JFIF     "" $(4,$&1'-=-157:::#+?D?8C49:7 7%%77777777777777777777777777777777777777777777777777"H !1AQ"2aqB#R3b$Cr4Ss%Tt&c$!1AQ"a#2B ? }XuAo)8^ IƟ`vUp9jY0Ǧ w)E허2jU`SEKw5]kSno!]:?jc\غV7/9N+{t#8zd/޲3F/=ź3GNquV"/4:{z%ۣI'D@ %88^f}VV)S_2ed^Mx"͟?UC62Q%чmO͓ cq0rŖJ\Õ_Sݶ'|G.q޾D U]nP%EF>˲E"d&'f2s6H]4w IS˶4VbaQ+9]XtNx:M0JNxϙ⟟"{nr;|{%vo\z-wc,*|k}-m55o4W9ؓw߱Yzk .=/oϡȴ^9ҧʹamtQԬZ]4?egjrQ}+)MleE]MPEn!`IK2RUEwVIoͷcp;lśe7΄uN ;rПV8|e\׹9Y-V_G.)XԢOv<;_"ڜ]ߙEr݊'K{KuBJ}KI}24|"v)/ʻo5)6-Tjd7.C]Q&lU,Yk1P4~UKZs|$kX6+屷CUq+N(jlGrpG&UB3#k3\9qfg7O8Kim(AJOO~C#e`i0wĦij$cWh<dtQߺ"NOtG+ZǪ]b5%]v5$)u|qZ柡s-rۖu$MKڎCmN_V'/1u,21pvlc>қeNnֺ|bkl=lǷNOʣlz*]»vȎ[)j[fs[]:s#m6Qt6*Q+`};ßj[F_jcv`r#w}|k<ڞ/r53N8>Kh q_-_??@enſEܥ\D\YAEo+ ޟd}IcY7+t{=ɩ>}i\\JfxzVdSzᔢ]Q^CJի\iceitMM5hڦg')^ et#ۯ"ÿfF->4iؤ2ݷ6#p6^-R̫gETj^I.kӽUp~D9[:/>h> \gJ|ۿؘ>ml9jMK =+*2i=0RiͶۗV{"u]IH`9J_˹KƼK$X-|=ve/ bjxw.9i%NqVJcFYKcTtO,F;%67vYb8֝qq0tUt=DvawsS~~Edzr^F-v{c++ݔ\|9Iy #nOavOY=3690Tcrilwa\˓m$?箵S6U c(.~R7suMhqcMOnKoc*ȣȩEd'J ܜk*_q}%M/7c.|;trddbsdcJev85̤iW Ę 8C# .딖e$sk80^\J众2)Nm~|Idj_ O+6ǻ#(MIz4Qo:օY,:q]̌"lK}{F]ζ)h>ʶ ^ue78_G#rqv$wkk[Q c+վ+ĸZΝFB]VzoiJRke&Kgom_7Wef_7,osJɽE%lzBt>mRs)v8'P0ֲtrOg4p_2`GlhYڦDF/ӚKmtm'P2kqU765fJY:y؊.ox%8V_ִ̌ܞjpqwЮQ;iUcNoOoٸcY w*4soӵkqf$?-jy~0{>?DaL8XL/ɞo+'8 {ʸxգj#Dy)wk̘e۩+%}~;ڼ5xek|y-%ڱ-ʜe:EEScÚ5z|r'&I&яF*F7|[nRF =(4ۖ@. n7@xx:N^8Bg%u/ny6&dR{?8U_Q6Z߯-oh.NR]} qi6~H(j7*uF&l&o8ts]/P89:jW*$w׹Ӌ FxpsCJi.7N q4WU_}7*M#qWiصnk'4ݍl*t^ c<'d:~͗enFQRz9v~ddoTZ̚k7X(wUswO̙fոҁՕ[$IAI>WW~ĪEѢNoeutYߑ-Eixιpxq{FnyfRrjqU᫤]>wPU8)Y-7Wbq㛋w:7ܣ].j%K:y4] %9$I%pT(󨪙VqiYٓ4y~5S/XTDZM2lȪ; S~Kx:(Mn0';-{*qV&|W3S+\֔a{R{s=lYmN9Fn&o'}Vi( ?*qV5ѼCNsM饏zߴ$^O69@ ,$y|jE;gW/u|M?3+ZՕN86յw%|QO㏏S\E#ddsgl+Scl3~~CԕQľ?5_ z߿t11OĶ0>oB9E/SOSk+b&Yn>$툧eg) "!܉(1 uBoJ)/t/,:=7M+1ܺ#CmS^Nz 6[u&]+|Dfj:uZ5-Z^TjMtm>cȳ NdT_,M#Ex;pt۴ͮ#!N iKl!zPծ~$1SiO} HI&g Bf)b%Ko̧kumEnص;V?j>nltOMVۆl>.WueYaw2+qK,?uHiqqSM}~gu3xbcWSy/Xc{%sZ]uaUM;7:cb5G97'7þյW,;$ܛyVjl޻y7S;o6gf.Tг[7/i1Z^rE cUF'P1-?%u&q{fw~27ޡ ^w$?SwP[=R3Y73 4x(Kk&rLȫMKn:RjcI?3Al`vض[POĖSYujj6v+-[xҵ=~zNN>\ɲQ/uufo*e6l;31붏.>w6=7#7dFDc%ƶTbd;2/=?Asr! ~ZSS~I"9y]Hn,ĊJ7S}cK"amCg3yP=RQɤW}t;-{F+v+RɔڎB?º{SV묖kۏmK~%.Q;OfEf_Y/F-V-MdD)m.ZՍ8Y*h[g/6ydmCc[rdfʾ䖗gd$^֍^ʅѻL|<[݉\߯RiJUo';œN?B smS ܹkس,mRE^ѣlJ&.ċ԰YO:޼f\Z'HCѯU[ʩ1ff4S-٥YxTIGLiыr }L)edׂ*l|ٚuoxӿnWkTbbVm zT_'"x5Vިxo1ج^Fq6Sd3ws'/ڞ6m?