From 1776b062836563df3ea1f65cfeb728fde0fd5f19 Mon Sep 17 00:00:00 2001
From: zhangpan
Date: Fri, 26 Jan 2024 03:05:23 +0000
Subject: [PATCH] update to 3.2.1
---
backport-CVE-2023-1668.patch | 433 ------------------
backport-CVE-2023-5366.patch | 233 ----------
...l_preprocessor_in_manpage-check_rule.patch | 125 -----
...-2.17.5.tar.gz => openvswitch-3.2.1.tar.gz | Bin 7992213 -> 8330080 bytes
openvswitch.spec | 13 +-
5 files changed, 7 insertions(+), 797 deletions(-)
delete mode 100644 backport-CVE-2023-1668.patch
delete mode 100644 backport-CVE-2023-5366.patch
delete mode 100644 backport-docs-5-Run_tbl_preprocessor_in_manpage-check_rule.patch
rename openvswitch-2.17.5.tar.gz => openvswitch-3.2.1.tar.gz (50%)
diff --git a/backport-CVE-2023-1668.patch b/backport-CVE-2023-1668.patch
deleted file mode 100644
index 0b7f7d3..0000000
--- a/backport-CVE-2023-1668.patch
+++ /dev/null
@@ -1,433 +0,0 @@
-From 27fb5db7f727ffc056f024f9ba4936facccb5f40 Mon Sep 17 00:00:00 2001
-From: Aaron Conole
-Date: Fri, 31 Mar 2023 17:17:27 -0400
-Subject: [PATCH] ofproto-dpif-xlate: Always mask ip proto field.
-
-The ofproto layer currently treats nw_proto field as overloaded to mean
-both that a proper nw layer exists, as well as the value contained in
-the header for the nw proto. However, this is incorrect behavior as
-relevant standards permit that any value, including '0' should be treated
-as a valid value.
-
-Because of this overload, when the ofproto layer builds action list for
-a packet with nw_proto of 0, it won't build the complete action list that
-we expect to be built for the packet. That will cause a bad behavior
-where all packets passing the datapath will fall into an incomplete
-action set.
-
-The fix here is to unwildcard nw_proto, allowing us to preserve setting
-actions for protocols which we know have support for the actions we
-program. This means that a traffic which contains nw_proto == 0 cannot
-cause connectivity breakage with other traffic on the link.
-
-Reported-by: David Marchand
-Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=2134873
-Acked-by: Ilya Maximets
-Signed-off-by: Aaron Conole
-Signed-off-by: Ilya Maximets
----
- include/openvswitch/meta-flow.h | 4 +
- lib/meta-flow.c | 25 +++++
- ofproto/ofproto-dpif-xlate.c | 8 ++
- tests/ofproto-dpif.at | 18 ++--
- tests/ofproto.at | 182 ++++++++++++++++++++++++++++++++
- tests/packet-type-aware.at | 2 +-
- 6 files changed, 229 insertions(+), 10 deletions(-)
-
-diff --git a/include/openvswitch/meta-flow.h b/include/openvswitch/meta-flow.h
-index 045dce8f5fa..3b0220aaa25 100644
---- a/include/openvswitch/meta-flow.h
-+++ b/include/openvswitch/meta-flow.h
-@@ -2366,6 +2366,10 @@ void mf_format_subvalue(const union mf_subvalue *subvalue, struct ds *s);
- void field_array_set(enum mf_field_id id, const union mf_value *,
- struct field_array *);
-
-+/* Mask the required l3 prerequisites if a 'set' action occurs. */
-+void mf_set_mask_l3_prereqs(const struct mf_field *, const struct flow *,
-+ struct flow_wildcards *);
-+
- #ifdef __cplusplus
- }
- #endif
-diff --git a/lib/meta-flow.c b/lib/meta-flow.c
-index c576ae6202a..474344194fa 100644
---- a/lib/meta-flow.c
-+++ b/lib/meta-flow.c
-@@ -3676,3 +3676,28 @@ mf_bitmap_not(struct mf_bitmap x)
- bitmap_not(x.bm, MFF_N_IDS);
- return x;
- }
-+
-+void
-+mf_set_mask_l3_prereqs(const struct mf_field *mf, const struct flow *fl,
-+ struct flow_wildcards *wc)
-+{
-+ if (is_ip_any(fl) &&
-+ ((mf->id == MFF_IPV4_SRC) ||
-+ (mf->id == MFF_IPV4_DST) ||
-+ (mf->id == MFF_IPV6_SRC) ||
-+ (mf->id == MFF_IPV6_DST) ||
-+ (mf->id == MFF_IPV6_LABEL) ||
-+ (mf->id == MFF_IP_DSCP) ||
-+ (mf->id == MFF_IP_ECN) ||
-+ (mf->id == MFF_IP_TTL))) {
-+ WC_MASK_FIELD(wc, nw_proto);
-+ } else if ((fl->dl_type == htons(ETH_TYPE_ARP)) &&
-+ ((mf->id == MFF_ARP_OP) ||
-+ (mf->id == MFF_ARP_SHA) ||
-+ (mf->id == MFF_ARP_THA) ||
-+ (mf->id == MFF_ARP_SPA) ||
-+ (mf->id == MFF_ARP_TPA))) {
-+ /* mask only the lower 8 bits. */
-+ wc->masks.nw_proto = 0xff;
-+ }
-+}
-diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
-index 8a28b29d4c2..c9bd075a90d 100644
---- a/ofproto/ofproto-dpif-xlate.c
-+++ b/ofproto/ofproto-dpif-xlate.c
-@@ -5186,6 +5186,7 @@ compose_dec_ttl(struct xlate_ctx *ctx, struct ofpact_cnt_ids *ids)
- }
-
- ctx->wc->masks.nw_ttl = 0xff;
-+ WC_MASK_FIELD(ctx->wc, nw_proto);
- if (flow->nw_ttl > 1) {
- flow->nw_ttl--;
- return false;
-@@ -7094,6 +7095,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- case OFPACT_SET_IPV4_SRC:
- if (flow->dl_type == htons(ETH_TYPE_IP)) {
- memset(&wc->masks.nw_src, 0xff, sizeof wc->masks.nw_src);
-+ WC_MASK_FIELD(wc, nw_proto);
- flow->nw_src = ofpact_get_SET_IPV4_SRC(a)->ipv4;
- }
- break;
-@@ -7101,12 +7103,14 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
- case OFPACT_SET_IPV4_DST:
- if (flow->dl_type == htons(ETH_TYPE_IP)) {
- memset(&wc->masks.nw_dst, 0xff, sizeof wc->masks.nw_dst);
-+ WC_MASK_FIELD(wc, nw_proto);
- flow->nw_dst = ofpact_get_SET_IPV4_DST(a)->ipv4;
- }
- break;
-
- case OFPACT_SET_IP_DSCP:
- if (is_ip_any(flow)) {
-+ WC_MASK_FIELD(wc, nw_proto);
- wc->masks.nw_tos |= IP_DSCP_MASK;
- flow->nw_tos &= ~IP_DSCP_MASK;
- flow->nw_tos |= ofpact_get_SET_IP_DSCP(a)->dscp;
-@@ -7115,6 +7119,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-
- case OFPACT_SET_IP_ECN:
- if (is_ip_any(flow)) {
-+ WC_MASK_FIELD(wc, nw_proto);
- wc->masks.nw_tos |= IP_ECN_MASK;
- flow->nw_tos &= ~IP_ECN_MASK;
- flow->nw_tos |= ofpact_get_SET_IP_ECN(a)->ecn;
-@@ -7123,6 +7128,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-
- case OFPACT_SET_IP_TTL:
- if (is_ip_any(flow)) {
-+ WC_MASK_FIELD(wc, nw_proto);
- wc->masks.nw_ttl = 0xff;
- flow->nw_ttl = ofpact_get_SET_IP_TTL(a)->ttl;
- }
-@@ -7190,6 +7196,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-
- /* Set the field only if the packet actually has it. */
- if (mf_are_prereqs_ok(mf, flow, wc)) {
-+ mf_set_mask_l3_prereqs(mf, flow, wc);
- mf_mask_field_masked(mf, ofpact_set_field_mask(set_field), wc);
- mf_set_flow_value_masked(mf, set_field->value,
- ofpact_set_field_mask(set_field),
-@@ -7246,6 +7253,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len,
-
- case OFPACT_DEC_TTL:
- wc->masks.nw_ttl = 0xff;
-+ WC_MASK_FIELD(wc, nw_proto);
- if (compose_dec_ttl(ctx, ofpact_get_DEC_TTL(a))) {
- return;
- }
-diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at
-index bc981f8fc61..71c267b3adc 100644
---- a/tests/ofproto-dpif.at
-+++ b/tests/ofproto-dpif.at
-@@ -720,7 +720,7 @@ table=2 ip actions=set_field:192.168.3.91->ip_src,output(11)
- AT_CHECK([ovs-ofctl -O OpenFlow12 add-flows br0 flows.txt])
- AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=1,nw_tos=0,nw_ttl=128,nw_frag=no,icmp_type=8,icmp_code=0'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+ [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: 10,set(ipv4(src=192.168.3.91)),11,set(ipv4(src=192.168.3.90)),13
- ])
- OVS_VSWITCHD_STOP
-@@ -783,7 +783,7 @@ AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_ds
- # Must match on the source address to be able to restore it's value for
- # the second bucket
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+ [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),11
- ])
- OVS_VSWITCHD_STOP
-@@ -815,7 +815,7 @@ done
- AT_CHECK([ovs-appctl dpctl/dump-flows | sed 's/dp_hash(.*\/0xf)/dp_hash(0xXXXX\/0xf)/' | sed 's/packets.*actions:/actions:/' | strip_ufid | strip_used | sort], [0], [dnl
- flow-dump from the main thread:
- recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no), actions:hash(sym_l4(0)),recirc(0x1)
--recirc_id(0x1),dp_hash(0xXXXX/0xf),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.0.1,frag=no), actions:set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),10
-+recirc_id(0x1),dp_hash(0xXXXX/0xf),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.0.1,proto=1,frag=no), actions:set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),10
- ])
-
- OVS_VSWITCHD_STOP
-@@ -830,7 +830,7 @@ AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_ds
- # Must match on the source address to be able to restore it's value for
- # the third bucket
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_src=192.168.0.1,nw_frag=no
-+ [Megaflow: recirc_id=0,eth,icmp,in_port=1,nw_src=192.168.0.1,nw_frag=no
- Datapath actions: set(ipv4(src=192.168.3.90)),10,set(ipv4(src=192.168.0.1)),11
- ])
- OVS_VSWITCHD_STOP
-@@ -1407,17 +1407,17 @@ AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=111,tos=0,ttl=2,frag=no)' -generate], [0], [stdout])
- AT_CHECK([tail -4 stdout], [0], [
- Final flow: ip,in_port=1,vlan_tci=0x0000,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=111,nw_tos=0,nw_ecn=0,nw_ttl=1,nw_frag=no
--Megaflow: recirc_id=0,eth,ip,in_port=1,nw_ttl=2,nw_frag=no
-+Megaflow: recirc_id=0,eth,ip,in_port=1,nw_proto=111,nw_ttl=2,nw_frag=no
- Datapath actions: set(ipv4(ttl=1)),2,userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535)),4
- ])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=192.168.0.1,dst=192.168.0.2,proto=111,tos=0,ttl=3,frag=no)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_ttl=3,nw_frag=no
-+ [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_proto=111,nw_ttl=3,nw_frag=no
- Datapath actions: set(ipv4(ttl=2)),2,set(ipv4(ttl=1)),3,4
- ])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x86dd),ipv6(src=::1,dst=::2,label=0,proto=10,tclass=0x70,hlimit=128,frag=no)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,eth,ipv6,in_port=1,nw_ttl=128,nw_frag=no
