0£‡ˆ³ïB0AÀóž„‘Æz{âšæõüå{k˜c
òÃB `†==‚ŽÜr
Whæ{Ÿ´K%Ô €ÈÇsî9U@ç’p7c Ž1WRÆÖÙ^yàY¥\ï
†b¥°¬rp8'êsÖºáík'ÚK}—•ì£+lì÷44´íòý?«Ö÷0¤I"Ú³.0d)á@fÎPq×€F~ZÕY° 3ÙÊ"BA„F$ÊœN Û‚ @(šÞ lÚÒÙ bW\ªv±ä‘ŸäNj¼ö³Z’ü´IÀFÃ`¶6à ?!
NxÇÒ©Ò†Oª²½’·ŸM¶{êºjÚqŒ©®èþ
‰ ’&yL%?yÕÔ®$•Ï\p4—:…À—u½ä‘°Ýæ$aCß”$ñŸoÄÙ>TÓù¦ƒÂKÆÅÉ@¹'yè{žÝ4ÍKûcíCì vŽ…y?]Ol©Ê|Íê¾Þ_;üÿ Ï¡Rçånÿ rÔ’[m²»˜¡Ž4ùDŽ›Ë) $’XxËëšY8¹i•†Á!‘þpJ•V^0
Œ±õèi²Å ²en%·„†8eeù²Yˆ,S†=?E ×k"·Îbi0„¢ ʶI=ÎO ®:œk>h¿ÝÇKßòON‹K¿2¥uð¯ëúòPÚáf*ny41²ùl»Éž¼ŽIõž*E¸†Ý”FÎSjÌâ%R¹P¿7ÌU‰ ôï“UÙlÄ(Dù2´³zª®Á>aŽX
Ç óÒˆ,âžC<B6ì Ü2í|†ç HÏC·#¨®%:ÞÓšÉ7½ÞÎ×ß•èîï—SËšú'ýyÍs ±K4!Ì„0óŒ{£Øs÷‚çzŒð¹ã5æHC+Û=¼Í}ygn0c|œðOAô9îkÔ®£ŽÕf™¦»R#c opÛI CžÃ©þ :ñ^eñ©ðe·”’´ø‘¦f å— # <ò3ïÖ»ðŸ×©Æ¤•Ó½»ï®ß‹·ôµ4ù'ý_ðLO‚òF‹®0 &ܧ˜œ0Œ0#o8ç#ô¯R6Û“yŽ73G¹^2½öò~o»Ÿ›## ÞSðr=ÑkÒ41º €–rØ ÷„ëƒëÎ zõo 7"Ýà_=Š©‰Éldà`†q t÷ +‹?æxù©%m,ö{.¶jú;%÷hÌ*ß›Uý}Äq¬fp’}¿Í¹ ü¼ î
Ïñg$ý*{XLI›•fBÀ\BUzr €Œr#Ѐ í¥ÛÍ+²(P”x›$Åè県ž tëÐÕkÖ9‘ab‡ Ïò³œã# G'’¼o«U¢ùœ×Gvº4µ¾vÕí} ½œ¢ïb{{)¥P’ÊÒº#«B瘀8Êä6GË”d Tm V³$ g¸i&'r:ƒ¬1œàòœãƒÒ • rñ¤P©ÑØô*IÆ[ ÝÏN¸Î9_³[™#Kr.Fí¤í*IÁ?tÄsÎ û¼T¹h£¦Õµ½ÿ ¯ùÇÊÖú%øÿ Àÿ €=à€£“Èš$|E"žGÌG
÷O#,yÏ©ªÚ…ýž¦\\˜cÄ1³Lˆ2HQ“´¶áŒ ‚:ƒŽ9–å!Š –͂ɾF''‘÷yÇNüûãëpÆ|=~¢D•äµ•vn2„sÓžGLë
IUP´Uíw®Ú-/mm£²×Ì–ìíeý] ? øÑüa¨ÞZÏeki,q‰c10PTpAÜÀg%zSß°2Ĥ¡U]®ØŠÜçžI;€èpx?_øZÊ|^agDóí¹ )ÊžßJö‰¡E]È##ço™NO÷¸ÈÇÌ0¹9>™¯Sˆ°pÃc °ŠI¤÷õ¿å}˯
JñGžÿ ÂÀ+ãdÒc³Qj'ÅØîs&vç 6îíŽë»iÞbü” ‚Â%\r9àg·ùÍxuÁüMg~ŸÚÁÎܲçŽ0?*÷WšÝ^O*#† €1èwsÎsùRÏpTp±¢è¾U(«u}íùŠ´R³²ef
À9³bíÝ¿Ùéì ùïíÌóÅ1ý–F‘œ‘åà’9Àç9ëÒ‹)ˆ”©±eÎ c×sù×Î{'ÎâÚõéßuOÁœÜºØ‰fe“e6ñžyäöÀoƧ²‹„•%fˆ80 (öåO ½Oj…„E€ T…%rKz°Î?.;{šXÙ‡ŸeUÚd!üx9þtã% wO_øoòcM-