}1OsRGݝ+,~ڬ%^p1ef5c25vq~﹉ă[r-eq] 8+/ESj}?mUE.xYK3"oƔ^Y9I]I ޑ" &*4.Jâ}ټQbXKJ񽼀ncg`+riܭ_'Bֽp%bX'7cB}WPm|zHָLJhj~E>i~Z$297|_hyΕ&s}ZϷ *j]:v.HK<SP8`Pƣ)r ,}8Wk[ArHgn=о7:J]TTP>OOj J_KyB\Ԥrm嬷ȫr{ݙ5R(FRЪ6q}KLmR'eޖz6[YތesYYL5Tr7s\^rؙV͸컬j5d?yk'b S }kra^ߚRH)[sg.fLM\u= vJQ]rVkZuoN}#G?yjO%|i2fKoӰღC P_Ϳ6Zr{e/m$i}9 G2')YG9KY>|1ӫ +v+i;h\Q@˿Lӭn˖ 7ck>Vr.D0)hC<˄4"0[eԬݭe+l2s3ss oX]1r]+VK vI;mZ')R6e5=/i@]H^Z۬՝EW.jƆf{8mXMV~_̝z^VR}T63}}k3+k3:j1Phlpi{欍BȽ}6w73GtUZv>4eUj$ xz$$D/߇ߟI"uk̜aƪ*ke/F:dһ_PE1ݡkp(5ʏ-ɮ{Yllԧg!ܝ g]i-umεŸxOê^=PR ##XeMy%2L~󜺶Hm ݙ2t_ƶz7'\Z4T<"AM-&xaC]a5.huQ۫$cMμ|h;.J.o߸sE-zU{d];|YLSMvSEneNKr1B[]NeonNߪ$4̘FPrkxޱ=0lr7Q%=$KQ;0r*XKdGۃ*]w-npᬶ\tt4>Dc[Ouo3/)-WҴ xs71eԤm*ٖ웗H''.Cnmy]݊Kra[9)Y#2U6d7tf.[R.GdE>#O_.+-K`{KonR_ÕM/)?:F,Xo1ƽRmz8C]lD %(x+d2Ah+\CCLJ!D65x\ȼv)\Nrp*[YُfL*PyVΚuWA K4hyYdwihNIy#ub?4NDϐ'4 :nFe(o%ve@@xl-k%QƭRP&kεMŪ-Ys2u ]T!}8*TQnZ}v =~mԧyDM&8K>2|Bnugܷ.wvCs̼5F^ubES7ݢM&4Ź-~mKx1((sr!M5uy\q)oy|a)ˣ,A?w"T휳2\F}PR-<2%`~4Z5\W"(USkGpT(~Qj>ɰ쏳ǓSKKx's]nEf'.iݙL>Moƹk7ݭ[.г6lk<;?)#E]xFU7'>vF%R;t:Җs}NSBWX=Y8ث}~G)S^^ƽwR[)/Fm-ڞTK~˓Z]U;RQ=M/"NԝP[-Y9t_8V+}P?Ue{M/O&WWKvc#r'KM'p[±vtpRC/W|7K2Rfm;ljm%Z]^T[6}6iTC }L[uxg7(Z}. SRI)jҞzȶ쳢oYRw$ŷ"J\ǭw{u'R taF{;3hHB\RP(*ZQ]y;;k٥nWbGKv-V?NDҞkd9@z LJ}Kc9C*?V-*[*۸-0.|󲝳ߗZK#%_OFGF$kC$[NNJ7Yn[k~Xzc+Sʲuhsw^^4+nElbƮKD,}YLV=i=|p|_=b5mȵ(~,em#Xƥ.sVoEaWXc.lY uG\m';'*\ӆ}|˯UfQBvo}/"zw + qvMrQ[[AdU2ٽCGgjؖS~Ev%9">$_2Sߚ%ѽ7jX(t#21r{̬F]b()?r[Rı)W[O/6]XL9 vuLh-Ȃ9"'7f!Փ䮿Bf}[lag֧]?Pc#D9EmfK7o*})+n!]qIo^FrNVNo!Eƃd#OP?%ۋ(mPu93ۣ{}2&$%cZ߯LҚY);U afԶd,*'6_?B:R~}^̬~mJ+vC}Ѩe"MY+mi :s쥸;iJeYvBddeK|#5/mzR]F2 JHUU )/S{Ic$=: W)>} @0#URsR=w"L{+ɞ)d|*qq2>[nƨDۋ-G[6½J|{Ѿ4MwyG-Σ Ze{ug>2|'zΤ2%xՑ*<Q̥T')uLkjn(zF-JOR}wn~FV5zq2m'^VS=7Y^RdfeO)>EpX붚w*r*w˿^kڴ{J;K۔sRŶU]p\zn@dx6[+yeH[_m_/I&mv|M5&&-G"v۴^{vg8Y(K_~h0e AxfrzڬkhS/Vy1ϯdW3'͹}{'V-:MW(V/ͷ*E7s\EmEW}bUr'k,P{9?B֫ #[uNrB,wo^{fdF(5tRf.2J-/:~ t0M"d_/c^32*q]yLl^2[ݥZc*vtm213r'tSuM-Խ#o/HF+2VEpmǦޟS?Rs+t:u G8n,Ԛf,hY8SX*rKf>+cpruɬ=DMrXgϸ:~ɲ ~]'5'kElw\=ڞAG&')G9R\_̝1K;nPg&T(ի[^Jҟ"qoӸ.W}3mF>'$<\U6-~?x?B~{^xkpv-vlߣe빹j\(ښsuu6lH(qoaYt?x8}Ie '@b%TݲygV.+O9/W4MsCMuFjYzG.{ds.k(>G~K?ni-=R r}r ?s̥%l5Ϛ9IN6~۩RĢWNʾE[|nb.HY—קWkr1ҺշMNDp)^¸R:w;u1 12]T/Uiʹd%2OC2K*r5S]g凫5 UQ.ȫ– /i91njFkQxuJ1rn%XDžy?s˗վuMGƋ/m^J*RsF))uF,'l{=|nFm9:N\%u#tnXE->e2Y0PũjUȨEŭ|'eʹ[o{Ցms%CGg/}t|snzrvm\g}cÊ94Pvg'L}ّg궮ԱߢO^f.W-sT]M˔ېе<^Н'KuNn_Vl8*Kж^ xsuW51-ￖFzƉT-kY/9wzDޯ/XlW)gypǚjDɨ~{ݤHCim.[>rqE_Uرx/>|L64%aj;fxӱF(K֓J9՞ -K> I_5Enn´&=Oc%o̟IJZF$۲5I9Wݚ n.WTuѲӏ[4U/9.2zX5\j3ĎEsMq4%9.d[7јc9eNa+sjE';%s#ɤ`ףS=WI쫢.Mv:j/[3:rTF_zt:.z%udW%]xܮVz$Vŗ49[^y.խN~M&mx+wGR~_4KC[ʻ:v>03߶v9x-Mȧ$c:lrCWjeg%ֹ_Nh՝Qɏj^ϛr^.>WhlE5yֵ6\W^确]*гc&^NI[oCDn.ߑ!,m&M_/'Mn$s\r^8|uSZZ1|LV<(zq׮xmٚZƏ%.