-+ [Megaflow: recirc_id=0,eth,ipv6,in_port=1,nw_proto=10,nw_ttl=128,nw_frag=no
- Datapath actions: set(ipv6(hlimit=127)),2,set(ipv6(hlimit=126)),3,4
- ])
-
-@@ -1527,7 +1527,7 @@ AT_CHECK([ovs-vsctl -- \
- --id=@q2 create Queue dscp=2], [0], [ignore])
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(9),eth(src=50:54:00:00:00:05,dst=50:54:00:00:00:07),eth_type(0x0800),ipv4(src=1.1.1.1,dst=2.2.2.2,proto=1,tos=0xff,ttl=128,frag=no),icmp(type=8,code=0)'], [0], [stdout])
- AT_CHECK([tail -2 stdout], [0],
-- [Megaflow: recirc_id=0,skb_priority=0,eth,ip,in_port=9,nw_tos=252,nw_frag=no
-+ [Megaflow: recirc_id=0,skb_priority=0,eth,icmp,in_port=9,nw_tos=252,nw_frag=no
- Datapath actions: dnl
- 100,dnl
- set(ipv4(tos=0x4/0xfc)),set(skb_priority(0x1)),1,dnl
-@@ -11703,7 +11703,7 @@ ovs-ofctl dump-flows br0
-
- AT_CHECK([ovs-appctl ofproto/trace ovs-dummy 'in_port(1),eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800),ipv4(src=10.10.10.2,dst=10.10.10.1,proto=1,tos=1,ttl=128,frag=no),icmp(type=8,code=0)'], [0], [stdout])
- AT_CHECK([tail -3 stdout], [0], [dnl
--Megaflow: recirc_id=0,eth,ip,reg0=0/0x1,in_port=1,nw_src=10.10.10.2,nw_frag=no
-+Megaflow: recirc_id=0,eth,icmp,reg0=0/0x1,in_port=1,nw_src=10.10.10.2,nw_frag=no
- Datapath actions: drop
- Translation failed (Recursion too deep), packet is dropped.
- ])
-diff --git a/tests/ofproto.at b/tests/ofproto.at
-index 39c3b047045..32bde5b5a28 100644
---- a/tests/ofproto.at
-+++ b/tests/ofproto.at
-@@ -6448,3 +6448,185 @@ verify_deleted
-
- OVS_VSWITCHD_STOP(["/nw_dst,output=2
-+table=0 in_port=1 priority=83,ip,nw_dst=192.168.1.15,actions=set_field:192.168.21.26->nw_src,output=2
-+table=0 in_port=1 priority=82,ip,nw_dst=192.168.1.14,actions=set_field:0x40->nw_tos,output=2
-+table=0 in_port=1 priority=0,actions=drop
-+])
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl send a proto 0 packet to try and poison the DP flow path
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 \
-+ '5054000000075054000000050800450000548de140004000289fc0a801c4c0a8011408003bf60002001bbf080a640000000032ad010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=0,frag=no), packets:0, bytes:0, used:never, actions:2
-+])
-+
-+dnl Send ICMP for mod nw_src and mod nw_dst
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.21,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.20,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will dec TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.10,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.19,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod ECN
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.18,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will mod TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.17,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set DST
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.16,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set SRC
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.15,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+dnl send ICMP that will set TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.14,proto=1,tos=0,ttl=64,frag=no),icmp(type=8,code=0)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.10,proto=1,ttl=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(ttl=63)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.14,proto=1,tos=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.16,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(dst=192.168.20.26)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.17,proto=1,tos=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.18,proto=1,tos=0/0x3,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(tos=0x2/0x3)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.19,proto=1,ttl=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(ttl=8)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=0,frag=no), packets:0, bytes:0, used:never, actions:2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(dst=192.168.1.20,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(dst=192.168.20.20)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.15,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(src=192.168.21.26)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(src=192.168.1.1,dst=192.168.1.21,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv4(src=192.168.20.21)),2
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
-+AT_SETUP([ofproto - implicit mask of ipv6 proto with HOPOPT field])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2
-+
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=77,ip6,ipv6_dst=111:db8::3,actions=dec_ttl,output=2
-+table=0 in_port=1 priority=76,ip6,ipv6_dst=111:db8::4,actions=mod_nw_ttl:8,output=2
-+table=0 in_port=1 priority=75,ip6,ipv6_dst=111:db8::5,actions=mod_nw_ecn:2,output=2
-+table=0 in_port=1 priority=74,ip6,ipv6_dst=111:db8::6,actions=mod_nw_tos:0x40,output=2
-+table=0 in_port=1 priority=73,ip6,ipv6_dst=111:db8::7,actions=set_field:2112:db8::2->ipv6_dst,output=2
-+table=0 in_port=1 priority=72,ip6,ipv6_dst=111:db8::8,actions=set_field:2112:db8::3->ipv6_src,output=2
-+table=0 in_port=1 priority=72,ip6,ipv6_dst=111:db8::9,actions=set_field:44->ipv6_label,output=2
-+table=0 in_port=1 priority=0,actions=drop
-+])
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl send a proto 0 packet to try and poison the DP flow path
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::3,proto=0,tclass=0,hlimit=64,frag=no)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=0,hlimit=0,frag=no), packets:0, bytes:0, used:never, actions:userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535))
-+])
-+
-+dnl Send ICMP for mod nw_src and mod nw_dst
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::3,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::4,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will dec TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::5,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod TTL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::6,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod ECN
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::7,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will mod TOS
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::8,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+dnl send ICMP that will set LABEL
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::9,proto=1,tclass=0,hlimit=64,frag=no),icmpv6(type=0,code=8)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=0,hlimit=0,frag=no), packets:0, bytes:0, used:never, actions:userspace(pid=0,controller(reason=2,dont_send=0,continuation=0,recirc_id=1,rule_cookie=0,controller_id=0,max_len=65535))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::3,proto=1,hlimit=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(hlimit=63)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::4,proto=1,hlimit=64,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(hlimit=8)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::5,proto=1,tclass=0/0x3,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(tclass=0x2/0x3)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::6,proto=1,tclass=0/0xfc,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(tclass=0x40/0xfc)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::7,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(dst=2112:db8::2)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(dst=111:db8::9,label=0,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(label=0x2c)),2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x86dd),ipv6(src=2001:db8::1,dst=111:db8::8,proto=1,frag=no), packets:0, bytes:0, used:never, actions:set(ipv6(src=2112:db8::3)),2
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
-+AT_SETUP([ofproto - implicit mask of ARP OPer field])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2
-+
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=77,arp,arp_sha=00:01:02:03:04:06,actions=set_field:0x1->arp_op,2
-+table=0 in_port=1 priority=76,arp,arp_sha=00:01:02:03:04:07,actions=set_field:00:02:03:04:05:06->arp_sha,2
-+table=0 in_port=1 priority=75,arp,arp_sha=00:01:02:03:04:08,actions=set_field:ff:00:00:00:00:ff->arp_tha,2
-+table=0 in_port=1 priority=74,arp,arp_sha=00:01:02:03:04:09,actions=set_field:172.31.110.26->arp_spa,2
-+table=0 in_port=1 priority=73,arp,arp_sha=00:01:02:03:04:0a,actions=set_field:172.31.110.10->arp_tpa,2
-+table=0 in_port=1 priority=1,actions=drop
-+])
-+
-+AT_CHECK([ovs-ofctl del-flows br0])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+dnl Send op == 0 packet
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 \
-+ 'ffffffffffffaa55aa550000080600010800060400000001020304070c0a00010000000000000c0a0002'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=0,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:2
-+])
-+
-+dnl Send op 2 -> set op
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=2,sha=00:01:02:03:04:06,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set SHA
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:07,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set THA
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:08,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set SIP
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:09,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+dnl Send op 1 -> set TIP