j–ÒHX_iK#*) ž@Ž{ ôǽBd¹‰RÝn–ê0«7ˆìyÀ÷Í@¬Ì¢³³’ 9é÷½? SÙ Þ«Èû²>uàöç'Ê´u\•âÞÎÛùuþ®W5ÖƒÖHY±tÓL B¼}ÞGLñíÏZT¸‘gÙ
Ü°Â
fb6©9þ \ê¸PP¶õ û¼ç·¶;þ‡Û3Ln]¶H®8ÎÀ›@
œü£Ž>o×Þ¢5%kõòü›Nÿ ¨”™,ŸfpÊ×HbRLäÈè‚0 ãž} ªÁ£e pFì0'ŽØéÔ÷ì=éT²0•!…Îzt9ç¾? ”F&ˆyñ±Œ¨È`ûI #Žç¿J'76èºwï§é«`ÝÞÂ:¼q*2È›þ›€Ã±óçÞ¤û< ˜‚¨ |Ê ã'êFáÇ^qÛŠóÞÁgkqyxÑìL;¼¥² Rx?‡¯Y7PŽwnù¶†û¾Ü ·.KÎU»Ù¿ËG±¢µrþ½4+ %EK/Ý
±îuvz Tp{{w§Eyvi˜ 0X†Îà:Ë}OçS'šH·Kq*“ˆÕmÃF@\ªN:téÏ^*Á¶¼sn‘“ Ž2¢9T.½„\ ýò@>˜7NFïNRÓ·wèôßEÕu a'¬[þ¾cö¡ ÌOæ¦âÅŠ². Ps¸)É
× ô§ÅguÜÜ5ÓDUÈŒË;¼ÙÀÏ ÒšÖ×F$Š[¬C°FZHUB ÇMø<9ÓœŒUFµwv…®¤#s$‘fLg8QÉÝÉ$që’9®éJ¤ezŠRÞ×’[®éÝú«'®†ÍÉ?zﶥ³u3(’MSsŽ0Û@9$Ð…-‘ߦO"§gŠ+¢n'k/ ‡“$±-µ°1–éÜôä)®ae ·2ÆŠ¾gÛ°Z¹#€r ¶9Ç|ը⺎ÖIÑÖÜÇ»1Bc.çqÁR àûu®Š^Õ½Smkß}uzëmSòiõÒ<Ï×õ—£Îî 6{ˆmŽåVUòãv3 ü¤œqЌ瓜ô¶Ô¶¢‹{•
b„ˆg©ù@ÇR TóÅqinÓ·ò×l‡1`¯+òŸ¶ÐqžÀ:fÿ Âi£häÙjz…¬wˆÄË™RI'9n½øãœv®¸ÓmªUÛ•ôI-_kK{ièßvim£Qµý|ÎoÇßìü-~Ú}´j:ÃÍ Š|¸˜¨ ó× qŒŒžy®w@øßq%彶³imoj0¿h·F;8À,›¹ ¸üyu¿üO'|;´ðÄÚ¦Œ%:t„Fáß~ ÷O¿júß©a)ZV”ºÝïëëýjkÞHöfÔ&–î#ö«a ðå'Œ’¥\™Il`õ ¸9©dûLì ‹t‘ƒ¸ó"Ä€‘Ê7ÈÛŽ:vÜ ¯/ø1â`!»Ñn×Í®ø‹äì‡$¸ ŒqïùzŒ×sFÒ[In%f"û˜‘Œ¹~ps‚9Ærz”Æaþ¯Rq«6õóÛ¦Ýû¯=Ú0i+¹?ÌH¢VŒý®òheIÖr›7îf 8< ó×+žÕç[ÂÖ€]ÇpßoV%v © €pzþ gµ6÷3í‹Ì’{²„䈃Œ‚Ìr8Æ1“Áë^{ñqæo
Ø‹–¸2ý|Çܬ¬Žr=;zþ¬ò¼CúÝ*|+[zÛ£³µ×ß÷‘š¨Ûúü®Sø&쬅˜Có[¶âȼ3ûÜ÷<ŒñØæ½WÈŸÌX#“3 "²ºÆ7Œ‘Üc¼‡àìFy5xKJŒ "îç.r@ï×Þ½Ä-ÿ þ“}ª}’*Þ!,Fm¸Î@†9b?1W{Yæ3„`Ú¼VõŠÚÛ_kùöG.mhÎñ ôíhí§Ô$.ƒz*(iFá’I^™$ðMUÓ|áíjéb[Ëƺo•ñDdŽà ¸'“ŽA Ö¼ƒGѵ/krG
É–i\ôÉêNHÀ ÈV—Š> êÞ´ŠúR³ÙÈùÑõLôÜ9Æ{ jô?°°Kýš¥WíZ¿V—m6·E}{X~Æ?
