From d5698270e92eb6297feffe9febc2ae933fdf72b2 Mon Sep 17 00:00:00 2001 From: Alexandr Stelnykovych Date: Fri, 11 Jul 2025 19:03:13 +0300 Subject: [PATCH 1/2] improvement(ebpf-Linux): enhance eBPF object loading for kernel compatibility and update attach points --- .../ebpf/connection_listener/bpf_bpfeb.go | 2 +- .../ebpf/connection_listener/bpf_bpfeb.o | Bin 32456 -> 38464 bytes .../ebpf/connection_listener/bpf_bpfel.go | 2 +- .../ebpf/connection_listener/bpf_bpfel.o | Bin 32456 -> 38464 bytes .../ebpf/connection_listener/worker.go | 96 +++++++++++++++++- .../interception/ebpf/programs/monitor.c | 24 +++-- .../interception/ebpf/programs/update.sh | 7 +- 7 files changed, 121 insertions(+), 10 deletions(-) diff --git a/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go b/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go index e32aedd3..73842b56 100644 --- a/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go +++ b/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go @@ -1,5 +1,5 @@ // Code generated by bpf2go; DO NOT EDIT. -//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 +//go:build mips || mips64 || ppc64 || s390x package ebpf diff --git a/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o b/service/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o index 7c9e91d7fc08c2f663505f09277b49d41c45a58b..8af544f0cf640774fb04cf4fcb16bccad20f5364 100644 GIT binary patch literal 38464 zcmb`Q37i~9b^mKtw`57H)oDw%MzT&H^6IbVl5q|>GG z^#f^(F8M&WK` z^ovfe^JvzjMZ-TwDfCKDTZzM+W;%37cCnc(zR#D=Wkt2>GjrqixN;|Z{X3@^vqEx| zAD6cpa;DdFS9Y!0rTbq@>uS=uKAW2R*1B}A&23D!>x}xXKJcYqsF$VT+x7(dTH4pU z?Y_tP@;ADa_H9d)WA)9>Kcn6Sl7pYDcZvA1{eAnFP3sodoO55*rslq_E}gr{rL^B3 zt@e99{kKjx?px&U`|{%czU>2!ZC>Zo*q;JB%W@rYzb@=F%O(0h@H5-4*w6l_{`6S> z1K%FLeUqzwuH8Yu*?uUj?XY&2eII@F(c2fM?O40r+k0N@?|-npy#E#!wfyo4C^8e; z`U&>BLW;%Z`S!nTp)uBT{$M+nZS%~+vaz0Uh8@d(TrNtC%Mp`S&RCzLBW_&!_U_8A zNsOC{tLMHoE`7{#GvfUDjBzvK{P~P=Gve&w>)m!n`HK?cX2jW(awf)$5#z>9a=eZh z>tAub-Vdf$D+xasG0Uty*8CTKFyi9geG~oaF~`ky`}a75C9XewOG+H8n=#kk>(0$D z5wk-VV*Jqz4`|5T5g-~u>uCg~UjQ|8Px z$@4tsUdKr=b65@&82^aGKCd@f^UgH*9x!34GXmcSrryq8@F&4Hq)cZ6{6&wc zZ_+nBem?kNkEwgoqr#I-CvG%Z#<+oUZU<}J?gO6$tBt~A;BJpkfg><&>}-Pff{~j? zGWqFT=*xK#xCBQ3c@6L}kH^61A=}Ptf?wtFIQVVg7a7ws(rZ3DGr;apd6aITiSD|YJ{s?$AxBrX6(=r~<6oZo0cIC~J&KD0X8w#hvw|e;n z;M+W22!5#=z#-+*0$va3X@3fdjE-qzT+S5&zuV`ht<&D?^Q(TVv#jM0If}~Fy|CPm zLn`jYhkT4<+Ud5Atu{%IuX6KzD`KX7hg9WK*R&sddC_(Zf7JkzDi z3Qmsc(l^E{smQlsy2k8ENg%U{%Y~c~r)!AMBVi6J=dk9+>D#gTwLdTGDQsFdR(PO3Pg zZ)8vLZ8lZp5BZDuoYSA}%e+kYV8m^CF=V%R$h^|aYy`i?V{A74^%9l)<4zFwQhV=L#|BRl=JEjB}Q!d1$LM>0NIc&)b$<8Q{r9zPMh z)!UV1#!loTPL3JZdztN`+A`B+d#^^zrphbdiR;Y-xE$c;`Z9OGQ<*Ydn!GP3?cwB@ z@ft2FKMj68>3+@#{3f3l9cR3~tq*sNk#E}ro1_5J=M?EK$DQ&1w)~8b!`toopYdfr z3Hb-xGWPEEPG&+IzY8yl`J{UStTlr@C`bBp&R`DJe5+%|&$tLv<&59>dNnqrtmH{% z{El>=c&ztkaS_HhW_Egc;>^qi9^VLFthGubIhd8 zMmXZM3XqUz=04>4r+LK6AJ%;@FC2lNN{Szu1~{&F3_337Plem%%*;YY;vql8rGqmK zmY#8$YOipE)0dO_4`KRL@-%y9ne=Ayz{j|F+>-yE?ns#9DabU?VJU8w2EPp6YTW?K z$5wDgVELGE6Rft-wp0Xu3z#`G)d2qm7~f8ff&U7e12@6)vBG{C39gWx9k%V6v>Mf|UUhnYi!zYQ+ZbYa$JhWT_x1lC#rTg-xQ=S2K! z*6r|r4=sF>lcrmI2Y9B(W8f|@el-i-XPpbKkTyA2g6lj7kj%Q63pP>sn1v0rwp!8v zU*mo6Y4Fs)DH2$AOg&vZWa79%448E@G955|Hq$E!_*pI*gK5sVe-WK^6fzReACj|& zFGn)8J04TBj)VI+ZTXX|q`hDRsi*id>v;g-bzu3x3Qmq$ujZmTpaFgZX+LKZELr+7 zMbh%6yzuOpDZ-cmUDP;^9Qp1fqi^f1cfr&6;F$FuF2ZT>J;=zw+raXX0w>2T`G{}> zEFU@FRW<8#9(Tfj(Bm}tn;v(A)t|(LR0RGpn3$5<5B`nEH&Nvjk9)zh!04H3faim; zd1?&2#COs&;Hgh!PU<~pEve)<&Y|phzCY(uFgDe3&PJbiA@~~FC^7;cBAv&{aZW!M z;RsywxB-5V$4&4Z4$JoE+~aWs{*=cJ@V7i}f`3O{{F7~G&vAUNX146@>zcjH;|BcI z9yh@o$cP=}VYJB+}8 zf%71fq72JcW!U-$+^b{>u=0+9KjU!|`~{E4!C&$1q`uHEXMYnJ^?d_dPa#$Rk8xU~DCMYf zlHE+DobLkEO#H^q9iw25*}vd&oHOFI0wl6qj86#9MoFdquz6*Cf80Ww$GxPnejkJXBwy}r;HP?wZ_erUm@zYFz~dJyuh*4i#&;oa z7Y~_XFC*Xc<#)_zWAn$tGj%a3Wad=8e788(XeOodJQkYsEMJ!w)pM^q+BUWHs~p$r zLp$67kd4VZM{$+C1RZl;>oMegkL=9K)qNSTAIJ>N%)f0{IBtf$6%tf$IL z`o`tKeT@^{R})<`TkCoG!kmww=U(oObLwDBw2nUmH9du{YQdcQxr~7$QXPLzu}%07 zfVbcV5mp`o({Gx`=lqk$W8i-U6N@J`!C&|IH28ZSkAr^+#unPQnmYxIuUV{lLHK9z z71J;3Fq3``KG*Yq0Zw~N8FMujCI2h%L5@MUzPA zFMGV+CG);QO03o~?;BhWSjYv3_41GP%wi?qz_lSn`Pf{sXrB7?RgvCLaYQOoUvczbpFdvA4V*L9@cMqRgnTWuqwnumN>f1BS`2H(jUamI?i zO_%}eRT1UpSQ*?O#2c%NB?JC~kne3y)m_hmf43EO7sU~du7+)-n^RSwbd>yyN%3JF zU9aXMY}*=?`DS?dm5wfaGsZ1DQ;vQ9l1?05_i*vJB}08(ABWFa(9!jIE@~S`*SOcs z)*;0>82hoEQr~K0qq1c)nc}c8hxdWl*TnDo>1}q;dqxEQ4`dW~IJzF?@?Opc%P(T9 zc^_vJEFatAx?;ZkN;ralp~nrdd`bK!cr%#(m$vht;Bf=I(_yJM|3;6+f2zZn%FG|| zSo}Jen1!|7^U*>#uIJ0&h11Bq1kCuK8nISXOrX-K4fwAGGmfW@fi=#APk|Lfl(z|H z+*|%Q_&$#x1}i4KfM;Qn`HH>55%}94H^9H}xJh@ap~$GG7Ib+Wfzuv0z?XxmcX|_i zmB-_xvM0L9+zWcR(6=-2u?2@b=H7xlm^x;p!AHS=3y#1e;14o)kt}$&$KuOx#czOR z2Y7Rv;JZ8?2j2@OKFXaJe2U9Qz!6yO{V2ErR(qRZ&ILaO{~fW4WWjH^{5?3LNmIa| z05`xY>;Z5SycA4ZWR8WaJ;p!_FY_4Lg^%-?HZHspj2>NSaF6597k;wG>%bY0yTP&p z<WkBznS_9j?%z^2>B!FM6^D*MXL zEO`(7?|~!ujEmH3!TZ5Y@av4(A?(M+j&bmp;s1%-B3|+h@SlQ}_aQKK^fbT^gI^D( zjB`62-f6%KxRj0A8G+TA3sYt%Z9Vs5k9ULdQ`vuK15BpW8{D@1xi^CU3>?AFgWm#{ zObvV|xM?^h>EaIVYtA>FB2j`PHLk12=xzl>rYT4MBU^Kvdm9(w2B()d_X^L{#iYK8 z%u6X;{tf@!H`_qYjulEX6Bc~A8?0vA1Q zfblDpGr0-IcZ8>qocC6bBk(DY8{m&lhv3+ti!|r>urA()KM{8P)KA;k+$Zd1@S|A9 zd@SJqEa1zQvHZ^i{`~=8<2Bad9|Ha_0{$lh{x5|CUy`rNIBDAT8GzJY!gy3)c%M0M z94vl=Gj7-W0?asX@gHepbDA>0J53CKc$<7%q{lxD@OJ|IyEZn&>GOVmmU845aXDXW zWAhc{f9w0`tK!ebu}K~j=J+?_{A_=pd`nkMbvB^+OBKU7mR`q&JWFpOMb)K8Nv+wO z-fqq6+wh;<^LjXr=gWs7zDqsYZ{nZ&AbzhP>7}=GQ4DTy%f~e{ z2LF}te$3ef-{ITz5IBApNNivFR$DpMlLj%vVEd(ax9f}dY$(kvmA|XLbf8BBUt?YE zYI25tv=35x+avI=AHX;pUwth;rds+jfK){NrJo^P$!U+E9E~H%hx%JH(|7#Sy``VG znatAfky75$-;g4+Yz`?!EmOJ3E!#vog;N<-hImgDO?sG%bcy@qm%`qE1a&AT`uizt zzicQdr=ffBUe3jqLq%!^ZCl2?VWbnsvN10IAq0Lqm)}~*#Wu=x*rt1|cE|cKE|$If z%&}nb!6m!SaE7_&&tWsIQ|Hl7rLzYXIR;09PROSlO}ztmjUh3C_r)I8S(=TlE=zI(d1~a?ZaPypi~1!0=LvRT22{Fb;ql;A`O1$6bq2 zjHMK9TO^sEgLi-%VA+;(79oFuY`fD<-xts)rkpa1)9@ANg;#*rdb|?6)#D4n*Lu7P zd;^BkTpM98{8T=m!@eIxPw}nKOaV8MKTOKlO_5x13+YtO2;57G`=uJ-94X@<)dUY3 z8kjPvaqu%e{s#CZ9)A=37LUILzSrY#llrls*GBRDX!m+zen%jqeu(*hM>#n%NlB6m z9w5ce?y#Bc8nh*UzwUUxY!T1JicvBD9|HUd`8fqkuQcVWPd}*p*e%P2J~9#fe?^5( za4-0)q_SrN{2elS-Rz!W1fS!A-}*A~zvYY$HcgexJ@6wJ&(a_9cpUyG!3!rDhJs1c|EhNy?M{E+S@tC;1q9M#) zQ5yU*^rs)DMc~(h>4#~(;5(7&05`yDm+%<)<6vwutqEqX5Jnxd;>#XK;D*jZj6zFAX!N~RlPdW7sC)v!{1Jdtd5nm zJ+&ARfv@*6OPtSWe$cV*6{w#7oMtBmeG;`&LNI%HQ5yo}B zi%zYC*+kxdhn2ceQohVp!cHF{9jVp2`ui&a{7-zEIR!nZz@zF5=jk4)+JT-IGJciq zLiICxT`1p`+|$WJYH@*-4_^aslRy906 zyiILCd5m9O_#UT!>MHR2d|SY+GOa&&`6%FT7xsEy7x1qYPV}h;X{_TX1N;J=jg6`W1*tKlEwgk1FoQnfzQpx;($-J%%%kli9QDaBxp)v!|;Km$Ar+{Y>Ye9|0e1XiEP zUXmf!rShC(V8*Uumh7-v?WBCwxcUk32Eb|Xwcxqn2u%N_Xu~97*|-31fTat4Fj-i2 zo&Yz&gT~HhQ-n2N(npxftj6{hM_}@$p6TZM)x;q6-P9)h*Mpzsx_bjNoYU7ppSLMATfv+#O-UgA?K3ywrf0J^EG z$A1&x`vTlAJX05wLYLKFp`~gp)vW%eWt-K%)J^t=X@ZJdvxsyO={i#6)@&o?-kSKE zM*3sTK^no4!j@}paoB7EKZ6V^KTWNQh29_5$ObRrjF7>usb_#2;1`g-h;t15Vvn0( z#RfHPT=Ens-K5KFNIBLpZmiDlB$dv8ODdi3CzagixSR(*1^yS(h?ApLUmE-%MGV1= zz~iLSqZj-g&u@TZoyNdF@cbtDr^d;TgR!5=!GvbbZ@FNfRGK|<)J~N-BQQ3#xB*_} zaTAQq#8*?-Ug@#quYwSHbol_=*! z-VbR1TK`RXY6SdcpO@Qfe@I@9IeVxT{#ZbYm^FmEnAE+xC(DpW{Tt&C2UvaU`5o5H zaTH}?9IjO#x$G16+1CD=is&1YX1YRLd%-&Fw`=HbBKX8C8`pZl^qs{GFnwb27(WiQ^x$a4% zUiWneJ&xd0R!aFA;69I=V2!yqL6fY*=ae@kKC-Fjxmwn}5d3^_1pn2>%5*fq@)z!P zG{J9$f57?Ix_jWih^9pFKL}>LOm2WbW^CTcP4K7Sqm!Dp?