-+AT_CHECK([ovs-appctl netdev-dummy/receive p1 'in_port(1),eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0806),arp(sip=172.31.110.1,tip=172.31.110.25,op=1,sha=00:01:02:03:04:0a,tha=ff:ff:ff:ff:ff:ff)'])
-+
-+AT_CHECK([ovs-appctl dpctl/dump-flows | sort], [0], [dnl
-+flow-dump from the main thread:
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=0,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:2
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=1,sha=00:01:02:03:04:07), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=1,sha=00:01:02:03:04:08,tha=ff:ff:ff:ff:ff:ff), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(op=2,sha=00:01:02:03:04:06), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(sip=172.31.110.1,op=1,sha=00:01:02:03:04:09), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+recirc_id(0),in_port(1),packet_type(ns=0,id=0),eth_type(0x0806),arp(tip=172.31.110.25,op=1,sha=00:01:02:03:04:0a), packets:0, bytes:0, used:never, actions:userspace(pid=0,slow_path(action))
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-diff --git a/tests/packet-type-aware.at b/tests/packet-type-aware.at
-index 054dcc9ccf6..38d839e85ce 100644
---- a/tests/packet-type-aware.at
-+++ b/tests/packet-type-aware.at
-@@ -1021,7 +1021,7 @@ AT_CHECK([
- ], [0], [flow-dump from the main thread:
- recirc_id(0),in_port(p0),packet_type(ns=0,id=0),eth(src=aa:bb:cc:00:00:02,dst=aa:bb:cc:00:00:01),eth_type(0x0800),ipv4(dst=20.0.0.1,proto=47,frag=no), packets:3, bytes:378, used:0.0s, actions:tnl_pop(gre_sys)
- tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0),in_port(gre_sys),packet_type(ns=1,id=0x8847),eth_type(0x8847),mpls(label=999/0x0,tc=0/0,ttl=64/0x0,bos=1/1), packets:3, bytes:264, used:0.0s, actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00),pop_mpls(eth_type=0x800),recirc(0x1)
--tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0x1),in_port(gre_sys),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(ttl=64,frag=no), packets:3, bytes:294, used:0.0s, actions:set(ipv4(ttl=63)),int-br
-+tunnel(src=20.0.0.2,dst=20.0.0.1,flags(-df-csum)),recirc_id(0x1),in_port(gre_sys),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(proto=1,ttl=64,frag=no), packets:3, bytes:294, used:0.0s, actions:set(ipv4(ttl=63)),int-br
- ])
-
- ovs-appctl time/warp 1000
diff --git a/backport-CVE-2023-5366.patch b/backport-CVE-2023-5366.patch
deleted file mode 100644
index 6e2a7ca..0000000
--- a/backport-CVE-2023-5366.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From 489553b1c21692063931a9f50b6849b23128443c Mon Sep 17 00:00:00 2001
-From: Ilya Maximets
-Date: Fri, 17 Feb 2023 21:09:59 +0100
-Subject: [PATCH] classifier: Fix missing masks on a final stage with ports
- trie.
-
-Flow lookup doesn't include masks of the final stage in a resulting
-flow wildcards in case that stage had L4 ports match. Only the result
-of ports trie lookup is added to the mask. It might be sufficient in
-many cases, but it's not correct, because ports trie is not how we
-decided that the packet didn't match in this subtable. In fact, we
-used a full subtable mask in order to determine that, so all the
-subtable mask bits has to be added.
-
-Ports trie can still be used to adjust ports' mask, but it is not
-sufficient to determine that the packet didn't match.
-
-Assuming we have following 2 OpenFlow rules on the bridge:
-
- table=0, priority=10,tcp,tp_dst=80,tcp_flags=+psh actions=drop
- table=0, priority=0 actions=output(1)
-
-The first high priority rule supposed to drop all the TCP data traffic
-sent on port 80. The handshake, however, is allowed for forwarding.
-
-Both 'tcp_flags' and 'tp_dst' are on the final stage in the flow.
-Since the stage mask from that stage is not incorporated into the flow
-wildcards and only ports mask is getting updated, we have the following
-megaflow for the SYN packet that has no match on 'tcp_flags':
-
- $ ovs-appctl ofproto/trace br0 "in_port=br0,tcp,tp_dst=80,tcp_flags=syn"
-
- Megaflow: recirc_id=0,eth,tcp,in_port=LOCAL,nw_frag=no,tp_dst=80
- Datapath actions: 1
-
-If this flow is getting installed into datapath flow table, all the
-packets for port 80, regardless of TCP flags, will be forwarded.
-
-Incorporating all the looked at bits from the final stage into the
-stages map in order to get all the necessary wildcards. Ports mask
-has to be updated as a last step, because it doesn't cover the full
-64-bit slot in the flowmap.
-
-With this change, in the example above, OVS is producing correct
-flow wildcards including match on TCP flags:
-
- Megaflow: recirc_id=0,eth,tcp,in_port=LOCAL,nw_frag=no,tp_dst=80,tcp_flags=-psh
- Datapath actions: 1
-
-This way only -psh packets will be forwarded, as expected.
-
-This issue affects all other fields on stage 4, not only TCP flags.
-Tests included to cover tcp_flags, nd_target and ct_tp_src/dst.
-First two are frequently used, ct ones are sharing the same flowmap
-slot with L4 ports, so important to test.
-
-Before the pre-computation of stage masks, flow wildcards were updated
-during lookup, so there was no issue. The bits of the final stage was
-lost with introduction of 'stages_map'.
-
-Recent adjustment of segment boundaries exposed 'tcp_flags' to the issue.
-
-Reported-at: https://github.com/openvswitch/ovs-issues/issues/272
-Fixes: ca44218515f0 ("classifier: Adjust segment boundary to execute prerequisite processing.")
-Fixes: fa2fdbf8d0c1 ("classifier: Pre-compute stage masks.")
-Acked-by: Aaron Conole
-Signed-off-by: Ilya Maximets
----
- lib/classifier.c | 25 ++++++++++---
- tests/classifier.at | 88 +++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 108 insertions(+), 5 deletions(-)
-
-diff --git a/lib/classifier.c b/lib/classifier.c
-index 0a89626cc30..18dbfc83ad4 100644
---- a/lib/classifier.c
-+++ b/lib/classifier.c
-@@ -1695,6 +1695,8 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
- const struct cls_match *rule = NULL;
- struct flowmap stages_map = FLOWMAP_EMPTY_INITIALIZER;
- unsigned int mask_offset = 0;
-+ bool adjust_ports_mask = false;
-+ ovs_be32 ports_mask;
- int i;
-
- /* Try to finish early by checking fields in segments. */
-@@ -1722,6 +1724,9 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
- subtable->index_maps[i], flow, wc)) {
- goto no_match;
- }
-+ /* Accumulate the map used so far. */
-+ stages_map = flowmap_or(stages_map, subtable->index_maps[i]);
-+
- hash = flow_hash_in_minimask_range(flow, &subtable->mask,
- subtable->index_maps[i],
- &mask_offset, &basis);
-@@ -1731,14 +1736,16 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
- * unwildcarding all the ports bits, use the ports trie to figure out a
- * smaller set of bits to unwildcard. */
- unsigned int mbits;
-- ovs_be32 value, plens, mask;
-+ ovs_be32 value, plens;
-
-- mask = miniflow_get_ports(&subtable->mask.masks);
-- value = ((OVS_FORCE ovs_be32 *)flow)[TP_PORTS_OFS32] & mask;
-+ ports_mask = miniflow_get_ports(&subtable->mask.masks);
-+ value = ((OVS_FORCE ovs_be32 *) flow)[TP_PORTS_OFS32] & ports_mask;
- mbits = trie_lookup_value(&subtable->ports_trie, &value, &plens, 32);
-
-- ((OVS_FORCE ovs_be32 *)&wc->masks)[TP_PORTS_OFS32] |=
-- mask & be32_prefix_mask(mbits);
-+ ports_mask &= be32_prefix_mask(mbits);
-+ ports_mask |= ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32];
-+
-+ adjust_ports_mask = true;
-
- goto no_match;
- }
-@@ -1751,6 +1758,14 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,
- /* Unwildcard the bits in stages so far, as they were used in determining
- * there is no match. */
- flow_wildcards_fold_minimask_in_map(wc, &subtable->mask, stages_map);
-+ if (adjust_ports_mask) {
-+ /* This has to be done after updating flow wildcards to overwrite
-+ * the ports mask back. We can't simply disable the corresponding bit
-+ * in the stages map, because it has 64-bit resolution, i.e. one
-+ * bit covers not only tp_src/dst, but also ct_tp_src/dst, which are
-+ * not covered by the trie. */
-+ ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32] = ports_mask;
-+ }
- return NULL;
- }
-
-diff --git a/tests/classifier.at b/tests/classifier.at
-index f652b59837b..de2705653e0 100644
---- a/tests/classifier.at
-+++ b/tests/classifier.at
-@@ -65,6 +65,94 @@ Datapath actions: 2
- OVS_VSWITCHD_STOP
- AT_CLEANUP
-
-+AT_SETUP([flow classifier - lookup segmentation - final stage])
-+OVS_VSWITCHD_START
-+add_of_ports br0 1 2 3
-+AT_DATA([flows.txt], [dnl
-+table=0 in_port=1 priority=33,tcp,tp_dst=80,tcp_flags=+psh,action=output(2)
-+table=0 in_port=1 priority=0,ip,action=drop
-+table=0 in_port=2 priority=16,icmp6,nw_ttl=255,icmp_type=135,icmp_code=0,nd_target=1000::1 ,action=output(1)
-+table=0 in_port=2 priority=0,ip,action=drop
-+table=0 in_port=3 action=resubmit(,1)
-+table=1 in_port=3 priority=45,ct_state=+trk+rpl,ct_nw_proto=6,ct_tp_src=3/0x1,tcp,tp_dst=80,tcp_flags=+psh,action=output(2)
-+table=1 in_port=3 priority=10,ip,action=drop
-+])
-+AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
-+
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=syn'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=syn|ack'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=ack|psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=+psh
-+Datapath actions: 2
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=80,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=79'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=0x40/0xfff0,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+
-+dnl Having both the port and the tcp flags in the resulting megaflow below
-+dnl is redundant, but that is how ports trie logic is implemented.