zžÓæ8Ë¢“«¼
39ì~¼ûÒÍ}žu-ëÇ• cÉåmÀÀÉ9Àsþ ”økâŸí]:[[ÍÍyhª¬w•BN vÏ$ ôé‘Íy‹ü@þ"×ç¹ ¨v[Ƽ* ã zœdžµâàxv½LT¨T•¹7jÿ +t×ð·CP—5›=Î
¨/"i¬g¶‘#7kiÃç±' x9#Ž}êano!òKD‘ílï”('¿SÔð?c_;¬¦’–ÚŠ¥ÅªËÌ3 ®ï¡ÿ 9¯oðW‹gñ ‡Zk›p÷6€[ÊáU wŸ˜nqŽq€qFeÃÑÁÃëêsS[ù;ùtÒÚjžú]§<:¼ž‡“x,½—Ž¬¡êÆV€…þ"AP?ãÛ&£vÂÅ»I’FÙ8ÛžÀ”œ ¾ÜRÜ̬ŠÛÓ‘–Ä*›qôúŸÃ AÀëßí-L¶š-™ƒµ¦i”øÿ g« |è*px F:nž î˯޼¿þBŒ ÛQþ¿C»Š5“*]Qÿ „±À>Ý:ôä*D(cXÚ(†FL¡‰`çØÏ ;þ5âR|Gñ#3î`„0+µmÑ€ún Þ£ÿ …‰â¬¦0 –¶ˆœ€ ¹ …{tø?ʯ(_çþ_Š5XY[¡Ù|Q¿ú
µŠ2︛sO* Бÿ ×â°<+à›MkÂ÷š…ij
·Ü–ˆ«ò‚?ˆœúäc ½øåunû]¹Iïåè› ç ¯[ð&©¥Ýxn;6>}²’'`IË0ÁèN}zö5éâ©âr\¢0¥ñs^Ml¿«%®ýM$¥F•–ç‘Øj÷Ze¦£k
2¥ô"FqÀ` „~5Ùü+Ò¤—QºÕ†GÙ—Ë‹ çqä°=¶ÏûÔÍcᶡ/ˆ¤[ý†iK ™°"ó•Æp;`t¯MÑt}+@²¶Óí·Ídy’3mÕË‘’zc€0 íyÎq„ž ¬4×5[_]Rë{]ì¬UZ±p÷^åØÞÈ[©& OúÝÛ‚‚s÷zžIïßó btÎΪ\ya¾U;C¤t*IÎFF3Š¸™c
1žYD…U° êÄàõë\oŒ¼a ‡c[[GŽãP‘7 â znÈ>Ãü3ñ˜,=lUENŒäô¾ÚÀÓ[_ð9 œ´JçMy©E¢Àí}x,bpAó¦üdc ûŒW9?Å[Há$¿¹pÄ™#^9O88© zO=«Ë!µÖüY¨³ªÍy9ûÒ1 úôÚ»M?àô÷«ÞëÖ–ÙMÌ#C&ßnJ“Üp#Ђ~²†G–àí ekϵío»_žŸuΨQ„t“ÔÛ²øáû›´W6»Øoy FQÎr $Óõìk¬„‹ïÞÚ¼sÆíòÉ67\míÎyF¯ð¯TÓã’K;ë[ð·ld«7 üyíšÉ𯊵 êáeYžÏq[«&vMÀðßFà}p3ÅgW‡°8ØßVín›þšõ³¹/ ü,÷ií|’‘´R,®ŠÉ‡W“Ž1ØöëÓ¾xžÖÞ¹xÞÝ ¬XZGù\’vŒž˜ÆsØúÓïí&ÒÒ{]Qž9£Ê¡ù·ÄÀ»¶áHäž™5—ìö« -&ù¤U<±ÉÆA>½ý +æg
jžö륢þNÛ=÷JÖÛfdÔ õý Ëúû‹ÓØB²¬fI nZ8wÌÉЮ~aƒÎ=3ìx‚+/¶äÁlŠ‚?™Æü#8-œ\pqTZXtè%»»&ÚÝ#´ŠðÜ žã§Í’¼{p·ß {m>ÞycP¨’¼¢0ú(R ƒë^Ž ñó¼(»y%m´ÕÙ}ÊûékB1¨þÑ®,#Q)ó‡o1T©Üà *Ž‹‚yö< b‰4×H€“ìÐ.
¤²9ÌŠ>„Žãøgšñ
¯Š~)¸ßå\ÛÛoBŒa·L²œg$‚Iã¯ZÈ—Æ~%”äë—È8â)Œcƒ‘Âàu9¯b %)ÞS²¿Ïïÿ 4Öºù}Z/[ H%¤vÉ#Ì’x§†b
© ³´tÜ{gn=iï%õªÇç]ܧ—! åw„SÓp ·VÈÏ¡?5Âcâb¥_ĤŠz¬—nàþÖΟñKÄöJé=ÌWèêT‹¸÷ qÎჟ•q’zWUN«N/ØO^Ÿe|í¾©k{üõ4öV^ïù~G¹êzÂèº|·÷×[’Þ31†rpjg·n
Æ0Ý}kåË‹‰nîe¹ËÍ+™ ÏVbrOç]'‰¼o®xÎh`¹Ç*±ÙÚ!T$d/$žN>¼WqᯅZ9ÑÒO\ÜÛê1o&,-z ~^NCg NÕéá)ÒÊ©7‰¨¯'Õþ¯þ_¿Ehîþóâ €ï¬uÛûý*ÎK9ä.â-öv<²‘×h$àãúW%ö¯~«g-ÕõÀàG~>Zú¾Iš+(šM³ Û#9äl%ðc¬ ûÝ xÖKG´x®|¸¤Ï™ O:Ê8Ã’qÉcÔä‚yÇNJyËŒTj¥&µOmztjÿ ?KëaµÔù¯áýóXøãLeb¾tžAÇû`¨êGBA õ¾•:g˜’ù·,þhÀ`¬qÜ` e·~+å[±ý“âYÄjWì—µHé±ø?Nõô>½âX<5 Ç©Ï Ñ¼M¶8cܪXŽÉ^r?¼I róÈS•ZmÇ›™5»òÚÚ7ïu«&|·÷•Î†