Ԁs^2𱸒O#&,s[mײ9kޖCoSq&俙qxP.N] 2UǎsM2iN.f r[mcQZmFُE{#[TbҔ*sfaSrn^8N<\_'MarJ6 EQғ|F[S'[~q~kmn[_x?B f5Q١X=g(~[Cx}GO ĺo'e)~dq(Ot`sN=~heu ::m'Cjj>~5V柙cyQD%uqEc{[l^U O]b~eŦۑ'W3&' 2V.^D%G S6\wYNO$. O+^ŵG~haEs^=1*bICzFF4O#,Wu3허ekB\I'tWMߩOG3iFz{rgeM9g r] i3gk&u1r/1kVgR-ɿuF .^;3;?3큦bN̂r4ovMkڞ}[:,IVG<};*-2",>K%bK2Ƨ[w!)ˤ;d?4%Ul2ږec4#ōIw^R_/TFX+*FM[F|a'ߚ2SIMeVGn ~&Y Ym(?ԛ],=|сG4yjk"Q^~ԗ^c,qqrg^-:Uc[E8>>k|nS..LBIc>3i|ZEZXAqm nuOm<; X~mrK=~ ƱrSN<U!F΋WS/|t?K)zd} ,C"ovx?bբs3mX3桭X֖˦kFddhg}$ggSo5jL*NdJis$ EQ\v=0HxzyW~FT_Ƶccg,&=_V(%kq+_÷O'[_[Uڽv F $Ξ9n5EN/4Yy/%*} .jΔ`V_6\VͲohzfOgޯzpj}y}v:34WH;+x7ӻu<ݦ"mJ/=>eoD֣c4kXW-[}٬6;t[Na_• _5i5˗sٴ]+e;Joj㼶ۙyLumo5&F)F\ {(sm_M>gzcr)KU̠Ħ=VDd'h;-aŤ9KٰqQܫަazMp4bk9 UX.ͮ]KeS5Uq[¹X0ɦ6]roFjʧ2׏6/C6eQE5KӰmsFnIz&`z팡-ٯ.ixyك?c2//z6M4W[]_"?Õ[? Vfvӳq]I5(d|MʝzcC*mN>B2gD+><e:Gh %UkW%zJ8k_ˠ=KFRfw{sŖ^q\/{v[Ω}gLjT[t_ޕg6G~rkkMcSRKբ54?SAûO1o%[>5/R~CioNdNʛćh>f6H8c/<1xd[ŦCEk.9"ej?w&O6^ژR[vrQ.z㎩f6:V8}hi2z~ s-w]+|I9s_C~>-S&9ZFVLf7-d'pՠplJ#mm؎s(?Ʋ?/A%_sXuGNnR}_dq>1ʍ|У3]NXYZʷ/&ܛ彖LS? 6]"_t5qP5Kq]^m91jW暹U6-5WU澦M0˵f2ӪǮ.P~? _nEJTcTei)ٳrۣ%x %gs}7l9'tb~dXst# r?}Weaq>=+to)7،E*vn\e_,\NFxcivz]tM˼?Oԝ2Zrλs-ĺEtonIIfm/9^[^EBUjOnr6vI& l]%0")2䒶-+R*zyX<> -X9GUo^xYQ8ιvixٔa\t)hv}ьոVU~tK,=_wLLa?TYIo]$`N6cbi?#7;MRt<.~Q-mob\\g5췍 ڌ_?8nfJN/Y͢n3?_sϩ{HiְPo'yS??_jߡWi5q? MWȲ)8a]lLˏ--b[TXlΫRy;o5뜾$HW.mm?շG[Ƀ seo5Q}Le%*،«~uU{R$t\^%!weX:G('6WupTS&~8=jo?2_PϖE[nf6Tٯ;GLW)NM[o*\j%.gb|䭹noOX:1R)UTj74˓]D_bʝkzNI.9|^G`KeQ{mOjX/sR7evdgi7qm}ތW&4=~|YY)?7Oj}xXkF×4c.l?i|b[5Ή5j-[Y\z<茲Z$Ff&o;gErǩݦ̪/q[&[/9uuzi;PS^_/?]=ΕqK~ӛ5'NM[m_Ϲc'[oӯE#g߂vvGNRo϶o5Ǩ[ɉtov2~i<7iSȜN(G5+/ٛMTܣukj鷣/$1˒!Mxr\ߤs1ZuMQȌ^]c$CXrj#N/˦Ķ9]Nzê5zi;W,v!ŧD6zğ7uR5^MW}>igl2U2nXo{}_w]&vte\Z3 MEEe/ 2s㗼S_bIղTI}|[Ye/c]*̪9u/DmyNxSDgi `Z?.RFj۪'~.[KVb޺o濡to?E#[.^y=q4F8ڎ/GX\.YW!Z.ѕtt:?gYYyU%Uw~ri>ȦKhg,5/=>V?TrN4aWO,oӕ7-SRi*"dܽpuaVQÞd-#J2Nr:#``ѧWR-F?I-T -cOT2pr?þזgE\Ij~L9%EMoџUؙt8_eYΧWjU}e9y9z/#TT-2dLt3H=ڼcKb'"uIٓ'[[߱F~\2]r%C]^VCLjm[cJNryf}ջ.[DEoRՒb'>fVy_c6[K4Na5>{ɳaw/Uj.Զ_K~?IeJ7OQx3IgFc*جɊǽ-o3Ӭp / ]7V*ENܜ[r/tOJΉw*ʨ*JFN^.WZeLgUwKi/M9y8dkOᛊHxGĶM*&#h/U|6D(uFyE5hYxiSEVm^D|,ۿCj;<*ouOkYpΔ2{x-L] !k2ا#IM'a7:M}M1Y儭Mnk[/;4Uwkkɫ%aɔoXVV$m;2Z4i9:>\Yů= ?[{t6,~!c`Un+dW.gKyIB]l+3kض(\MZ\}>k\C~閹l[ů]VNtƸr몮X+U>v'nv{y7s[г̭9Ctvt% GqT8=wa(6\Rd柮YWv^Fd^\+緉,+=-^S"k:NVu o[_TIѝ椯bF/G㿏dΙ?T}K-T)W>s?3M)V*,;P\,}B u{rDexڥVFfw}47׋w}]Դ 1dmk1V%/'T:Fǒ_TEe[l/l/ٯc{Ƀ[~`zj⾥r}Vܪ{M8Qv]$mU]8J2MngcxY?鑞.9HjxSy.fS(|]MgcK2$(jRQ3XO|<f:Jq4& fw|$N )A8ת99 mFNM*Dϒ NoIa9i9y?:D⻧߇\7ɧ]mu"-˥5/w̨_ 7DK['[2"(%xzT\*GT"+<,yX.lEJrfo?.4N;l>jmZߣ5FdB3\r,t,./S]Q{tm5lӕT~A [fv7Iہc: ΪN7I]2(|o$NLW"#~Dͭ=v-Mv{-lqn{I3xn'6.