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=1,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=81'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,tcp,in_port=1,nw_frag=no,tp_dst=81,tcp_flags=-psh
-+Datapath actions: drop
-+])
-+
-+dnl nd_target is redundant in the megaflow below and it is also not relevant
-+dnl for an icmp reply. Datapath may discard that match, but it is OK as long
-+dnl as we have prerequisites (icmp_type) in the match as well.
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=128,icmpv6_code=0"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x80/0xfc,nd_target=::
-+Datapath actions: drop
-+])
-+
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=::
-+Datapath actions: drop
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0,nd_target=1000::1"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=1000::1
-+Datapath actions: 1
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 "in_port=2,eth_src=f6:d2:b0:19:5e:7b,eth_dst=d2:49:19:91:78:fe,dl_type=0x86dd,ipv6_src=1000::3,ipv6_dst=1000::4,nw_proto=58,nw_ttl=255,icmpv6_type=135,icmpv6_code=0,nd_target=1000::2"], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,eth,icmp6,in_port=2,nw_ttl=255,nw_frag=no,icmp_type=0x87/0xff,icmp_code=0x0/0xff,nd_target=1000::2
-+Datapath actions: drop
-+])
-+
-+dnl Check that ports' mask doesn't affect ct ports.
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=3,ct_state=trk|rpl,ct_nw_proto=6,ct_tp_src=3,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=80,tcp_flags=psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,ct_state=+rpl+trk,ct_nw_proto=6,ct_tp_src=0x1/0x1,eth,tcp,in_port=3,nw_frag=no,tp_dst=80,tcp_flags=+psh
-+Datapath actions: 2
-+])
-+AT_CHECK([ovs-appctl ofproto/trace br0 'in_port=3,ct_state=trk|rpl,ct_nw_proto=6,ct_tp_src=3,dl_src=50:54:00:00:00:05,dl_dst=50:54:00:00:00:07,dl_type=0x0800,nw_src=192.168.0.1,nw_dst=192.168.0.2,nw_proto=6,nw_tos=0,nw_ttl=128,tp_src=8,tp_dst=79,tcp_flags=psh'], [0], [stdout])
-+AT_CHECK([tail -2 stdout], [0],
-+ [Megaflow: recirc_id=0,ct_state=+rpl+trk,ct_nw_proto=6,ct_tp_src=0x1/0x1,eth,tcp,in_port=3,nw_frag=no,tp_dst=0x40/0xfff0,tcp_flags=+psh
-+Datapath actions: drop
-+])
-+
-+OVS_VSWITCHD_STOP
-+AT_CLEANUP
-+
- AT_BANNER([flow classifier prefix lookup])
- AT_SETUP([flow classifier - prefix lookup])
- OVS_VSWITCHD_START
-
-
diff --git a/backport-docs-5-Run_tbl_preprocessor_in_manpage-check_rule.patch b/backport-docs-5-Run_tbl_preprocessor_in_manpage-check_rule.patch
deleted file mode 100644
index dcbc4de..0000000
--- a/backport-docs-5-Run_tbl_preprocessor_in_manpage-check_rule.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-Description: [PATCH v2 5/5] docs: Run tbl preprocessor in manpage-check rule
-Date: Fri, 4 Aug 2023 18:25:33 +0100
- If we omit this, groff 1.23.0 warns:
- .
- tbl preprocessor failed, or it or soelim was not run; table(s) likely
- not rendered (TE macro called with TW register undefined)
- .
-Author: Colin Watson
-Bug-Debian: https://bugs.debian.org/1042358
-Last-Update: 2023-08-07
-
----
- Makefile.am | 2 +-
- build-aux/extract-ofp-fields | 15 +++++++++------
- lib/meta-flow.xml | 25 +++++++++++++------------
- 3 files changed, 23 insertions(+), 19 deletions(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 9807d63..c29725d 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -368,7 +368,7 @@ ALL_LOCAL += manpage-check
- manpage-check: $(man_MANS) $(dist_man_MANS) $(noinst_man_MANS)
- @error=false; \
- for manpage in $?; do \
-- LANG=en_US.UTF-8 groff -w mac -w delim -w escape -w input -w missing -w tab -T utf8 -man -p -z $$manpage >$@.tmp 2>&1; \
-+ LANG=en_US.UTF-8 groff -t -w mac -w delim -w escape -w input -w missing -w tab -T utf8 -man -p -z $$manpage >$@.tmp 2>&1; \
- if grep warning: $@.tmp; then error=:; fi; \
- rm -f $@.tmp; \
- done; \
-diff --git a/build-aux/extract-ofp-fields b/build-aux/extract-ofp-fields
-index 8766995..5fbdc34 100755
---- a/build-aux/extract-ofp-fields
-+++ b/build-aux/extract-ofp-fields
-@@ -552,12 +552,14 @@ def field_to_xml(field_node, f, body, summary):
- ovs_version = [int(x) for x in ovs_version_s.split('.')]
- if min_ovs_version is None or ovs_version < min_ovs_version:
- min_ovs_version = ovs_version
-- summary += ["\\fB%s\\fR" % f["name"]]
-+ summary += ["T{\n\\fB%s\\fR" % f["name"]]
- if f["extra_name"]:
- summary += [" aka \\fB%s\\fR" % f["extra_name"]]
-- summary += [";%d" % f["n_bytes"]]
-+ summary += ["\nT}"]
-+ summary += [";T{\n%d" % f["n_bytes"]]
- if f["n_bits"] != 8 * f["n_bytes"]:
- summary += [" (low %d bits)" % f["n_bits"]]
-+ summary += ["\nT}"]
- summary += [";%s;" % {"MFM_NONE": "no", "MFM_FULLY": "yes"}[f["mask"]]]
- summary += ["%s;" % {True: "yes", False: "no"}[f["writable"]]]
- summary += ["%s;" % f["prereqs"]]
-@@ -566,7 +568,7 @@ def field_to_xml(field_node, f, body, summary):
- support += ["OF %s+" % VERSION_REVERSE[min_of_version]]
- if min_ovs_version is not None:
- support += ["OVS %s+" % '.'.join([str(x) for x in min_ovs_version])]
-- summary += ' and '.join(support)
-+ summary += ["T{\n", " and ".join(support), "\nT}"]
- summary += ["\n"]
-
- # Full description.
-@@ -589,8 +591,9 @@ l lx.
-
- body += ["Width:;"]
- if f["n_bits"] != 8 * f["n_bytes"]:
-- body += ["%d bits (only the least-significant %d bits "
-- "may be nonzero)" % (f["n_bytes"] * 8, f["n_bits"])]
-+ body += ["T{\n", "%d bits (only the least-significant %d bits "
-+ "may be nonzero)" % (f["n_bytes"] * 8, f["n_bits"]),
-+ "\nT}",]
- elif f["n_bits"] <= 128:
- body += ["%d bits" % f["n_bits"]]
- else:
-@@ -657,7 +660,7 @@ def group_xml_to_nroff(group_node, fields):
- '.TS\n',
- 'tab(;);\n',
- 'l l l l l l l.\n',
-- 'Name;Bytes;Mask;RW?;Prereqs;NXM/OXM Support\n',
-+ "Name;Bytes;Mask;RW?;Prereqs;T{\nNXM/OXM Support\nT}\n",
- '\_;\_;\_;\_;\_;\_\n']
- content += summary
- content += ['.TE\n']
-diff --git a/lib/meta-flow.xml b/lib/meta-flow.xml
-index 28865f8..cb612d7 100644
---- a/lib/meta-flow.xml
-+++ b/lib/meta-flow.xml
-@@ -3517,23 +3517,24 @@ actions=clone(load:0->NXM_OF_IN_PORT[],output:123)
-
-
-
-+tab(;);
- r r r r r.