>[©ÞXHeS$Œ yà€ ÷ù²:ò2|óãDf? Z¼PD¶ÓßC(xÆ0|©ßR;ô Msÿ µ´ÔVi¬,͹›Ìxâi˜`¹,GAéÇlV§ÄýF×Yø§ê–‘:Ã=ò2³9n±ÉžØÏ@yÎWžæ±Ãàe„ÄÒN ]ïòêìú_Go'¦ŽÑ’_×õЯðR66þ!›ÑÄ gFMÙ— äžäqôÈ;ÿ eX<#%»Aö‰ãR¤ Í”Ž¹È G&¹Ÿƒ&á?¶Zˆ±keRè Kãnz ·ãŠÕøÄÒÂ9j%@®×q±ÜŒ ý[õ-É$uíè&¤¶9zÇï·Oøï®ÄJKšÖìdü"µˆ[jײÎc;ã…B(g<9nàȯG½µŸPÓ.´Éfâ¼FŽP
31 ‘ÏR}<3šä~
Ã2xVöî Dr
Ç\›}Ý#S÷ÈÀëŽHÆI®à\OçKuäI¹†ó(”— G Wî ñ³¹¸æ2¨›‹ºÚû%¾ýÖ_3ºNú¯ëúì|ÕÅÖ‰}y lM’ZËîTÿ á[ ðÐñ/ˆ9Àû
¸ón3 Mòd‘÷ döª^.ÊñŽ°›BâîNp>cëÏçÍzïÃôÏ
YÍ%ª¬·ãÏ-*9ÜÂãhéŒc¾dÈêú¼Ë,. VŠ÷çeÿ n/¡¼äãõâ=‹xGQKx”|¹bÌŠD@2Œ 8'Ž àúƒŽ+áDÒ&¡¨"Œ§–Žr22 Ç·s]ŸÄ‹«ð%ÚÄ<¹ä’(×{e›HÀqÁç©Ç½`üŽÚõK饚9ƒÄ±€< – úƒú~ çðñO#Í%iKKlµ¦¾F)'Iê¬Î+Ç(`ñ¾£œdÈ’` ™ºcßéé^ÿ i¸”Û\ý¡æhÔB«aq¸}ãÀÆ:ÜWƒ|FÛÿ BŒÇÀeaŸ-sÊ€:úW½ÜÝÜ<%$µ†%CóDªÀí%IÈÏʤ…ôäñÞŒ÷‘a0“ôŽÚë¤nŸoW÷0«e¶y'Å»a Η2r’# Û°A^ý9ÉQÔõ=ù5 ¬£Öü.(Þ’M$ ~V«=éSÄFN½®©ÔWô»ÿ þHžkR‹ìÏ+µµžöê;khÚI¤m¨‹Ôš–âÖçJ¾_Z•’6 a” Èô> ÕÉaÕ<%®£2n bQŠå\tÈõUÿ ø»þ‹k15‚ÃuCL$ݹp P1=Oøýs¯^u éEJ”–éêŸê½5ýzy›jÛ ³á›Ûkÿ ÚOcn±ÛÏîW;boºz{ãžüVÆ¡a£a5½äÎÂks¸J@?1è¿{$ä‘=k”øsÖ^nŒ¦)ÝåXÃíùN1ØõÚOJë–xF÷h¸ Œ"Ž?x䜚ü³ì¨c*Fœ¯i;7~ñí׫Ðó¥Ë»3Ãü púw ‰°<Á%»ñž ÿ P+Û^ ¾Ye£ŽCÄŒ„/>˜ >•á¶Ìm~&&À>M[hÈÈÿ [Ž•íd…RO@3^Ç(ʽ*¶ÖQZyßþ
1Vº}Ñç?¼O4Rh6R€ª£í¡ûÙ
a‚3ß· Õ
ü=mRÍ/µ9¤‚0ÑC¼Iè:cŽsÛ¾™x£ÆЬªÍöˢ샒W$• €Å{¨ÀPG
ÀÀàŸZìÍ1RÉ0´ðxEË9+Éÿ ^rEÕ—±Š„70l¼áË@û.' ¼¹Žz€N3úUÉ<3á×*?²¬‚ä†"Ùc=p íÛ'¡ª 1ñ"økJ†HÒ'»Ÿ+
oÏN¬Ã9 dÙãÜדÏâÍ~æc+j·Jzâ7(£ð W]•æ™?nê´º6åwéåç÷N•ZŠíž›¬|?Ðõ?Ñ-E…®³Ç V$~X¯/…õ x‘LˆÑÜÚÈ7¦p zãÜüë½ðÄ^õtÝYËÍ7ÉÖÕ8ÏUe# #€r=sU¾/é’E§jRC4mxNÝ´9†íuá»›V‘