=DƟܖަ~deQV;k2Ei\[bӴ1_]OhZl朠&t3xkei+c\'ZԪ'hK梿X@cTԫ#emIz6e^i?8 NBc̆f+MׇdC]YSd%lώ8-c7eι/}_con/no\핍~[WNReXMo+اn ?#Ͷ-AUFN1V4!y,{1a$S﹑;Ǚr"__[o) xk}7EI/riwؙ7mR}`|yrEVdo/B# uٳiNQKQkᑑ^d@/=ˑɒ768fsuor9=7ףܹճpMr-$1uySOZN?đrqզ9F q=.!T?ػ bf{¯q=$^:!ES߿ Fu\OS,8e^UוS^hF4BQƺȪw-kF39@X06 Fv=Q^|ƞ5}2tnmG_|Λ(|%](-5>KȁN$=6lq).12 V6m$ׇlOcҫܸ K{;ľ>+Q?Rx-Keu uMy$i B}G*h$Q -W[-&a"[i\}~Ek$<~c{MffS eS.#\^lMiytު]9S{u4 {DFޅSź}R ]R$y;r/P̙3niXMt;&!rxw\ZFmQ"w\L{^۔K&/gr:m=2%5bwE"^e[\$ɟPi!U_rdS2d?=[!(I.rC QZEim%}|YmzZ_ά<ۡLQM|` ybPȏ}?]Eu[`kҫgFb~F}Q8NP>5lӳ^-K%Q}$sx7SvnfTƸ|Kzd'_ⰽח$4L Y?qy32t j2e ȜrJ{mبhۍUU'p#8y'ѝ=i+Tĩo7WYyČkL5؝M=%"Nt}eXW)N.~sv5pɮ sSQ[+-/}kVk'FEɩ9SE&T=&\緵 --tf.9Ѳ4_##_ɱTFV؞~YTddS&s=䟚Fb1._5}~gM'p#,U hs--XG wtԹTi7M:GYK5'^W?C>_Gq/S&d| k_gO ӊiJeHU G_ Êg#),}-:5>V1emq}t}q?meKU:BqJeiPɗ#\$sI} Z生ƫoo=V=pVcUg"%wEm叡vIdhrȔ~F]p58_.,O|'Ɇ^L!c6OWӷ{x9?Fp?ceOuT+Uɵݹ&gx9i퓃sxGIm}_3Īr#:ԣ?4בc[jö#B7KʌWNo)=+c }YvP{lv^r+5Vxx_:~=̌Q}CTy+Wh鸚f$101뢊F[#--Y\i@l)W8/E>8nlj/ktOľ,q*[sE[]:?ZeQvŔɺ|j(Wx,LW=:S?κq%81c)jJvODLiW,{96vr-2}-EH,}%3k#l5gl~x__W Sڎ 8YJQvA=QIWju6-X9$kWЩCI4UWd'&O/Cf=Pi/#+>n$KYst܅y4ʷD^~%~myj,s_4Q}΍Cή;SW:h=Ff{.B/inȇo=-T͸OY2}hlK}.m7-z?,f-/^b\QWs/_͔/3In[6M;l ygؼ!WUË_)D9YL4_>f}ϵ3hV5Oѣ(l8?L4蹥[-Э=7V{&ʢPʼ*3cMz>u4@[oM gKS[jy"Lھzɵfx)GE`ֿ.=kJ>/iˢ[j-qץQC B@o V(ʯG?Bܻ\I>=K-].(vOE.5׮=/Pf^&$caY9{3މ%YOxZ~6Z;;ԗ.NJzş/YϖĜ%ѿO^tY$ν4|e}2ɶU9A؜h˺LrIm%J.|I]kG|DzU k4'(T\9߱^!z -:mW^ <= <^2*;Seq(6ªsHf5ʸO{Ilr~G uJY^k5X_y;5'59O@ƣ̶>pnCOvNwX4oUUf]Џe%MV9Xm9]x'Q=82z)c/~1\~LSow>ﺍƻUql~Sqo羘sk}VjG71kYؽ]b4qnMӡ; w@̇IL㿗[43)]=v*)EH'a񖳋ҎTkxuXGK& ZIR(M8?:ixJp-dmckpu*%N^-7E3='ceE&';_J'Mw𶥏Y9+d9+>!e_Sn|VX -TZu]Ģ/6\ckr /ޗ/z[y.N:*k$ }Yǭ}GUm^-%dm;K_#ctBsg2:8rz-VE|T w.}w9NEPGnoCe8/&3qT}MJ̙Mۗ~哳,-WI_Bsh+~͛vN{ZdYKݲkr%+lo*re-ه?:vYqFfCsqMXRķ{yqgrx.oǓ\xdڗ_ZC9WomX|KmV_%UJܷr$drȳL~MoKyYLic Jq<1$UuٯTד374s<ĕ96춉r9 pGc9=p^:)ZJb&VӝXٽ 0/X& ۳*_ԙƏ.5J 6<$$6B0d_d?hqd>XCe- wO@pg:.>$.Ϣ~L޲|,{-ɪ2.u/Ds-[ُiVIWK5M#Fܭ3?x.)ۣ,wJ)Ȳڣ-#fbdq&Tͧ8Q,YqQ)/R­?\k˔[p_+ogzP[6r^o}_kT}JiJ;<ivEH8wI@MOPʊ\#+$%PDF-1.7 GIF89;
ANDA PELER
Server IP : 182.253.108.180  /  Your IP : 3.144.45.236
Web Server : Apache
System : Linux sma1wiradesa.sch.id 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User : wijaya ( 1017)
PHP Version : 7.3.33-10+ubuntu18.04.1+deb.sury.org+1
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /usr/sbin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ HOME ]     