--Criteria OpenFlow 1.0 OpenFlow 1.1 OpenFlow 1.2+ NXM
--\_ \_ \_ \_ \_
--[1] \fL????\fR/\fL1\fR,\fL??\fR/\fL?\fR \fL????\fR/\fL1\fR,\fL??\fR/\fL?\fR \fL0000\fR/\fL0000\fR,\fL--\fR \fL0000\fR/\fL0000\fR
--[2] \fLffff\fR/\fL0\fR,\fL??\fR/\fL?\fR \fLffff\fR/\fL0\fR,\fL??\fR/\fL?\fR \fL0000\fR/\fLffff\fR,\fL--\fR \fL0000\fR/\fLffff\fR
--[3] \fL0xxx\fR/\fL0\fR,\fL??\fR/\fL1\fR \fL0xxx\fR/\fL0\fR,\fL??\fR/\fL1\fR \fL1xxx\fR/\fLffff\fR,\fL--\fR \fL1xxx\fR/\fL1fff\fR
--[4] \fL????\fR/\fL1\fR,\fL0y\fR/\fL0\fR \fLfffe\fR/\fL0\fR,\fL0y\fR/\fL0\fR \fL1000\fR/\fL1000\fR,\fL0y\fR \fLz000\fR/\fLf000\fR
--[5] \fL0xxx\fR/\fL0\fR,\fL0y\fR/\fL0\fR \fL0xxx\fR/\fL0\fR,\fL0y\fR/\fL0\fR \fL1xxx\fR/\fLffff\fR,\fL0y\fR \fLzxxx\fR/\fLffff\fR
-+Criteria;OpenFlow 1.0;OpenFlow 1.1;OpenFlow 1.2+;NXM
-+\_;\_;\_;\_;\_
-+[1];\fL????\fR/\fL1\fR,\fL??\fR/\fL?\fR;\fL????\fR/\fL1\fR,\fL??\fR/\fL?\fR;\fL0000\fR/\fL0000\fR,\fL--\fR;\fL0000\fR/\fL0000\fR
-+[2];\fLffff\fR/\fL0\fR,\fL??\fR/\fL?\fR;\fLffff\fR/\fL0\fR,\fL??\fR/\fL?\fR;\fL0000\fR/\fLffff\fR,\fL--\fR;\fL0000\fR/\fLffff\fR
-+[3];\fL0xxx\fR/\fL0\fR,\fL??\fR/\fL1\fR;\fL0xxx\fR/\fL0\fR,\fL??\fR/\fL1\fR;\fL1xxx\fR/\fLffff\fR,\fL--\fR;\fL1xxx\fR/\fL1fff\fR
-+[4];\fL????\fR/\fL1\fR,\fL0y\fR/\fL0\fR;\fLfffe\fR/\fL0\fR,\fL0y\fR/\fL0\fR;\fL1000\fR/\fL1000\fR,\fL0y\fR;\fLz000\fR/\fLf000\fR
-+[5];\fL0xxx\fR/\fL0\fR,\fL0y\fR/\fL0\fR;\fL0xxx\fR/\fL0\fR,\fL0y\fR/\fL0\fR;\fL1xxx\fR/\fLffff\fR,\fL0y\fR;\fLzxxx\fR/\fLffff\fR
- .T&
- r r c c r.
--[6] (none) (none) \fL1001\fR/\fL1001\fR,\fL--\fR \fL1001\fR/\fL1001\fR
-+[6];(none);(none);\fL1001\fR/\fL1001\fR,\fL--\fR;\fL1001\fR/\fL1001\fR
- .T&
- r r c c c.
--[7] (none) (none) (none) \fL3000\fR/\fL3000\fR
--[8] (none) (none) (none) \fL0000\fR/\fL0fff\fR
--[9] (none) (none) (none) \fL0000\fR/\fLf000\fR
--[10] (none) (none) (none) \fL0000\fR/\fLefff\fR
-+[7];(none);(none);(none);\fL3000\fR/\fL3000\fR
-+[8];(none);(none);(none);\fL0000\fR/\fL0fff\fR
-+[9];(none);(none);(none);\fL0000\fR/\fLf000\fR
-+[10];(none);(none);(none);\fL0000\fR/\fLefff\fR
-
-
-
---
-2.27.0
-
diff --git a/openvswitch-2.17.5.tar.gz b/openvswitch-3.2.1.tar.gz
similarity index 50%
rename from openvswitch-2.17.5.tar.gz
rename to openvswitch-3.2.1.tar.gz
index bebe967830130ae36a7b794be89ee5fa6c133c63..531ba92d56ed0a775e3617fc82de00078396e742 100644
GIT binary patch
literal 8330080
zcmV(!K;^$5iwFP!000021MFLCQ{+aL?a%!yGWf6sHYzBd-rn&<&_KJH1)6QZ-4hcN
zgi6Y)l2J(-rBr}D{_lJ4y_u<0@#x-Ihc{+t2#29d%A1+@dG4cz8yE5YdmX2`HXCK7
zi-oz%nq(Gj54VP+SHH>6CVuvIcKA1bmVa-Kwzpo5c6LYGyPNy??-hNpz5Pnvzxo}1
zTGPZej`HfC^JjZg&6{klzaQ=W`~L3k=4f{`+}ZqYe{+9xYxgyt#{H*T!_BR2Jl)+H
z(bMGlwXgp5^AGUz$mBPE`#s3U_xE?{_Xq|a{&qi0_P@71+I^*Ve^2|*hV%Fy%G{Wz
z-}}<@W#{$}EB_!KoF9L>{GI*(&h`%Z|GnMOzx@CIiT~gHZaDhxyFEDZt?wTDe}1~p
zPxt@j|Nme5|KG^ym+gOV=V|}HJ=)yd-C45#eT0BlYV-HB|9?{dzhI%ONR9T@hon(k
zfOoH>Cw^Wlg}2_eQ#Hx%wR!!TS8mG61AP32l^=e*JbL?v{#NQ6bvTQQsZQ0Ttmko~
zvO?X>vSg;pg-OTCBr`paRZgoh0s$f$stEgpQUjV
zk7J{8%v_tHQkN~!?XNG&I~C`7d4~l}NgFkBN35A?HRf&P9IG&oS=lyBdkrM7W|@)o
zhL)RbT4a+fiHjzGP}#hy%Y_b!J-!c)!&fg7J#=rL>pQuBWOR)e73d_|7HsHkgflph|ISRe5vWaK!
z6OvHiK~-y`iv}!tSJu4P3PRBpvP7$Snd%(pBW5{jZ8fa{Fd#nD)NLYSfeH++`9W4d
z$Leyf+?Lx=(6~sIj_W)FZCn7l=cv(>9OthG*p!K>aw3de-Cr9zjr%myMW4Mmf87=Z
zZHLWkoyQM++;zSPcsHgag76~F@v_^GbO-#HWYe~0i7c{M4MNHrMmG`Di%i+piH?|9
zyR8Llx4YSjx%8yOYnV(esL~#rK1cYBJMgiSZ{g3i`%}!7<%=NS$YO
z*-mGwxhrKG7H8#|On0+8(COc(f!pcEpO5z((59yQ(4OuzE82T?tLp-CB^9dTX6Ef0
zR&E)T=MaV=MVEU|VrWBKB`}-tI?W8`PdC9W$}w4?P91w3W23mLh)pT|f5Xf`KQaSl
zHO^BXn2<0|(9XR{6e4iKklO_t1Roy2elsoRe?Fm}i8vYw*{DM+%8LYK{*
z)|FS^b$n_befsMP%hFpV89Z4k){6>j_@{}LS;t1FL1J`F(yO?m8i~TQ!aA
zaXi&d&C2@4YozVGiu~e8-&b
za34z3xP@{w?H|fOHgalD{_nERguPT+PnT&dHKXWy<-$V%(qs9
zpR$JiGchn$IeCz%(C|A%MKuqV_VOFZ(^)ef_=jw3)&}6Saa5yb*>pyS2aZtNJL-pV
z?h?rC58{3b^iNB`*wheDJ{drN9es&aU6adY|S
z%bSk}pH4ntmnt4-dDc7xQtbSlvt9^qb{Ez0T~l{?W@^?0cOd?+(_x6>1qyDsvmmhL^evQ=sOj|J@M4Wt#tOQGa}gk!
z#dUf|K}Gv64V~#@OIE9NoHa}B
z`qA?a!3x9pzT_`ZcGEJeN{s5@IH+;?M=19`bJ@rnH
zzm#tFd@?C>3QHnDnsDaHQ26lTTE&w|R**v`3B~D8$X<+OLG66(tO`=Vsx(I|px0`R
zNSwhVFdiVufZPP}kGyVdy=SBj-ramYx_I-v_ZhcY&YWdl=Gpi@tt6ev#^Y+D{`kGx
z9PWEAT?R{q_6vrJ^AOU8dg~(9MUrXGd_6q#AUJL$-=(uCs^-CZuNgq3nV~nLctYnQ
zkR%^?Ym(Pw^X@H5G6Rx0$nqg@=EkRv&jR0-5W7w|aBPrA)hphjT-3(FD$3rNJ>&!)