ZI€×cr1Ÿpzsøf»¨åV‹ìû`qËLÊIã?\~¼³á ËC©êhªOîO»‘ÃmçÛçút ×¢x“Z}?Ãœê#b-¤X7õ Äò gž zzbº3œ m*qvs·M=íúéw}¿&Úª°^Ö×µÏ(ø‡â†Öµƒenñý†×åQáYûœ÷ÇLœôÎNk¡ð‡¼/µ¸n0æÉ0¬ƒ‚üîÉÆvŒ w®Sáö”š¯‹-üÕVŠØÙ[$`(9cqƒÔ_@BëqûÙ`Ýæ0;79È?w<ó |ÙÜkßÌ1±Ëã ¿ìÒ»ðlìï«ÓnªèèrP´NÏš&Žéö Ù¸÷æ°~-_O'‰`°!RÚÚÝ%]Ø%þbß1'¿ÿ X ÕáOöÎŒ·‹¬+Åæ*ÛÛ™ 0¤ƒOÍÔ `u¯¦ÂaèÐÃÓ«‹¨Ô¥µœ¿¯ÉyÅÙ.oÔôŸ Úx&(STðݽ¦õ] ’ÒNóÁäÈùr3í·žÚ[™ƒ¼veÈ÷ÞIõÎGlqÎ=M|«gsªxÅI6
]Z·Îªä,¨zŒŽÄ~#ØŠúFñiÉqc©éÐD>S딑 G ñŽ1éÐ^+
Ëi;Ô„µVÕú»i¯ÈÒ-ZÍ]òܘ®ì` bÛÙ¥_/y(@÷ qÐúg Ô÷W0.Ø›
6Ò © r>QƒŒ0+Èîzb¨É+I0T bNñ"$~)ÕÒ6Þ‹{0VÆ27œ WWñcÄcX×íôûyKZéðªc' iQ¿¯LaW ŠŸS\·Š“źʸ…ôÙÂí |öÀÇåV|!¤ÂGâÛ[[’ï
3OrÙËPY¹=Î1õ5öåTžÑè Ú64/üö?Zëžk}¬¶éàoá¾á }3“ü]8Éæ¿´n²Žš_6¾pœ) 2?úWÓÚ¥¾¨iWúdŽq{*ª1rXŒd…m»‰äcô¯–dâ•ã‘Jº¬§¨#¨® §,df«8ÉÅßN¾hˆ;îÓ=7áùpën®É 6ûJžO2 ^œÐò JÖø¥²ã›Ò6Ü·‰!wbÍ‚¬O© »õ¬ÿ ƒP=Ä:â¤-& ÙŽ
` È9 r9íϧzë> XÅ7ƒ5X–krÑ¢L 7€ìw}ÑŸNHëŒüþ:2†á¼+u·á÷N/Û'Ðç~ߘô«ëh!ónRéeQ´6QÛÿ èEwëÅÒ|¸Yqó1uêyùzð8 ƒŠù¦Ò;¹ä6öi<'ü³„[ ÃZhu½ ùÍ¡g‚>r¯ ׊îÌx}bñ2“k꣧oø~›hTèóËWò4|ki"xßQ˜Ï6øÀLnß‚0 ¹Æ{±–¶Öe#¨27È@^Ìß.1N¾œyç€õ†ñeé·Õã†çQ°€=Ì©ºB€Ø8<‚à Sõ®ùcc>×Ú .Fr:žÝGæ=kÁâ,^!Fž
¬,àµ}%¶«îõ¹†"r²ƒGœüYÕd?aÑÃY®49PyU ÷þ!žxÅm|/‚ãNð˜¼PcûTÒ,¹/Ý=FkÏ|u¨¶«âë…{¤m¢]Û¾ïP>®XãÞ½i ÓÁ¾
‰'¬–6ß¼(„ï— í!ú Ùäzôë^–:œ¨å|,_¿&š×]uÓѵÛô4’j”bž§x‘Æ©ã›á,‚[Ô
ÎÞ= ŒËæ ÀùYÁ?ŽïÚ¼?ÁªxºÕÛ,°1¸‘¿Ýäãدv…@¤åq½ºã œàûââ· z8Xýˆþz~—û»™âµj=Ž
â~ãáh@'h¼F#·Üp?ŸëQü-løvépx»cŸø…lxâÃûG·‰¶ø”L£©%y?¦úõÆü-Õ¶¥y`Òl7>q’2üA?•F}c‡jB:¸Jÿ +§¹¿¸Q÷°ív= VÑìu[Qml%R7a×IèTõéŽx¬
?†š7
1†îã-ˆã’L¡lŽ0OÓ=ÅuˆpÇ• ¼3ÛùÒ¶W/!|’wŽw ^qÔ×Ïaó M8Q¨ãÑ?ëï0IEhÄa¸X•`a
?!ÐñùQ!Rä žqŽžÝO`I0ÿ J“y|ñ!Îã@99 >þ8–+éáu…!ù—ä
Ê°<÷6’I®z
ÅS„¾)Zþ_Öýµ×ËPåOwø ÷þ*üïænÖùmØÝûþ¹=>¦½öî×Jh]¼ç&@§nTŒ6IT Àõ^Fxð7Å3!Ö·aÛ$þÿ ¹ã5îIo:Ȫm ËY[’8ÇӾlj*òû¢¥xõ¾¼ú•åk+\ð¯ HÚoŽl•Ûk,¯ ç ²²cõÅ{²Z\
´ìQ åpzŽ3Ôð}ÿ Jð¯XO¡øÎé€hÙ¥ûLdŒ`““ù6Gá^ÃáÝ^Ë[Ñb¾YåŒÊ»dŽ4 †2§,;ÿ CQÄ´¾°¨c–±”mºV{«ßÕýÄW\ÖŸ‘çŸ,çMRÆí“l-ƒn~ë©ÉÈê Ü?#Ž•¹ðãSÒ¥ÐWNíà½;ãž)™ÎSÈ9cóLj뵿ūiÍk¨ió¶X‚7÷ƒ€yãnyÏŽëÞ Öt`×À×V's$È9Ú:ä{wÆEk€«†Çàc—â$éÎ.éí~Ýëk}ÅAÆpörÑ¢‡Šl¡ÑüSs ‹¨‰ I ÄóÀ×wñ&eºðf™pŒÆ9gŽTø£lñëÀçŽ NkÊUK0U’p ï^¡ãÈ¥´ø{£ÙHp`’ØåbqÏ©äó^Æ:
Ž' ÊóM«õz+ß×ó5Ÿ»('¹ð¦C„$˜Å¢_ºÈI?»^äã'ñêzž+ë€ñ-½»´}¡Ë*õ?.xÇ^1ŽMyǸ&“—L–îëöâ7…' bqéÎGé]˪â1$o²¸R8Ã`.q€}sÖ¾C98cêÆÞíïóòvÓòùœÕfÔÚéýuèÖ·Ú
Å‚_¤³ÜۺƑß”àר ý:׃xPþÅÕî-/üØmnQìïGΊÙRqê=>¢½õnæ·r!—h`+’;ò3È<“Û©éšóŸ x*÷V¹¸×tÈiˆßwiÔÿ |cŒñÏ®3Ö½ Ì°‰Ë Qr©ö½®¼ÛoÑÙZÅÑ«O൯ýw8;k›ÿ x†;ˆJa;‘º9÷÷R+¡ñgŽí|Iáë{ôáo2ʲ9 029ÉÏLí\‰¿¸Ÿb˜ "Bv$£&#ßiê>=ªª©f
’N ëí>¡NXW ~5×úíø\‰»½Ï^ø(—wÖú¥¤2íŽÞXæÁ$ °eÈ888^nÝë²ñÝÔ^ ÖÚ9Q~Ëå7ï
DC¶ÑµƒsË Çè9®Wáþƒ6‡£´·°2\Ý:ÈÑ? (#¨'$õèGJ¥ñW\ÿ ‰E¶—¸™g˜ÌÀ¹;Pv ú±ÎNs·ëŸ’–"Ž/:té+ûË]öJöÓM»ëø˜*‘•^Uý—êd| ‰åñMæÔÝ‹23å™6æHùÛ‚ëüñ^…ñ1¢oêûÑEØ.õ7*ÅHtÎp{g<·Á«+¸c¿¿pÓ¾Æby=8É_ÄsÆk¬ñB\jÞ Ôì••Ë[9Píb‹Bヅ =93§ð§LšÛáÖšÆæXÌÞdÛP.0\ãïÛ 0?™úJ¸™Ë
”•œº+=<µI£¦í¯õêt¬d‹T¬P=ËFêT>ÍØØ@Ï9<÷AQÌ×»Õ¡xùk",JÎæù±Éç$œŽŸZWH®¯"·UÌQ ’ÙÈ]ÅXg<ã
ߨg3-Üqe€0¢¨*Œ$܃
’Sû 8㎼_/e'+Ï–-èÓ¶¶Õíß[·ÙÙ½îì—¼sk%§µxä‰â-pÒeÆCr ú
ôσžû=”šÅô(QW‚Õd\ƒæ. \àö ¹¯F½°³½0M>‘gr÷q+œ¶NïºHO— ¤ ܥݔn·J|ÆP6Kµc=Isó}Ò çGš)a=—#vK›åoK§ßóÙ¤¶¿õú…ÄRÚ[ËsöÙ¼Ë•Ë ópw ®qœŒ·Ø
ùÇâ ‹ý‡ãKèS&ÞvûD Aù‘É9 Œî qÅ}
$SnIV[]Ñ´Ó}ØܾA Ü|½kÅþÓ|E Mu R¼.I¼¶däò‚ÃkÆ}ðy¹vc iUœZ…Õõ»z¾÷¿n¦*j-É/àœHã\y5 Û ß™ó0— äŸnzôã#Ô¯,†¥ÚeÔ÷ÜÅ´„“'c…<íÝ€< ·SŠ¥k§Ã¢éÆÆÙna‚8–=«Êª[Ÿ™°pNî02z“ÔÙ–K8.È’Þî(vƒ 2®@ ä Èûã çžxäÇf¯ˆu¹yUÕîýWšÙ|›ëÒ%Q^í[æ|éo5ZY•^{9 6ˆY‚§v*x>âº_|U¹Ö´©tûM ÒÂ9PÇ#«£# € éÉñ‘ƒÍz/‰´-į¹°dd,Б ›p03ƒœ{ç9=+
Ûᧇ¬¦[‡‚ê婺¸#±ß= ³ý¿•Õµjñ½HÙh›Û[§ÚýÊöô÷{˜?ô÷·Ô.u©–_%còcAÀ˜’
}0x9Î>žñÇáÍ9,ahï¦Ì2òÓ ñÛAäry$V²Nð
]=$Ž
‚#Ù‚1ƒƒødõ Max‡ÂÖ^!±KkÛ‘
«“Çó² FN8+ëÎ{Ò¼oí§[ «ÕMRoËeç×[_m/¦¦k.kôgŽxsSÓ´ý`êzªÜÜKo‰cPC9ÎY‰#§^üý9¹âïÞx£Ë·Ú`±‰‹¤;³–=ÏaôÕAð‚ ÷kêÁNBéÎælcõö®£Fð†ô2Ò¬]ßÂK$ÓÜ®•”/ÊHàã$ä ¸÷ëf¹Oµúâ“”’²øè´µþöjçNü÷üÌ¿ xNïFÒd»¼·h®îT9ŽAµÖ>qÁçÔœtïÒ»\ȶÎîcÞäîó3¶@#É IÎ ÔñW.<´’¥–ÑÑ€ÕšA‚ ;†qÓë‚2q
ÒÂó$# Çí‡