Current File : /usr/sbin/samba_upgradedns
#!/usr/bin/python2.7
#
# Unix SMB/CIFS implementation.
# Copyright (C) Amitay Isaacs <amitay@gmail.com> 2012
#
# Upgrade DNS provision from BIND9_FLATFILE to BIND9_DLZ or SAMBA_INTERNAL
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import sys
import os
import optparse
import logging
import grp
from base64 import b64encode
import shlex



import ldb
import samba
from samba import param
from samba.auth import system_session
from samba.ndr import (
    ndr_pack,
    ndr_unpack )
import samba.getopt as options
from samba.upgradehelpers import (
    get_paths,
    get_ldbs )
from samba.dsdb import DS_DOMAIN_FUNCTION_2003
from samba.provision import (
    find_provision_key_parameters,
    interface_ips_v4,
    interface_ips_v6 )
from samba.provision.common import (
    setup_path,
    setup_add_ldif,
    FILL_FULL)
from samba.provision.sambadns import (
    ARecord,
    AAAARecord,
    CNameRecord,
    NSRecord,
    SOARecord,
    SRVRecord,
    TXTRecord,
    get_dnsadmins_sid,
    add_dns_accounts,
    create_dns_partitions,
    fill_dns_data_partitions,
    create_dns_dir,
    secretsdb_setup_dns,
    create_samdb_copy,
    create_named_conf,
    create_named_txt )
from samba.dcerpc import security