(8&$hp( zBJNR?J!AQkl6UoXSU>RPygJ}dMF)LbtXm}Kjgxv`vEN||kdGT$uHx69u4{4wP7ZTa>4eY?;4gt^4izTHhT}=VkvsM>kFCuXGV|I;P&mz274sT`wUn-_PxL>pu8Cj~n0zVbE{N zYQK9I#s+rIB!;BYeBPw0>9178Gaa$o;$84*lEwQ;L;VzcWDm|cZ}$4V6Pil87tggR zlu5luR}OUSUe@MYoyA9w?v-tR>K$ToQ10q4wEM36qBg$Za2t1D5#SvG-W%Xx@4EZx z0sk2RKGDYKOljlp+XMV30e({(&v|?sci$D@djkB40G|%<*8}|H0RO6u&kx>PZPdr1 z{y6_@ZM<=AfR_e%eSkLwxF^5|1Kbzj;Q&9oji+DN#%tf$#v5N8;MWFtEWqyx@cjY) zWPpQy-}qpgzvQ7d-uROMKibBdW(D}X0Iv-2B>@ilZc`NSpA_K0CYy!=e&92kUJ&qK z6X2ljn}W74_)=SD!M6ka(*XabjTZ(!xv;a%-}KQoUihOn-t?&e2lni^I^h3XfCJy# z6!_j|`y+AZaGU3~~E$bG3A}lslTfsCsmL`dMa%1PaB0Qu?ZN zUwI%?DHM^QYlq3BlUbeZ*LtZZ(k;t%?&y_pUW4H<=X;%+1$~g(h?`7POiYH z{FO8KVZVGurm{-lyqR1jpJh;s&Y`XRtL3pcr}!i&=xWjJzz5aV1gq}cu3X6vIu2qkP2!Mpnis-RU(fR!?1->DE8Y{=hEfFWl7YkEeGo>6#FyfLF?|-!FsK~H0q38 zJ({8)1kD5tnO zBh#O)Wu+Ixt{yvG?ntHFy1{tKS;vys;#h-OdO$gplMtBgx4OC^P^C}pO&1lMHWKz0 zSL6_REIU*ne?D`3xKLBTum$E_s1&Z`(ats{XYVQORq5rdtGkk`+ep<8Qn}1PcDOJk zU2=ASNsXKB<**Rt><>@Qc>6rffu}nduJC~6|T7aNUk8P#( z{r&Q-Tn2(xWvVSku2ec&aMkyhinUy+d?M4AKT=TV<`@?){4mPOWfv|`^Q_FaO09AT zF}4&{R?ZeGgz5m+w{Ed_+sd^yV?xPq-h@2UNP8;Pj4ZAEu+C-b8@CEG2P3(0Yg@89 z7~4)p^mVtO%II%dw^$!0dtW}xkK;IdS+_4bx5c&;rWOz>aOArZ}ncR>IH&$yV8C$L!`8GBxqn*_W zIfRAL5mUt%#nBxPjSbbNk{!*oSr9g3wvrocvB@;j5@Bp(P=ZXqiD$(6HqVJCMN`Wb zhK&4cG)n-m^KoX7SVBn&j?HOw&sgWM$hw8XN_}9!<})Kh`J$<`Cw-9!sAallXoWdG zP#KO_4#&&#CewF9i-*1wh5qB#&%_wG8%#nPNpj(coV@#VrZVCfhmbiI2Kg8mS zsb`3(h486lG&^*ZB8Em>(ZrQPkvLm3S-X}s&bh26#fphzRvdgS{}?MEs}~-VKTbaD zhek24GV1%tn!iPjIOI%cyN6g-HCC8z$Yh3W@OI5|rP+nD$saGXK&+a9deNz86|jvv z#@}GDR5fm;k196Kxv_4q1hOh?6gT*Fbqr0Ph2wNXMkb6gOM5Liv7)o4<{(#%ip^K6 zI6!ub$!^uaMsckz@~jFA{hK#&%PKTf7|7d6EjPdjWLnSkonR^%DlnHAqD+5C+xyH) z%z2^21df%V{){(=Cc{#(zv>D*+YOro-OrxmY&Q~`*DG{!O;0*jH3l@*t5HUoEwDM< zIyWP)vJXcm3`-oN*+2AVzq%eQ4fTi6d9kjn0!?43G-NW@=xU3u4VQ-uuADEjIE-h{ zN`6G%ZKE@$%$rhKYd?lG^=5}ygk`xhLh>$Q#U;uXNJfHyX)VI+NR?-42v(W7+(^~K zNhO{IO{FhWDKWj0+CWM`Cj8mpT4u7(*k!GdVXa-&{Huj2Ls#?j04u*bUV~?7>N_$} z1|7v&#IV<+YCV)N^nCDTrRK!7XgnXr{1rH%6lPMo%#^7N(t}Lbv56-0u%fq%fU2R9?CPMtD}xF#16oagGE;SghkAM zmPag}zp6RwNA_8QMP5~lw=(hf1ObJa+^*&Hyz3r#DlBfLBdQFQ7*jsY42<>@#d!3J z8AF@fyc!G4qgc;*#=r@7ATn8LbwmM-X~aErW7vU8X}HDj&*v&9$~D-?yXdDURj+xA8%PZZ8i925dv$f+udvO#k(&VUY@DNT|t`Me%6HesG0?Sl&8%o#(iH!_) zovNpZ0%NV1C9><{f?Q#M=bvoVXt^TmDs>9=WeNY93Jo;R`ZA=os@2Y-da;r};+RAa z#4WdMhrK2ThpOd#j?tTAVtIy_s1%5pc6Y;vPwnO$aU45sx=yz-Y`9h@$maWLySTRP zo^IJ9j=pAav=xb2g0QykZ`0P5LrFqJ`!3_W+NSidkE7HI*`YR*6>~<~=t144(1D`X zsEW`>if%~T7;mk|P-Jh2;a}F6YeTq1-)ymeh#{2AR@iZ@WSAH1g1g1g)3|4ivPK%x z+QesKWfgPmxX9NAYfP&d*>h;~u=-5UMI#|ik1@A4RE?o;h9nfDT#xfqf7CtIv(mJS zs{Y|DGXzUl>leCY!UkK0=AAkX)eNLq$@W|e7xN4@0w3KkG1bm|ro)yz?i7Ce5KU|ZKd6<#-7XRneBim&3k5T-p-0(CZ1u2ook zmbndJ-+BkLV1t7&4C>WEyUfzc$c`PUzq zL!~}iYI{r#?5hv)N6L?vtJ+;4zF0-`ZeFq__<3D{xxaM8?>VxQ+a^nHzQ|br$BtEY z{%WQEk`E%b1#ZD)J=NxQ_Y{_V)GAbmi32QIDzzf&$)(*L#Slh(C2t?*=|O74FM~*3 z{Hjl|ISYXwfXvEis>+1Kz&17Fm+Y>teAs zvn_a_XHU=egKc`p;Tvwa*&H~ucTZ-|?!DJ%!rIQlRq1|-quCH73}gJe|37n5Y{@zJtu2&trK3gUScI{2#dpY7nU97&T#3NVw`=n(i;pW zHW%~stObJ`wmMevJZJFWZQnaoPZW7&#p;aJpna@RU$FaT>}uqwdw0}tj_6Tf6R>Ay)8?g`(RFQ!;xXoFk-P4LGRY&~Jo4QCF zCIqV*@mO1;ep#TgXS?17=_*AH5z#R}kMVUj8|f0e08u-wCUU7E`xe6LWp?bz?C6p2 zW_IAijCs%C4fZv1cu%^U8T+C)<{jRP#108b4ZO}y6xIj*+#s`#W{>9UWs{W#>^V3QM-)penkKRs2+S@mA@&Q(!)zN>hE7mFJ9X|US#NOc z!@eIt{t3l%_1e+v1geOH)#^iAJgnLZ)wAaKh zdF<9$ynDyY%cFjK-`Q4a7r<3*LHXx`!2-K$4ttlScgko};6cLA(K)vb!Y&$5%B@$x zu4^${team2=`C!`VohMTs_C+)kmydi(R%k; z@1xsXDC7YmBljrgPO!G(F^tFfycuC5k?tgeH9H};MHo9w4X?rSwx0~&L`-;ZzzYSQ zzO9>v?<<&72kqP93O3~Zl6?ytZ+h!lTaHYyvi__W#E^Ofa69F0`DioxQq)^^t8LeT zL%VNaQr^4oK+nNL+YcNvF(;<&mW+R8V{tt1)2i6`2ln5PInZ;Xn~-8+H?zHoiGzm^ z?(f;lobM&KA3n4%$)iTr1*Ss5z859UDu6KIGa{hjFTT&sJH0BVM?BBodz#%F*UH7X%_8k&}Nro33D4_X3rp{?27%!2mUkxyw!?UyeK*qg9 zAJj|P0Y6R$d_WvQW>lDA060zsE0M$PVWXi zhs*>P>#l%4xC{|oa+2Ou|)+x^* z^6}`Xuh7^a#s&FAE~a^$%)x5W?m4nW#uF3b8G`$u-Zt^-op0-G#OAr!z9F&egQK(o z)4FRb3P9R7aXu(WUDjakEu9E&bRZG8DBs~xf%&nL^-B#GKm960Pv6|p`yD1L+%co) zJcg&%DSFFPsZ{eL)NqX5F9vB`JftfJpk)e){a%1nc|}+Hw9m|}Q`2U{5%hsMJglpI zv7`rY5&mtzUUsnwCY_J5-eseiWqC|WPCEk1djyZO`81-%2*;H^)gv}$`?DG`Zk;6= z_q7^G_8!Rcv^T(7f___OM7(L(P6xxQPq$75Y zH{DlsU$N)uWeQ9enb)LEjWGIQWt8q|vZ{NwoT+bnW0;#&XozlSvjP|pdr*uE`Qk<{^0h<-zJ^Cni=8us|*gJj{W>qBi?@7%_q5WsS~RBKlvm# zF8R`{|0ml;hm+zcCDL27Qa%Zg`>mWVb9q`z?wQmoqL4 zd>~EuVezg&=)Oe0D!qF@kF|&PWe)GyzlRlt?T)aUz30Yd2cEmN<)iy3bAOQY9T`$cT}qI%VPsDdi{$gNv6TjsG}g4e6Ig@LVHzy0@yeJk=k#?TLn z|G$nZaYtNwb=b*UujJ{0@3i?^A#Zy0{X1`bybt)te=Sls^fBdcVDjhfnHRQ82E7xr z&(l@A@#gmMhBfo+3w;(HC*1PI)BefCE~~YkcJJr4^zo}4cIw>ssoJsCBFRy1A%1M2 zI;;=w>{^Cb3APv}?6wkdy}YdT^SQ6luK@J$q(>va5vYAQyDR0k(fszWebwu}Ly6_B zkl)>?mg?*Y*!_o$HX!21PG0od&z7+xwP@4BZyf5GFL$*r z^O9ZVX(LeUE-i23twUbqs9)mtAi<^&*5ji|yI*K^uv>d}31ZhB8l5P~!X^Gp*YCi# z-+HUw_|3OoYxwe2vtHWkdrxgQxi{wRH>`T0qR$E4M?B=?n?8L3V)qv8HUOVP@t&bl z8nqvVxF-_(MUvi=Xq6>#KG~%t|9VbKCi_DZZqS)S&K3oI_F`WPBRgOq%k@57(mgXt zR4;(AmV2j39M&73SY!K%QR};9Gg@X(%~t8YRbs#2?kCuna+w?L>pXX*VC4MW)*C`C z?8Me9J%7*cNc+8Ni>sr0Nv4N>HVf^0EBltq_N8ANYSYpBf4J)8M??Pq)=m2#tm!wg zoYVGjHu!DehoSY`#Xe5^yGBxe4teo=+jQ#f{E5tBK>sC}-wfJ3my+t>H|P3)Io_t< zwCbK{e%pOYzg>(Rt-nk6UVhuE|6@k?^>=w5xCpG@HHscIW?a9+?)5ak75?HvF#MK$ z7q}eIs*B&U>;C#Gf6{O(xDn6`z_$mq@}KlHZGU(b_>O?q{V`8JY|QVZ&)osN0({ER z7p=o$SAc1!>bLX~a5JEl{~=F5%cMH>vr)>m@}kcNKN8UEu)}muf0#ducQJHlK%Wb( zI#i$TFNW?8XvuF2Xvs$bE%{vmE&2TcE%}=QTJpUCE&0KKmV7y&C4bV<7q2y`Rg%9W zpd~*R(2~D9pe27Qpe28AKuf+E(2{>3pe27gpe6rMKqKF=&eJczH1tPDJJzM?S8PM{JC62yi6(-RAbU+LHdM~-2CTm=HJ74l9lX|Dd zMK34iU-E96sBtkE(1G9E`>Ol6zyDj4`pi~vBcKDnzeM)~zrXYfOceONr31gebkL+8 zd^}~{?aH$>c8vYr(hH$|zg&9Cq{b!xfS3P;N&QIe_x)h+EB}}LeaS2TxT81BH>pR6 z4YA*ExXN_s@7t%+?tW~48-s#)v*G!sV^`2G8~)mK><{|I(i8ioqkm$*bo8qZ-!B`! zVLFbh-?zDXFPm>Vo~?d~98JG?0S1ZtKUv~ z`nRUzUiI4@0j+);3uxt!`{4@H@nQAbDR-ZK>-ezlHywT1a?|k{)$jYk(o3LE2lv(f zhXPvi4+pg59|>sWQ;_n@xcs=E;_~D8WNFE(j8Hxu(A-O{3uwvj^7L~|$CuD2jz^b? zmi$e@eaZI*wB!c^TJq(9mi+O6mV6_iC4YNBOa5d)OMcALUp5^N>HgipedRwD(7J!G zqw(vGU&yb=J$;p#r1+nD#M80=c0%`Y&g4AKiI1%>km`^wqW{`b&NoE=z|*Q5`l1Uw z{eY+Wn=JNt*wL}P?Mun?H$8ONz6@z!|HaGveP4e}+t{d||4!!&^;qKRSkFJO9WA}@ zb@?xf^&WTh2KQ$T-1-As{+IQ}_KNMNzLK7?UU5CX{dVkx?eBK-aeJ+Aa=%6U{IOn0 zKgKa>!k=nr3&B^+I^%#ZyC#pz8Q|OskBT|QNCRt+zdZaeuw(- zF3OQz!(%eUd*IIsnPAE5P(7-{Iuq%-1RYJJpV$knI#e#l6XhGqAJZqnD%;cc|6Eqt zG5rKEA=)wEI`H>NyAt$G33@O= zYkYzB@tRo1oR->O>!JCXXj*^>=XJhTo7@e}{BBL3bzUC_(Q}(7g$|oS+*C`ecG0 zOVFnhbTdJpPSE2C`r(PRmc(Iur*HP`1mY{D-(63Fp#wc3mFkpB@lAN4D14QNRbjSo4#PPEMBHt#-!w#b3ht81;8(eCu|%OIz1CzZeTR z<8^){M*DcN=0hEE{qgfdoL~GN&c~>KQj>ce_IbiVca8Il+Rph{_22EpTlL4!DRF+) z|8~x}{)8V)dBEon`%A1?Uiei3oy>n)0vxI*JmUJrdl_d;C-aX>fFr)|sEPEaV21j{ zGNe<+9Wi=yz!VJI^9kt3vY*x~I=VUKKZ-{>Vtv#uJ{@SIqQ4PF$-4hc&}qtVD3EX|B( zv81pKyD6c#ZGccVQ6QxMw13OX}xl$MGDZ73A-FJ0)r(EPu@d+(dM zdT|OZy`Q{yf9KqDw{y=ucX=b{mHqo}?&wIFR!EtD1qX~)3gGTNmWup)nMq9@x7a+~ zaB)w!i{tmhX^Sp2QYM`nvava{#l`2_+{R>=J*9rz9{6fs*e*-M zxBUs)YiVEaHD{jb%fHga^zWKPIkvsoi0?ENo*4ra~JPyA9>*n`~YZjfU+Sr`g z>EiRRaxwk4q1AuSXB>N#aAu`T_vOXo{@RBf+q~7sv0Vjv);M;=whqQc03AOI;{Ss=O>?h^5lxNoqH#}-j~Mq|1;~&+i_uK z%RaBCAq$|by`Z=2)UdcbuZMe97-ug(vp&nVduB!1Sc`jFeU|+^U747t$KCkF?K*bc z%~Rj+J=x8Pc~o)ro!RW-r=3T~oqa!L9vye~{gioh-08*Fd(BhIUzwOk$DLj&XSV-1 zZrnUd&fnw4&ZD?qZx82HD+zlzZq})1h0Q<39*#SIcxJYJ#rFJ^d34LbKBut6`@8Q= ziDTPl%=T}&=TiAH)1j9!b9ho#%9y#t>6odQATjA+Ezi7I4xHwR%Q#P11^Hm}cv)o@ zt$Cn18MD`e=kY{5ms;m;%zUs-R|diYp6B=s@>>y)S?pvaa)_sk=XQ)-c5x4e$rS)8HN82C>4+z)kqS38r5Qi8_9l7xgWSz@G=d z5|=OjV|szpMBf2l0FL|!<7XBPf|tT?fO+Oz2+o0^m6@=5^Yr#9f5qPi1 z4e*P=uY%tM4}!-Gksi z2JcUq?gseJJf^-m-}IQW=lr9`)Tb$6_RlrluLY|U`zhxnSoV4ld@C!Z0UglMW&oj&a9;|-7*$#)9_lsbj z3nKXM^tb{35cnymx|ANO2@Yg(Uf~i9?D~aZ*k8cG>%-b$7 zwz9GT*4Rm=3BHv1yvLYTu+GCKQ`q9F2uy5FfE(Ze8ZBSNxZ7~Pj}@t+NPr-H4I(ca z?