zBjJ@O;s-8B4TGvgbaHgsGXQozmfHlxfC00KB*zuyqzHh3`fZzW0Rs^Jj&fODb0K34
z$K-ZBWN}(m#xBl0K4nFUpxp~5f^1JN5WgmMJSBVX8OjpqST;x-gh}U
z;V3wmsCMb(<<-T;NBmDwL<2H5&63-3XpA6m(6$TMQ&zTyY9|eQN$hk+SWBrN3Gxa&Ls}=k8BVXRGgy=L
zFF1si5ZThe-INo=!C&gXnx=~UMF*Uz)ns6
zB>}axO}zQ^OI&$ePvHyw=C;<>U5xWCsUkee-+e&r)PKO7>{7IWb8HNlbL|~4<5tRi
zpk2FB(*ifGyCd3!B~3G8B3=+~;t#Bd8AvS~bFC}fMv!Xf6X?X{WLY-O=R7{Eq>{kt
z6+*|)Wg#|Zj|V(iyCb`k+DB^=1mG^ZBRD38z8>2wGAK(nEbFNa=Txyo2#3`$4x3uL
zWtWTO2sSj<&OTC!u3v_<A%?np7%(@bzF=!#w+0Q+*nm
z6;rJ$raT4WNx151tKd`_ZCs6a9w&8)WKC0H!I3&Wxr7(|@bTvO;PCw#v~8hT-N5B2
zbGeKI&)07w6Hhe!dY6K{h20>pOF6HF3T8GbCcT}*Q^6>i9%F
zHC0v@83C)R-
zc?NAVy^6$A-F&I~-sI(!3X}@hxjJ}zdaTOg@5p0TJa9dkAdRWXp2}jq-xOf6f`D3u
zQ_rDtxjH$2_d#$!;U~-bwV==$c9$d=h-~Ln_7Wknmy^R-;T*m74Vd2DPD|wMH;0ne
z+QyO38Xe#}3^2!P6j8R?=(V7L8DKfK!lnM0p<=d!#c?HxJ_jtL3C>VYLTUo^;i5z)GN$T~3kJ3X_-vL#
znr3ZJwwmPebX{J&!HYMaKAv11-yFU_IRD}J=;p)u>7Unq)yb=VRpnHv6U8sNg?5jG
zvYclLxpOjP02_)1w)U9n*t@$1GCNt=e*5_h5G-+0qwed~K2GNqqK&(vtR8I6Wp;oH5U2#GgbK!r{*kU)^DW7r$)
zW5^Ez1a9APM`PgX_auw(HB?&Z%kdWglrI!P5-2|0JoO2swB&mw(*BcwyvZt%x%piUR(ogAL=?{`=D
z6_itvu>YV7gbG_5dns$D#M%~*bSk<7_z-p)oC{rDrQGAQm*`N>Lg?Va
z(ro~V33XlpqK&HBx++aq7rY`I0D!lMVTc9m^DUBNNp~&u?<4Fak6E3I`~NR2hz
zuq(ZGiD-y21jQ_~L;OEo#)o4!Nz-p9VcVd%8*Y5?vYM|un~!u=<=
z@sy!iCGLy0f$$(?VarVXjvq@vV3Nff*JJpV*6)7dvbLB9iu?qk{gqbft*6Ci?1~&u
zRCaqW+fWE#1~do6zzi{^5P>@tv*Pj?L~BPk93}F^k;9A}q8FD|>RAy7T~U90^8nN~
zPkolu)xmnN^{yzaaR=u5v6gCECPOCnrcN=+NjL|g?_&}d0?B!oA&QT4v74tYT3~!&
zbSc;MGgsST2oD9T_hFr{>dxot^>F3|mHg;P&Hti@Wc!&E+M7f=@qL|qW}T$J$gXdy
z+vX;RXyUMB_f>%d{+*)67zc=G^+FH2e&!es7};lJ@-dK2;mfo^aXM%f_J*K{&nS
z;*v9(H@*5{SRiE5{=E=q%X!mQ`>2o;9D+BP$3&qZ_OR}Zv!*T^u6b<@NBeFD)Hdaw
zE_y{@42&OaeJT||DxpVaZu+=V?qJw!Nx>a3geq29+=GRKOL^stUpZxZ19nM$yjWIQ
zVm8Q&Y>ewHooa%NJxJ1@Vf&(NN;Lr2XM=U?*ST6div){Y-Lv5V
z$2ba-oe=~CEF;`PnM>gPu54M=INZ=3wANDu+Pr%tEzN#U`D@zA)Q!c00|X%O5pdyB0o{3*Q1$V_X;-k0BAH+!TNk5r&MPSM292w>
z>hLrJ(x|OOY@`z*G0t)5GeU}qd}OxuvH
z@!0yKCndz_}dtKyZrQ
za3Cd!JQV`X6GL!COd(ngjL8Q!#y(l8w%v6{m~JD3jJ9%Yhy6|2Rjwzo2_~j+&4(hH
z)n$?W97M_ZsV@~s^)Xh66na81vrEpr<#P%A$;$S;D@Fkb&4OmvS^N`4YDo^+C@hi<
zz9`_BX~#6BQ0ptNe$YX~X9*^&0nE+(EWlP_38L-EPS|PgSH2yH5uZvia
z>=UU0EICUC>pUanoV1(Sf?p(%sxAp0(w7w;q9a>oy{cp0clG-6=xWV=L1aRs1zg7U
zRX@SSdu~|GHiJhm;bMoqLN<&xw{{|6ZFQ7QaF6J{&U2_5tlol578_0etrzckF2#*uxW-M@sa~(~??#U}=LA9V9%d^jl@nPri20`JQEoy|zCaL1F}!xfFUSfeoPHp}jN
zRbO5-{_OhlFA-zCW9N$!7MLz5I(3WHT=3>^Yl>{JYip2I_7y9Oby2`6-
z&RquIEb8v)CdUX|(uh>o!IJmcjpzl{P2hbt5RvF_{K3PkS=lQIOY7ZaWNN&*+nUEE
z)GvlSG=3fOaLMZC+FB6%$U>O))GiE;#ZB{FYkD0X2Se8dw<^8MsDQ`!}s6Or>J2(BdJ?OEta?LbgpTM
zwl%FSBIR}_oncC3QL30*SfngXlJ~Q}X9I9hg(}j{GWXsmJrj!s-~cETmV>kWPJDiS
z*23L?q?Ax-a)?u{d21|QwE+f)tfh0{0JL
zNj26bXCN+hbKQad;s%z@`%Cm}w3{5CT)^L)EZny>28Hi`x;Wj5+Gj^QQRj>;caJZR
zfEN*2R7gvZ7hK$UPryzU^Z@?rcx}>@wVsO+`4QqU-{D!B!;v~l=K4snwi#zfyU@{H
z?j(6@Dkh7LSCQ~ft!$0UlCCV7qq&EudSteWVJGbFnbYB#UelRHf{tXQDsxrPV;b;-wtdG^(tmEK@byJ4`r-28^60#)or!TPP&Xnp^S2)x
zy;F#@;9jM1k4*4FM4*#nnWE|y2v0A8KiuiM(q(0S0m
zn@;mIm#YW##a3IG8hk%-&ZzK4z(V)`TCH0aRJ&DmBCK~iqPr_F;v^Qtj^gw@>9oWf
zYX@EDmN+kQCEd}?A|VO8=!doKL(Nhs@
z9nFf7c_^6)Z<LX*0UJE7FhPhvlExgESpTs(Fkqi
zvP;-DjTezM7DFPZ`6Y&pUX?fzGSvqB1VUv_Q
zD3Kbov57lDb8xfuY&&2C7e<@F`-k)w
zzrlcI00S711-sn{4RtzF&x|=)E
zUu{+qqEN;W7AcJNLFsl`_QiLnI}WL@v*&Fb1zG*slH3SUfauxaZfPmuc2f&R`9ptB
z9tGEgFPzYEU>oOlE3>By-!C=p0({2l=pOCooYIpVJA@s_j@{FWH(m2KJNuqR)8yZq
zD;9d-?Hbw`-{Cm#4z5?8j58M)rXc>3;u5N0nBc1)7IBzxCIk?e?0W`)m{vP*;7N^7@Zpo&G&T?d
z;$)^bYtAyCQwWHS+sw(-kZoOqju!QOsPPFPXOhjeokZ4=(PES4dxQwTAaA*BgfGRNf9H%Qsv5RXmxezV6F`t&`cPhaUHNiPDdzrN!%
zO8QZ!iEPM8uN2NOuMmtNVPhxqp=Iw5^h-`P=0is2L*C4_M)72oaX$pMwr`xO?E5%7
zAXptA-m-P~j(5`${i``34eNK-I*uWUGQC~ngU@REIGOANG&_MBI;
z%AZ)TZx2s$CsFdnG@_d)T{>|FptZfdrJ7B4A)6uG!l`9oU{9YGZu#Pa#z*^8Sevt1
zQJiQUf^)vY(ItO$6I<&fnT<+4;+0c+dR?4fSeOm`gh@fvZTBs)hgr^L!l9NUo!n>h
z>4cR3WI269W}cni_4%8N>+|E@(Z%`O9hnb1#@rA$5y2Q^b_DS?gs+&xCb+en+@OES
zc0sX+M`*K_lhP)H!ZleJ6c&d+Yrbqgm^UDQ{wXZy$M3Z62L1f=s4*ssiw1q!Mm~c3
zLBsPK71=ZFXN?(bxyk&op+~>LdPYn}0SO8r@t7MuGNhRGLQy-@e5${?>56JR546qZ
zp^Y8!%$^ML9YQAB(Vela-7FCkq+l(rhwWXqc)z@fTC(kax$8Dvg{0y)zzi)1GXXbp
zuC$ywNa>(g2tKl4@kIB`D7-WMS@VUd=||4K@hcPsEN<1JfrSqbdmS6F)~HWBETILz
z$zNw!@+YWc2RNA>;AQ^8JL@K1m*y$gZthbIJ%<|T$*tY+=>CEU5qrD|S_I#pt&~Y=
zWSI@4!AkUMDfu(`@|ix|A15gOqWdd$1m91TqA|H75hJsh&LV*owfh(FRiw6?ex7hM
z25hHU*&H4vXtJ1nN@IqBTir60*Tz-|Y%0|d6ebnqy3EWoI5kC^WOI$8Q3@D1`v6O!