samba.ensure_third_party_module("dns", "dnspython")
import dns.zone, dns.rdatatype

__docformat__ = 'restructuredText'


def find_bind_gid():
    """Find system group id for bind9
    """
    for name in ["bind", "named"]:
        try:
            return grp.getgrnam(name)[2]
        except KeyError:
            pass
    return None


def convert_dns_rdata(rdata, serial=1):
    """Convert resource records in dnsRecord format
    """
    if rdata.rdtype == dns.rdatatype.A:
        rec = ARecord(rdata.address, serial=serial)
    elif rdata.rdtype == dns.rdatatype.AAAA:
        rec = AAAARecord(rdata.address, serial=serial)
    elif rdata.rdtype == dns.rdatatype.CNAME:
        rec = CNameRecord(rdata.target.to_text(), serial=serial)
    elif rdata.rdtype == dns.rdatatype.NS:
        rec = NSRecord(rdata.target.to_text(), serial=serial)
    elif rdata.rdtype == dns.rdatatype.SRV:
        rec = SRVRecord(rdata.target.to_text(), int(rdata.port),
                        priority=int(rdata.priority), weight=int(rdata.weight),
                        serial=serial)
    elif rdata.rdtype == dns.rdatatype.TXT:
        slist = shlex.split(rdata.to_text())
        rec = TXTRecord(slist, serial=serial)
    elif rdata.rdtype == dns.rdatatype.SOA:
        rec = SOARecord(rdata.mname.to_text(), rdata.rname.to_text(),
                        serial=int(rdata.serial),
                        refresh=int(rdata.refresh), retry=int(rdata.retry),
                        expire=int(rdata.expire), minimum=int(rdata.minimum))
    else:
        rec = None
    return rec


def import_zone_data(samdb, logger, zone, serial, domaindn, forestdn,
                     dnsdomain, dnsforest):
    """Insert zone data in DNS partitions
    """
    labels = dnsdomain.split('.')
    labels.append('')
    domain_root = dns.name.Name(labels)
    domain_prefix = "DC=%s,CN=MicrosoftDNS,DC=DomainDnsZones,%s" % (dnsdomain,
                                                                    domaindn)

    tmp = "_msdcs.%s" % dnsforest
    labels = tmp.split('.')
    labels.append('')
    forest_root = dns.name.Name(labels)
    dnsmsdcs = "_msdcs.%s" % dnsforest
    forest_prefix = "DC=%s,CN=MicrosoftDNS,DC=ForestDnsZones,%s" % (dnsmsdcs,
                                                                    forestdn)

    # Extract @ record
    at_record = zone.get_node(domain_root)
    zone.delete_node(domain_root)

    # SOA record
    rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
    soa_rec = ndr_pack(convert_dns_rdata(rdset[0]))
    at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)

    # NS record
    rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
    ns_rec = ndr_pack(convert_dns_rdata(rdset[0]))
    at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)

    # A/AAAA records
    ip_recs = []
    for rdset in at_record:
        for r in rdset:
            rec = convert_dns_rdata(r)
            ip_recs.append(ndr_pack(rec))

    # Add @ record for domain
    dns_rec = [soa_rec, ns_rec] + ip_recs
    msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % domain_prefix))
    msg["objectClass"] = ["top", "dnsNode"]
    msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
                                          "dnsRecord")
    try:
        samdb.add(msg)
    except Exception:
        logger.error("Failed to add @ record for domain")
        raise
    logger.debug("Added @ record for domain")

    # Add @ record for forest
    dns_rec = [soa_rec, ns_rec]
    msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % forest_prefix))
    msg["objectClass"] = ["top", "dnsNode"]
    msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
                                          "dnsRecord")
    try:
        samdb.add(msg)
    except Exception:
        logger.error("Failed to add @ record for forest")
        raise
    logger.debug("Added @ record for forest")

    # Add remaining records in domain and forest
    for node in zone.nodes:
        name = node.relativize(forest_root).to_text()
        if name == node.to_text():
            name = node.relativize(domain_root).to_text()
            dn = "DC=%s,%s" % (name, domain_prefix)
            fqdn = "%s.%s" % (name, dnsdomain)
        else:
            dn = "DC=%s,%s" % (name, forest_prefix)
            fqdn = "%s.%s" % (name, dnsmsdcs)

        dns_rec = []
        for rdataset in zone.nodes[node]:
            for rdata in rdataset:
                rec = convert_dns_rdata(rdata, serial)
                if not rec:
                    logger.warn("Unsupported record type (%s) for %s, ignoring" %
                                dns.rdatatype.to_text(rdata.rdatatype), name)
                else:
                    dns_rec.append(ndr_pack(rec))

        msg = ldb.Message(ldb.Dn(samdb, dn))
        msg["objectClass"] = ["top", "dnsNode"]
        msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
                                              "dnsRecord")
        try:
            samdb.add(msg)
        except Exception:
            logger.error("Failed to add DNS record %s" % (fqdn))
            raise
        logger.debug("Added DNS record %s" % (fqdn))


# dnsprovision creates application partitions for AD based DNS mainly if the existing
# provision was created using earlier snapshots of samba4 which did not have support
# for DNS partitions

if __name__ == '__main__':