%`>Gj}oiCQ(%qthPlSv2WC#24H(zEz;E>U-Qc%*{2uTJ!Hk8O=21xVG~s`Ycq46% z!17(2zzy){z`fum_{$D=MBs0Ow^3A+SYbOhPITTAyq*b;h!q%1;rU9W{d1aN^+Wh9 zvBI;#Gw?45-+&zv%_pDAnVTk7xG~1_T>Cqbkv_X^s(Z65CReu6QRy@=1#`3hgA^dUyv7tO&w@sRl?FLNdMtsY+m zey4;bKpYA9{vgu%K}hM9(D`9rS6gU0KS{jPeUamK%9ftx@%IppWzj04`2@q@^kFA{VkM#5t(tT2w)`aVo0gIH6 zi}6;k8|GiviBOXH6elN32R9mJ~y7zUpbgI0vow%-SfGYuhl`nHQ zJe4WcrOEpi;(i`N*IRk1{51HT!~;AL_&q-F&EQ{ew}(_?Zn1A(=p;p?_WU-n`a|e? zq%Gg|85o)igsw08GM@|ndRxXOKF_{+we{TfIAj#_iT4HgK#VCz?dR$G9`Sz1@A{#~ zRN3|KzFy4@HCFOOUH?IRP(1c~vNK`qXTdTrkDpnv(&Jmfy*@8~aDn`~*Wm(kVOI-J^Pn4pP8T+LHiGM%1Be!0 z&I_IN2uHk5fE(c541&Uo^+LBPB3O1#$tDO3W51CBzYv)Ym_C~slmvYAXXjvAlpkM2 z7mhbY$gU7QO}`+zXZs&@Y9B_ww4o(*VDV zc$lXNmfkehL@is&3onkDB8(Z)OPwRopM@W!65rQ_ABHDA6Bhm!FX1%!Bgja>*xABQ z5f^v}3uPn14e%F;FLYHc{8Nv+;eXxZH27N{_kmS5ejycse*ng(qz1tM?(rQ|Ip5@rx|AV^tPr6-9TjRPG zuk<*Azuw~pc#FqPa32{pUKsh}TZj+w5Ejet@8@ZN2au5-_JD_o5AzTfkMm;8WiN{- ziFdf77B{>ej>CVQdO=80hGnZV$X_GvP4E^%L}2-%8V{jm2Tl0*!Jus#*To+M%O(fG z4}xi*#&7XykI~`ck9m9we8ywSSS;I8-f8d`J#K=(;_(dlFMU6$FSN_W-$F)X-$2*i zhRigyRf=Llm51zxd9(O&fV#<8*tNs%kKq3cyh)yj#|jY124XxVyqHER_93~qdI5aZ zqw;;eR7rTABhm3<+58dlxRa31Uv8mUvXYD{8{QJx!z&!WRSs=mvRN4jl)vOM-w?ld zTyiD({d`z*9Wt-BlJ-8t&h3aivLVgIL7upM_rTxh%Y7~QE{~Z9ONKmV&MX=A_zlYI z+e&2j8z;p>rsQRqudVVK>lm9i2`|vgq_W7@y?mcIR%s@MJ;YdO$;*9RUR38^7uq_t z^e;KCZ4do$0f64DPUTm*OHf$yHjg2fOba6FT2EW@|t1Y{4^a-;vWedK-!N{l@MaV!oHh7cDtMAK&WM+$DcR zy4DH8l0V_~Zk`7CtHkf&X@b8&j4z<;X32Lvj=(?kxB>o&$4&0X)E4}XYCK=-f^Y-8 z(qSdrTXgty#FzgC&lP{C$Kv;c-)m=rTfeX=4bAxncnPP$cY>$E5px+esM7Nq@Q1<7 z`}3y3vMu4$;Fp4xw+VhFSo|6ATReUOOr5&tn@@E910F}=U0 z54xqO`wzjt369`@1^i)f13Ux%EpQY3T`+xFM%4Y!9;2Y{Cq1U(rBbkD=;P9b;E#aQ z;1!O)TzIp`z2GZ6?gL8?z#ny2Zc8<9XzNPxr8nV0Fgnmac4Y(nN$|(OP4H*I z54&rYrCPHd0Y~uv9E`77)c|X*eH`2bKMwwc?V4Ho1Q?l~2>!o;DYvJAzNEw71vkMf z!N2EBY8kpQ@K#6g(Vh7exB=E&qn)dp;A=ge0q+O@zPmnLCLQhoNAO3%=x0p>{BrOg zfScfxVA`{mXxV+du!*%1_&ePo8ZrY8Q*n8%l?Gd=iSxQvaf+J0!Q%w z4ou$lM9XA9v~#`q>aXx1W3veS1#kl_;}X9KR(~1O^)ujY;4fP9u=Zgd14r;RUufrs zCinpOFPwW`ekV9*uQSbZ-``CUG86Ex=Xf;;ek1r0xB>nZFzwz%bBClVIA>-vECajGp_O;6HQtX30O!3mx7Zfqw{Ikuo>$0YB;SURa%A#^vS) zcnx`PaMva)&|hj7ID${RQa6DmL;ln);3oJ`%Gi)1RylSNbu9Bv;<-HCqC505sn_f6 zaZVTkk!i|$J~8c3Sn*cn38({RV@;jQ~Z#z7PXod6+ ze@=uC6GONGUgmKVe2K&K$gIRpBr`Vxqi2g7VDD4rHo-4({CPwxU+QrL)*K`6yaxE~ zc0lYmgO(0INP4WpyM@&w^r?m$NXX&8_HPu>G@*# z;B`_L>G6pGzc;|sZEVg^&e^Ayqcyfw&dC73ppDI^$@^75Ub3lpU;9~M!lR^r*Qb9D z{N#B~ALwM&QYW%%6LAU}f1+luVs1MXx;}(^-qfp=$M@|G0e(|}2Lr6R8Oy(~jm=r= zxsyilpY{(6BVwy7_#7X4E{QKZ*ZZ>&Bo5DBSc8eYIzx*`(KkuW(o^_|p63ST+@&;l$9UOts7T$QZ#@&l-{c|mXfA!r zLeuj);%__LD)-HzeH|JLkImnb_nvdii^s8xo^$a39{$B`e$RccwRcM$$oFXONjHR^ z5Aedbs>YrNdHoYO0<&J4e*ia#SM&TcxC#GZ@V~mQ^?U;SBX9)&_rbJxP6LcRTigWy zCHUXm5cd2H_}|?*s)u%%pSbf+&-YOob#zC_Q(kHfxB>nT@LF(_CUk+Lp+r zycGG>t6<=}mNvj?_>AW=SgU)%_>5%{_(~Xbe^~>3lgCZ)t;nR==NNDXd@(oz7hq84 z@&>pH{}Oa5nU{e#f+fS)r8arYn58y@C4Vo1wC#c>_&xBqfM>9zx5B^PO|8}M2ls>1 z$b1+~T`M9m`b=#FH^H9*Uy6?+dG({<%fXUCx2Y?@4KTV*^?@aiZd3GA>R7F@EvL+? zG#DLQd=dNQc^=cxHR_OL=-V37ET(U3o`IqkK}VdW|A-hHP_TEqv{QU*Gd}<~k>5`I zQR*gIa}BR2z!CTc@c#ujz`MZz2yTLJ2D5)k&4BOl_#5D(9@CFCFZcMH;J11FEn+EF z0egwpKD$4P`PQbLOiE>Veu{BhvumzvB+;7tNmBc4@MV5igwLxv9GCeo!VB~=sWH91 z%!>nzz4YjgkN-@X@-?O!V}iYlXRJ*GA3d4>$1@229b)OT0saFrN`XZ7yHo@wtobSo z{?mQ-8qF8U6V{;1R^A^wtn6#&^MaPn*Dg8FSEbu_>Q_^4&B@C5ut;3gPb(l^t2!f$}T6dxv; zx4@5_KU?=sk7wY22)tsBnNPG%<4?W%P06~?c}#ul{@mkv;J@>j;aewLkvy3%Q~~sB zekWLyTzqtJ;YN=!(F^ermcI}z{Yi#)Ur2i`UJSlVm^-C3_$9P|88`x0z{|md;8!8j z0d9cRFX3tM`@raAeiQtl!!*ZS_^`(j__H22z>IZ@vFU7r=~s$+X|lQSC*U4;ceFmG z5(rOnW?q6aQedL>T63sZVO1{a#yadc@u%- z?`wOYec`G1z`u>WYKCNF1B`>h`axdzxF+cvR*Er5MexUo(Q&Hb?;H1noAA-0{dVvu zc*^6m;8%J482F7rUsM<4tYE*FQI}~_=6YnX5p7)7zk_%O4`ID@{tBK5{E){D;c(asI5ZOXP` z7csioaD-TL!{i~hxI|3Ya5pdIc>}TXyp>q`jO&&Eit$Qe+US}j!tRF@rD(&354e8m z_n)y)>S%yR0$dKT#y_qjAK>-Eemxm)^EIzp@)rqvnHL58(Ew*?+XL!&9K24M)2(u_ z#|inZ%eDDVf8)Q$6 zPa1!tW~9@^c6{s$f@HPDk87)JI}d!DennEg&pU-Ze~9w*JxNJK_B?w~>CCH$m$0?L zpsr`aQ(XzZ{hrd|`?`Jsxwzi91o++nHv;?|Vc)h0*R=*G(h9!J8^!Q4?-cg@-N-+y zEuVf4jZqTqOdlZreaV7vLti%oB2hjszQrq5z@++lsW0I?c)L=({GGynT*Z>l#D`pb zFO!t9N6@PK)AuR8t<%=M6?Ja@N9zb1^waz1fdBS3ULEwS_rq;|@5clDhXH;pz~5@)HQU>``=K`O z{eFOd(#Bgm+qnBo8+QhM-@3fb-x{3Rw+3}>4fM8kAdr7?fD3KB*nC^>iC|gzbE!&ENXD0DrNKyT8)LD>k+9(y;tsEVh25 zEwl9p0se6tUpgm5RlDu2v`&Gx-zntEOJ87LFG4!|Ab7@u+>7Ty4_Sa^+aqjHrOAD?-+` zE4FRBqFgB*tz^fmSB#g6g<7eyEoW#;`o@8qGXsYX-qIUnxGY_*RqDA~x?0K|OJ7<& zwl)1y(uG4*Mb|#J8=rWm~dUf312vGcuMvYCBm=^kkw^s0IBf z=kv!hr4idMmsHLdhp`MbN=@;ktaGGL8Mm#@<`BqKYuQ@e)d69)oErf>qp8`#nNmV#pm+FEuo{;QpQd~S|O~` zWxQ&Y)lF6t(YA4NG|S&g!!KutHH}H$43?rYTJChP?krhiax)oWI?Y!?m zb+j;I$1iR|Y?8{~YEIq_${6~~SEMT22#hzAtK_pxYSB4bEBk6$EXFB55e;;;C^@h} z^)brQAwjzT~W7$!amI(JUjN9Lk9c%nsYO zx+zd)Ol_j`3a&L0_8OPx5P2dyRv>>qGdW(U$zj+6^UhTYSMs#Zb|q)iaGbuZ*%zJJqFV}65AYNi z^5|Fr&uL*XKUp(nCgBNFE>)|Ap|N~M164B`g+g(s?YISXQ+L!gF;K;h<+^;0!9|Q0 zayxgBKgammWdv=p((!I@Db$a6g61-6O}=QoG6Ofk0@&7v@>tcix>Brsc zg(6F;{C}>D^}^8LO!xt%bdg0mtpSobs+lym1^w)RuKMnfYRieeaxOE0Pbp1ga%0Zj z*jBU1*mB*>x4uys?W&H;!7WT2H&tv=9Hn?@tgAMa>_n!`g0LC0mE35HO{U{55#}}u z#mNktctxyV<2mu7XlmKQn2~)=WN`p?Jj5Q96tXasd)JH~aK6895 zUo@5WqAwBw^-S*!y)cs_mGOAzFjl7TaK4w zRGXhPg%NE_+`60}V{^sQGse<_`&2ZM9Xm!5W5-?5_?1EtKU*_dyPGx6xNJ*`6%+fc z*!f!i33foXU06(hl6=+RZCK-l|R2XA6 z_u6oxMW;=zL9QAVo3BCCU~^Mx20Y zZNltKm1SuPR#~~+Ox59}60d@$GL)&5SYC;(BgG-({;YE?v)E_swpPfn*RE>))y9;m ztMz$=onIZR!7{Y;9UUoyj$tff*!MB@9!kD1!@j0e_dAo| z%PZhYS$&38rS=2`_BX{WYnzKm89&>AB)foD2 zNVZhYSKNrRM?dEF=&T#oMGlW=Sr=J|tX=4p2|H{V8nZeb)##nbYdM{0;bOjUbd)VA z!!I$_j&&-s#mjtAkSj);DZ3mLD#uMdXU20@P>EGz7u{;+m?jlYd7SRmb?U_G#_QZX zkU=|N@r@mK-GG?kYBp1@Rai>OBm+1F;G2XBWgqQy36ob{?HKud{+hn4uDo&eW%}H09^)+#0rLH#-mLyS1Iz zMlcu;od>`q3&&Y%k81g0*|D*AqeXTX?B=VjW0DoSosR|*;^(7bD>Ex~Qu zxroV)4wsJl8-!V8$*s2;Yyar6$~nGP8ZLP!Vte4+pS4t**QLoVd9PKdj^hW$@}^QN z(ma{8OOa1u##i!oYt9H#8+JMD4|42`itHt^8tp(av+*%&xN+>Kc$U+qwcYU;sHEyt zb)=fH^PhvPB~ZE3m-7nk)>zjUUR=z&HWRb=fPPPHIK#cWhZ8VlAXXykT@!27Bm0Uov zezQ)tQ%4FTrGUh{a4!)vs60Ew4ssSJ_UY{ghGmci$6Kilu@wl4@#mm+y&S#Rg{m@j zF`(SRkV(hz*|Vh_5i48EgW6+Rl48scyHpo$o_rYcbKu~CeiIWn?K)uW(FeQMl&P|O*{CeX=P|0&rtVm2 z=q2pNb*awZ9pGx2rP}9d+7IK^81eF0w#L=zxLY?I)2|`ixlUpzMQ%3BTCDXAV;B#@ zr4PHoGMmC`A!gtbaput0fmk3fz{bG30LAu5l`DMQDL02z%8Pe{F zeXYSkj@O-oc9@j$(g}Gx?bT5R?zB*K-p?~gu+_PHInE3APO&;wOO~thkYeSfw&Czk#>>r0?gh_-F`XJ$%FmBt;jYoKPw>?!j0PX zUxxu*ycpe#R7|OQ+@Gp7L^=%Nv1)i`U3d6R0-CamqILncT!;oDI^9<$Cx0z+cA zBkHGZiA-wD-Z0vBnce#`yZdFkncdhhbKW!fI(4HA-jgmdV?W}=ydwvY*exM71FN%b zur?U45~y_|dn{iso2*)psn$78a898E!(^~a5XT|(CMb)(j%B9|2VJgG z*x1;+D!$pNQq0*}3mvp%HfPnO&5me_)_0Bi5X0tNA;*b~%%hl_Vwc6CEX(9J$GIfH z*2rMhj*D#(#!gei6?fi_li_>ktUEz23%NkBW*Xi_vZjvOFG1`wbzfn>@WdBdI(f^G zaaPuz_3;N%2Lg8s<~EZ4%7M!V=lN0K7`s+oN^r`uw-RG{vigcNp!Q(D=g{H3`&qXS z96Z#2+u>b@4x5-0(=t0IpuQy=>v=6B-XGBWc#sYa?9UwPztt^VF|n6jfr*LRj@&lT ze}KJ#m)v#a@WCXHYS}-S3I+SomNdHs+=ws}+AFWUGW_msuOpxO8U4zgz13rv-w=G? z-lhw5&TD)&j|=Jx3$j<76m+g^HqGVR?!M`tOUm8xrmw#~z3XOnH~ok8y+LtB7xumQsSW4*|GCO;ectiSSCKUT<>~xbHJ{e649=D7DJ|L=H|fe9Ql{zZdP<`T zKYOFX4`SQ&p{BmA^)cp!g%|s#Ub+3LRoNS6M1JP}#~5GKIF`F3`IY<6h<4mpdfnV`gc>J22s$Ejx`(SYN1X*`H# z~U9LvIF&Q}VhxWZxKPx9wCJsKcF$b@PlD&>3F4 zfXb9TTIVYxaU0yB)?dc7_H6dYGyDKW8$wPz?zGS0w8j+S_D0BVW$mt$FKgUwRZ0_f zEAIPNm}p(_u-i9~<@yi<Aq^UzbyHS4!c*4w?o`5wP^h;$qfdQ_AXO*mj2S(>d5|_QX}oJLF~mxbwanX z+9$FpADxPIqP=6dk$0ch-KVqG?{O@t&v5#}U(@$>9o{lJQTbC`wN&Tq6MR%b$rEJ` zq0+W2lh|Hu`+nGOhr0jN&p8SH--u89AHeGG4|wMDw?OmH^4suFLhHBdLp=6(?Zo^X z{^Iwy>D2T1Cp7doB0fFE@6zqx87R*-9)&v3oB3yO^tUhkp4`$OH|8`y$2XCq_4h^( z={N5Drd{d!JJ&}q1?xBKqF-XnjQ*Bo(9>_?