zjipp0o(~D}6L3JeS^CmSlu(j!V^C-dbzEF@3q7;kIcYGJ@nE;&RSZGdj63v#KD=af
z0~e4!i8WrzHR-T`kh@oRO)6j(8S5p!dgnzmXmS_K7DXN~U{Tc7&Vke6tT#yWK5$^@
zCf9?TC!v0n(eDsfMJzrP%WbbnB*u)beQ2CpbgwsbYiALEg`N~9;%B;L!lBl^x;Q;;
zU$I(IIC`iFjr7RZj8sY_RQ9+aVT>C*JUwE68X-RM*xBt9XEY;rOAL%)vJtqK>6m=+
zW)<<=C_v$8MfPjHUGR|j3Om&gD9O8A=6Ac7R>GKnwPC8ZdVTJ=vahWU#bfZbsj__D
z-yP(O-Nj<0wKPUNinu7So6MGrRWDH`7v6t`O!&c$_#qf`6Sy;oD$TBXtK9q0j&WVZ
z`+F}AfY5t>T6jJzJU`RNx|j2Ohj~@%mDz^KV-Z-iTiO{sk#*6uo7r@IvJF1%;#~**
z=r;ogpJbDe-5hz!X8_6AVnA+1aI+(H0=B8aUgBjD*l3NF@WI`Nj*GV;eL&ZP;HgcH
zB@hn_4-4})_;U^I9GP@
zB;jVHXJ7;8%h`ftBCGFv=8}o0BU~;}XYcL9kqEu|Rcp~vNLBTej{bW!1_+`Eva0lXr9`i!q
zvy
z2cHRqW`d5FWVv9)3W!FG!Y^V05_kM+28}DYnvNIg7grER@4A=qbqx?K;-fSC0fDl8
zhlg127A9g34Z;yK$2^boTMwa_IM8|!StBHW%G}?f5t8rK3(3!w-t@fent=}TwR
z9NGFu(x4IqBpL_hChP#?{r%w8zg1rVSRn;{(BlF
zH?W-P0Lw$Sm6cbNLEy~u4v17^zKLF(L0U;*OqFjc8>dVm@w(R6<_~cOYNjyvYpb|1
ztyiZLnHQ=K%JBL6u=dr48IK*(VCfp}vi1W7Fr11XHOPArc(%SLC=_j(jo%+g8EfEz57
z|BJ7wT@^D$w2Urjif8jdm_g_y;~|D~FcrMj%~R$>r_uAhhy}d47wf@sYKjF$d9AUH
zH$HHrljknMlGxsfo&CHm#1{^j=rd9o(IE5H!xh2J
z1oD)mn?f%Pv(dsyHF9B@Fb#O722zMn-!>cDIvdKV3hAuFFKkH07o1J8(NoT;6?Z2vH%Dk;vAM2~UtLe^;
zH^XF1abX;ahr#c)(00l`kyOI)C9v7bt?vFkqBULO)t-*cQ#>8dGNVZNQjyC`61g}>
zGGk?c?9Vt+Flkl-SOBP0)o`39z7Tk>_htTG59Z<_o~L9@L~#AeDk~a`I@=DTfK@FX
z+=jq*NO~N{$)M7|vIQHcxI^a#qK*dLib(gH&uo-1g=Y#!#8i1p`S9}QlIvBXJlMB<
zr?`?X39;?rwfCEc+s!%!w<35B=jl8dF1C&0P$5hIMi5-y
zdxr)oN*g}jN*%xzp`=CU$Hu~*;QziWizuzj1Qa#4h1wdK%?TL)RYPZ+C2@batDw@8
zk{fCH9w9b7W?PZyK-p|aj>%#KDchN!XIQRA;rOV!7N{#qu!CNg$`=*WEG)qo>76&0
z*PPXD{f%2q9^wgBkXN*88!TPfzPep<7bnsG-=odI^iL;l?h||EOIK)rYcG@NnqCr}?qswKb6#YhDkQvO9{pA3-*S}!2pwyj%}@ho#j
zn~bHY+?=eon9e67BuEyFIOcggc~P0lNDfwD$lh4q_Qo=Gx!GH_nFRMs%E;&t
znhhwe(IxB2Cxc{!0w$a6qYJy6KfzkM@xmK3>hL8*2?xGFxqgO=f`z-zlHF9-jE)FC
zym4%rb3C2Mv|!sY-WEiPh{|Tvnq?{C$z|(o7w)sIGb?$C4T1#bp&54%<-OShqeRb<
zcR+RUgizpz5~xLB$;1Lxn>5E{A5Ql*XXUPLIEgVBHy7$%_<*EJG=f}p$&O4=r0Db@
zqA&{RtU(`G3*DWA9-FfgwC^LVfrsz3^aaJ2lN;PPNBNA-H49g5?9dxhZS+g-9_0Uu
zeslMJ)$n!K*yMZk)1tr{tdTAqH(YcR=N@j3o2aRyC~K_U4wfcFhDTA$V2DO|rLD_1
zSKFQ`9Yd|o(9UYHJ4h#wyYrOdIogR&zzz;8%Ct;{<}4zj?Plwgb9z^l)8qEH#qq*P
zVqq@D=Whh6yJ=2u8Pn8;IT3OMK3%_D?hNGIfXO{X#)(o5g90ftPR
z8LEUExRUimKe_C*kFehPsrlE7KQ@EmxMe#fUs
z#=9t6n4Q~zuC)hw_~g|mrFhq3Ogo(D_Wb+e(>t5#^SW?MyF>RMd0zA3yiQCsl1x>V
z5SuS++@3eTM9)d~QH(M=Mr}D=ukHEZoA|iYPGhok)UL$S}8A@WlPELsx4RK#TrJ~JWs`hq_N|h
zrpUx{B1La#LnqG)oBhsjI;R)!dS~tK`-|h%M*Buem_O!d*`>e%SG04~J?(W*&e|8(
z-St~B=dv8!q%Q8U7UXS0*3_A9#y&^T)l6fI)HJ{48jAV&f!#&I~z_Y
zlZR0WaC+m$Wx=wcc0TLkVLF)3lP2aiGcw~-VOY_NWRZGJ{nZ@S^X9`2{(XUenbq1S
zR|(=KBuv;#u?gOPxwcI(R%Jhw1}LII=D?St-7`TsHiVPMOFxGR%2%x+=jc6pAr9W7
z7cpXPlb=&C6sN*GXP`GX9=B+e=W`<#Lqqy3TsX4o*5iW;{-VJc*?DS_cJI>BY`7c=
zrTGXFf`Gy6(bQXqsX_N;)(_E1gVgYTCwRIT|&T^%QbJ
zJ6fMjXrK6HpYD{bcuL4EsN9%HBp7OpP944ByX!&`s-ZDT`mb2d}2tjNY;yJRr2Q1`BDf346=K0Ys+noOpo>AI>QlSWhy~BWDC<8Z4Be@
zRUo%W!n2}x201qH6Zx7DW?R~H-tF`zTQ93z+6ma~JKuSv0V_Tx`?zdK^OlAD=}0FQ
zfltGJD2+a0VX&ePefuy0YqAMcHzeM=QqAhSLAQ5x0XKtA7j6a}vx_>}l3vgI&8JSE
zrLO91Ga%Ty_}JMlYO$KZAg6f4aY3AEV8il_FF+@iR}uVCKF-B+Zs1~8^x-(L
zmqUNct-frUuz7e0SPehQ0+G|DIu6lUnYZQ|sJ1ee+e$;Tz#ZyD$2{zhXNSA^@AKV7
zf7V0B(wW0+=YO<1;k~N_d&F@`1%>zuZiy0%2v-N`*A90@&9#`ifT
zj30A(aE6Hs6)4Zgcrphvi5pdQu>7G5c>&PTK!tPs)DhiY0)6mqVtmQ4g74*odMJ0U
zXbVLUF(Nn&cF4ZvmNr>h8898OnU?tL+O!tqjRJz-b+`b+1+DK;xu;lQ?ztZMMxtX(VOQb
zVS*AZYwLEcZv=Zll|1cB#!#dzsWQtd@>rx1lMqg%E=%RgW&$p`chRpLcZ!?KVUlc9i16MNjK^_(G%u05Kq>J4-gy<+rjcSY_;j>(bbe
zgh4!FDw`!k3`W$UNTfMT7UayV*u(^R^-bO3>Pf;Uv)T!-Y^!s2w2kY;|CA=^F4>7W
z5CqqP+3$0sxkBF{4gw~g-4ycG2#drq0=9+;-a!fCTRv#}s&m;o4{o`fr97R;Dk2_E
z^Zs3y053sPVG{4{H5U(yZM{Fz{3^nWCnii#+0xgYA~*|WJ0)E;x?=F7bjM;wIkEqa
z^MdtkKL{t$`E5xBV)9_Q9)31R8qB85K4qH4gGZXLW)sb$hvu`rS5}7mH0r19#{!v6
z;%3R7i-B06b8d@X-r#Z28ZAf$&Da8Bu#r>HFE+Qc!t*3IsE-5+wsmyA&DWh*1=;D#
znxM$%o%cnJ?S#F$v5UkG${|mm*nH_MUBD6<_Tx!@7azRzEio5}CxqQEAaG8cUBDpi
z_kgqqMT;Pm*duEQJ1I^Ttze~@43+Lw+kQGs7giPOt1cc7ciHV-%rR#NS~zNzenl7+