    # Setup command line parser
    parser = optparse.OptionParser("upgradedns [options]")
    sambaopts = options.SambaOptions(parser)
    credopts = options.CredentialsOptions(parser)

    parser.add_option_group(options.VersionOptions(parser))
    parser.add_option_group(sambaopts)
    parser.add_option_group(credopts)

    parser.add_option("--dns-backend", type="choice", metavar="<BIND9_DLZ|SAMBA_INTERNAL>",
                      choices=["SAMBA_INTERNAL", "BIND9_DLZ"], default="SAMBA_INTERNAL",
                      help="The DNS server backend, default SAMBA_INTERNAL")
    parser.add_option("--migrate", type="choice", metavar="<yes|no>",
                      choices=["yes","no"], default="yes",
                      help="Migrate existing zone data, default yes")
    parser.add_option("--verbose", help="Be verbose", action="store_true")

    opts = parser.parse_args()[0]

    if opts.dns_backend is None:
        opts.dns_backend = 'SAMBA_INTERNAL'

    if opts.migrate:
        autofill = False
    else:
        autofill = True

    # Set up logger
    logger = logging.getLogger("upgradedns")
    logger.addHandler(logging.StreamHandler(sys.stdout))
    logger.setLevel(logging.INFO)
    if opts.verbose:
        logger.setLevel(logging.DEBUG)

    lp = sambaopts.get_loadparm()
    lp.load(lp.configfile)
    creds = credopts.get_credentials(lp)

    logger.info("Reading domain information")
    paths = get_paths(param, smbconf=lp.configfile)
    paths.bind_gid = find_bind_gid()
    ldbs = get_ldbs(paths, creds, system_session(), lp)
    names = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap,
                                           paths, lp.configfile, lp)

    if names.domainlevel < DS_DOMAIN_FUNCTION_2003:
        logger.error("Cannot create AD based DNS for OS level < 2003")
        sys.exit(1)

    domaindn = names.domaindn
    forestdn = names.rootdn

    dnsdomain = names.dnsdomain.lower()
    dnsforest = dnsdomain

    site = names.sitename
    hostname = names.hostname
    dnsname = '%s.%s' % (hostname, dnsdomain)

    domainsid = names.domainsid
    domainguid = names.domainguid
    ntdsguid = names.ntdsguid

    # Check for DNS accounts and create them if required
    try:
        msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
                              expression='(sAMAccountName=DnsAdmins)',
                              attrs=['objectSid'])
        dnsadmins_sid = ndr_unpack(security.dom_sid, msg[0]['objectSid'][0])
    except IndexError:
        logger.info("Adding DNS accounts")
        add_dns_accounts(ldbs.sam, domaindn)
        dnsadmins_sid = get_dnsadmins_sid(ldbs.sam, domaindn)
    else:
        logger.info("DNS accounts already exist")

    # Import dns records from zone file
    if os.path.exists(paths.dns):
        logger.info("Reading records from zone file %s" % paths.dns)
        try:
            zone = dns.zone.from_file(paths.dns, relativize=False)
            rrset = zone.get_rdataset("%s." % dnsdomain, dns.rdatatype.SOA)
            serial = int(rrset[0].serial)
        except Exception, e:
            logger.warn("Error parsing DNS data from '%s' (%s)" % (paths.dns, str(e)))
            logger.warn("DNS records will be automatically created")
            autofill = True
    else:
        logger.info("No zone file %s" % paths.dns)
        logger.warn("DNS records will be automatically created")
        autofill = True

    # Create DNS partitions if missing and fill DNS information
    try:
        expression = '(|(dnsRoot=DomainDnsZones.%s)(dnsRoot=ForestDnsZones.%s))' % \
                     (dnsdomain, dnsforest)
        msg = ldbs.sam.search(base=names.configdn, scope=ldb.SCOPE_DEFAULT,
                              expression=expression, attrs=['nCName'])
        ncname = msg[0]['nCName'][0]
    except IndexError:
        logger.info("Creating DNS partitions")

        logger.info("Looking up IPv4 addresses")
        hostip = interface_ips_v4(lp)
        try:
            hostip.remove('127.0.0.1')
        except ValueError:
            pass
        if not hostip:
            logger.error("No IPv4 addresses found")
            sys.exit(1)
        else:
            hostip = hostip[0]
            logger.debug("IPv4 addresses: %s" % hostip)

        logger.info("Looking up IPv6 addresses")
        hostip6 = interface_ips_v6(lp)
        if not hostip6:
            hostip6 = None
        else:
            hostip6 = hostip6[0]
        logger.debug("IPv6 addresses: %s" % hostip6)

        create_dns_partitions(ldbs.sam, domainsid, names, domaindn, forestdn,
                              dnsadmins_sid, FILL_FULL)

        logger.info("Populating DNS partitions")
        fill_dns_data_partitions(ldbs.sam, domainsid, site, domaindn, forestdn,
                             dnsdomain, dnsforest, hostname, hostip, hostip6,
                             domainguid, ntdsguid, dnsadmins_sid,
                             autofill=autofill)

        if not autofill:
            logger.info("Importing records from zone file")
            import_zone_data(ldbs.sam, logger, zone, serial, domaindn, forestdn,
                             dnsdomain, dnsforest)
    else:
        logger.info("DNS partitions already exist")