|Ddq~JnCu5>u&(c0lf^Ye#Ygg?uMh& zwC{WRyNZ(meF6AXKr8=!o_>%&{oDwi4rrx6;OW2SPZQO?(*dpiJmTn!R-vJ5!Oei~ z0Y4hh%Ksxzzl1*lpifqvmnPrEzh_b} zlAU+@eBU>zVU25dK+7(A9DT_;RHXEDKr6l1(>IyaDb15RJbkZ8-K+FLPv4KqG*3nY zI+zESC_R`5mR4IDUjBzB_0Uf6$$$>#!6ix$=E26ROzM$f9#}e<2O9@X>eJ7ntkbSM zOQYv_9$0z>bknClz>rD)tf#-n|B6BS@Z+>m>B>Lj(?u))+E#>tYkB{|PS5Srm`8K`Ebo2z{w&}M_M>-fcOV1v+jvcedtz$ z73@ua+pO|8FEbtclpZ3dDbsM04reZT2=nZ~sd&>GixoRluTp9<2u z!S{Lkho6e=h&6C)lZ5FNa z2ZMCUj|Q~l%KU$)hmELqT zcHi-7+5L>8dE1bBoJjV3wdt6_?)h)FeRo3-@hsqJ@L+@KJBSt3Hqr01l(QAlU-h)w z0(}vW4QD+)=tw)(fxI1C$xpjW%A(>($s%POILgqvQVDxuklh;S=oI z3?28^+G~XQ)b{st4j+sxge^VXHx5e$hY0@gE zFHAsKJ~J8q35Ms}`RUW`->k=c>9!RpN8_9f?5SeDwc|MbAKH9t|1p094lC}L=XGdo z-oQU%AbSsk=D{TLiT2wuDZo#(r$h1|r5xEs80JEpf$wd&l@#|+`4~fE9UpOTf{td> zeM+Y|qjCv-5ijMBY4t~CdfNWK6jXLhKN~DNj%oefs@fdWgWyoUoS+*C`c#6RPSB?l zbTdJpP0%w5`ia@JRa4MDYpWrhPRREq=qN!CB>(+RqnpwA}gnFRgBY}!uW zpucmv6Y1#$-It*EKnM0eNAo45M-%j9f}2ig8tELdTwWe z?n%(S3Hq7@y(dB6k)THt^kjlQnV|1W&<`Z&M-ud-3Hq@F{rGI!y5GP*&C_^?bUHz6 zyu7^Scx2=>*-EprZsmke~+>bU8sc z67;DAJ)NLWC+KE^KAWIt67-Lu1OL{^ecCK~U4rJ{jhL0L^*zk5^*y9tl%U5F^ve?T zJqh{)(1E|~d?-PGIzfLqL4PYjYcCj-r+?~b7OnmUP&#U$yh|{ovb&|GSE9d>*Q0hs?I>)VPg(cg(&U zZ@en=OhtVzx+=3%)Rivki>a%fh>y0TqW_WbSxQOl&*O5ZE_X=(Cef@Q+m3^9Ok2kp zClE&g4x#KV4n2UMlHZ;eVtK`#0dWCXwxbZ)ck5M}^st*)`}eq?aenbz|2_;j(f*G6 z;1TTk!$J3s^NV^e&(qa^(uv!%f$ERXHF18`ulug2>Hi%0ErQ)|I_TbUeo@?yK5hNJ z{jK`r^HZE(^*_uL*B|Q#mcqOl8@10Vo@~jBejm@%<$v5~P(5LY>laURJ*JcO|Hx;G z(>>Xe7yTDJas6?+kLUUPcU_c72<`9BNPD{Rd%)-GBi8sW@^suD^-E{Wr>TEUaNSP+MQB|3jrG_gTF)AZCZDUQfq%7bl19{US_zz=;#v R@%W<-+xsu&N%p_z{{zm1=Oq9D diff --git a/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.go b/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.go index b29ea58e..9650a09b 100644 --- a/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.go +++ b/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.go @@ -1,5 +1,5 @@ // Code generated by bpf2go; DO NOT EDIT. -//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 +//go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 package ebpf diff --git a/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.o b/service/firewall/interception/ebpf/connection_listener/bpf_bpfel.o index cece72609e0da964205245ef0ca990c457f2f92e..4388c5a801b57df9b3791441f6f2cd4739548435 100644 GIT binary patch literal 38464 zcmb`Q37lM2nYV9O7CK=I0TMuj3Is@4LI@!un-!o#BH7I10HW2^)z#^uyQ?Zy-RX{s zmVkna8U-Ct2YW=+85hEc%D7REgM)}8E~BV8wmTv!I*2eXe9!-!_f(x+;*2x%ogcT( z^S<{z`+Cp49bVb9c2%aUD+#VE`CZbHf;LH7Z|-o;VJ?}A<<9wD|M70`AC?OI@l2AO z%&m`4^Y>qkcQx1DGrfH1%;!0f{s6AVYfg0X$B9QKjd_cm{1Cr6uHwvvPA+ekb&@=U z-5mU(d0B}`dHa6OADVZJ$-0{)Tf4dwvXT_GPj|AyWuf9cCnicy?!ZtUWLYZzieW~w zK(~oM#CKdW8(HC2;}`1sB|q3_@r%bxqMUW_A2`?hg$3#KybPthPQaCN0?qNR;tQ63srepHja2Iqr6H zchUO?9_#&rm9t%b(>LZVat3!7yq)5cQ+r>-^>GQfw|cMLpE~utz_nXw*F(FGc9#G1 ze&)*+`q}@sKmED>Q`qhcpz^7v8^`-{ciPRjL%Dv4s{z&Tbx%M2^r4xqB z-~ZzJvi@5xgnoIB>zCz%?<328$_vtHL zH*V7L7gFP9zKxsoc%5(KCOux~`~DTuRX=d^*9nVUe%k$DzD5)CNZ)_c59a%M@9wBy zDcqkMHy3SOtJ}|T@A`RH;&YZHcU|DG*Ph-s%S;2Q61gtbXtpgTy5+{6^v~j&Aw|c| zOPJVHE_shIvXzpmn6BD9JSgyw;!=D$E3Ez&WXvu=V8Uw3x5^f0yp9B!&_xT z;eH+Ta0X+gmm{;vgu*6d?kM0;Fbgj>&cVygrWZaB{wr*nu-qkFEqFEhmr6llHo-3g zoABkvEw~KlWJ9Hl!~BO)3^n{6;|G~DE}?&>KwiUezn5Fcf-mK^@FG}qL^7W~3Eu|i;EUiLvWM5h%vIN1hb(uX_uMa0 zxVn&V1XnNDW!P(uZE}@h&2785s<3t|H!=V1G=3-5f35M~z&9G-0^bU&Ehf3-vRo~$ zJJB!1&ym+p!^go*_#Su>+=9PqoFjrC!b_xAWVqAyL%;qd`saW-Snf0#3p%$2J+7Oso#c&eib@DO zU13Y;>0ZuNjk8EsnmyelxyG0-ki5=wSijJ?dYqx`{WbSwBR2_a4U+q?g;%-nwD78~ zD9^42=ng8f^5&e%C;4-P(V7_Ckp>S~yvn1T$|U>mpnta0B*~9q#jCV_VfK>E%~GFv z-0R(wnd(GNX)8|Z&Sbny2rmwHVy%s5Vvp-S-g)#7 zYnO}ApI|!kGXKWSi_yzQ>284+M>bTV%kyREPcnTGKG}E#KE-$(#&xUw=3E<`h@d)D z{N|iq^(nm%=I%JX`i}IvUT$%o>TY++axMC$rhAjwoQ8aZ@iO>k&tdOD5#2Cy{rgt# zEtdlKA@~fB$tU0y#{ax$c+)1C{R2_o54%{M!sVUzbNLP?$gcjrN?Z#}`5pMV#*e_* zwAcvpzTCxTv(k%g8`V8|Zo80&E!c;2^AXn~ex=2Ep@k;w^ep@a^gX7#0apCd-wbcW z&vCue!mfhf2ZuZ(CKu_)9C}wLyRlhqx{pQnpM%$!{(czO{d|5Nifp93SU=`M8GnLJ zE-3NWM!Y^^@;_Z=cm#W`$#TCoruvenU|hGxhMeqG|9?QQwOwvsCRVY=%^Volt$F4U z;}^ik!wRc;a0MLd@N9S!x|}YvQ9PPgHsi}ZAH6sy!MlvYY(P(5T%5AsYByys&T(B1 zs~UXKBFeVXeJ#H^2+P3_=j`V;THZeTw`#uAM*pe zKupIv4|aPi_t zS2)kFm6|h7Kp*yVC&H)L{ZnAosoZH6_E7kIm^zrAgSWuiE6Vj7=ipJ}Cj1)X7JO5% zCqH)td-%R!5C1UO!+(I)wpqd+K+A-*4l&N5Khn4fA7|Wxm%wT-&7D24=03SK@H+e^ z*Ls*fG<`MP3va=f8-ms5Ev_A~`jH}g1&r(7&d=4JyU3=i58c3J9zpS1?$JE1j&6WQ z{k?WSXd%B1z4E4Zy%koURQvrMybf-{A2z-YzSDRY{AuHx;Co<&RU6-L+=9PmJOzIn zRymbk+%JECUTxpx3Vmo2Hb)T7Jh^CtWG2^7uveXiwPqZh+~epc@N*Kp%Vy!xh`3V z9@nk-PxRd0JD!TH`cb)_3tuHm+i< zUmgaoPQ`E54^H_}IfA3juTj|RiD#WxcHL-9yj`~#6W7e!jAj2JIP7gc3afu+eR%z5 z?u+tyqv=t#`^FiO?c0n=!<{Qi4ENO+K27}V$>)@A;BNAs`~4e!TPEKkpG5A#eiF=C z9{v_?5&6C7HO_N%1npteZcX@K(TgYHZ^D|3Tk!Xc^(_8V<0<&J@NL-W+-k;weqM&V z_A~x9JlFU)(~`{L#*d@V8vhnP(fA4Y4CCLyIpZgZe-r#(($c``g_W+jZZ`0=ml;o+ zo^-w1n9kSrMq?J{%uUAop#NLrZuswvXTf(E&xZfWcwhKS#+=7>ecgC}_y@)Zz`r&= z5dH(Ke9j@Cdi|w!3+_7B_#k+>@m%uuJmW*quQNUr)+-f-org`$_%QUZFg_f9i}4Zg zyN#a(f5ez`!>)fZem4A|@lo(kjE{zYZJdSwWV`^@L5cc<&Kc$2$CZP%SJb@G3m=3H z-79Irhr`lO!bic+hFkDri{}AY?(ey#;ALi?%y8=D19(~E55hV4EDO64et~f>JYZad z$6=+_gqx<{1;5#N5}q{P4SxVuziPqSw|~g^7MJ?k{mV%88>0M5dY!m&+w|`NLXzhT(CI>{q?3?4qsz@ zK8y={2%C|V6`oJH)E$;ez^T6Idd|Ju{EG;`$@nrjE*ojP^{hYA*Wg>R&si9}%zKPU zygmPJ?c8^HIT2ZTiJa4`FUNY7SMtk9=lzlK-x=%N8|Tg_1j?iAuSKtMB=;8MP}UIV zE$G#+go*Bg}x^JuZZ)lG`F7V{uBO)**p#32{*ZBu>t!iev9iMcsah-sl$!6P91C9 zgikSU!KcHUWKY4)F>b=Ef}U1-LD0jO2R)TO5cKdE{4vGDxYqO0p<>4AE6|Ix@N40Z z!#TM9i~-+>UgLNYeuwdH_yZQU1>bJ^Dfn*V$KWr+R}(hjS@=QYoSut~oABetEjUAi zI(s%5bB%Lw*0>3u0V~ff_*~;DSkKXJzM(C8(5r3dz*~%UmR5q*N3!q`{Ex8OZae%5 zST7r1Zmf0qTH_{sBb>ve1>a^o1>XgKQeo-P_raeAbMS-kXW%CMBe(^(;9tT21nXhv zDfpkk96WhT|cEy9cQe0>r~@8@NX9hxyOFJ9^N#7yb9)8hX7)dKCT=toKMy!2b$sQu!17WiSWt!@W1cP52=A zD{u=w4E`#t!ez}S2QP-dCVTif@YiJzuY&(g_H?QZuv`1!OW<$H9=;qV>7)f;VLSz2 z2|uW?M^K0Gaxe$q1gn0U@Q2`U!7cbMSb5e#*S+xfz#RMycnWU9KZ3sxx8UExYF~XA z^fdefF%#atlyd=?gXhCj(jP^%u=1IM7aRA&=fFQi--ORMeGA?It4*iim%u-Q)d2_L zUxGP!JFI-R;8(zp$tKGj0vE*#DKD(@=8j|E1fL7{!v6?wf}8N?;9tYZ@wB1obMW`z z-=JfcnL*d6^y&yRbege$FC&MI@G~v@>)pH9z z8~z;}4nUp+bBj1{M*l~+32%a*hFh@q7;X_?oFp$o|3>EKT#h<{bK;e>JNzcN3BMk8 zeFMG;-atH4@NMv$vC&Jr+u@&rIrwAnjp#SR>VIz)U&y$C70(p>E%(PhSp~mcVJ~8Rf&T{1 z!6o=za1$PdZ-ra1xoPs>#WkI4js)*AQ;N&@`^Fi}vglqxJW5yY8snyu+)w7N4$uAp zVPA(0-C(-(?|?PF8E?Nx95reiiZELCg8WW0C%|kzU{8n9F=F5ca=`^!G&i|A_Se z66qh0^k0bdzwPL$9l!2T>?F%|Kjor|-7`Y`>@el^NfR4$8GUaQ_;(RM8Sw)c{KVJQ zKEW72^P|Xy&$oih{5ax2MEngbezTW&{utSOH{x$&|9fxW{T+*)+xtIc{O|btGtc9? zzst`8m^zrLdN|$dlZ)^bsjG}3n|64O5&=`)f3 zC)|G->5vcC2I0Mef?bDRb4rsd%xjbIo6!FPzr}SEjO%`wpLZJn41Tv~mj&jGkb36l z+f=kE!k5hftmBI07<}br89u|bPo?}LBeiBpuB z777Qu7p4Aw<`4KE#vZrFnEDe6t*vRj3Zr#4=s!W&Q&4d-%DqTU+7t;bpR!%lr>7mkqob zz6Ny@E*ZDr27HF>*-O6)eva(n*Tb7+55E;YQ#Pz!x4_Sp4g5a%EaThZvthRnhp8s_ z%~uOP2mKWGdY5r7dJV37(D#5@_$#o|%E8}-&%?e2{}6s2oUjjl1U?_m!M}kogq!f6 z;2zn-)7ew5l06If0dP(6&riCJHeLXqV0;X`!uVMD0^^17I(R=lcN1RE-Rc8!dOzs$ z39HY{P`dC|?A@~l@@4Q${2Z6|!TaDhxr%T%ev4}mrg+IzSJL%TWA-gwuQg^L()BK5 z&JDWmGG^@{v~!v1f#^os6Pe3|K8>9DSjQ&wPq6ZU=gv&-h0hD2ydVFmNamg>?0y}d zeSe2D{}QpjwN*b?7ta#kSBU=;7Qf!-s;zTe-$XwL+g|uPuK{2QkbxAjyo5YTaVAJUP=ht*bDg574k0R9N9{&fs|xAC#?7mXLf4;mi_|J?X^_>aaXz|)9W@$eYX zb$~IC0bNJI=c3PX>AM5fUoThagH8CPEJH*2~s<9*=8u*%g9KiBlL;8n)6;SI+7!g=HU z;JWetaML);Dsnx1LKpdlZ-f`Yz3{CtRp7p}xWjl7{pVoSNeljxanjA2V4Q;=Hg3Xy zgco;V56?P=y*ixCV($r`0_%L}SQyuRDDqMm&y9n#;f%ZG+ZvvpMP7;C)hE0Pp09Y| zi{T75TJqFqv_8mPjy}v=12C?8we#Fh=1bU(p(l&ebEvL_pJidMg0Ghuvc7{j5*J09vZ$vM?7k-EF1MscJ55gaSGgcO*^-jf)(>E7Nt0lp^%(JnV!