!Ë}Õ9ÈÎÑÉã=;ŒÇÎuñ+ÉûÏ¥öíeÙ+$úíÜ娯'+êZH4ƒq¶FV‹gïŒ208ÆÌ)íб>M|÷âÍã¾"iì‹¥£Jd´™OÝç;sÈúr+ÜäˆË)DŒ¥šF°*3Õ”d {zÔwºQ¿·UžÉf†~>I+ŒqÔ`ð3œ“Ü×f]œTÁÔn4“ƒø’Ýßõ_«*5šzGCÊ,þ+ê1ò÷O¶¸cœºb2y Ç ;cùÕ£ñh¬›áÑŠr¤ÝäNBk¥—á—†gxšX/쑘hŸ*Tçn =û㦠2|(ð¿e·ºÖ$
ýìŸ!'åÎ °yîî+×öœ=Y:²¦ÓÞ×iü’—ü
-BK™£˜›âÆ¡&véðõ-ûÉY¹=Onj¹ø¯¯yf4·±T Pó`çœ7={×mÃ/ ¢˜ZÚòK…G½¥b„’G AãÜœ *í¯Ã¿ IoæI¦NU8‘RwÈã;·€ Û×ëÒ”1Y
•£E»ÿ Oyto¢<£Áö·šï,ä‰ §ûA¼sû»Nò}¹üE{ÜÖªò1’õÞr0â}ÎØ#>à/8ïéÎ~—áÍ#ñÎlí§³2f'h”?C÷YËdð:qëõÓ·‚ïeÄ©
ÔÈØÜRL+žAÎ3¼g=åšó³Œt3
ÑQ¦ùRÙßE®¼±w_;þhš’Sirÿ ^ˆã¼iੇ|RòO„m°J/“$·l“ ÇÓ¿ÿ [ÑŠÆ“„†Õø>cFÆ6Ø1ƒ– àz7Ldòxäüwá‹ÝAXùO•Úý’é®ähm •NÀ±ÌTÈç
ƒ‘I$pGž:‚ÄbêW¢®œ´|¦nÍ>¶ÖÏ¢§ÎÜ¢ºö¹•%ÄqL^öÛ KpNA<ã¡ …î==ª¸óffËF‡yÌcÉ ©ç$ð=ñÏYþÊ’Ú]—¥‚¬‚eDïÎH>Ÿ_ÌTP™a‰ch['çÆÜò7a‡?w°Ïn§âÎ5”’¨¹uÚÛ|´ÓÓc§{O—ü1•ªxsÃZ…ÊÏy¡Ã3¸Ë2Èé» ‘ƒÎ äžÜðA§cáOéúÛ4ý5-fŒï„ù¬ûô.Ç Üsž•Ò¾•wo<¶Ÿ"¬¡º|£
î2sÇ¡éE²É FѱrU°dÜ6œ¨ mc†Îxë׺Þ'0²¡Rr„{j¾í·è›µ÷)º·å–‹î2|I®Y¼ºÍË·–ÃÆà ã£'óÆxƒOÆÞ&>\lóÌxP Xc ¸ì Sþ5§qà/ê>#žÞW¸if$\3 ® ûÄ“ùŽÕê¾ð< Ó‹H¶óÏ" å·( á‘€:ã†8Ï=+ꨬ UA×ÃËÚT’ÑÞöù¥¢]{»ms¥F0\ÑÕ—ô}&ÛB´ƒOŽÚ+›xíÄÀ1
,v± žIëíZ0ǧ™ 3 í2®0ภ—p9öÝÔž)ÓZËoq/Ú“‘L ²ŒmùŽï‘Ó9§[Û#Ä‘\ÞB¬Çs [;à à«g‚2ôòªœÝV§»·¯/[uó½õÛï¾
/šÍ}öüÿ « =x»HŸÂÞ.™ ÌQùŸh´‘#a$‚'¡u<Š›Æ>2>+ƒLSiöwµFó1!eg`£åœ ÷ëÛö}Á¿ÛVÙêv $¬ ƒ|,s÷z€ð΃¨x÷ÅD\Ü ŒÞmåÔ„ ˆ o| :{ÇÓ¶–òÁn!´0Ål€, ƒ ( ÛŒŒ c¶rsšæ,4‹MÛOH!@¢ ÇŽ„`å²9ÝÃw;AÍt0®¤¡…¯ØÄ .Àìí´ƒ‘ßñ5Í,Óëu-ÈÔc¢KÃÓ£òÖ̺U.õL¯0…%2È—"~x
‚[`có±nHàŽyàö™¥keˆìŒÛFç{(Ø©†`Jã#Žwg<“:ÚÉ;M
^\yhûX ‡vB·÷zrF?§BÊÔ/s< ÐÈB)Û± ·ÍÔwç5Âã:så§ e{mѤï«Òíh—]Wm4âí¿ùþW4bC3¶ª¾Ùr$ pw`àädzt!yŠI„hÂîàM)!e dŒm'æ>Ç?w zºKìcŒ´¯Ìq6fp$)ãw¡éUl`µ»ARAˆÝÕgr :äŒg ƒéé[Ôö±”iYs5Ýï«ÙG—K=þF’æMG«óÿ `ŠKɦuOQ!ÕåŒ/ÎGÞ`@ËqÕzdõâ«Ê/Ö(ƒK´%ŽbMü åÜŸö—>¤óŒŒV‘°„I ¢Yž#™¥ùÏÊ@8
œgqöö5ª4vד[¬(q cò¨À!FGaÁõõ¯? §†¥ÏU½í¿WªZ$úyú½ŽzקÉþ?>Ã×È•6°{™™ŽÙ.$`ÎU œ…çè ' ¤r$1Ø(y7 ðV<ž:È ÁÎMw¾Â'Øb§øxb7gãО½óÉÊë²,i„Fȹ £§8ãä½k¹¥¦ê/ç{ïê驪2œ/«ü?¯Ô›ìñÜ$þeýœRIåŒg9Ác’zrrNO bÚi¢
ѺË/$,“ª¯Ýä;Œ× ´<ÛÑn³IvŸb™¥ nm–ÄŸ—nÝÀãŽ3ëÍG,.öó³˜Ù£¹u ÊÌrŠ[<±!@Æ:c9ÅZh