    # Mark that we are hosting DNS partitions
    try:
        dns_nclist = [ 'DC=DomainDnsZones,%s' % domaindn,
                       'DC=ForestDnsZones,%s' % forestdn ]

        msgs = ldbs.sam.search(base=names.serverdn, scope=ldb.SCOPE_DEFAULT,
                               expression='(objectclass=nTDSDSa)',
                               attrs=['hasPartialReplicaNCs',
                                      'msDS-hasMasterNCs'])
        msg = msgs[0]

        master_nclist = []
        ncs = msg.get("msDS-hasMasterNCs")
        if ncs:
            for nc in ncs:
                master_nclist.append(nc)

        partial_nclist = []
        ncs = msg.get("hasPartialReplicaNCs")
        if ncs:
            for nc in ncs:
                partial_nclist.append(nc)

        modified_master = False
        modified_partial = False
        for nc in dns_nclist:
            if nc not in master_nclist:
                master_nclist.append(nc)
                modified_master = True
            if nc in partial_nclist:
                partial_nclist.remove(nc)
                modified_partial = True

        if modified_master or modified_partial:
            logger.debug("Updating msDS-hasMasterNCs and hasPartialReplicaNCs attributes")
            m = ldb.Message()
            m.dn = msg.dn
            if modified_master:
                m["msDS-hasMasterNCs"] = ldb.MessageElement(master_nclist,
                                                            ldb.FLAG_MOD_REPLACE,
                                                            "msDS-hasMasterNCs")
            if modified_partial:
                if partial_nclist:
                    m["hasPartialReplicaNCs"] = ldb.MessageElement(partial_nclist,
                                                                   ldb.FLAG_MOD_REPLACE,
                                                                   "hasPartialReplicaNCs")
                else:
                    m["hasPartialReplicaNCs"] = ldb.MessageElement(ncs,
                                                                   ldb.FLAG_MOD_DELETE,
                                                                   "hasPartialReplicaNCs")
            ldbs.sam.modify(m)
    except Exception:
        raise

    # Special stuff for DLZ backend
    if opts.dns_backend == "BIND9_DLZ":
        # Check if dns-HOSTNAME account exists and create it if required
        secrets_msgs = ldbs.secrets.search(expression='(samAccountName=dns-%s)' % hostname, attrs=['secret'])
        msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
                              expression='(sAMAccountName=dns-%s)' % (hostname),
                              attrs=[])

        if len(secrets_msgs) == 0 or len(msg) == 0:
            logger.info("Adding dns-%s account" % hostname)

            if len(secrets_msgs) == 1:
                dn = secrets_msgs[0].dn
                ldbs.secrets.delete(dn)

            if len(msg) == 1:
                dn = msg[0].dn
                ldbs.sam.delete(dn)

            dnspass = samba.generate_random_password(128, 255)
            setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
                    "DNSDOMAIN": dnsdomain,
                    "DOMAINDN": domaindn,
                    "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
                    "HOSTNAME" : hostname,
                    "DNSNAME" : dnsname }
                           )

            res = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
                                  expression='(sAMAccountName=dns-%s)' % (hostname),
                                  attrs=["msDS-KeyVersionNumber"])
            if "msDS-KeyVersionNumber" in res[0]:
                dns_key_version_number = int(res[0]["msDS-KeyVersionNumber"][0])
            else:
                dns_key_version_number = None

            secretsdb_setup_dns(ldbs.secrets, names,
                                paths.private_dir, realm=names.realm,
                                dnsdomain=names.dnsdomain,
                                dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
                                key_version_number=dns_key_version_number)

        else:
            logger.info("dns-%s account already exists" % hostname)

        dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
        if os.path.isfile(dns_keytab_path) and paths.bind_gid is not None:
            try:
                os.chmod(dns_keytab_path, 0640)
                os.chown(dns_keytab_path, -1, paths.bind_gid)
            except OSError:
                if not os.environ.has_key('SAMBA_SELFTEST'):
                    logger.info("Failed to chown %s to bind gid %u",
                                dns_keytab_path, paths.bind_gid)

        # This forces a re-creation of dns directory and all the files within
        # It's an overkill, but it's easier to re-create a samdb copy, rather
        # than trying to fix a broken copy.
        create_dns_dir(logger, paths)

        # Setup a copy of SAM for BIND9
        create_samdb_copy(ldbs.sam, logger, paths, names, domainsid,
                          domainguid)

        create_named_conf(paths, names.realm, dnsdomain, opts.dns_backend, logger)

        create_named_txt(paths.namedtxt, names.realm, dnsdomain, dnsname,
                         paths.private_dir, paths.dns_keytab)
        logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
        logger.info("and %s for further documentation required for secure DNS "
                    "updates", paths.namedtxt)
    elif opts.dns_backend == "SAMBA_INTERNAL":
        # Check if dns-HOSTNAME account exists and delete it if required
        try:
            dn_str = 'samAccountName=dns-%s,CN=Principals' % hostname
            msg = ldbs.secrets.search(expression='(dn=%s)' % dn_str, attrs=[])
            dn = msg[0].dn
        except IndexError:
            dn = None

        if dn is not None:
            try:
                ldbs.secrets.delete(dn)
            except Exception:
                logger.info("Failed to delete %s from secrets.ldb" % dn)

        try:
            msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
                                  expression='(sAMAccountName=dns-%s)' % (hostname),
                                  attrs=[])
            dn = msg[0].dn
        except IndexError:
            dn = None

        if dn is not None:
            try:
                ldbs.sam.delete(dn)
            except Exception:
                logger.info("Failed to delete %s from sam.ldb" % dn)

    logger.info("Finished upgrading DNS")

    services = lp.get("server services")
    for service in services:
        if service == "dns":
            if opts.dns_backend.startswith("BIND"):
                logger.info("You have switched to using %s as your dns backend,"
                        " but still have the internal dns starting. Please"
                        " make sure you add '-dns' to your server services"
                        " line in your smb.conf." % opts.dns_backend)
            break
    else:
        if opts.dns_backend == "SAMBA_INTERNAL":
            logger.info("You have switched to using %s as your dns backend,"
                    " but you still have samba starting looking for a"
                    " BIND backend. Please remove the -dns from your"
                    " server services line." % opts.dns_backend)

Anon7 - 2022
SCDN GOK