`uHT zCE>Em!?`-`yLck#_cVn+SgT;|L0FSyTGcXg2u z6wg9qJS@FCF1oKVVlMNq@C+sehKbAPL9pCW_%b^QKZAcZ{xtjz_zbV)CEj;o%COuh zzQVi;Ut!*aKTS8h%X}qD_atNN+Ie*Q8*ESJ-Yta1b-&Vi?kA(ak1&@}dj153w{y&21TmNyUZG6;@C-Ar!=E)~4G%8!8T95dFEpM> zz5SK(W#)(a3uSt_>9?7$e1FyAzXbla@ul$3jhi7Q>g`47e~+FydiulCAIBVwPHsA! zhnw)eaG&&C2g5~tmHjZd2erz6G+e@; z!D{?>8)soTvf|!7egOT8WrMpD-r+I18%FJ(f%Q%4OU%Y@XB6f>Y>3D8+b_etX7e?; z0O!mYFQfV~m-$G-zFZ4;l}h2V7cGo%WTH+F70Fu_T)$nWZC%LXQZo${X z)I&1GC416$dAAy1R=Bc^Y`zcTwN__wB4hJFvLzh>c?C$NuG{9N;loA5&87QD<@g*`ji z!xzD9pWXg+Gu*(og}!L4!ZwU^@Kwf5Sl_d{c?Z_FjiZEBrQCqc7@ULO0q=mD@U8H; z;#bAtCS*^Ae;7Tkdqgr0Z@NtM{ZqwsA2pjQ@+XZ|{`-x$qyHAHuypz4=WyM^BFd3V z_sE?nZi*OO=B|!i<{u;eRK(wic(w(`bK~$=q!r=|=Ua;Wcj#x5pDa9s1uM*@n!AuBRicrmPbrv;nK=nQKadR(`jYs_Wd6^Jao!tzXc+uv&axjFik zQTfz&&L(cQq0{drzURXs@0*Qt=r4m6t_k-Ux8N&aw+H23&Fs|&UkSeoUzPQ0_$oLD zzr}2t@H^mFqi@0QhPBUb(Q6|+=M?1D{n3MKG>CyKJ`^teKQCD0M-0Q~dWK8sZ`-jay-xrIU==DvzYeQsx_wL#d)|#m~BnwYl z>Yq1ru)b4M+i73Dzv;CnHRtlDa3O#C{uFn>2eFaae8S)#DCO-IjyxtuMtaF|bGVL) z^dB&L#jQOF&b8f%*aX%&Vc@eO{e=;)k9bqWFNyeyh<8S;Z?HrB*G2lbMf}c)^{sNS zzb(?=5%K3EejwuSMf{71pNLrJv?2cKr*&9oyg`3pq<>b#iz8kZaZkjXBkqfMB;uDx ztiN##>1v%1d~IZNW5kmY-yZQj5q}}#uSNV&#CnGw()wkje>&oQwMn!-b40|)M0|3@ z&y6@2@$)0@i+DKVoe^Ih@eL7AMtpn3`tB&?Q{Np0)^|sN_1#fmeRmXC-yH@1OcbZS zy$SmJBK_AQ*1xY1Z2mpc|03ciBA$7A$Nr#*=SRFS;!`5dMZ7j*eS;D5@Zw0XZy17p zIMQpL3VQ7&18Z*(cxPmvlq;i2KEHC)rj?iGH?O&@C%@&=jXn8%GP<)?N=6D3`BG)H zUM@9~+DN`wtyD_I(Q>ttFYQ3zNX9CS^0rE;KRaBlY;!+JadaXXE!Ki@GN1@{o*Ju` zEIGASuWqXsMjEG%R4e7tYJEvjImw>CaaDffrVSS@ip)>WHb(1X#nEh|S{%xr*ce)z zeOWR~2Ia~?HG6KhuQrgcmn+-)#_&sxQhi5h(eZoBE-{r~TB;5#vIu)rh{Y#omo7d# znN=RhE?N*`-6M%p&a0LCNhhE08!HcwmMi(b#(1H2`m#lf#!g?hc#+cIRvOJ0$Le(= z%wwG&-B#{jv^aa-d08wJeTey#^ZLtmUx`GyVe6LjH*8&h;T{Im&1kh)9p?U)3pSpe zsNA$sV~9E(p}rDmSUUXvdbQRN)QdZYtK)@Haj9Of*7MuPN@FE=Yl5(S`C_3s=;cze zRNhhQ81xm2L&Mc=vK^?_#|!oTd|{Xrq!=E~k2OjTD}`D)U+#BN7I#qFE&w%Bs*7sX z;c{`OyE~EZZ@8S`b<(YlltwxcH!A%W#klk?w=Qlcw$mSNY|jr27q+=Vj;2a7UN4VE z<*1cPL;31}%a^}ZD^>dG8OoHhVxs!yK)F8Ra$P85kZ+6@M#o$lYg$cUo7>vjkYzac{c>f zg;=qx^D0-aZVDQPE{_v~g~p&SN`ENqP^n(YyMBXxrJASZixg)roF?P~SXK&j3!Z0uBb8&*VZ0qSQMx=fU?Vi>lW426E%Zd{stq$Z2eM!SRc zl`H-E+Mw(1jlr?e{_41|x?QpNm0VWd2)ycFF4Q#Oh|o(?HSCzWeER#YoyUSU3^v5Txu3e#5| zqhb0>JMv|X?qXgY(gB9f-?4(y_xG!B74ry`D&J@;iq+~+*(cv$t&A3{wVnCC(zdc1 zx5&8g(+{JpR`b&Z+1#tLlcjb%OffDNB~~kx>rB-Vj;&bk?shWQ$r%eu>GWmTvy60> zQmx3!l@04+e(barV%A_RPg~KkYz&6FQzcs3ZB!in?b@x3jS#%A6o;qd`1*3)zT&$r zbxUL_0W$?1d2qPQ%;~UFnix%L48k2rt=edm`-V$-HPmRLRw!3ixPm(vOUAr(W&kDZ zRldk)CQK0{<>HFvgfG&*ZW*DrSn2rfY$#NYFhGlW<)&0|voZ}g&H~t}4~216*DgwB zY#qQ#aphhq-y>z*66(`)HvhTpu{e*LZQ__>W<1L*=?hZ4&;Uvhr2GGFe?}H zZD#6&v#S^E?}Wv z9Biuzw7qS@*rr06Wcrh^B95JDny@G)qlNNtqW(2rU;=RKaek1wgqTtq7c$Yk#B~lw zu3KnY85pe%S>kebwr4l0RR+F6z;d+HgWwE>+kZhSjrP+OFR1W@oChlvHcl`!S?R zw=m2mtiUfLq~twzT#{Ub1Y{CO+M6&pQq{9G1RJbeex&N*q#jnmq~4dWS6N>1-9*ZS z%=G6b*BXm`-fe3|3485^)?aN*8M<1Z2iWuehblFC4Sw60xRxt4E? zjf{|PwOY+rhYCBB;pMgw82A1-!&JLta_@F*Nk>5e@&iTsfqGA4Y}h{{_`alyC=z#~ z9}DU8wqv+ZVLQchGfSIQNUZZASSD-3C5Cik+$)AT0T}jJVaLz3NcHdK5sT-qM$z>n z_bkCCuc6Ibjrn&c6ACN2+so;B*FW&o+1x6RWM#O@m@+>Z7jk3WU zqV{~x7}&`PM82S0ZPNtCGU6Y)sn~&fb)>EDFBR)MYon;K_p_g#l*?=~-R{fkL9?U7 z(PBAaB68XAd8gefZk}}miHXyzsg3b!eP~amI;HO&e#WK9$uq*ILPlXi$I^aNmwQa$ zWTfPVpJr{EzS9rueQxk-fo5{rp)21g^0ZnUq*pSwYs@7yIk{lD)R-@C8+3zyxa1zo z)EoOt>ieNvjD|<1zWj*8JpJ8mA~k`GHdturmW4`@eQBce3RmwUVlNG7S?{+83JhF# z%;(43z0!}E(D)jd?Gp#eOGnWrO&yg39;OqvD@;=(sZL~KnQf|?jZC-=iJKYRK2=W< zWyV^iz|5{6KgpE`c>XCg5^YyhyYhX8`U*_{%s_0F^|<9K($%WVoujczy|m3Q;>;eH zJ8jJkdo2#08nsf9(OYC;xxy^!WoArwx?$6&PII<-jaxQ-qq{k5WOR&4w$xAArFCUD zxm_1w_Du%I+cPm+5cbyn9oco|*pextbC+@6=tz3lr=yIP3&R~HJLbG{qX%{8BS#r^ zm8uzfTg4A)H^;l$V<>Vq#PF|a%ykegvu~l&KgLg;3&&#UiCSA`iMHe(9cF9EssGvI@}0o#gK*ODBt2d)erfndUl#_ zQ`J9GV1;1o>iUI#@^OKkLhH^L1=R|qxsv0#HdjgvHYPrrUuH_3^-P|NUJD)-)VsDVlq;6hPv7C3tJ;Uq|ri;A7Qc`(>WErZe)zJN&;wpmEKQbIx}UWF63*Y zbvB?EU!8@eSYSFL8YY!|ot*&_2hS3D_qdzrs7!ecd!i`&9o2R%ZR*8- zccF$v*fw14qol6IRKUKm;i2uxM6IFI1?Cr*(UM=6Tnx6ZYhv!NZnHB-PI5b9)vp(M z*Z--<1}A@`)&8nYBCZ5}!{mCZ3+wM`TC!QI+!$dVV9Qb;t&lx+X@5s^2qV5;au4&g zp!Qiim?r(hEi-k6r%!r~o>}Q;Bg3xa2H%Ewf%7TXcSiy=b~XkYc{lbs_HqK%?d!_V z2%Vg0ytU62wVP}UI%MoG_K{^be$^(_ISKXJ9h`l z1Jy`mQsDqIC`i1}=XU^|?1ZVjqlx1n2=i@yw2xlF3>7=X8r}lAv&4?s_g2Y&( z<=o<~`G=*iJ#qSjB|p!RN}bik%~k3W6gNyEdLkl%NJDZ=pL^3Kn=Z+(Ub+6lwLP2i z7i?I+dF#5K3uE2N^&7UV?%5QpdM;Uc!IoIDapmUCZc0#o-Lz1tvjFG}X|(S8a)Wai zp1b(n{ps9c9OGQ_tF-m76>Ag0q20mK?T8?9vVs)_OcGhhTdC5!g#~~t~8hDV_{3MC&kC0mt zdlt6T5G5+`e}Q2U(A$9OfZwGKjQfMwF)SQW3vPQ)fA#r7A=W;|KPPK(9bZI;t@H+ih0V`-de%Y_(q|XXa|RFI?!7}}XN6Z*?9SK?y2lE& z1*dO`+l>tQcSrrn5Lq2^&H$pjzbVCU$T1~Xvb=EvN-Wt~oNM&J^187%E_BN#D* zYG$Ae{%|(Y>1jQwHn!Wzo0>=mCQMeN%*Q$swQYgMo@;tPNjHdUm>Hew=P`ba!$z9K zZ9r5`mlJiVVfPloxZT`X@_1*l1^kK%lDR_f@zB;^#{$}32=ncB9>#?{{M#=`g z&Mg$K58B$GY8@{OmBwmGK{?=LfCmVkOejD<0o=mFkqPBj_eal}gE#R)rOKvhPZa}! z)unC3c|mQ2W25@;PSWS3&OasV4UT)*w*h2ND5lkGN6VM@=)R-8f85z9a-5+v2)%k| zp3?gz2Fw`KlV(%K=e>fbYZ}s6v{lbl`m7IaSxb&5~qEte(td%SQe9zt~wcAE{JYDOrp3b>#$CU*vPu= zOgM~EqDi}z{mEsa=&DIu9Ni{rz55*NquKma$OA-P-J??6$=-^`FdpMe$#xDBX-)#T zYG;aV3yB-139rFQuALITiP+=40WTDI`gYwkeqX_wI_TaOv#->drh5w<4!!lPt&YrO z<@&Q;5F_dlz@L=+?V}55v8c7&QQPWGTh^>&QC`1cQ_totD>rRPf+ooBNXA~-I1cMR zr3#h5Y2&*5rk)r01t|z?SnZP_Y~H$gW6yfle6w7+b<2jdjuhD!By}RTR+Kfn0Hz5G zh=GQ`^cI@MHIj5w=dPL`+UtM>9V*%xychY^uCX(XGbydPpoe0t+wj7b=dbOdFk47u zAPxldm*_}x40vV)za)(wzXh;323m_{Ov zr!gH~lW$2bhW0%#N$(yybiBf%$Q-?m8J!i(y~0jLv{34lD=vFl9; zN-FTfPDI;qsQq4F&smz0-4Z{LFDcnjd{XYyo>=w;u-y!)zMjhBA3Thc`C(^l66sN=hG@>D!Kyeso~O3H8P`7rJlI@Y}rQqDa^n z3!9@G>sDTpxGEphY?bf{7E_#lM7-^%Eu1{y6s{RcePyWPvnBk<75$4TlUY9Z80oN znCF??2lcjzSMPjV=Vol4i`^R%w?7!73{k=mj9XFP z;ZcG0v0kvPhMzxem!YR`?&$pvixu55ujf35r}im&%T%v7O4~_c2d7^Q(hxnOj|b2; z1wP+BX4M(hVZ%1^gK}g}?Em$*pm&;Bo;&`o z!zYTzcfL(o8>W-Zc^WFOkp9uGz?A?UoJs ztru=w%Z|b|N8HTTb3@!w&t1{(r|q80i1_n;w|(#b*mvE0G0U%hS@N~QeG!{IajaoI zRFf*_$n9GcTh-&f1Rra-5=M39+wFfg?AtTnpBeg5^#8wSmCz8UoEJCpinDoo;5%); zRwyMs`u?3aKGp~9@n4(NC4DUUOIZAQduGON%b<5+?s>Z54&MA3-iTIyeWA~$W2fJ~ zm~2lbZdGHDH z)^khIb^v;K(xZ_b1nL~lol5y*G&}xvuX_D=D8b$t+37~3I>woRJAcUQ03tkg@}k#$ zwoE;eiVi*O;84$e(Sx&E}=YF zaOgwr@zJC^FLZfuM|*Ay;`SXHon(@YOZZIJPGCE4y_Ifw^R3q!7Qa%~OM89qspBU9 z#=P@}RWDTZIidfEhj4t;r!PR<*@8O;;BzS6Gt{f&?xPU@MB=_k(t8r^vSiLDyToL# z=d@*Ve`vxD8gtm!MOmM{xYxqi4kU=Ru|B$_e`b=YUI0;B{+%ZCu-^ED9J^19+TSfF z<2BCIT$27ZZd4hW>mw$nKo#%gv7(2V$enY5@oz!}zXZPHRw4GHuZj9?CnI8H% zEOhU!+*>Z!mbN$4p`+{n@vf6U&e8u{H>rcu0xa`mV^zVfw zcb?Rd-^Y!L{~Jl}`2Sz+9DId2MGD*)*Xy}vyvP4Nq2#-`_TTOQrc?4P;+c6Tf71v{ zeirhH_a@0kllAWm%$xFmkFERqTj4{$&cEeg_hmm9`&uN=L7p(V!QYUsc+~&BrNT=- z1o^t?{#@i;CVz_i3m@a(Ta4tn$de{N#{GGJ@c(|h;*-1pdAHqPbRz#|9JQu$>b~T| zkXw;F5BXt}U&j5+oG$lo0LxzTvyq>S?k_^_rkuL}Dej+iSeN@Z#)5n}GXJ&j&qr7q z$+AB)l4YNZWZCO)N<)0I-x$fVza)}n-y6xYS38C9vadz5?01=b0)6Nt{*j@ZBKdIS z$w;1${QgLm{q9JX{aukP`&J~&{@zHI{R5FK`-dZ0_KW!YJLUgs@|U4DAwP?v`?6nc@+*}82Q%&YNb+IGmqhpH zA@@eI><1%R_O(cs{X`_oz8T4~zb=wxzbleuKWXx}RDTcC9?^Y;-yO*cf0xOwUq7Bn zrc8GIdd{@uNs~kWokM;1an0tM;M$+7%vvL-z9RV_OrA9P5tDbDd=zVi+`U|~-)^$n zR&uaUNL%t9cE39%tFCnaNai>>)kQ38Ze-iw##|h)#+c-g&%d-BA>Vgd_>k`@lMi4_ z%4zJ+!tdt#uhI?m73xo8C(c($CzQWs_k+ANRo>MpS#7KMLcYL1>!!v3QblAnEtwHX z9h~O>nT3u5I)iI&6c5vxbL0FTFy%QXd&PN< z7u~;ep)9YBWc?!;y^$>YT1sxFWc3fZ5dWl;I`Zz6+)Bw0q~xiT{8&nMg+Le5o1;ud zayBK0_6qj7)cuVqxi=-(QgSmT?@Gy&DS3BFZl&Z0Qu0(vek>&?