ì’M5ÄìÌ-‚¼ëÉùqŽGì9¬á ;¨A-ž—évþÖ–^ON·Ô”ŸEý}ú×PO&e[]ÒG¸˜Ûp ƒÃà/Ë·8ûÀ€1ž@¿ÚB*²¼ñì8@p™8Q“žÆH'8 «I-%¸‚
F»“åó6°Uù|¶Ú¸ã ò^Äw¥ŠÖK–1ÜÝK,Žddlí²0PÀü“×ükG…¯U«·¶–´w¶ŽÍ¾©yÞú[Zös•¯Á[™6°
¨¼ÉVæq·,#
ìãï‘×8îry®A››¨,ãc66»Ë´ã'æÉù?t} ¢æH--Òá"›|ˆ¬[í 7¶ö#¸9«––‹$,+Ëqœ\Êø c€yê^ݸÄa°«™B-9%«×®‹V´w~vÜTéꢷþ¼ˆ%·¹• ’[xç•÷2gØS?6åÀÚ õ9É#š@÷bT¸º²C*3Bá¤òÎA9 =úU§Ó"2Ãlá 0i ÝIc‚2Î@% öç94ùô»'»HÄ¥Ô¾@à Tp£šíx:úÊ:5eºßMý×wµ›Ó_+šº3Ýyvÿ "ºÇ<ÂI>Õ 1G·Ë«È«É# àÈÇ øp Jv·šæDûE¿›†Ë’NFr2qŸ½ÇAÜšu•´éí#Ħ8£2”Ú2Ã/€[ÎTr;qŠz*ý’Îþ(≠;¡TÆâ›;ºÿ àçœ k‘Þ8¾Uª¾íé{^×IZéwÓkXÉûÑZo¯_øo×È¡¬ â–ÞR§2„‚Àœü½ùç® SVa†Âüª¼±D‘ŒísŸàä|ä 2 æ[‹z”¯s{wn„ÆmáóCO+†GO8Ïeçåº`¯^¼ðG5f{Xžä,k‰<á y™¥voÆ éÛõëI=œ1‹éíÔÀÑ)R#;AÂncäŽ: tÏ#¶TkB.0Œ-ÖÞZÛgumß}fÎJÉ+#2êÔP£žùÈÅi¢%œ3P*Yƒò‚Aì“Ž2r:ƒÐúñiRUQq‰H9!”={ ~¼ “JŽV¥»×²m.ÛߺiYl¾òk˜gL³·rT•
’…wHÁ6ä`–Î3ù Ì4Øe³†&òL‘•%clyîAÂäà0 žüç$[3uŘpNOÀÉ=† cï{rYK
ååä~FÁ
•a»"Lär1Ó¯ 2Äõæ< ™C•.fÕ»è¥~½-¿g½Â4¡{[ør¨¶·Žõäx¥’l®qpwÇ»8ärF \cŽ¸ÜÆÓ-g‚yciÏÀ¾rÎwèØÈ#o°Á9ã5¢šfÔxÞæfGusÏÌJÿ µ×œ/LtãÅT7²¶w,l
ɳ;”eúà·¨çîŒsÜgTÃS¦^ '~‹®›¯+k÷ZÖd©Æ*Ó[Ü«%Œk0ŽXƒ”$k#Ȩ P2bv‘ƒŸáÇ™ÆÕb)m$É*8óLE‘8'–ÜN Úyàúô+{uº±I'wvš4fÜr íì½=úuú
sFlìV$‘ö†HÑù€$§ õ=½¸«Ž]
:Ž+•¦ïmRþ½l´îÊT#nkiøÿ _ðÆT¶7Ò½ºÒ £Î¸d\ã8=yãŽÜ äR{x]ZâÚé#¸r²#» ÎHÆ6õ ç® ÎFkr;sºÄ.&;só± Ç9êH÷ýSšÕtÐU¢-n Ì| vqœ„{gŒt§S.P‹’Ž‰_[;m¥ÞZýRûÂX{+¥úü¼ú•-àÓ7!„G"“´‹žƒnrYXã¸îp éœ!ÓoPÌtÑ (‰Þ¹é€sÓ# GLçÕšÑnJý¡!‘Tä #“ß?îýp}xÇ‚I¥Õn#·¸–y'qó@r[ Êô÷<ÔWÃÓ¢áN¥4Ô’I&ݼ¬¬¼ÞºvéÆ
FQV~_ÒüJÖÚt¥¦Xá3BÄP^%ÈÎW-×c¡ú©¤·Iþèk¥š?–UQåIR[’O 5x\ÉhÆI¶K4«2ùªŠŒ<¼óœ çØ`u«‚Í.VHä € Ëgfx'' 9ÆI#±®Z8
sISºku¢ßÞ]úk»Jößl¡B.Ü»ÿ MWe
°·Ž%šêɆ¼»Âù³´œ O¿cÐ ÓÄh©"ÛÜÏ.ÖV ’3nüÄmnq[ŒòznšÖ>J¬òˆæ… qýØP Ž:ä7^0yëWšÍ_79äoaÈ °#q0{ää×m œy”R{vÒÞ¶ÚÏe¥“ÚÆХ̮—õýjR •íç›Ìb„+J yÜØÙ•Ç]¿Ôd þËO L²”9-Œ— õÃc'æÝלçÚ²ìejP“½
âù°¨†ðqòädЃÉäÖÜj÷PÇp“ÍšŠå«‘î
< iWNsmª»¶vÓz5»ûì:Rs\Ðßôû×uÔÿÙ