zIzHs<`4oH@K}`tNo4X1WCaZCZC{QY215f+9zb&5MS|J-Wg!GYfrxOCWGy-N)yV7L5
zb3H!vmid)oi1>a=CS&As8Or6qG8~06}b|-s`9s2|muXyn(=C(cV)$KXsq@Hqjs}
z6?&1l|0!RNk@+X52K>Rsu=oqTsiDTkj^^napOb9ilxAWWAIC-*BX$>l>x6X1ZTkpj
z*vucM*+f5MZ?l2?%JG*S-vMGzm*h0xl7^$HDw7f5ROlE(ipJ)`
zZ!bW^>zMwz7q7ORRi~h5Uqw<$1;6Ii5$90uX8Q15NmO4B-%+|HQcsylcG^s2OwF}e
zP@{~1K#N>t_Qqr{#kSfp8#p+5Dw}|cAva|j1)X|(x`KR5gX@VYtjU)sgc}BXvQZ2*khn6G
z??q{KYLAjHI*kx1{#YdrC2$MMa*oAfY>Bf;#J)IrsuWplaHOd_r1_Q&)ezH`%E3=h
z1dgX!(c>ulWkLD%`GRNCTN^O9vgRX1yyiAPN3#$
zVlQ&R&91sAqpsT-`0%W^CdOqwm?uwxOHXfd(_{2Ex@AB@E(soOenTMj_SW@XQCvwz
zb}{PycUX#~QmP~{{Y4LL+~$!NL7c9Bd>?^D#j=(u$wyl@o~Ww(Bk7MM*qvE&3_>wl-VQ(VbrafnJ)0#&vyEvOATwQlCo@x@Q)
zupr0`lDu3uj6zxP?~P;@U(O0=o9k*G@AqHSs2f&f9BL&%a4FM=klw>VWb
z1SAeWe>$H}=MCTR3jv}~^N71`!*khi4HjZNNn{8Wr9z@Sk*gl*q--Z_eX2zb>ltko
z%-#>bRmMMjEYbF@wY;M3mTS0!uvXgMJksH1If5fmn46=m!Z%kg!58}?0aOxORimN-eayK;FD4x43tqsgypy~H)B7r
zdP#X@?TAl~bB$?ZgEJzRwD+(N-C6XT+ZqjY|2eRHx4s*(L&eiP7y(EvCmJ*_VU$@Z
zkngbAn^Ai0g=paI1$3U0gC{P;hV@+!oyIOAhy!e>L}SA3QkL5|
znSau-=N5c{cug~KzfUQg7K8|Tf?=(pL=pS-PFSwaujE45rJ=o
z9*`b{JAn+O5ddR2aMCE)aXd8uLdFb9O#j#re3|2ok66&;(f{t+;PM{o-}LY5o2=ZB
zc%9G;x&jgcrSnfFRBmb2xg}#va0*pn{X~^?zuh{uQwm$4y^6Lfamglu_52g>@lF@d
z<^zv4kVXj_1xi3OjcQah^{^b>-m~Vu#R7bL@=u_u)7lf)%aiH*R7j!AGV
zk=GKQjPt1R>umDt#`X^5a1Ho4w2;}2!E~|z$Cy`IgEw+=Zc^w<6mM)2j5j6IXpi0W0Y4wR
zZ^Q!$X{ql0WDZ-jQ>+JQqU4N;-V7GLj=ux0i;uo!~8lPTxJWC~&lnTHjpRhBpGofML>g
zd9SC;%_;!~Shvho^vGc;GD8&y(Me%=rU-nE&*5a0w}QH
zYp2DChU_>ko=(kR3?t?glmc8V*3jdBKAlQ@te~_fvhMpzC8@)m_|O7%8};c^xlQXA
zMu-4)&!%Z^TrSjlZuo%_P7i?Vf}7z}%^5-VAB`t&Hd?^J@&N$BV
zQS6aPn$QKVZKxuZkF3}hmU@sR4ecDs(G{*M8~`psIVR_^FSTMYk2^<~B=L|>
zRcoY7#D|gyhJBJfSa!PKd5i=?Y!7^`aPSZp76w&U0Wd-=LK5B8#>$jD*{m2sScw
zHBnmf*>cev-1TR@sqtU%Qt(43+P~%}n#9Ef%gka?ZYP(bDpUKTb9vJzleY3(&n^Ab)Y`f}7lDr=IY~vOA2ni%*mV<&nG(t|;gn5d9#B7+3zeNzmz6eR6&cyXeD|Yt
z+=?~Iicc5Pur;y?S~L+)i}9?#FgPssR4LBI1flip|4$DUoFwHj;Aa#6JPqrbfNe38?>D^@k|7&17p)H
z7Yg!K`>zA9N_+X74;Zl|6~rM@L5&kU&L^ZfCJ%g8VK6t%RUR~-HurXTJWK=ti)dc}
z8K8*uv>Rm{*f5a=L&yN+>a$2|U7;>pM?bc^y^HIvQ)`s@2=uY$yR^HB(NWj1Zb?0M
zOZq{)j~aqzsV|?}Tge)PFG&UFyqjq4FAd_aLRuTo=mQ#48Em8&RcD;g>0E&QXS;f=
z&Cs%CcOghzhPGWPdOBJQ)fCMG$wbz7|K@O2=|h5iMU!=8O25fnhx_S#I+>1BADmQQ
z#lH>hbVd|J*cb~PNyhi~DmsMuR=1@O)9`JTX3jsVpk#FyTwm8p@{pWfIV=!q2=64m
zeyKc2Q+_@DMYs;)c~Sh|I(;Wwf`Uc1SKR>E9Qp~839T`1VgNKi%fBnLhTpD-typ5?
zjDcmPTA-|M-{f_%=^4h@*HLmBv%35{4#6_89?z+=9hI%tAWoXuWp#UK`;WUDUH0dw
zpA#?eV#io9M}bf`RRgvn?#Wu%(+LM3bz4?cQsn7)pACAeUDs%%_*NQ>)t$Endc*{6
zl*n2npTU^DZedgnvyV0Gg&6S|7w1?fP^J`%jI0=IC9*{&fA{nQkk9Z^!KzeuV=*?v
z??}?&wpd&xx4b0n$(Rsqgo}E|(Vb8Yl6!ZR+tKs}57lP0)g`DFxhOh)J0EMJX>M-U
z;hdJ^pVffzPI~i)KT=dH5kF6Q3!A{ZYalRY?rb*ks~f~wce>3PCu#8@MsqU?$sz&j
zjV$RFC8Lq2fD5RNpKD-poeyo0#ZJB)o6C0-1_YsUi1hu%Pu+{4u?eA8zMn2;qvdV2
z*fnIPXJ!}qxF_?Q40x*fqqw@$vb;PxQ6WGzizF75=DLA{=1h=D`5!}(WPY1FD9I!A
z5Ljfa)6j<`Um-A7GSCsoOE&lw_JeE|(9M8EcsKLur*tArp_#kxT%Zooz92|@3X-3d
zv=L%Hj$k4a0CJ>z8M&j0LMRoh8Xci?&{!6$D>`#1%kUko
zTs7tfo}D23VHx$6vP+|woG4}`YoMJdZNiW=a=B5NE&~s<7r}8b`IP^#AMfuq6hbK_
z;|ykFihWWY?Xe*1ISaC081V7ub%Ly-YC=vmV!S_`H=PeMf`?`}G;k3xFqsagvxJaP
zK7z%FHgKrHVFD44J3?0Hr
zD8BDv0ud3&nM!FdQ6)6{By-HE{|};Ejnu)ky10?m$x=p-p!qYFn20;OX9u
z#13^ujN;Dvak@>T3SA-mmgTFALt22&YNvU-IGEQMh`39P(#R+homV##*cLK#?h&{^
zI@pv3T^-47?uSXLZrHV`1oQ&+>$$8t+$<+bqKk?6iL%G)hUbxDQ6VgrtbxI|mzyRB
zwNL1dHA)|-KlTXX6-HsCX)_@!1L}>`15*ahQf3Tp9;3s(e=F%<%~z=IgAu-pQt6p9
zKb+pCG{xxnDvfTKq;b@VAG<6(2`!^QpBn$PT(bnMujtWnd#&@|glancR&Wuys^c~y6;v@XCAzM_Df*x(;UEL>LEsQx7<^S>
z&QUbv@G{VW_WYw2Kb)K&2ed_~KFaDGlE36N3Pa
z;wvkB$t*&mLv&JtpD>z?>*4vwv)=i~-r418r`PSC%Gr)1W=u^W1#=_F^?~}?1%P?T
z9eLcsukpkA&Nz8M2=^b(ws+iX;<=076ndpNPe;TOh|XY3K(~1E(&8!wNrQLR^B~L;
zOt^PPz1Hz@@8YU=c5%#NB%Fost}d=GDam{amY@s<%54z^Q@qof(9^7&;+SpNJd04Y
zWWX596)%;r^oK*X7Zo#^!W}tN0!=bXCYE8R>h5dq6rKnyldH^l>G$>B%^I!2H~DTwACzL9B=j`Lov6!0wb~2q^m|bw
zosc7uC!4clPH@d5V+ZLSQo*B(Ky!PO&%LxiVMf+J*i7~Uv8@faqTt?FH@sIVmZR4o
z_eR!9dEz;ix58Xxuc?z`(JGbiqnmMT#AqV=P=X>7SJA2Ev9`RxAk{H@zK15)==5LG
zo%A8?FL^UXYYW |