*3UwD=A`6oN?w|h zwKt3FEA;;mUvKJuEhRTo@~)ITnUZ&>)2sW;fqv8g`D*_6CACFfG| z#+2Nfl4~isnUZ&<N`5RQhb6XMer=X;LC&V+r71a=k~gO0-jrNR z$<36!DJ~MEiVR2aB zIk8_dJj^M%PSp9LB0BE3zouNm;XI!?Bug4QN1Sij_Z9Si{QVf=)jnzW3)|3rId#Lf zA#JT>T{c|X`dpj#1hr@E^ceDAh2LoFeh6dTB#7?+t*EBXwKX2DyVm=2On(r*${E53 zy`Hc3mi{hFcd2ehE`$#%{WDg3OaG?5q^~JGgb(TWpxayeEo+qUJQ30h;e)&q*jxJV z-%I+MQbPEU{`=4={d6C=H(GzV-FB(!aQ|QDy@e0!TSzBF5Yi9w^?-Eg^uv0Xwol9V z5jLGC#T~+5st3BrrTgFKxwp6ayUXftsfAVl*^euvAIhaCxxJ--&Xqpk<%&FV>Gahm zdrSXeOW)nZM(H2Gl}`V!(M?@@UQ2)~ECO8SbQpn6tggn&ISmGcp#WKbouly3?)v0O81_KL0c;kMf!3`j)@vXDo({DejUl z^w`hgzH@$BBKo83edqj>ysW3jY@gC&NRr9znr3DBOGEkjRy2xN?wF7-WLYX73Sqig zq{oCG!aKzrfh>RPx#w#7Bt6)tx#yQiBEL0vKW47G=N2X7cXDo#E68rToSa+a^3&Bj zS@Et>_;nxtvwZlwq;=(z=ANJL(wke6jQ2R1ncRwGybG;9)PwSW0-BlBqhfyO`S!7S zDDUpaob2v7pU+PIy}mwwsWo^g=j;@ooa+5%t_LLGZg;m%yXuznNw(fXz0RAGwwC|> z_IAAW7uwq>l0y2QwyWRPj&i$fG`8KS#Oq63{=4<(>Z4dY&X$DAdC${NKRqus#q7ae z^0D&g+y5V2ZoVBCbD@1+XxnEo=i1A>Dd*dSh454kw{Xp~t;m=^xIAatV9dOkD=hrh z@|?NYJ}>4H{d7Uv>s`8bE;z}`%J+IGH=xg`ADwDN^U#31|JHuAz_ssZ^rHnm*5fn! z(E=C0;8HO;L%aJEGAe+ZUyO z4%c)kx^_;HY35A!2iDJhC+DoyoBAD4M9tne~iJ~>CLsfFiYO5^Pdxp0i;&ejUX z%qC2;m1`E)6PYVQ058)}LrU(2U2Amx>=K@5$jn3NGh!0(2&}OB;jh5k;1>LS zc)M)K+>=2MPs3R8Wk~EXu>2Ylmj>p6Y4{A!8F;m~>4!7$OR;Iea#wP-;TNH|(=M6W z2EPJ*3%<^C8{P?L(5sV=!~8R8_$JR8_)p-A(D%dp;Z<-8mb-zg4Sx{5@?|Kjzk-$D z4EzQ7M(OD$kHY*jY52#0T6{*`hcdm8TR(g(+=5&1iEtin!%JYn&%e$8qaO`9k9}-N&0TsmO1=k__gv2e+pI_`r*HWH^Hqr zX3Ez*zZ(9&=hwhL_k0tqP9Xc6=a^|nd)`Ah&xN<3-wQACydOTt^FjDxSb1#2eehyf zgL^-G4VZzo98vmP@R;ZQ@XfHwwhh0{^8|bk{5te3!psL@r7aDA3RZfS!(WBp0B7Lu z!f%9I@K50u+=hP%-vS%f4O3~~@|%H=hLxUv_}Q>6D|iX4^z4VvhBI&*UgK>h;7dF| z_AE2yYR^B0>z@DRS!Tw~@SE|g3b_@&70keQcy7TTfZw9<;rrn~kv$drSMb|p4}Z~f z3;w3(HvBK14fEkI;oD^o&!Vrs18%|3g%wU4J{?|9e>Mwflkf&O18;zL%O3878LMvI zgDiK9yV*~Iuw^0P*S}KA3^! z)^LfZGL|X*ZFr&QL*C{B^b_z|=ry(&+R++V;iO@?i@5?5<#Y{i8?d1pbR134x+~D* zdT81v=h+WY2EWtfcL#c!mvy^5r;%>-_B0doI?pr#bBp6CN=}+fPU(>RPM*m|?oVO2 zDm3Px_pf|^)ceOzoMu}BGzVo_;aL~L{S1CICkA(dhcEkZl}0)2r^)|6p+C`TjQJ6) za8*7(^Y)Uxo254MA5L#~Y$_8u#VtQ7q(xT4un_TLSnL&Ul$yD)<)% zJMo{;md?W-*R#al?A&VWWdr(Cz0TiKH)FpEJvSTg74T`14TWgad=2_DyuJXR>A3=* z<#`;&^(g<|**Z8KL1h@VC#zR^O7FY@ww1fKBfYLy`7qDcQ=HN%)f@O&ZZ*cd)!VE< zzTNXV@EwlB+5@jP0^7dd&$Crh;O>LZb!a{bulD@e!~J`$NzD#Kd5_vqt-|Js`m^Z{ zCdjt@zCu`wyz-ym7kGXg#->x}=Xt&ATswe_m${{aA91i#{ivLN?ZUCvN3-70*f00& zh);uYJ!;!$d43_h23EN$ob_;qyWA#kv(||n8KW>^}o<@cJ*o zxSkjB@$JY)$`|XyyO77nu*n1^_l*&6j+pdosc9a^UURbClb$I)^D7wFqrM?0dzJrh z&}(j&o6W!~R==4G<9amC%=i2fcquHu8VA?Fp$spCx1!5%UF>ZXj>eVCxyx-tFV0AC zE+s!NK~Gw2n6lsQAIe^w;kpi1J8E%-c=yBJrEaGZ@!wlOc_qWX)dKRgsJ?B zTU_3y-tNP}-uBxXHdpzFV-W}YcY1r|)YW{v1{=otX=y6(R#o$3tEb`Sb zb!W$HJ?_^BE{}c#_p}6@>X)`+M$l)Z@GcjCyTXx84IAY}?s|BDJH-Do# zz|)q(x574G@NKZ>fEL%C@F4d#m&(nKV^a{EOBFnznjMrw0Z3XNen0+{My2IGSp7rp zL!Q&{hhd6$+8X#%aFM&*=RCLIFTy8ENo4=vc@F$-&uRDvo|nU_PmK#1_-F9xa3B0D z&sV}TiB$T2cs5KrZM&Wa?}YcGe>RNkdAYs0xl&`sY3Rdx?o9YB|NLxNWh%GQ`<(}` zgDHb)8TblVYel&s&lz~P=N7!ja~pnFuqQnq4)*XDf<64hU=RNWR^6uYJBOMHan1Lf zLH}IOE%;Q=ZFo7X`qJ2W8LY8S?#1vX?k%o9m^L(RJv;z!<1RM>tIpe8W3bwh0&Bsz zo?U#r*6|dQY0E()~kFPwdHQ3qxQ z*JIeLOv79=icao7(2sG?NN_HtF~z&oxCfGgrE|eAl8xtOfZ`$i;8GPl$f2|I!>{nI zIYh4KXk%XK(9DN1wSDus@TMpxCA|}N8z98xU+U#fvoaTzRrhVBTJmlL)6bR zT$g$7hrLVPLbw~z<9cr9<2ui3rvskVXNEn$9+p#Dl~=7d_E-&Lzqe6;^)98l4*aG- zoHFImH@*Gxu0Eyq;GME*UWtw3qQ6?V*WY!+z?P}_t@^+zJ<3OL)cMWwdn@5=a>^-h z_e{7`_IoC*86WU0`}^Rqws`@S1o?Gy*J-6Yh$M|uF#2@9k1Q?#BW$XX#ScfrgAo; z7pLK?;Qeq0?#u!3AbR!t{qRoD2jN$Ezis$Nub+V5;#ubr?}cx|uVJlnz_ZR)@As@V z%)_4B@Rx%!7X?K{t(=Te*!BnX09>+?zsnk+VdQECU&w}2p=HQ;WqqP_yJf8n=io+f*JVh z@U3tQ{x1A+xD7uBe*#wKp71sq_`l#!${wCcdHt2_;rZ}i%brH{Jh%;J;HB`V;1+x) zY}+Axp63a86Z|*W=m7BwSp7W%55p>-7W_*1({LN!11rtii0p$u4`$$d;J<}i@cr=L z!EN|6@P}c&$o+fx3*r;mBfyKm4E!Tlesx&+6WEq5{9m5?;iIUVFJjVy=fXBG@bh5R z=>)tC{*uC>ajAVg3TEK7u+rIvH^cuZn>1qxoEI-9zp(O~ImMV!_(HfJegnJ}ZozMZ zzX_Wqj1^v=f$xLAg}S}O^n46f8+Zi$r{RBs4=pis{=w@f(EkwrHhLXk{X0AXX5gn_ zqA@LaD(z3@+=h>YzYB*2>i59RQkn<)AHgm7B>2a08$JX639Q4fv*B~5V4pGO0{9H^ zTK2{8O1K4QVOySX3EqO&33wbn7aJX_-UR<&Fay64UW2|5z72kXcpZHSRyY&z2jTPN zx0ikcpATo?Pr?_#E%;&hLbwfo&9k|b_7AHJGw_qJ!d!o;new#f4R8-iTQAr=8@@;7>ae1o2rjHxTbM2Tm_eUU9g~u@z+3?}Hp4;%ro>gGydd|R? z1$+34U=P1M*iUCZ4)*XHf<62W7}vAR-t0%}{arrddh+F6>J;2@5BDQ;ykHMkM{I%1Y7B=3c zUeygJb!Wuoh(Ct$!>+7m29MlR&B$hV#P5xGf5Z>r>ChzMFjNMY(tgal)XO4%809yd z-=5ES10K)*tmj9#|HME49Q-s)dCX9m97`vVJB7P~T*IC6F&nts!qY=k+uhyrYofSc zAMu+a?vMDT5#JT@Aws)~cu0q>k8mcWNQThU^i7K^jCuRv5%gc@-saj3<9fc#$Mv57 z0oFW@o1%Qs4MU8nuOh#WXCXeF87dCBThWWtTp=A9cpv(&ac^^ZXNyH+v&t`WR{s?g zlj;B7>y@VW5+;eV`=dXHPl^HoZ8+cX_M|_!l>Exg@O5_(zjB{(;hC>C)Em+}8Vv=;T&%4+Vsn`i|9FU1wkPPOsDRH(>lC{Dg3>^Wp4_!Xa+E#~VfW zeed^G@DDt{7XD#3Oi}91-9)5rjrgB=cnkKp!}`}_C^YXT_5XrGb8yh_!|z$_wH_nE z?}ZV-@Am$57O%R_aD4>* zFS++~eGIm34E{7s5H@XkPm@6>_YL$4a}E5Mx0n9sk>96+o&aV(hc!FTTkz2^e(f0d z99Zs5?mRN*b5|SP!ksQ^`nj*7&efJm@Ndw`jlrs`G~RCVya;|PY}*n1ZqFyff982H z{87)Rz@PWL1pcPyQ{nG=UJ5_%nJvPUr(pG!3|Dyn)ena@*n(%Vf3uk(&Bwu0xhqr8 zft9vQ%1k-c^IG_9&lkflgq5#L;1_#d2VV_OBb*lD6yck(X;Fxy@KNa7@C|Su`u22V zUJoBDd&aQ0z!~Y`J3LRoAAl7XqxRH~c;-7LQ$FW;8vJ$7)8QX^o&o>T^GtZ=i7sC~ z@B&z2&Vm8 zhNpYK+UMUQGi1HPn#n!GHG=*~?kz5zH*UhD4cE|%^}We)&xhbwdwvvt103?AxO6ry zr}t%wtIee|bo!;u%R8~5Z(4UR{3|LtIhsAC7EYC-9|0K4=X~%*uz;fT_ z?oA}7)b71YHQ=A}Txm$7{3U$1e;E2;23hYNW@FoipLXH)936#ojAw3GIyWbJu0G{m z>fP{>Eb{4AHk}Lnf`2i0nXTYX9?V+qq|0pQPIoke?r!~5V7cqL%g^h%%g^oH<;T0! zTcddAd&aJlM!O!ucmdDe=fdo{G599P9g+W`h^rBgM_h>bxm`YDq{}JwEALW^y80uo z>2hi~;w*f?rA@^UTc^teqKrkEORbV8=Z<(=ms6{|e8d2} zB5lL9-qRmJW2f~bP0Xxjor9XZ;AM}h+7fAu**keV4V%& z7(qKOb#Y{KN0(FUV4WG^to;kqE?-LLX83Qo%UzykU4?B%f^(^>yW!Y8_981UQ8}mH z(X~lk<(b=I-ygs2BwJTUz38_*f9Wai`NnQoHi|olOY!OY`4T=D-Zx{@H8ZJ~AUwr0 zjlE}Lp!f7!y@B47id*RQZr;`*vfkg@I)qcFx^+Sto&l@ARK{~WuZNHK+y{GS)2BWV z(x>-mxT9qwvy<_|{TL}P_x?zuSsLjj%c(AwMfxq?USY3BkDIBF3nJba@pTdJh`15) zO%ZF4fSak0TO$45h~F9Udm{c|#2<_J(-9wv_}dZxIO3-xp1o8lap^fe;-wL1zixKNRdI*0!(!Vz1w@0kL6zuPc z^!i>x(Cdsou+Gf`AB^lXOr$~oV5I+C#9xY7@9l!U&dLMpeO2H`Bm3`0{IiIkig^0z zUB3$>*89Q`rYV*iCYxQmb?e%zvX^goS#NgRReinLtZ9r_3uYuYmMxSUwPK-esw3Ha zrCcuL8^uaFTiA`hZkpwKaYwl@m@ZYyJM4$aH^xjOUk%1)NCAwW9jlg|y=>Xp)mmjo zEjLm>d!$k>HY&Acd8H+Nao?rczO7p>TN-&dGhJ`gn)yb$UdiuFpI+a2TKW}cmJEvJ zp-TF~^gwkeTPv1#3^chH>V?|w!qO#^C76(k*B2^7OMQU7%EoDDrk9^~zL`}VN-td$ zLOm>svo5L@2Z<+}9cUIyjbb@FP#?`zSDv$UX>;W{r!7_dI|_|#zFDggU>56aV@Gjt z>1pYUE=pse;6un~T{Kv%xnd;9E!($Uyk-05b%z;HHjPTYQsVixOZv_?$~U!C-$|*C zP+kTqNymM#R;ktnwfyc^SS)6lMDGmad)9>Fp$gd zELC>McBoPt&D938xe_r*Q7UDd^@7E6u3F3%2W^n~-ITWVK#3G;qH3j7%#YirW7)yF zO$oPdyp@r{NH^emdC&(jD!omu4cm&H_#5?I*`ZQyhs|Uok(1F{u@U8?S}5$yR)%c4 z+@ortJV?t>qLdUbs&x((Ya=$*xjY8hdL!3p+Bis8qc~Ei=%K*ntyZiMm(ATsu4aqA z>U`F64O^<}EeX|7EoY;yRhlF-pYt_krE=wPnS#$320KPO>XoeRgrq{O(A9XADqA)= zbwr!SvEf{O*kxrfWOiqvR?gaXgMGP@rRMWwXG~@tv1UbTx2D!)Gw(A{A1)5r`U^=2 zO;Y|l$tk!>DN%lfnu^LMg2tQ8*9tj0wd6dhRr~6+SQ@AF+(@8{MUSI4sJtdrP1o$I zwZc%LMmMaFtGSgFP)C3U>4r8D1+3_X9VS7c-F7OMDj%uJqEYWOuz_NEFk2nA&AmR{ zYz$ULT_M+Z7Hs8TpZAbgnYkDmV+u1nSjY`h7KQ9cWzZId*VhWwO0D5KrEkU7zFDT| zZK_mJF5#+->|m~uQ@ZGO&CuxbJ8IR=1NuweHY~MT8rE=*8juh9WC+X++O)bZP^V7q zLpLh8)X3PExJC|%yK|)?{tMZ$kzzvwh7GXbhDvd*KL` z2dR8^C^u3pDJ^;1!IX@=3#Us8(MrYY?$wpDH!m}uQrUUtC;1tuG^v=u!tQKQy*r;( zgS3F5z3*O4?gt0ew(?m7a+R%j6!}VJXVFDJSSdI1mFjqQps=H;%FWX+-0(v$t5)4` zK{6**c9YZzhatv>qR6VbVvV6X!shB#_Gve9-IOt*6jq*tJ<~{cGS!@{RQYb5&o)=A z7BdTDxngzKvOXNjPKD^>?x4aL?38Y~IfD0rLhPT0wqfl?u>ifS0uLb1HsX52#4G@Z02fFgD(m*q8vA!4MMU%d+d zdFt0rBa{|19iQDLh4K+PXg;gd6v}o~rs77K0K4TOKep&PSt&P5rTSs{=qeO$vCNdJ z@jqXs^`cPajQR>Cbctm$tqM|eR5D3!2Yv5AuKVop)P@sA<$QLOF{Lt^&6nJ8V^hr} zW5abl-;Ry)XlHeX9EOF_U8YW3ltxcH8aq^*T5dGkRUuf9xmtd>qsG&&jtPC60%edH zG+{<;uJM{MDVj#ESTbr~qd5iuJ0E9<8A}K$p|L)Vo*COXEZJtEVWl}VWc`_4r9#=% zx|6;{43sl{X32#a8>)?jmBUz7t;r0GYw<8JUK|{=1xHM65oX3(vM>6oG| zjG5w)mL+apE|geYG4+&~S{Occ8_kt=5=3d23z~7ISZ17Un4DeB8rQgNO3F18#;h>- zTK#TTKsH^pn8FzTY&$d>^J=5Mj%@LFq+O0&(b?)@EUO!9Of_V)B|CV#Y`M_vQrQ&7 zsw@!eW~f){P_NSfa;r>kwK_Hl*V>}Ms<1e?@*E!71eJ)C;E zrjk;Txx_Ha492p3&aA|o7h4>ru{Ok?^~Isduu>kZyTB%UV11DG$$d=rAd&KBjVf+v zuVa%&hbDSu%E+??>%*;cvuag#do*rX;uy{TaclOg>)}diFhwj1$Se`CCLVeM+O1Y zS%lf1s+OfLSZC&PJyn~NT9^e*Z6I5#FuiiO11SSC!=D{ot4#J;yQ~!%*4lN=zgn2m zbu~W^vGQxuYG@gn`gROep`A1qDeUJ?K;ZZw<`Ypt-uDOu%VZnagdg|+rJj_TDyo-UK8nY`Rv)QaTa?p1tYXm7T|X>2D@ z@w33wKseH9lK#RVYkp}d@R1;EAhvQSOEWy$DOUy*X3D{?yt|YucO@)oJYAUvRqsk# zx>qTMVy@IxGXG_j8ZEo+9XU#r#cmb@(9^$ zYS&4t8)$z;TQDZ8p@)%$jz}O@zR{d?YdoXs+xlU0i6xJ+1 zXT^%cq;pqU(Y6`+Rt}Uf!(!O5fb6V^sdxsP?BS}hK_cT=$Iw9N2F?1g9W*u0*}gSs z_inZykayd5LK~sMcyuEGO|rO)sdk5^AEq69_rqwJ)dj2hdgt*#t&$te=jgZu!#XZo zV;PSpRt8zScs1JiDy?CJi;~|}?NVb>D|Ra%RV2cWQe}Xg+8R>^2b!gwyUbX%uDt@| zi%n?3rPGGsmhBwGW<>f|&Zffk%7av?4c5E=1A0XMb5361%cb3JR zc#Q3`gFG6QuVKN>zM5hmqd#f%m$EuMZWF`I!rtGwQm3kP5Mb-cX==@KSu1<(*X;tw z7PuK@7%7xCj>fkC1JQjTu%p^Vs72pYR%XXV==I|$gO&ha4WWEo%sq_OU3 z3W~5{Zm1oJ#}+k>>_jK^~?FV|q7%aTs`E;H@C4`#8u&a@bXwHytPH%I)wmAT`8pFrExlChJazj)Mm1`@TFNyzIvsKIhEw`E zgfrJM8cLay&8jAAy~7w}1mVz!)nJuHVZ9g>42cZp$aVm+pizK@fgJ*Lw_B=wWw>C^ z_&XZXl9k}LI-;6R<7`DsBKaevR>TUXZt@U0%JKIhnIUx2R~d3^)}c{%$kN2Z5~V;A z3cIzMw(0V08-!g0YpQKB4Qchny4Em2jx^l>?U*McmE9Wcv{t7u7*30IH~M)+h~J&d zv0t!fiuLg_$I-0SSQ~0CvvtAF+Ss+pPIoRmXm+wt_dZlTtSi|HgfLh~+DXD2(0j8@ z`{qbH57z%SBAdX%VGn{4!>FDAwHeUCi_ytQ%~a~U{H|J6q|Fc`R)djQ#~pr=KuOt2 zQL6-o>pDS|7~3g+M$9G$2~>$)jwqitC2CS7d%|ebW!7!XuIp9X&90*j)91Z{w^J9Z z!F$m?%-WYYLAQM~7VBiBWYFqt8f+U3vjoLDn%h}uR!vSR$kv-|C)lTufk8ajDTwV5 z`B(EtUk@fuC|6iQ9j>Ay6e10qsOkt?!dhvZ_}PWK*G_hrEfuu!u^q_oS2Xyd)hh*` zE_b8(Hh8x%Ue8z9c-k;KC;D`lCW~2(ru4~?+&G8EtT(;vbL1C5cH0|v=FGvoLFt|; z*(mLDxUTJ`-z5we**QD*O_tiJlA0ph3O`%t-CGcL$W7Kaos%qEwG>-Oi(eDz4NFk5 zIJIZ8_b9ADlcPpP^$IR+e1)UpmrvNe!b>;FDY3z2>4dT>K#f?2a3qFY^ z#H&U|lMAAq6ipNsc`fC}4I5pKQdrp7vnt-%DN>rVZ7pQbin+WkCM|X(6SUrIGzX|Q zHx#m+$f|ji^W&_t*p%hy+-4Vt1hh3g*kWgh?FhzpQ^OH=!Pb-Eedl3kf*cldfMAndZriYld3*Dgt-Y6TTf23e37R0Q+0g;@F4@?T*DAvLfZT^l z+S<1%yS4WvZsH2U237?o2$yfaysvjNYXfh&cKfz1NgdI$elRrx_O&f*RtpR#-XjJY zCZzYinS>)r4|VpUailX}NYGn*e-7tFKAADeK^X2Cyf$3YOExxbxnk|b8+*yjHX`Zk z+p={Vkv!w^_RTNeyyc~v!-GpVTsetVnC7)wXQ{3?KwA1TnroM8H-DON&GPe>pLfoA zE6!UHzxTGsk4>fS6s_oqNBI<_8rpI%ddTA!g>EcS=gP|J3jdelH|WKT`1KH zX?@FJGGEU~(dv+-6{}R3X4b4{B&zs_Cn|m+woET-n#(#bW3Db<>yx@-nf3n7zLm2Z9*^0g6t5k(Oz^%PK?H-@D@=8GsH)Wf3qU-=?R z2>Gmw{wE!>lU=^Yq6328-3=q_KdK)^;kfqr-{_ClgT8^&&3LhT1uH-nJEVS<28(m) zphdnG#5lyXW={+3_irvtZ|Gyew{1&y`?|i38@Bb@>WHh^H{lR=)Pz@e+G%LQdPCjF z{hlV=@%BeHVLN`zaiIDuSd z_wm8!OYBLZw)4dSeX++KeW_KjOXILGd?`X2J0}V>PujULY#2GrQ}`0?Zi6~8L z@2j{&GJB+^lQK>8;k|}sZT8$2gKdM|V@S<%!|!svq;(#s<$>RjvWMnndspkW(%vR) zJ!P+>L;sRQqD`m5pg7#VSSQbn0@}lC6;K;^1 z<97ROP8)O)PH#kZDQj1qyjkOHt5zAcOL3pK;%Mi9ht#9{z`;xH7lkTln_sx<&=&)Nd>_Y(dJU&H z{0+Td*XAv&9hKk3)hkW*KG91R3VF23CRC-ZmdV{7ZTo!KcZWLv)Ymz2`Wx|S0ZzZe z(RJrceuv5RNxti?ukj9W`LBKJx0B{>_nmo&zjwxiA@?15D{n&9*HGnWnbo+z3;1Su z`up6oCj4=(*$3Ts`XwKUzZv(tzqu({zjHnP5%*g($@<;L{0U?FVaabop7#~^HxPq; zFZNacT>j@GE0f{*9ORal2hx0h{c--jN+chLyf>2PBJcC^z1S~)!kGP$JQw+Zm%qdF z`A_jTAR>7N@`GMpu!!GkQHt$IUWiPRZ2I(kKJqWT{Bq>r6_*&m8z**_Y|vVS6yWp7e0 zKP1VzkeB-BmmtsHOFek`Ha+LZIQ?F}2l;dgZ8(y9k*kqB7kMm_=ODMd{3QNY-|zlE z62&k1IOM(2^SQ|TynN1L`T>=&Ka%GnAMkQN&tLE`^%ltskROcXdB|-qACUbc)RUJV zN1p!`>M44@faepDJP-LXFCWR+Gi!qK_VtL`x;b7xm*=UcC{Hhk`q7wmwzpNjUyVF{ zVX9MaA3~m=PIc-{@(kpK*oJzVzba+Ykvs!A)Y}C1$J1EW_~&!^9ng%8DUh)_YbGcgqJC1>mKv6ZTAzDH~-@HJqN1+ zE`CC6+tzIESEl*EsqILr! zgsigD^CM5<1E;cyWsR*YLu{Xn!(E6@@?B{@a4jy$zb_vl-ED6l(*2m1XV7QmG&aoQ z-oy2~;@#(;hj`VO;&ipW9P+Qeq~}3ilgMvhLRMYNKBNo$t!`@k%SUhZ&-Omm&RMZX z)q{R1srrhY`%U#!+h$_@udFcDXf8~;sb+doW&g&Ce(Ai_#?yW5ezQK^j@4bQqp9vE zc896IVF2j|qjI>?`+Gh5V{MCf*6IUtV_b8i^s7GPid=J}^vv<$ zd<6Zmwq?l5{k~H7hq#V4{BYAdwHvt*kAhV_E|n4&myn1|H_0soRG&7@}7jeFCiaD$PXsuM-uX*3Hh;v{ELL#qm1KpQ~DPs zOs-j|RMB;*GZ@*@fP(S-b1LJmW()Eb}W_^Bkw z>4dyIA!ibDUqbFr$kl}0O2~T?^8SQ;Fd?@S@}Y!0k&vHA$hOeQcgXJ?RYD}E6Y}ze zoJq)i3AsNZR}*q8A@5Dd`xElPgxpTZhZ6EcLVhA4hbgv`e=YXn{3qn)2|1IH`x0`0 zLarv{RzlvJkoPC#g9*8vkPju~iG=)ABx~qD$}bd@f5|5#Wyh=Px||*$d1vzFgKY%lIzCvWvG}x-1Bj{oEa!-|+@WL4?PXyyMi14Bn`Q zx1m<-z8vLv*gxS_LikmF^u}UYskGaDtDUd!NAEuT?<$t@dZ>{bFw5%WBlhmIV>VuV z@j2P&>$cq8&dIKpw8Gt%2kBgA;%_T$z5THtpCtf4sMz;MYUpVM4ThL^?l= z1T&NA(BYtV7CY@5f0zHTUkHAD^9`ao4pNiJbTkgeD(*hV>$P@QK7;?D-;8du`1kpB zP}qO?U^@PT{32ko`1ec_zowdG{5tQNEdE2jQs(${g!qF0AfEwD7XQ9U;@40Y{D=HM zfKKrz+dw=|^0?z<8@sy@CiDN8pI1XX!B2=k$aezLCFB2v_n)*+%KwPpWSSIq@W1Ff zNnMw0e_!L#WaW3jm)~;lRqf{}t`L97mv)$w#ec$}^Y|AEJaWnSRVS0h|EQ0@&-+*W y`tvHu_&c*#K-Qw!FrN00AV(jRXY5fvU5>3q7J~HCGg#DEK#rapimHYo%)ZSkJ diff --git a/service/firewall/interception/ebpf/connection_listener/worker.go b/service/firewall/interception/ebpf/connection_listener/worker.go index 0768b73d..50c763f4 100644 --- a/service/firewall/interception/ebpf/connection_listener/worker.go +++ b/service/firewall/interception/ebpf/connection_listener/worker.go @@ -7,9 +7,12 @@ import ( "errors" "fmt" "net" + "strings" "sync/atomic" "time" + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/btf" "github.com/cilium/ebpf/link" "github.com/cilium/ebpf/ringbuf" "github.com/cilium/ebpf/rlimit" @@ -35,7 +38,7 @@ func ConnectionListenerWorker(ctx context.Context, packets chan packet.Packet) e // Load pre-compiled programs and maps into the kernel. objs := bpfObjects{} - if err := loadBpfObjects(&objs, nil); err != nil { + if err := loadBpfObjects_Ex(&objs, nil); err != nil { if ebpfLoadingFailed.Add(1) >= 5 { log.Warningf("ebpf: failed to load ebpf object 5 times, giving up with error %s", err) return nil @@ -129,6 +132,97 @@ func ConnectionListenerWorker(ctx context.Context, packets chan packet.Packet) e } } +// loadBpfObjects_Ex loads eBPF objects with kernel-aware attach point selection. +// (it extends the standard loadBpfObjects()) +// +// This enhanced loader automatically detects available kernel functions and selects +// appropriate attach points for maximum compatibility across kernel versions. It handles +// the transition from legacy function names (e.g., ip4_datagram_connect) to modern ones +// (e.g., udp_connect) introduced in Linux 6.13+. +func loadBpfObjects_Ex(objs interface{}, opts *ebpf.CollectionOptions) error { + // Load pre-compiled programs + spec, err := loadBpf() + if err != nil { + return fmt.Errorf("ebpf: failed to load ebpf spec: %w", err) + } + // Modify the attach points of the eBPF programs, if necessary. + if err := modifyProgramsAttachPoints(spec); err != nil { + return fmt.Errorf("ebpf: failed to modify program attach points: %w", err) + } + // Load the eBPF programs and maps into the kernel. + if err := spec.LoadAndAssign(objs, opts); err != nil { // object only has ONE tracing prog + return fmt.Errorf("ebpf: failed to load and assign ebpf objects: %w", err) + } + return nil +} + +// modifyProgramAttachPoints modifies the attach points of the eBPF programs, if necessary. +// This is needed to ensure compatibility with different kernel versions. +func modifyProgramsAttachPoints(spec *ebpf.CollectionSpec) error { + // Load the kernel spec to find the udp_connect function. + kspec, err := btf.LoadKernelSpec() + if err != nil { + return err + } + + // Function to update the attach point to single bpf program + updateIfNeeded := func(bpfProgramName, attachPoint, attachPointLegacy string) error { + ps, ok := spec.Programs[bpfProgramName] + if !ok { + return fmt.Errorf("ebpf: program %q not found in spec", bpfProgramName) + } + var fn *btf.Func + if err := kspec.TypeByName(attachPoint, &fn); err == nil { + if !strings.EqualFold(ps.AttachTo, attachPoint) { + ps.AttachTo = attachPoint + log.Debugf("ebpf: using attach point %q for %q program", attachPoint, bpfProgramName) + } + } else { + if !strings.EqualFold(ps.AttachTo, attachPointLegacy) { + ps.AttachTo = attachPointLegacy + log.Debugf("ebpf: using legacy attach point %q for %q program", attachPointLegacy, bpfProgramName) + } + } + return nil + } + + // 'udp_v4_connect' program is designed to attach to the `udp_connect` function in the kernel. + // If the kernel does not support this function, we fall back to using the `ip4_datagram_connect` function. + // + // Kernel compatibility note: + // - Linux kernels < 6.13: use `ip4_datagram_connect` function + // https://elixir.bootlin.com/linux/v6.12.34/source/net/ipv4/udp.c#L2997 + // - Linux kernels >= 6.13: function renamed to `udp_connect` + // https://elixir.bootlin.com/linux/v6.13-rc1/source/net/ipv4/udp.c#L3131 + const ( + udpV4ConnectProgramName = "udp_v4_connect" + udpV4ConnectAttachPoint = "udp_connect" + udpV4ConnectAttachPointLegacy = "ip4_datagram_connect" + ) + if err := updateIfNeeded(udpV4ConnectProgramName, udpV4ConnectAttachPoint, udpV4ConnectAttachPointLegacy); err != nil { + return err + } + + // 'udp_v6_connect' program is designed to attach to the `udpv6_connect` function in the kernel. + // If the kernel does not support this function, we fall back to using the `ip6_datagram_connect` function. + // + // Kernel compatibility note: + // - Linux kernels < 6.13: use `ip6_datagram_connect` function + // https://elixir.bootlin.com/linux/v6.12.34/source/net/ipv4/udp.c#L2997 + // - Linux kernels >= 6.13: function renamed to `udpv6_connect` + // https://elixir.bootlin.com/linux/v6.13-rc1/source/net/ipv4/udp.c#L3131 + const ( + udpV6ConnectProgramName = "udp_v6_connect" + udpV6ConnectAttachPoint = "udpv6_connect" + udpV6ConnectAttachPointLegacy = "ip6_datagram_connect" + ) + if err := updateIfNeeded(udpV6ConnectProgramName, udpV6ConnectAttachPoint, udpV6ConnectAttachPointLegacy); err != nil { + return err + } + + return nil +} + // isEventValid checks whether the given bpfEvent is valid or not. // It returns true if the event is valid, otherwise false. func isEventValid(event bpfEvent) bool { diff --git a/service/firewall/interception/ebpf/programs/monitor.c b/service/firewall/interception/ebpf/programs/monitor.c index b436c695..f6540d74 100644 --- a/service/firewall/interception/ebpf/programs/monitor.c +++ b/service/firewall/interception/ebpf/programs/monitor.c @@ -81,9 +81,15 @@ int BPF_PROG(tcp_connect, struct sock *sk) { return 0; }; -// Fexit(function exit) of udp_v4_connect will be executed after the ip4_datagram_connect kernel function is called. -// ip4_datagram_connect -> udp_v4_connect -SEC("fexit/ip4_datagram_connect") +// Fexit(function exit) of `udp_v4_connect` will be executed after the `udp_connect` kernel function is called. +// +// Kernel compatibility note: +// - Linux kernels < 6.13: use `ip4_datagram_connect` function +// https://elixir.bootlin.com/linux/v6.12.34/source/net/ipv4/udp.c#L2997 +// - Linux kernels >= 6.13: function renamed to `udp_connect` +// https://elixir.bootlin.com/linux/v6.13-rc1/source/net/ipv4/udp.c#L3131 +// +SEC("fexit/udp_connect") // Note: This attach point name may be overwritten (see worker.go: modifyProgramsAttachPoints()) int BPF_PROG(udp_v4_connect, struct sock *sk) { // Ignore everything else then IPv4 if (sk->__sk_common.skc_family != AF_INET) { @@ -128,9 +134,15 @@ int BPF_PROG(udp_v4_connect, struct sock *sk) { return 0; } -// Fentry(function enter) of udp_v6_connect will be executed after the ip6_datagram_connect kernel function is called. -// ip6_datagram_connect -> udp_v6_connect -SEC("fexit/ip6_datagram_connect") +// Fentry(function enter) of `udp_v6_connect` will be executed after the `udpv6_connect` kernel function is called. +// +// Kernel compatibility note: +// - Linux kernels < 6.13: use `ip6_datagram_connect` function +// https://elixir.bootlin.com/linux/v6.12.34/source/net/ipv4/udp.c#L2997 +// - Linux kernels >= 6.13: function renamed to `udpv6_connect` +// https://elixir.bootlin.com/linux/v6.13-rc1/source/net/ipv4/udp.c#L3131 +// +SEC("fexit/udpv6_connect") // Note: This attach point name may be overwritten (see worker.go: modifyProgramsAttachPoints()) int BPF_PROG(udp_v6_connect, struct sock *sk) { // Ignore everything else then IPv6 if (sk->__sk_common.skc_family != AF_INET6) { diff --git a/service/firewall/interception/ebpf/programs/update.sh b/service/firewall/interception/ebpf/programs/update.sh index 1bc5b167..9ffda433 100755 --- a/service/firewall/interception/ebpf/programs/update.sh +++ b/service/firewall/interception/ebpf/programs/update.sh @@ -14,4 +14,9 @@ headers=( # Fetch libbpf release and extract the desired headers curl -sL "https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz" | \ - tar -xz --xform='s#.*/#bpf/#' "${headers[@]}" \ No newline at end of file + tar -xz --xform='s#.*/#bpf/#' "${headers[@]}" + +# To generate the vmlinux header file +# See "Export kernel information" at https://docs.ebpf.io/concepts/core/btf +# +# bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux-x86.h From 1b76004a63754848554f310cb84542da8a246e24 Mon Sep 17 00:00:00 2001 From: Alexandr Stelnykovych Date: Fri, 11 Jul 2025 19:47:28 +0300 Subject: [PATCH 2/2] Minor cleanup in code comments --- .../interception/ebpf/connection_listener/worker.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/service/firewall/interception/ebpf/connection_listener/worker.go b/service/firewall/interception/ebpf/connection_listener/worker.go index 50c763f4..b52c168b 100644 --- a/service/firewall/interception/ebpf/connection_listener/worker.go +++ b/service/firewall/interception/ebpf/connection_listener/worker.go @@ -150,7 +150,7 @@ func loadBpfObjects_Ex(objs interface{}, opts *ebpf.CollectionOptions) error { return fmt.Errorf("ebpf: failed to modify program attach points: %w", err) } // Load the eBPF programs and maps into the kernel. - if err := spec.LoadAndAssign(objs, opts); err != nil { // object only has ONE tracing prog + if err := spec.LoadAndAssign(objs, opts); err != nil { return fmt.Errorf("ebpf: failed to load and assign ebpf objects: %w", err) } return nil @@ -159,13 +159,13 @@ func loadBpfObjects_Ex(objs interface{}, opts *ebpf.CollectionOptions) error { // modifyProgramAttachPoints modifies the attach points of the eBPF programs, if necessary. // This is needed to ensure compatibility with different kernel versions. func modifyProgramsAttachPoints(spec *ebpf.CollectionSpec) error { - // Load the kernel spec to find the udp_connect function. + // Load the kernel spec kspec, err := btf.LoadKernelSpec() if err != nil { return err } - // Function to update the attach point to single bpf program + // Function to update the attach point to a single BPF program updateIfNeeded := func(bpfProgramName, attachPoint, attachPointLegacy string) error { ps, ok := spec.Programs[bpfProgramName] if !ok {